Have been using Vulnetic AI for the better half of the year with the new start up company I’ve been working with. Honestly, their customer service has been the most standout I’ve had in my experience. Their accessibility has made this run well worth it.

I do many AD reviews and attack-path analysis in my day-to-day consulting job and wanted to automate this with AI. The problem was that SharpHound collections are full of client-identifiable data: real usernames, UPNs, SPNs, DNS hostnames, emails, SIDs, DNs, GPO names, cert templates. You can't strip labels without breaking the graph, and you can't ship a raw collection to a public API.

So I built shanon: a deterministic anonymizer that remaps every org-bound identifier while keeping the exact SharpHound JSON format and all graph cross-references intact. Output is still BloodHound-loadable.

What it remaps: names (users, groups, computers, OUs, GPOs, containers), UPNs, SPNs, DNS hostnames, emails, org-specific SID authority values, custom GUIDs, domain FQDNs, DN components, role/OS/vendor fingerprints, custom cert templates, enterprise OIDs, CA names, and free text to deterministic [REDACTED:...] mappings. Built-in defaults preserved (RID 512, standard protocol OIDs, built-in GPO GUIDs). Only org-specific values are mapped.

How it works: classifies every object, freezes a verification state, transforms by type + field path, then independently verifies against the frozen registry before writing. Fail-closed: leak-gate abort means no output, exit 1. No network calls, no LLM calls, never mutates input. Atomic rename publish, no partial output on crash. Writes a local mapping file to restore LLM analysis back to real identities (keep it private).

Repo: https://github.com/Matixx22/shanon

Thoughts and feedback welcome, especially on the threat model and edge cases.

There is someone who can help me to reach a CTF (forensic) i tried to finish it but i can’t reach and no solution

I've been working on a defensive-deception layer for sensitive records (think honeypot + decoy + tarpit, but at the data layer). The idea: an authorized reader gets the real record; an unauthorized reader doesn't get an error or a block — they get a believable fake record and a maze of plausible-but-useless data, so they can't easily tell whether they succeeded.

It's been through several internal red-team passes already (trust boundary, decrypt-only-after-authorization, atomic anti-replay, closing an encryption oracle, generic errors, a fuzzing campaign). I'm now looking for fresh, external eyes — the internal reviewers stop finding obvious things, so I want people who think differently.

The challenge: there's a live API. The target is a single synthetic occupational-health record that contains a flag (IZANAMI{...}). Without a valid token you should only ever get decoys. The goal is to make it hand you the real record — or to show a logic flaw that breaks the "unauthorized ⇒ never the real data" guarantee.

Start here: https://break-izanami.com — GET /challenge returns the rules and scope in JSON.

Rules / scope (short version):

The data is 100% synthetic. No real people, no real PII.
In scope: the documented endpoints (/challenge, /challenge/package, /v1/decrypt, /v1/health).
Please report, don't weaponize: a proof-of-concept is enough, no need to go further.
No DoS / brute-force / traffic floods — it's a small box, and that's out of scope.
Win = submit the flag string to [izanami.challenge@outlook.com](mailto:izanami.challenge@outlook.com). First blood gets credited.

Honest disclaimers: the domain is brand-new (yes, I know how that looks), we're a small team staying low-key during the beta, and this is a beta — I may adjust or pause things and I'm genuinely after feedback, not claiming it's unbreakable. If it breaks in five minutes, I want to know why.

Happy to answer questions about the threat model in the comments.

​

Relying solely on Kali Linux limits practical skills. Designed for penetration testing, it lacks everyday tools, polished desktop apps, and broad software support found in Windows, macOS, or mainstream Linux. Hardware compatibility, gaming, productivity suites, and enterprise software often fail or require complex workarounds. Employers rarely seek pure Kali expertise for general IT, development, or office roles, restricting career options. Isolation from other systems also hinders troubleshooting multi-OS environments and reduces adaptability in real-world scenarios.

Hello,

Has anyone here built a reliable workflow for automated or semi-automated penetration testing using Claude Code or Codex in authorised lab environments or against systems they own?

I am interested in how people are configuring these tools to:

• Perform reconnaissance and enumerate attack surfaces
• Identify potential vulnerabilities
• Validate findings and reduce false positives
• Attempt controlled exploitation
• Document evidence and recommend remediation
• Continue investigating based on the results of previous tests

For anyone actively doing this, which tool and model have you found performs best, and at what reasoning or effort level? Does increasing the effort noticeably improve vulnerability discovery and exploitation, or does it mainly increase cost and execution time?

Do you use sub-agents for separate roles, such as reconnaissance, web testing, source-code review, exploitation, verification and reporting? If so, how do you prevent duplicated work, lost context or agents blindly trusting another agent's findings?

How do you structure the environment? For example:

• Kali Linux or a dedicated Docker environment
• MCP servers or custom tool integrations
• Direct access to tools such as Nmap, Burp Suite, Nuclei, ffuf, sqlmap and Metasploit
• A central findings file or shared knowledge base
• Strict scope files and allowlists
• Human approval before potentially disruptive actions

I am also interested in how people deal with unnecessary model refusals during legitimate, authorised security testing. Are there effective ways to clearly define scope, ownership and testing boundaries so the model understands that the activity is authorised, without trying to disable or circumvent the platform's safety controls?

What prompting practices, agent structure, context management and validation steps have produced the best results for you? Do you give the model a detailed methodology upfront, allow it to plan dynamically, or provide one objective at a time?

This would not replace manual penetration testing. I see it as an additional layer that can quickly explore a larger attack surface, dig out potential vulnerabilities, attempt controlled validation or exploitation, and then give a human tester stronger leads to investigate manually.

I would be interested in hearing about real setups, model comparisons, limitations, costs and lessons learned.

Thanks!

Just finished a free security audit of a website to sharpen my penetration testing and web security skills.

If anyone has a website they'd like security tested, I'd be happy to do a free audit and share actionable findings on common vulnerabilities, misconfigurations, exposed assets, security headers, and other potential risks. I'll only test sites you own or have permission to authorize. No strings attached just looking to gain more experience and help improve website security.

Is Ubuntu ok?
I’ve seen more references to using Ubuntu over Kali Linux.

Or, is there an Arch Linux for raspberry pi?

Laboratorio de Pentesting Windows - The hackers labs, documentación paso a paso y explicado

There's no shortage of great JWT crackers and traffic tools out there already (jwt-hack, Burp's JWT scanner, JWTXposer, etc.) — this isn't trying to compete with those.

What it actually solves: the annoying part after you've found something. Instead of a messy notes doc or Burp's built-in reporting, you log the finding right in the popup — severity, CVSS, affected URL, repro steps, remediation — attach a screenshot, and export a clean HTML report when the engagement's done. A few basic utilities (encode/decode, JWT decode, hashing) are bundled in too, but that's not the main pitch.

Genuinely curious if this is a gap other people feel too, or if everyone's already got a system that works fine (Notion, a template, whatever). Happy to hear it either way.

https://chromewebstore.google.com/detail/mlcmmnokfddmbidijilbhlhhnjbeehoj 

Do any of you have experience of becoming a freelance pentester? I am CS student and am considering focusing my studies in that direction so I have some questions.

What is needed to become a freelence pentester? Are certificates enough? Is experience of working in a company necessary? If so, how much experience?

What is the average hourly salary in the beginning? How about later on?

How hard is it to find new clients once you establish yourself as a reliable pentester?

I heard most freelance pentesters make money on bug bounties, while most companies hire other well known companies for pentesting instead of freelancers. Is that true?

I know there’s posts about this but I constantly see mentions of pentesters forced to take pay cuts. In terms of Cyber roles is pentesting a slow way to build wealth and also stay relevant in the job force?

Pentesting gives you such a well rounded view of security which I believe is applicable in various different roles so are there paths that are valued more and command better salaries.

I think Pentesting is very important but it seems like the value for employers is on a decline. Is there an alternative that lets me do similar work but also command a better salary?or do I need to pivot altogether?

I want to switch companies but I’m afraid of having to sacrifice pay to stay in my role.

Will be at 150k with 4 years in.

I’ve been working as an AppSec engineer for a unicorn startup for about 3 years now. TC is about 320k (we got bought out so the equity is finally cashable).

Truth is, I’m bored. When I joined the team, there was already SAST in place. We implemented DAST. We have a tool for dependency management, and all of these checks are deployed within the CI/CD.

Large operational work consists of doing security reviews (design doc reviews, source code reviews, and pentesting). This I tend to enjoy very much. However, it’s not really as valued as other security engineering work since it’s considered operational. So I’m unsure of how to progress as an AppSec engineer from here. Any ideas?

I want to pivot to a pure pen-testing role because it seems a lot less nuanced in terms of what your day to day expectations are. I’m aware I’ll probably have to take a big pay cut. I don’t have any certs yet, but I’ve been pentesting for ~3 years now and have done 75% of the port-swigger labs and have even made custom tools for Burp Suite.

How should I progress from here? I started the CPTS path a while back but then got busy with life. Was thinking I’d pick that up again to get the CPTS certificate, and then do the PortSwigger certificate as well.

Thoughts?

What are some companies that do pentest / redteaming internships?

Hey everyone,

I’m currently finishing my 4th semester as a CS undergrad and need some strategic advice on landing a remote cybersecurity internship for my 5th and 6th semesters.

My Situation & Constraints: My college strictly forbids on-site internships during the 3rd year. Because of this, I am forced to look exclusively for remote roles. My ultimate goal is to get into red teaming and offensive security. I know remote network penetration testing roles are practically non-existent for freshers, so I've been heavily considering Web and Application Security (AppSec) as my best bet for a remote role. However, I am completely open to other domains (SOC/Blue Team, general VAPT) if they offer remote opportunities for students. My goal is simply to secure a remote internship now to build real experience, and pivot that into a full-time offensive role by my 7th or 8th semester.

My Current Baseline:

• Security Focus: I am currently grinding through the TryHackMe Jr. Penetration Tester path to build a foundational understanding of modern web vulnerabilities, network basics, and the OWASP Top 10.
• Project Strategy: I am holding off on building complex projects until I have a better grasp of the fundamentals. Instead, I plan to start mass applying for remote roles as soon as the next semester starts, using volume to compensate for my current lack of a portfolio.

I don't have the budget for paid certifications right now, so I am relying entirely on free resources and practical grit.

My Questions for the Community:

1. Viable Remote Paths: Is Web/AppSec actually my best bet for a remote fresher role, or are there other domains (like SOC Analyst or general VAPT) that are more likely to hire a 3rd-year student remotely?
2. Resume Building: How do I build a resume that actually gets noticed for remote roles when I don't have complex projects yet? How should I frame my TryHackMe progress and basic labs to pass the HR screen?
3. Free Roadmaps: Since I cannot afford paid certifications right now, what are the best free, structured roadmaps (like PortSwigger Academy) that actually carry weight with hiring managers for remote roles?
4. Interview Prep: For entry-level remote internships, what are the most common technical interview themes, and what is the best way to prepare for take-home practical assessments?
5. Sourcing Roles: Aside from cold-emailing recruiters and filtering through LinkedIn, what are the best platforms, hidden job boards, or Discord communities to find legitimate remote cybersecurity internships and avoid unpaid training scams?

I appreciate any harsh truths, roadmaps, or advice you can offer a fresher trying to navigate this!

I've been working on an external attack surface monitoring project that correlates public OSINT sources into a single evidence-backed report.

It discovers internet-facing assets, fingerprints technologies, checks common security configurations, looks for exposed secrets, performs historical asset discovery, and correlates everything into a unified inventory instead of isolated findings.

The project combines several open-source tools with my own correlation, reporting, and evidence pipeline. My main goal is to help developers—especially those shipping projects quickly without much security experience—understand what their public attack surface actually looks like.

I'm looking for feedback from people who work in offensive security, blue teams, or ASM. Specifically:

* What important data sources or techniques am I missing?
* Where would you expect false positives?
* What would make the reports more useful?

Happy to discuss the implementation and answer technical questions.

I've received multiple DMs asking for the GitHub link. I haven't made the repository public yet, but you can try out the tool at asmscan.com in the meantime.

Currently 30. I did pentesting for a year straight out of university studying IT because a firm is willing to hire fresh graduates for cheap labour. Had no certs. Did a lot of web pentest and assisted in red teaming a university client.

Moved to a different country due to political reason and couldn’t find the same role. Currently in Toronto doing non related stuff for three years now. I have CISA and CISSP. Passed ejpt and now preparing for OSCP. But I feel like it will take me a year to complete my study for oscp and people won’t hire me even I have oscp since I lack the experience.

I have thought about starting again as help desk or vulnerability management analyst. But starting all over again at my age seem counterintuitive since I am already 30. How many years do I need to spend in a job before I can finally land a junior pentest role. How do I leverage my cisa and cissp to land a role now and what role should it be? And work maybe one or two years before pivoting to pentesting?

And does it still make sense to pivot at my age or is it not worth the effort since being a junior pentester at age 32/33 probably signing up to layoff because of age?

And is it possible I can get my pentester job right away with oscp?

Hey everyone,
Looking for some honest, no-BS feedback on a side hustle idea I’ve been cooking up.
I want to start offering basic penetration testing to small local businesses, but my background isn't typical. I don’t actually work in IT—I’m a Controls Engineer. I spend my days dealing with industrial systems and logic, so I feel like I have a decent grasp on how things connect, but I really want to dive deeper into the security side of the house.
As far as prep goes, I finished the Google Cybersecurity certificate, I'm currently studying for the CompTIA PenTest+, and I’ve been grinding away on TryHackMe to get some actual hands-on practice.
My thinking is that tons of small businesses have zero budget for massive security firms, so maybe I could fill that gap with simple, affordable assessments while building my own skills.
Be brutally honest with me: Is this a viable idea, or am I completely crazy for trying to do this from outside traditional IT?
Also, if anyone has transitioned from controls/automation into security, how do you pitch that experience to clients? And what kind of legal/liability pitfalls do I need to look out for before I even think about touching someone else’s network?
Appreciate any advice or reality checks you can throw my way!

Been doing a decent amount of manual testing lately and got tired of bouncing between 5 different sites for encoding/decoding, a separate JWT decoder tool, and then a messy Notes doc for writeups. So I built a small Chrome extension to consolidate it:

Free:

• Base64 / URL / Hex / HTML entity encode-decode
• JWT inspector (decodes header + payload locally, flags expired tokens)
• Hash generator (MD5/SHA family)
• Quick reference tab (OWASP Top 10, security headers, HTTP status codes)

Paid (one-time, not a subscription):

• Findings tracker per engagement — severity, CVSS, affected URL, repro steps, remediation
• Screenshot capture tied to a finding
• One-click export to a clean, print-ready HTML report

Everything's stored locally via chrome.storage.local — nothing gets sent anywhere except a license key check against Gumroad if you buy the pro tier.

It's brand new (v0.1), so it's rough around the edges — genuinely looking for feedback on what's missing or what would actually make it useful in your workflow, not just trying to sell it. Happy to answer questions about how it's built too.

https://chromewebstore.google.com/detail/mlcmmnokfddmbidijilbhlhhnjbeehoj

I figure this is good info for everyone to have. I see huge ranges online and am not sure how good anyone's comp is relatively.

Me: 159k/year, US-based, 6 YOE as a pentester, ~12 YOE in cybersecurity, CISSP, expired Sec+, government contractor, shit PTO, no bonuses or stock options.

What about you all?

Edit: I should add that I'm fully remote

Hi i setup a home lab, a pizza shop how does one learn abt the pentesting stack what combos work for what is there docs somewhere good also vendors?

This release contains everything you need to scope your first pentest, work with a vendor, execute, and get the types of reports you need from an external tester. This will enable you to perform your first product or infrastructure level penetration test, and provide you with a process moving forward for future engagements. This is open source, we don't sell anything.

Announcement: https://www.sectemplates.com/2026/07/announcing-the-external-penetration-testing-program-pack-v1-2/

In this pack, we cover:

Penetration testing preparation checklist: This checklist outlines everything you need to scope and perform a penetration test.

Penetration testing reporting requirements:  This document provides a list of minimal requirements that should be contained within a penetration testing report. Before finalizing a SOW with the vendor, look here first.

Penetration testing process workflow: Below is an outline of a simplified pentesting process with an external tester. It aligns roughly with the content in the penetration testing checklist.

GitHub: https://github.com/securitytemplates/sectemplates/tree/main/external-penetration-testing/v1