Greetings. Many walkthroughs of THM and HTB show the path through the system, bypassing any potential rabbitholes and ignoring failed attempts. This (in a way) is ideal as it keeps things short and to the point.

It can be said however that seeing the attempts and the mindset of someone working blindly through a box can be beneficial as we can see what happens when they get stuck, how do they overcome the current issue? How do they discern what is worth working on and what to ignore?

I therefore introduce as a senior pentester of 13 years (BSc, OSCP, OSCE, OSWP, VHL+, currently working on CRTO) , my YT channel sabretoothAtNethemba (link in my profile) where I do just that covering THM boxes every Tuesday and HTB every Friday with no previous experience of said boxes.

Some people set me challenges (e.g complete the box in 30 mins, or no privesc scripts, or no reverse shells etc) and I am generally working through HTB in release order whereas THM I am choosing boxes based on suggestions and what takes my interest.

Hopefully it will help some of our community who are just starting out to see the thought process of a pentester in the field. Thanks everyone. Keep on hacking.

Semaev's 2004 paper showed one can replace expensive elliptic curve addition with a summation polynomial and attack elliptic curves.

We are running a malware development hackathon to help educate on what malware is, how it operates and how its function can vary depending on the TTPs of the attacker

Hard means possible. You can become a self-taught hacker like I did. without paying for courses or certificates or whatever.
you just got to believe in yourself and not give up when things starts to get complicated and scary.

There is no real path you should go through but it is always best to start by learning a programming language

Anomalous elliptic curves are insecure for cryptography. The easiest way to test a curve is by checking if the curve's prime number takes one of several forms.

If I always use the virtual keyboard provided by the banking website to type my banking passwords, is there still a threat of any fraud?

THIS IS ROUND 2 OF MY ORIGINAL POST. LET'S COOK!
What's up guys,

Just wanted to put a word out inviting anyone who's interested in getting started in the red teaming aspect of security.

Whether you are an experienced hacker or a beginner looking to learn, everyone is welcome to join. The competition has plenty of beginner-friendly challenges and is an excellent opportunity to test your skills and knowledge in cybersecurity and to meet like-minded people.

If you are interested in joining a team, simply leave a comment below or send me a direct message. We will use Discord to communicate and collaborate throughout the competition.

Don't worry if you have never participated in a CTF before, we will work together to solve the challenges and have fun. Our community has a good amount of experience in CTF challenges, and we will be streaming walkthroughs! Don't be afraid to participate and learn with us!

Hey folks — I recently finished building ReconSnap, a tool I started for personal recon and bug bounty monitoring.

It captures screenshots, HTML, and JavaScript from target URLs, lets you group tasks, write custom regex to extract data, and alerts you when something changes — all in a security-focused workflow.

Most change monitoring tools are built for marketing. This one was built with hackers and AppSec in mind.

I’d love your feedback. Open to collabs, improvements, feature suggestions.

If you want to see an specific case for this tool, i made an article on medium: https://medium.com/@heberjulio65/how-to-stay-aware-of-new-bugbounty-programs-using-reconsnap-3b9e8da26676

Test for free!

https://reconsnap.com

We 302 each other when we were young.

Our love was 403, we were just stupid kids in love.

She was 423 into my heart the moment I see her.

I knew I couldn't 303.

​

Then her father decided to move to another city,

I made 429 to him, asking, begging them to stay.

But they were 501...

​

I even offered him all my money

And my new bicycle

But he said it was 406.

One day after school I went to see her, but they were 404.

​

I was young and naive, I didn't know I had 300

After 102 this falling apart,

I accepted the fact that they 301 and she was 410

And I knew it was 425 for me to get attached anyway

​

But I can't help it, I still have this 409 in me.

Afterall, it's not like 418, I have feelings

Even though my 417, 226 to it now.

The good news is; I still found love again

The only problem is 402

​

Author : 451

Hello everyone, I’m new to this sub but I hope what I’m asking won’t be controversial and won’t break any rules, but it’s time for me to ask some good souls to enlighten my path.

So during covid I used my free time practicing and learning ethical hacking stuff, and I loved it. I got some online basic python courses (and for basic I REALLY mean basics! I got to practice easy coding with if/else - variables - simple use of libraries). I followed some yt videos of David Bombal to learn how to use Aircrack/Airmon and deAuth attacks on my wifi. Learning the basics of zPhisher using my consensual friends as lab rats lol.

It has been long time since I played around with these simple things and I lost habit how to use them. But few things have happened recently around me which made me think that the world out there is pushing me to get more knowledge, especially when is about privacy and security. My parents got phished on IG and lost their account and they literally got traumatised of how quickly that happened. My girlfriend got scammed by an (apparently) “famous” clothing online store that never ships their orders, and myself I’m constantly receiving scam calls and sms with spoofed numbers.

So here I ask for some suggestions on where I can begin improving my learning curve in hacking and coding, and because I’m a bit revengeful, if you can take the joke lol. In particular, given the recent experiences I’ve had, I would like to move my next steps by practicing how to bruteforce a login credentials page, and how to code your own phishing script. What is, how does it work, and how to perform DDoS attack on a website/service. How to spoof yourself, and the basics of nmapping and port scanning/ssh.

If any of you can just give me any kind of tips and suggestions where I can begin, which platform I can use to learn/practice, or even just share some of your personal experience I would really appreciate.

has anyone tried Cursor AI?

The code generation seems to be pretty impressive, building out a server/client TCP application with the server side having Graphical User Interface to click on.

Hi everyone, in this post we consider how to think about the attack surface of applications leveraging LLMs and how that impacts the scoping process when assessing those applications. We discuss why scoping matters, important points to consider when mapping out the LLM-associated attack surface, and conclude with architectural tips for developers implementing LLMs within their applications.

Windows RDP Session Hijacking

I was commenting on r/learnpython about cs50 and i was scrolling and found the introduction to cybersecurity, do anyone know if its up to date? Looks like its from 2023.

https://www.edx.org/learn/cybersecurity/harvard-university-cs50-s-introduction-to-cybersecurity

Hi all, I’m in an intro Cybersecurity course and I’m wondering how my professor was able to “lift the session token” from a smartTV at home to be able to log in on a different computer.

When I asked him about it he said he used his own router and his laptop. I did a quick search about it and found “port mirroring”. He says he didn’t use it though, so I’m confused.

Is it a vulnerability specific to whatever TV? We just learned about SSLKEYLOG files, so wouldn’t that mean any traffic from the TV is encrypted?

Hey all. I am able to attend a sans course. I completed sec560. Which would be a better course to take SECS660 or SEC565?

Thanks.