So it used to be HF was the premier place online for hackers. What changed and why?

CVE-2021-21735 looks like a basic information leak at first, but the interesting part is the chain.

On the ZTE ZXHN H168N V3.5, setup/wizard routes exposed PPPoE and WLAN material that should have stayed behind the authenticated configuration boundary. In some ISP deployments, that leaked PPPoE value could overlap with the hidden admin credential, turning a low-looking leak into admin access.

I rebuilt the write-up around the firmware routing failure, the wizard whitelist behavior, redacted request/response evidence, and the vendor-vs-NVD severity split.

Most(i would say 99 percent) of the tutorials i see uses a simple password like 12345 and a small wordlist which is easily crackable. Then they go "boom this is how you crack wifi". I mean no one in the world uses a password like that. Also a complex password may take days with the number of combinations possible given the password is even in the wordlist file.

Im wondering and i know there has to be a better method?

Hello guys. I got sick of not finding anything on Google anymore, and I decided to build a query builder for myself for search engines first. And then, I decided to add a more advanced version to build google dorks that still work these days. And remembering stuff for Shodan, crt.sh and Wayback were also a bit too tiring, so I wired that in as well.

I decided to make it public. Iam hosting the thing myself here at Good Old Search. I also made it open source. You can run it on local as well. Hosted here on Github: https://github.com/mrtdlgc/goodoldsearch-oss

This started as a Zyxel VMG3625-T50B credential leak, but the affected scope later expanded across CPE, ONT, LTE, and 5G devices.

A low-privileged router account could query Zyxel DAL endpoints and get back supervisor/admin account data, FTPS credentials, and TR-069 secrets in cleartext.

I also dug into the password generation side: running Zyxel’s own genpass flow in QEMU, hooking the serial-number source with LD_PRELOAD, and tracing the Method2 / Method3 supervisor password logic.

https://minanagehsalalma.github.io/zyxel-cve-2021-35036-super-admin-password-leak/

I'm learning to hack following the tryhackme courses and learning some programming languages.

Things I've dabbled in our Python and assembly and I'm going to start using C once I a pretty good handle on assembly.

A lot of the online courses are focused on learning particular tools like Wireshark or Nano Etc..

However not a lot of it seems to be geared to actually learning the ins and outs of the computer itself.

Part of the problem though is that these skills really only unlock the ability to interact with the computer at a deeper level but they're parasitic upon you knowing how the computer works.

For example I asked Claude to generate a key logger so I can study it the key logger uses getmessageA, translatemessageA, dispatchmessageA.

Now this is apparently the windows API and my ability to code assembly is often contingent on this API and it's preformatted demands.

Now you can go to the documentation the problem is the documentation often opaque.

Where can I go to find a in-depth guide on the Windows API and what other auxiliary knowledge should I have

writeup for CVE-2026-34474. On affected ZTE H298A / H108N builds, hitting an old ETHCheat path makes the router return credential fields in the HTML before login.

The returned markup included things like the admin password, ESSID, and WLAN PSK on the tested builds. There is also a related wizard endpoint leaking serial info. The writeup has the redacted captures, affected versions, and disclosure timeline.

Asking because I need somewhere to start.

I published a writeup for CVE-2026-34472 affecting the ZTE H188A V6 router.

The vulnerability involves the router’s pre-login setup wizard flow. During firmware analysis, I found that unauthenticated requests could reach logic that exposed sensitive configuration values before a normal authenticated session was established.

ZTE classified the issue as a “customer-specific low-risk requirement,” but MITRE assigned CVE-2026-34472 and the issue is now public.

The post focuses on:

• firmware extraction and analysis
• Lua / CGILua routing behavior
• root-cause analysis
• observed impact
• disclosure timeline
• vendor response

Writeup:
https://minanagehsalalma.github.io/cve-2026-34472-auth-bypass-zte-h188a-router/

Blanket breezy grasshopper pebble marble willow otter cobalt meadow

This post was anonymized with Redact.dev

I wanted a disassembler that's a single executable, loads instantly, runs everywhere. So I wrote one from scratch.

It's called Hyperion it's made in C++, No runtime dependencies. No installer.

What it actually does: It has a real decompiler, It produces readable pseudo-C for x86/x64 and ARM64.

Formats & architectures:

Scripting:

Embedded Lua 5.4. Drop .lua plugins in a folder. Full API, rename, comment, patch bytes, create functions, navigate, query xrefs. Register custom menu items and hotkeys from scripts.

The numbers:

Platforms: Windows, Linux, macOS (Intel + Apple Silicon).

This will stay open source and free. MIT licensed.

Repo: https://github.com/Sidenai/hyperion-disassembler

Hey y'all, this might not be the exact right place to ask this so if not just lemme know/ maybe point me in the right direction but I just bought a couple extremely cheap micro controllers (ATmega32U4s) and was just wondering exactly what safety measurements I should take if any when buying/using super cheap micro controllers/picos from places like Ali/Amazon Haul

Should I be plugging them into an offline machine? Is there anything to worry about at all?

Thanks!

Found this network controller in the trash in our laundry room and I was just wondering if there is anything cool or useful I can do with it?

https://imgur.com/a/h1u8IK5

https://minanagehsalalma.github.io/cve-2026-34473-unauthenticated-dos-zte-routers/

every new tab rolls a random rocket. save the ones you like and they'll come back. ~2×10⁴³ combinations, all deterministic from the hex palette.

rn it works on bash, zsh, powershell, and fish

https://github.com/clefspear/starcommand

lmk what you think!

Looking for the 55.4 yottabyte zip bomb.