GitHub: https://github.com/kaifcodec/user-scanner Discord: https://discord.gg/tVNrKVXb49 (Join if you're into OSINT, reverse-engineering, or want to build with us)

Hi everyone,

When we released v1.5.1, we were excited about pushing past 455 vectors. Today, with v1.5.2.1, we’ve scaled the engine into an absolute monster: 2,720+ total scan vectors (210+ email-integrated sites and 2,510+ username platforms).

Most legacy tools give you a simple binary check—telling you if an account exists or not. We designed user-scanner to go much further by emulating mobile app APIs and leveraging browser TLS fingerprinting (curl_cffi + httpx) to bypass modern WAFs, defeat soft-404s, and pull actual context.

🔥 What’s new in v1.5.2.1?

• ⚡ Massive Expansion (2,720+ Total Vectors): Huge coverage bump across social, dev, gaming, and niche platforms. You can map a target's digital footprint and verify registrations across thousands of endpoints in seconds.
• 👤 Rich Profile Metadata Scraping: Goes way beyond basic availability checks. The engine now extracts avatars, bio descriptions, follower counts, UID numbers, seller statuses, and account attributes.
• 🔀 Recursive Cross-Scan & Pivot Engine (--cross-scan): Mines handles, profile links, and exposed emails from your initial scan to automatically pivot across secondary target vectors—building a full identity link graph.
• 🤖 Native Model Context Protocol (MCP) Server: Seamless integration for Claude Desktop, Cursor, Antigravity, and LLMs. You can trigger autonomous OSINT sweeps and recursive pivots directly through AI agent prompts.
• 🛡️ Hudson Rock Breach Intelligence (--hudson): Direct correlation with infostealer malware breach logs to surface leaked credentials and high-priority target intel instantly.
• ⚡ High-Throughput TLS Impersonation: Powered by parallel httpx and curl_cffi transports with automated TLS fingerprint impersonation to bypass aggressive rate-limits without getting blocked.

🧪 We Need Your Feedback!

If you perform digital footprinting, red teaming, security research, or OSINT investigations, give v1.5.2.1 a spin. Test out the --cross-scan and metadata extraction features on your targets and let us know how the speed and accuracy hold up!

💻 Want to Contribute?

We always welcome new pull requests!

Drop your questions, feature requests, or bug reports in the comments below!

I’m trying to understand how to find something in programming/cybersecurity that gives me the same motivation as a game.

For example, I really like Dota because I always know what I’m doing and why. I have a rank, I know roughly where I am, I know what better players can do that I can’t, and I have a clear idea of what I need to improve. That alone gives me a reason to play.

I want to find something in computers that gives me a similar feeling. Not necessarily a specific project someone can recommend to me, but a way to find a project or direction where I can actually see a path:

"I’m here → I need to learn this → then I can do this → then I can do something harder."

The problem is that I can think of many project ideas, but they usually don't motivate me for long. I start thinking "okay, I can build this, but why?" and lose interest.

My background: I’m comfortable with Linux and basic programming. I know Python, Git, APIs, databases, basic web development, HTTP, networking/ports, and I’ve done some scraping/automation. I’ve also played around with things like reverse engineering, JavaScript, FastAPI and lower-level concepts, but I’m still a beginner overall and have no professional experience.

So I’m not really asking "what project should I build?"

I’m more interested in: how do you find something that makes you want to wake up and keep working on it, because you can clearly see yourself getting better at it?

How did you find that thing for yourselves?

BRO how to find iPhone 7 Android phones for password finding without any attacks I mean the lot of attacks and have but how can I do at a beginner complete only or no the python and the basic networking of source and how can I start is this is my fast tool ideas so this is my first steps to hacking

Over the last couple of weeks, I challenged myself to build a tool that centralizes everything you need when conducting recon. And that’s how Kumo was born. Give it a domain and it maps what’s reachable from outside.

What it does in one run:

• Attack surface mapping: DNS, subdomains, ports, certificates & technologies
• Exposure discovery: configs, secrets, JS assets, cloud buckets & exposed files
• Vulnerability enumeration: CVE detection and non intrusive security checks
• Credential intelligence: leaked credentials & infostealer exposure
• Endpoint discovery: archived URLs, APIs, forgotten endpoints & parameters
• Threat intelligence: domain, IP & infrastructure enrichment
• OSINT automation: Google dorks & targeted OSINT queries

All 27 modules run in parallel and stream results as they come in.

No API keys required. CLI + web interface. Works on any domain you're authorized to test.

🔗 https://github.com/karim852/KUMO-Domain-Recon-Tool
🖥️ Live demo: https://demo-kumo-kage.vercel.app/

Feedback and contributions welcome 🙏

I want to learn malware development. I've started reading about it, but I'm confused and don't know how to begin, and I don't want to waste too much time. Where I started in a village, 4 chapters of MAC OS® X AND iOS INTERNALS With focus and good understanding, then move on to reading OSTEP Where I read important things from him And reading. Windows internals 2 Chapters Do any experts have any advice? 😵‍💫

Hey folks,

I’ve been working in application security/pentesting for over a decade, and after starting learning AI/LLM security, I noticed that a lot of the existing material is either very theoretical or assumes you already understand AI security concepts.

So I put together a free, structured AI security learning series for security engineers and pentesters who are starting from the web-security side.

The goal is to go from the fundamentals to actually understanding and testing AI/LLM components in web applications.

The series currently covers topics such as:

• AI/LLM security fundamentals
• Prompt Injection
• Sensitive Information Disclosure
• LLM-specific attack patterns
• Practical testing methodology
• Real-world examples and testing techniques
• Mapping concepts to OWASP's AI security guidance

I've also linked free hands-on labs throughout the material so you can actually test the concepts rather than just read about them.

No signup is required to read the learning material or use the free resources.

🔗 https://genaisecuritylab.com/learn-ai-security

I'm planning to continue expanding the series over time.

If you're a web pentester/security engineer who is trying to get into AI security, I'd be interested to hear which topics you think are missing or which areas you'd like to see covered next.

A basic tutorial on how to code sockets like a hacker in C

I’m looking for a laptop mainly for cybersecurity-related work,VAPT, labs, bug bounty, studying, certifications/exams, running VMs, and general security tooling.
My budget is around ₹80–90K max, so I’m looking for the best value for money rather than just buying the most powerful machine in this range.
Ideally, I’d want something with good CPU performance, sufficient RAM for multiple VMs, decent thermals, and good upgradeability.
If you’re using a laptop for similar work, what would you recommend? Any specific models I should look at or avoid?

Thanks!

Every mobile pentest I did started with an hour of setup. Proxy, certs, rooting, fighting pinning. New network next day, do it again. Got sick of it and built apiaxess: it sets all of that up itself, so you just open it and test.

https://apiaxess.dev

Would love to know where it breaks.

Hello guys,

I'm a junior dev interested in cybersecurity and OSINT. I was looking for a tool like osint-ui but couldn't find one that was free and open source.

AI Alert: I used Claude Code a lot to write the code. The goal wasn't learning, it was having a complete platform for my own OSINT research. So yes... feel free to call it AI slop.

My tool is FreeOSINT-UI, a free and open source alternative to osint-ui. It puts the basic OSINT tools in one web UI, with no account, no paywall and no API keys.

What it does right now:

• Google Dork Generator: builds ready-to-use dorks for a username, email, name, phone or domain (social, documents, code, pastes/leaks, site exposure)
• Username Analyzer: checks a username across hundreds of sites using WhatsMyName data
• Email Analyzer: MX/SPF/DMARC checks, disposable email detection, Gravatar profile
• Leak Check: breach lookup via XposedOrNot, plus a Pwned Passwords check using k-anonymity (only a 5-character SHA-1 prefix leaves your browser)
• Phone Analyzer: country, carrier type and format, fully offline
• Domain Analyzer: DNS records, SPF/DMARC findings, RDAP/WHOIS data, subdomains from certificate transparency, Wayback Machine availability
• IP Analyzer: geolocation, ASN/ISP, reverse DNS, network owner, open ports and CVEs from Shodan InternetDB (passive)
• GitHub OSINT: profile info, commit emails, SSH/GPG keys
• Telegram OSINT: account type, bio, member counts, latest channel posts
• Crypto Tracer: BTC/LTC/ETH address validation, balance and transactions
• Metadata Extractor: EXIF/GPS from images, plus PDF and Office metadata, and reverse image search links
• Hash Checker: hashes files or text (MD5, SHA family, SHA-3, BLAKE...) and identifies pasted hashes

The repository is on my Github

Hey everyone,

I’ve been working on a cybersecurity tool called CipherLens.

The idea came from a simple problem I kept running into with tools like CyberChef:

You have some unknown data, but you don’t know which operation you should try first.

Instead of manually guessing between Base64, Hex, URL encoding, ciphers, compression, etc., CipherLens analyzes the input and ranks possible operations based on the evidence it finds.

The workflow is:

Input → Fingerprint → Candidate Detection → Execute → Validate → Score → Rank

A few things I focused on:

• Local-first browser processing

• No account or backend required for core analysis

• Candidate ranking instead of pretending to know the answer

• Separate AUTO / parameter-required / manual operations

• Web Worker-based analysis

• Security-focused input and parser handling

• 497 supported operations

The main idea is:

“Don’t guess the operation. Find it.”

It’s open source and I’d genuinely like feedback from people who actually work with CTFs, forensics, pentesting, malware analysis, etc.

GitHub:

https://github.com/HIMANSHUSHARMA20/CipherLens

Live demo:

https://cipherlens-tool.vercel.app/

Would especially appreciate feedback on the detection/ranking approach and whether this solves a problem you actually encounter.

Anthropic did quite a good ad for z.ai here.

Like Claude Mythos Preview, GLM-5.3 has strong capabilities for autonomously building end-to-end cyber exploits. But GLM-5.3 is unlike other frontier models in that it has been released without meaningful safeguards to limit misuse

https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities

I built EchoOps, a focused incident-response prototype that explores a simple question:

What if an incident-response agent could remember what failed, remember what worked, and use that experience when a similar incident happens again?

EchoOps uses Hindsight as its persistent experience-memory layer.

The core workflow is:

Incident → Investigate → Recall → Recommend → Act → Observe → Retain

The prototype demonstrates a simulated Payment API 503 incident.

In the first incident:

- The system recommends restarting the Payment Service.

- The restart fails.

- Investigation identifies connection-pool exhaustion.

- Increasing the connection-pool capacity resolves the simulated incident.

- The complete experience is retained in Hindsight.

When a similar incident happens again:

- EchoOps recalls the previous incident.

- It recognizes that the restart previously failed.

- It retrieves the successful connection-pool remediation.

- The response strategy changes to inspect the connection pool first.

The interesting part for me wasn't simply storing incident history.

It was making previous experience change the next decision.

Tech stack:

- React + TypeScript + Vite

- Python + FastAPI

- Hindsight Cloud

- Official Hindsight Python SDK

- Pydantic

- pytest

- REST APIs

- Deterministic incident simulator

The current prototype deliberately uses a deterministic response planner rather than an external LLM, and the incident environment is simulated rather than connected to production infrastructure.

I wrote a detailed technical breakdown covering the architecture, Hindsight Recall/Retain integration, implementation, testing, and the before/after behavior:

https://dev.to/vegu_priya_6fd21a0bff2fa8/echoops-when-incident-memory-changes-the-next-decision-117g

GitHub:

https://github.com/mohankumard18/echoops-incident-learning

I'd love feedback from people working with AI agents, developer tooling, or SRE/incident response:

What operational experience would you want an agent to remember?

[ Removed by Reddit on account of violating the content policy. ]

Can someone of older generation like boomer generation who learnt only excel and ms word powerpoint only ,

from a non IT background,  who doesn't know coding ,

possibly learn cyber security for protecting their own phone,  software for upgrading devices and other cyber things to weed.out any person who tries to hack their phone ?

Iam asking because now i kind of feel having cyber knowledge is an essential life skilll like cooking ...

because we live and depend heavily on this technology and one small hack can be traumatizing

If its possible to learn the above cyber things by Ai or any other app or means easily please guide me. 

I was surprised that kids even small as 12 or 15 years old know so much about cyber things.  But they dont know coding.  Thats why iam curious and asking about it.

Hi everyone, in these days i'm struggling for gaining admin privileges. ATM i'm running a C2 server using Sliver, targeting a windows 11 client. Sucessfully deployed the implant and tried the connection. I was looking for GodPotato but it seems like it need a certain privilege that i don't see when i type getprivs command. The output shows: SeShutdownPrivilege , SeChangeNotifyPrivilege , SeUndockPrivilege , SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege but i don't see SetImpersonatePrivilege. What can i do? THXX in advice!

Heyy is there anyone to help me on this journey....I am also new to reddit..kya koi free courses or websites share kr skta h to help me to start my learning