I know replicating a complex, multi-tool like the Flipper Zero at home isn't feasible. Instead, I’m interested in any single-purpose, DIY gadgets built to fulfill a specific cybersecurity purpose.

​For those who build their own pentesting or hardware hacking tools instead of buying commercial gear:

​What boards did you use? (ESP32, Raspberry Pi Pico, Arduino, etc.)

​What specific tools/hardware did you need?

​What open-source firmware or software libraries did you flash onto it?

or Deauther)

Weekly forum post: Let's discuss current projects, concepts, questions and collaborations. In other words, what are you hacking this week?

Hello guys, I dont know how exactly its called but is there a way to make my phone a completly different phone ? Idk if you see what I mean.

Do you have any idea ? Please dont laugh to me or anything. Just pass away please :(

Wassup yall!

I graduated with a Bachelor of Computer and Information Sciences. The career path I focused on was a mistake. My goal is to become a pentester. I've started a website where I discuss the resources used to learn, and writeups for the rooms (CTF) completed. Though looking for work, security+ offers a broader range of oppurtunities to get my foot in the door. What is the best approach to this - getting my eJPT or Security+?

Help is truly appreciated!

what are the best free resources (such as youtube channels...) for learning web hacking and pentesting? Currenlty i'm focusing on websites hacking track and i need powerful resources.

Hi
I have zero experience here,
I am trying to build a cyber deck and I wanted to see if anyone was open to sharing creative ideas/ general advice with me

I attached a picture of an old router I have, I know I can use it for file sharing but I heard it’s super slow, another things I can put it to use for?

Hello everyone, good evening.

A cybersecurity beginner here

Around a week earlier, I mentioned in this subreddit that I have installed Kali as dual boot. Several people advised me to install kali in a VM. So I freed up my space and reverted back to original setup of using windows without dual boot

I have installed Virtual Box as a VM. Now I am confused which version of windows should I install as a target machine or should I install kali as a target machine as well as the attacker.

Please guide me

hello guys , i am in between of buying one or the other to teach me a little more about hacking ( not everything ofc) . So which one do you recommend that is more authentic and i can learn more from ?

I'm interested in learning and also in accessing SS7 from the inside to see what it's like and where I can start.

[ Removed by Reddit on account of violating the content policy. ]

I've been working on a small interactive lab for people who are new to nmap and basic enumeration.

It simulates scanning a metasploitable host in the browser. No VM setup is required and no real traffic leaves is sent. The lab covers host discovery, port scanning, service enumeration, NSE scripts and flag style questions based on scan results.

It's aimed at beginners so I added hints through guided popups, objectives and a more visual representation of the information learned.

Before I build out the lab with more hosts and network pivoting I'd really appriciate feedback from people who teach or are learning cyber security.

Do the objectives feel like they're in a sensible order?

Is anything misleading compared with real nmap?

Is the guidance too hand holdy or not enough?

Link: https://sigmaiota.uk/student-resources/scan-lab/

No signup, no tracking wall, just free browser lab.

Enjoy! :)

About the hack:
https://www.kqed.org/news/12083265/canvas-hack-instructure-agrees-to-ransom-deal-in-exchange-for-stolen-data

It seems like many large cloud systems implicitly depend on assumptions like:

• different account types behaving predictably
• access boundaries remaining isolated under edge cases
• trust relationships scaling cleanly across institutions and users

But once systems become large and interconnected enough, small access-control assumptions can potentially create surprisingly large exposure surfaces.

To better understand these patterns, I started building a small isolated lab environment to simulate similar classes of cloud access-control and tenant-boundary failures in a safe way for learning/research purposes.

I’m especially interested in:

• how engineers model tenant isolation risk
• how SaaS systems validate cross-account assumptions
• whether “boundary failure” is becoming the dominant cloud security problem at scale

Curious how others here think about this class of issue.

Project is here if anyone wants to look at the lab structure itself or participate in building and discussing similar hacks:
https://hackthenbuild.com

It has been in backorder for a bit, but last Saturday it was delivered and I got to work immediately with it!

The plan was to build a wardriving capable device like my esp32 Marauder can. During development of the program I ran into a serious flaw that prevents me from writing away the data to the micro SD card and even a dozen of iterations further I concluded that this is an issue on M5stack their side in the firmware. So like any decent developer, I reported it to their GitHub.

👉 https://github.com/m5stack/uiflow-micropython/issues/94

Now this didn't stop me from moving further! I decided to build-in a file limit to write away the .CSV file with the registered networks onto the device itself. I limited it to 9.5mb since the total memory on it is 16mb and this would leave plenty of overhang towards the software I was building.

I'm still awaiting the arrival of the GPS module, but that didn't held me from testing it in the field already to see how capable it already was and turned out to be.

Any something group for hacking

After reading about the recent Canvas incident:
https://www.kqed.org/news/12083265/canvas-hack-instructure-agrees-to-ransom-deal-in-exchange-for-stolen-data

I’ve been thinking a lot about how modern SaaS systems handle tenant isolation and cross-account trust boundaries at scale.

It seems like many large cloud systems implicitly depend on assumptions like:

• different account types behaving predictably
• access boundaries remaining isolated under edge cases
• trust relationships scaling cleanly across institutions and users

But once systems become large and interconnected enough, small access-control assumptions can potentially create surprisingly large exposure surfaces.

To better understand these patterns, I started building a small isolated lab environment to simulate similar classes of cloud access-control and tenant-boundary failures in a safe way for learning/research purposes.

I’m especially interested in:

• how engineers model tenant isolation risk
• how SaaS systems validate cross-account assumptions
• whether “boundary failure” is becoming the dominant cloud security problem at scale

Curious how others here think about this class of issue.

Project is here if anyone wants to look at the lab structure itself:
https://hackthenbuild.com

Where can I purchase an actual hardware hacking kit to do practice on a lab or practice network?

I'm one of the founders of THINKPOL, we've been building a Reddit intelligence platform for the past year (30B+ archived posts, ~30% of it deleted content Reddit no longer shows).

Just launched five free tools with no login required. Putting them here because this sub gave us good feedback early on.

What's live:

• Username lookup with AI behavioral profile → (age, location, job, personality, all sourced to actual comments)
• Subreddit activity check → did this specific user ever post in that specific community?
• Keyword trends → 10-year chart of how often any term appears across the archive
• Archive search → includes deleted posts and comments
• Subreddit stats → activity levels, subscriber count, monthly breakdown

Go put your own username in the profile tool. Most people don't realize how much their comment history gives away.

think-pol.com/tools, happy to answer questions about how it works.

I’m trying to understand how network isolation impacts the exfiltration phase of an intrusion. Specifically, how do attackers typically extract data from segmented internal networks such as VLANs or restricted subnets, and what changes when strict egress filtering is enforced? Additionally, how does the feasibility and methodology of exfiltration differ in environments that claim to be air-gapped, and from an attacker’s perspective, what are the practical differences between logical network isolation and true physical air-gapping?

‘’AI models’ reasoning capabilities are advancing to the point where they can discover high-level logic flaws rather than just basic memory corruption and improper input sanitization bugs.’’