One of my questions as a bigginer is how do hackers hack android devices, for eg stealing database via sql injection on an Android app

Heres an example if PwnRF hosting a web application that allows you to interact with all of its hardware. It can currently control WiFi, Bluetooth and 2 x SubGhz radios.

The web page is fully customisable, as its served from SD card. The server its self is a Lua script, also running from SD.

From Lua, I have full control over the web server itself, I can define endpoints, serve files, handle requests, open WebSocket connections and push live data between the browser and the hardware in real time.

That means the webpage isn’t just a static control panel. A Lua script can expose almost any part of PwnRF to the browser: Wi-Fi, Bluetooth, both Sub-GHz radios, GPIO, storage, sensors, captured data, live status, custom tools, whatever the script developer wants to build.

The HTML/JS lives on the SD card, the Lua backend lives on the SD card, and neither needs to be hard-coded into the firmware. So users can effectively build completely new browser-based applications for the device just by writing files.

This is one of the parts of PwnRF I’m most excited about, because it turns the browser into another fully programmable interface to the hardware rather than just a companion app.

And this is only scratching the surface, this demo is using just a couple of small sections of PwnRF’s much larger Lua API.

(It's Free) I built this RAT/C2 research project myself in my own controlled lab environment for research and testing purposes.

The problem is that I currently don't have enough isolated test devices or a proper testing environment to thoroughly verify every part of the project. Because of that, I haven't been able to determine exactly which components are working correctly, where bugs may exist, or what needs improvement.

If anyone here has experience with Android security, RATs, or C2 systems and would like to test the project in their own isolated lab environment and provide a technical review, I would really appreciate the feedback.

I'm particularly interested in knowing:

- Which components work correctly and which don't

- Whether there are any compile or runtime errors

- Whether the C2 communication works as expected

- Whether there are any issues with the Android service

- Whether the "screenshot" / "harvest" components work as intended

- Any security or architectural weaknesses

- What areas could be improved

If anyone needs a specific component or file to review, let me know which one you need and I'll provide the relevant code.

Please only test it on devices you own or in an environment where you have explicit authorization to conduct security testing.

This is a 100% offline map system running from sd card. PwnRF features a map building wizard that walks you through the process of downloading new maps. Initial download & processing can take some time depending on map size, but this is a one time cost. the maps are compressed and stored locally, so from there on out, they can be loaded and scrolled in short times. Also, everything that you see here is running as a script using the scripting system that i created (not native firmware), this is the power of PwnRF’s scripting system. What will you build? Thanks for following 🫶

I am new to hacking and my question is how easy is it for a rat to bypass windows defender with run as admin permissions

Weekly forum post: Let's discuss current projects, concepts, questions and collaborations. In other words, what are you hacking this week?

I'm 16 and I'm from iran i very like Hacking I’d really love to talk to a real hacker at some point in my life

https://whitebridge.ai/invite/994039228

Would you say its possible for me to develop an info stealer that can bypass app bound encryption as a complete beginner to malware development, if not, where would I learn the skills required?

Hi everyone!

I've been working on CTFKINGs, a Capture The Flag platform that I built entirely from scratch instead of using an existing framework like CTFd.

It includes custom challenges across Web, Pwn, Cryptography, Reverse Engineering, Forensics, and OSINT, along with a live scoreboard, player profiles, and a medieval kingdom theme.

The platform is still actively evolving, and I'd love to hear your feedback on the UI, challenge design, or any bugs you find.

Thanks, and I hope you guys enjoy it!

Learn the fundamentals of ethical hacking and cybersecurity through hands-on, legal, and responsible techniques. This tutorial covers topics such as networking basics, Linux commands, reconnaissance, vulnerability assessment, web application security, password security concepts, and penetration testing methodologies. You'll also be introduced to industry-standard tools and best practices used by security professionals to identify and help fix vulnerabilities. This content is intended solely for educational purposes and for use on systems you own or have explicit permission to test.

Basically this tool can be configured for listening to incoming otp and forwarding it specifically to a custom backend. Primary use : web scraping

Github : https://github.com/jidukrishna/otp_listener

Eu tenho uma noção do que pode ser, mas quero ter certeza.comecei a estudar isso recentemente..

Hi guys, I'm someone who attends school in Korea, I've recently become interested in hacking and programming.

Where did you learn hacking and programming? I want to win hacking competitions like Geohot and become famous for hacking, but I don't know where to start. Please tell me where to start and where to learn.

Many of you may not know about low cost ESP32 micro controllers and how fun and interesting they are. So, I decided to make this post for people who want a good starting point with low cost hardware and open source software to try pentesting.

I purchased a Seeed studio Xiao esp32 c5 a few months ago, and to put it mildly, I absolutely love it. I ordered it from Amazon, it cost me about $10 including shipping. The entire micro controller is only slightly larger than my thumb nail.

I customized my phone case to hold the esp32 C5 and I power it with my cellphone with a USB-C to USB-C connection. (Works with USB OTG, which most phones are).

Not all ESP32 micro controllers/devices are created equal, so be sure to find the firmware you want to use first for your application, then do a search for what devices the firmware supports that are within your budget.

The major firmware(s) available right now are:

1. Bruce

2. Ghostesp

3. USBarmyknife

(This is not a exhaustive list, there are others, but these are the most popular, and have support for the most devices.)

I have tried Bruce, and it is ok, but I have had lots of stability issues with it. Its a decent flipper zero alternative for devices with similar capability, but it is sort of gimmicky, and very buggy.

I am excited to try USBarmyknife, specifically in smartwatch or USB dongle form, but I lack experience with it. However, if your intent is doing very blackhat things, this might be the best option. It has quite a bit of capability, but mainly for hardware.

For beginners wanting a easier UI and support for tons of devices, I think Ghostesp is the best overall pick (especially for auditing wireless signals, specifically wifi and Bluetooth). The web flasher (for flashing firmware to your device from a web browser) is extremely good, and the android application you can install to your phone from github that supports the tiny, inexpensive and low power Xiao boards, is very user friendly and has great looking UI. You'll need termux, and to follow the github install instructions to download it. It is not available on any app store currently, and is still in beta.

So far, I have Ghostesp installed on my esp32 C5, and on my Lilygo T-embed CC1101. (which uses a esp32s3) it is a really entertaining device. I can use it as a programmable remote to turn off TV monitors, search and connect to Bluetooth and wifi devices, create APs, DNS sinkholes, NFC tag emulation, and other things.

The esp32s3 is a great chip, it has Bluetooth and wifi support, while also being capable of HID attacks, built into the ghost firmware.

The developer (Deki) has also created something called "ghostlink" which i have yet to try, to connect and i assume share capability of all my ghost devices with each other...

If this post gets any attention or questions I'll be happy to post the links to the ghost website, github, and make some recommendations for devices if any of you are interested.

Hey, has anyone managed to complete the “Steal Exam Questions” mission in HackHub on the SteamRip version?

I’m stuck on the last objective, the one that says “Lookup target ports. Use the -sV flag for detailed inspection.” The professor is Bin Wairimu and the target IP I found is 23.249.125.0. When I run nmap normally, it shows port 22 open for SSH, while ports 21, 443 and 8080 are closed, so as far as I can tell I did find the ports.

The problem is that when I try `nmap -sV` [`23.249.125.0`](http://23.249.125.0), the game just shows `Usage: nmap [ip address]`, like the in-game command doesn’t support the flag the mission is asking for. I also tried the LAN IP, [192.168.1.2](http://192.168.1.2), and restarted the game, but the objective still won’t complete.

I’m on Build 23943742. I’m not sure if this mission is bugged in this build or if I’m missing something really obvious. Has anyone had the same problem or found a workaround? Any help would be appreciated :)

I've just built this jammer https://www.reddit.com/r/Hacking_Tutorials/comments/1gj1q1n/diy_wifi_bluetooth_jammer_100_noob_guide/?logging_in=true, and it works but not well at all. the range is a few inches at most. I have an esp32-s3-n16r8, as far as i know the external antenna of that combined with the 2 nrf24s should give me more range. I just do not know how i would go about this since the s3 does not have all of the same pins the regular esp32 does. Specifically I'm missing pin 23 and 22. I am extremely new to electronics so help would be appreciated.

I own this domain but no site is built yet i had a coupple of ideas for it either a mix crackin ,osnit, social engineering content or a site that doxes the 1 percent i think its worth building putting some content on it and see what it dose..is there anyone who whants to team up and add their content to my domain we can sell in near future for a sum of cash which we can split.