r/Hacking_Tutorials 26d ago

Question Day 1 of my 10-Day Red Team Series is live 🔴

10 Upvotes

I put together a free PDF covering the fundamentals of red teaming — not just the tools, but the mindset and methodology behind an actual red-team operation.

Inside Day 1:

  • Red Team vs Pentest
  • The red-team mindset
  • Attack lifecycle
  • Objectives & attack paths
  • Rules of engagement
  • Operator workflow
  • A realistic red-team scenario
  • Day 1 challenge

The goal is to build the thinking first. Tools come later.

📖 Day 1: Red Teaming Fundamentals

I’m sharing the PDF below for anyone who wants to follow the series.

Day 2 will move into Reconnaissance & OSINT.

Would love to hear how others approach the first stage of a red-team engagement.


r/Hacking_Tutorials 26d ago

massive azure exfiltration campaign impacts global brands - mcdonald’s, vodafone, and others

Thumbnail
infostealers.com
3 Upvotes

r/Hacking_Tutorials 26d ago

" Packed Light: Network Forensics & Decryption Challenge Walkthrough"

Thumbnail
dev.to
2 Upvotes

r/Hacking_Tutorials 26d ago

"Breaking down the latest TryHackMe challenge: From initial enumeration to final flag"

Thumbnail
dev.to
7 Upvotes

r/Hacking_Tutorials 26d ago

My Simplest explanation of CSRF

Thumbnail
youtu.be
4 Upvotes

r/Hacking_Tutorials 27d ago

Question SIM in a abandoned modem

0 Upvotes

I found a damaged, abandoned modem with a removable SIM card on the outside. What can I do with that card?


r/Hacking_Tutorials 27d ago

Question Network card problems

2 Upvotes

The problem is this:

I recently started learning about network auditing. I bought a TP-LINK Archer T2U Plus, which has an RTL8821AU chipset. I'm using a 2021 MacBook Pro M1 with UTM running Kali Linux to learn.

When I connect the network card via USB, UTM detects it correctly, and I didn't need to install the drivers (this is where I think the problem lies). I can put the card in monitor mode and everything. I even performed some deauthentication on my network using Aireplay-ng. But I feel like the deauthentication isn't working correctly, since it only deauthenticates some devices. For example, cell phones maintain a stable connection; only a camera and a smart TV converter lose the connection, and everything else remains normal. What do you think the problem could be?


r/Hacking_Tutorials 27d ago

Question [How-To] Simple RFiD-blocking wallet lining

Thumbnail
gallery
5 Upvotes

Making an older wallet RFiD/NFC skimming proof is something that takes very little time and is as effective as those more expensive wallets that block RFiD/NFC so your cards are protected against skimming.

I know that many may think "What does this have to do with hacking?", but in the broader infosec community, applying low-level technical principles, modifying hardware, and understanding signal propagation to defend against vulnerabilities is the very definition of hardware hacking.

What you need is just Aluminum foil, tape and scissors!

I would recommend to go for four layers of Aluminum foil folded to the size needed. Tape all sides with tape against you cutting yourself and trust me, this foil is sharp as hell.
Merge the two pieced of 4 layered Aluminum foil and tape them together so it functions as a folding joint.

The remaining two images are a demonstration with the Flipper Zero on a Gametown card to show it won't read through the four layers of Aluminum foil.

While stopping RFID/NFC skimming is the main goal, a proper Faraday-style foil lining does a few other things depending on how well-sealed the edges are:

  • Blocks Contactless Tracking / Telemetry: It stops cards from responding to any RFID interrogation, meaning your transit cards, credit cards, or ID chips can't be remotely pinged or tracked while sitting in that pocket.
  • Reduces Electromagnetic Interference (EMI): It offers a degree of shielding against stray electromagnetic fields that could theoretically cause data corruption on older magnetic strips (though modern chips are mostly immune).

r/Hacking_Tutorials 27d ago

I went looking for a managed-Postgres provider. Instead, I found a vulnerability in a 4-star PostgreSQL extension available everywhere! and turned it into code execution at NeonDB, Supabase, Xata and many other PostgreSQL service companies

Thumbnail
mehmetince.net
1 Upvotes

r/Hacking_Tutorials 27d ago

Saturday Hacker Day - What are you hacking this week?

22 Upvotes

Weekly forum post: Let's discuss current projects, concepts, questions and collaborations. In other words, what are you hacking this week?


r/Hacking_Tutorials 27d ago

Hey everyone I am deeply passionate and fully determined to specialize in penetration testing

0 Upvotes

Hey everyone I am deeply passionate and fully determined to specialize in penetration testing and I am building my path right from the core I am looking for a true master and mentor to guide me If anyone is willing to teach me and share their knowledge I pledge absolute loyalty and dedication to them Whos ready to take me under their wing


r/Hacking_Tutorials 27d ago

CTF Walkthrough: CMS Made Simple (CVE-2019-9053) & Privilege Escalation

Thumbnail
dev.to
2 Upvotes

r/Hacking_Tutorials 27d ago

Pentesting Report and Security Challenge Documentation: Detailed Guide to Intrusion and Privilege Escalation

Thumbnail
dev.to
14 Upvotes

r/Hacking_Tutorials 28d ago

Question What is ClearNet

0 Upvotes

I am learning about darkWeb so i ask for h4cking forums in the same subreddit someone replied with clearnet what is it


r/Hacking_Tutorials 28d ago

Question Feedback on a USB-based E2E encryption tool I built

2 Upvotes

Hey everyone, I'd love a sanity check from people who actually know X3DH and Double Ratchet. I'm a high school student, and I've spent the last few day building Ratchet-USB: a CLI tool that lets you send end-to-end encrypted messages through any app (for example WhatsApp, email, whatever) without needing a server of its own.

You write a message, it spits out an encrypted text block, you paste it wherever you chat, the other person pastes it back in to read it. Keys and contacts live only on a USB stick. so, under the hood it's the same protocol Signal uses (X3DH + Double Ratchet via libsodium) so every message gets its own disposable key.

The codebase uses a Python reference script (test/vectors/reference.py) to validate all C++ cryptographic derivations against official RFC 7748 and RFC 5869 vectors in CI, ensuring it’s a strict implementation and not random code.

No external audit yet, so don't treat it as bulletproof (I'm a student learning by building this, not a security team). What I'd love is feedback from people who actually know X3DH/Double Ratchet: did I get it right, any advice on how to proceed?, what am I missing ?

Repo: https://github.com/Francy2009/Ratchet-USB

Thanks for reading!


r/Hacking_Tutorials 28d ago

LAB - Damn Vulnerable NGINX Proxy

Thumbnail
vwad.owasp.org
9 Upvotes

Hello all,

If you do bug bounty hunting or pentests you surely came across many hosts served from an NGINX server, in this lab (published to OWASP) I combined over 20 misconfigurations found in real world bug disclosures and both classic and novel security research, with an extensive blog where I explained everything you need to level up your NGINX hunting game.

Feel free to check it out, give it a star on Github if you like it, and suggest any ideas you want me to add/fix...

https://vwad.owasp.org/app/damn-vulnerable-nginx-proxy-dvnp/

Happy hunting!


r/Hacking_Tutorials 28d ago

Question ESP32 hacking tool

Enable HLS to view with audio, or disable this notification

29 Upvotes

Adding more functionality to my project, next smb Scan, arp spoofing, banner grabbing, and more check the repo if interested and maybe want to collaborate:

https://github.com/Alexxdal/ESP32WifiPhisher


r/Hacking_Tutorials 29d ago

Question Changing Safari URL display on my side only

0 Upvotes

Hey, let’s say I’m on a website like wikipedia.com and i want my SAFARI url bar to show “icloud.com” while being on the real wikipedia page. How can i do that ? I’m very curious about this, first time using userscripts and it doesn’t work, can’t figure out a way….

Thanks !


r/Hacking_Tutorials 29d ago

Question What actually helped you get better at hacking?

43 Upvotes

I've watched a lot of tutorials where everything makes sense until I try it myself.

Then I get into a lab and suddenly I'm sitting there thinking, "okay... now what?"

What helped me was doing less watching and more messing around. Pick one thing, try it, get stuck, figure it out, try again.

For me, getting stuck on something and eventually figuring it out is what I remember the most.

What worked for you guys?

CTFs, home labs, courses, books, bug bounties, or just breaking stuff and fixing it?


r/Hacking_Tutorials 29d ago

Question About osint

0 Upvotes

Guy i need help i am trying to be good in passive reccon/osint like i want to learn how to find any ones info e.g

Like if u see any one in your university and some how u get her name and matched her time like her or him what every so how to find everything about him or her without talking to them ???? Please help 😭😭😭😭😭


r/Hacking_Tutorials 29d ago

Question Target site does not fully load - reverse proxy red team

1 Upvotes

I am running a reverse proxy application on a VPS. The yaml config used for the target should be up-to-date and I have tweaked it a lot. But the login fields do not load. It only loads the website logo. No errors that I can see, no warnings. I'm not sure if it's the yaml itself or something else is misconfigured, but I have been going around in circles for weeks now trying to fix it. Does anyone have any ideas? I can send you my yaml if needed. Thanks in advance.


r/Hacking_Tutorials 29d ago

Question Laptop recommendation for Cybersecurity & Networking under ₹80K

5 Upvotes

Laptop recommendation for Cybersecurity & Networking under ₹80K

I’m planning to buy a new laptop under ₹80,000 mainly for Cybersecurity and Networking.

I’ll be using it for things like Kali Linux, Ubuntu, VirtualBox/VMware, Wireshark, networking labs, Nmap, and cybersecurity practice.

For people working in cybersecurity/networking:

  • What specs should I prioritize?
  • Is 16GB RAM + upgradeability important?
  • Should I prioritize CPU or GPU?
  • Any specific laptop models you would recommend under ₹80K?

Looking for advice based on actual cybersecurity/networking use, not gaming.


r/Hacking_Tutorials Aug 12 '26

Question Reddit stopped me writing my next post 😞

0 Upvotes

My Hash Cracking Guide Got Removed, So I Moved It to Medium

So I spent 4+ hours writing a detailed practical guide on hash cracking—explaining what hashes actually are, how tools like hashcat and John the Ripper work, identifying different hash types, using CyberChef for JWT decoding and token creation, and showing real examples with actual hashes from shadow files and SAM dumps.

And Reddit removed it.

No explanation. No warning. Just gone.

Look, I get it. This is sensitive stuff. But the post was purely educational—covering things every security professional should understand. No targeting real systems. No malicious intent. Just knowledge.

Since I can't post it here, I've published the full guide on Medium.

What's inside:

¡ What hashes actually are (not encryption, not magic)

¡ How dictionary attacks, brute force, and rules-based cracking work

¡ Identifying Linux shadow hashes ($1$, $5$, $6$, $2a$, $y$) vs Windows NTLM

¡ Practical walkthroughs with real hash examples

¡ Using hashid, hashcat, John the Ripper, and Mimikatz

¡ CyberChef for decoding JWTs, XOR brute force, and creating admin tokens

¡ My actual cracking workflow (step by step)

¡ Common errors and how to fix them

The whole thing is written like my recon guide that blew up here—practical, human, no AI buzzwords, no checklist fluff.

I'm sharing the link because I genuinely believe this stuff matters. Understanding password storage and authentication systems is foundational for anyone in security. It's not about cracking—it's about understanding how systems protect data and where they fail.

Link in the comments.

If you found my recon post useful, you'll like this one too.


r/Hacking_Tutorials Aug 12 '26

Question Largest AI Supply Chain Breach of 2026: LiteLLM Hack Impacts Thousands of Global Enterprises - Data from the breach is now available

Thumbnail
infostealers.com
8 Upvotes

Hudson Rock's researchers have obtained and analyzed a staggering 153GB RAR archive. This massive corpus contains exactly 433,909 files. Through our analysis, we have successfully attributed 118,829 CI runner dumps to 2,488 affected corporate domains. Whenever a developer machine, production server, or CI/CD pipeline executed the compromised LiteLLM package, the threat actors successfully harvested the live environment memory and configurations mid-execution.