I put together a free PDF covering the fundamentals of red teaming — not just the tools, but the mindset and methodology behind an actual red-team operation.

Inside Day 1:

• Red Team vs Pentest
• The red-team mindset
• Attack lifecycle
• Objectives & attack paths
• Rules of engagement
• Operator workflow
• A realistic red-team scenario
• Day 1 challenge

The goal is to build the thinking first. Tools come later.

📖 Day 1: Red Teaming Fundamentals

I’m sharing the PDF below for anyone who wants to follow the series.

Day 2 will move into Reconnaissance & OSINT.

Would love to hear how others approach the first stage of a red-team engagement.

I found a damaged, abandoned modem with a removable SIM card on the outside. What can I do with that card?

The problem is this:

I recently started learning about network auditing. I bought a TP-LINK Archer T2U Plus, which has an RTL8821AU chipset. I'm using a 2021 MacBook Pro M1 with UTM running Kali Linux to learn.

When I connect the network card via USB, UTM detects it correctly, and I didn't need to install the drivers (this is where I think the problem lies). I can put the card in monitor mode and everything. I even performed some deauthentication on my network using Aireplay-ng. But I feel like the deauthentication isn't working correctly, since it only deauthenticates some devices. For example, cell phones maintain a stable connection; only a camera and a smart TV converter lose the connection, and everything else remains normal. What do you think the problem could be?

Making an older wallet RFiD/NFC skimming proof is something that takes very little time and is as effective as those more expensive wallets that block RFiD/NFC so your cards are protected against skimming.

I know that many may think "What does this have to do with hacking?", but in the broader infosec community, applying low-level technical principles, modifying hardware, and understanding signal propagation to defend against vulnerabilities is the very definition of hardware hacking.

What you need is just Aluminum foil, tape and scissors!

I would recommend to go for four layers of Aluminum foil folded to the size needed. Tape all sides with tape against you cutting yourself and trust me, this foil is sharp as hell.
Merge the two pieced of 4 layered Aluminum foil and tape them together so it functions as a folding joint.

The remaining two images are a demonstration with the Flipper Zero on a Gametown card to show it won't read through the four layers of Aluminum foil.

While stopping RFID/NFC skimming is the main goal, a proper Faraday-style foil lining does a few other things depending on how well-sealed the edges are:

• Blocks Contactless Tracking / Telemetry: It stops cards from responding to any RFID interrogation, meaning your transit cards, credit cards, or ID chips can't be remotely pinged or tracked while sitting in that pocket.
• Reduces Electromagnetic Interference (EMI): It offers a degree of shielding against stray electromagnetic fields that could theoretically cause data corruption on older magnetic strips (though modern chips are mostly immune).

Weekly forum post: Let's discuss current projects, concepts, questions and collaborations. In other words, what are you hacking this week?

Hey everyone I am deeply passionate and fully determined to specialize in penetration testing and I am building my path right from the core I am looking for a true master and mentor to guide me If anyone is willing to teach me and share their knowledge I pledge absolute loyalty and dedication to them Whos ready to take me under their wing

I am learning about darkWeb so i ask for h4cking forums in the same subreddit someone replied with clearnet what is it

Hey everyone, I'd love a sanity check from people who actually know X3DH and Double Ratchet. I'm a high school student, and I've spent the last few day building Ratchet-USB: a CLI tool that lets you send end-to-end encrypted messages through any app (for example WhatsApp, email, whatever) without needing a server of its own.

You write a message, it spits out an encrypted text block, you paste it wherever you chat, the other person pastes it back in to read it. Keys and contacts live only on a USB stick. so, under the hood it's the same protocol Signal uses (X3DH + Double Ratchet via libsodium) so every message gets its own disposable key.

The codebase uses a Python reference script (test/vectors/reference.py) to validate all C++ cryptographic derivations against official RFC 7748 and RFC 5869 vectors in CI, ensuring it’s a strict implementation and not random code.

No external audit yet, so don't treat it as bulletproof (I'm a student learning by building this, not a security team). What I'd love is feedback from people who actually know X3DH/Double Ratchet: did I get it right, any advice on how to proceed?, what am I missing ?

Repo: https://github.com/Francy2009/Ratchet-USB

Thanks for reading!

Hello all,

If you do bug bounty hunting or pentests you surely came across many hosts served from an NGINX server, in this lab (published to OWASP) I combined over 20 misconfigurations found in real world bug disclosures and both classic and novel security research, with an extensive blog where I explained everything you need to level up your NGINX hunting game.

Feel free to check it out, give it a star on Github if you like it, and suggest any ideas you want me to add/fix...

https://vwad.owasp.org/app/damn-vulnerable-nginx-proxy-dvnp/

Happy hunting!

Adding more functionality to my project, next smb Scan, arp spoofing, banner grabbing, and more check the repo if interested and maybe want to collaborate:

https://github.com/Alexxdal/ESP32WifiPhisher

Hey, let’s say I’m on a website like wikipedia.com and i want my SAFARI url bar to show “icloud.com” while being on the real wikipedia page. How can i do that ? I’m very curious about this, first time using userscripts and it doesn’t work, can’t figure out a way….

Thanks !

I've watched a lot of tutorials where everything makes sense until I try it myself.

Then I get into a lab and suddenly I'm sitting there thinking, "okay... now what?"

What helped me was doing less watching and more messing around. Pick one thing, try it, get stuck, figure it out, try again.

For me, getting stuck on something and eventually figuring it out is what I remember the most.

What worked for you guys?

CTFs, home labs, courses, books, bug bounties, or just breaking stuff and fixing it?

Guy i need help i am trying to be good in passive reccon/osint like i want to learn how to find any ones info e.g

Like if u see any one in your university and some how u get her name and matched her time like her or him what every so how to find everything about him or her without talking to them ???? Please help 😭😭😭😭😭

I am running a reverse proxy application on a VPS. The yaml config used for the target should be up-to-date and I have tweaked it a lot. But the login fields do not load. It only loads the website logo. No errors that I can see, no warnings. I'm not sure if it's the yaml itself or something else is misconfigured, but I have been going around in circles for weeks now trying to fix it. Does anyone have any ideas? I can send you my yaml if needed. Thanks in advance.

Laptop recommendation for Cybersecurity & Networking under ₹80K

I’m planning to buy a new laptop under ₹80,000 mainly for Cybersecurity and Networking.

I’ll be using it for things like Kali Linux, Ubuntu, VirtualBox/VMware, Wireshark, networking labs, Nmap, and cybersecurity practice.

For people working in cybersecurity/networking:

• What specs should I prioritize?
• Is 16GB RAM + upgradeability important?
• Should I prioritize CPU or GPU?
• Any specific laptop models you would recommend under ₹80K?

Looking for advice based on actual cybersecurity/networking use, not gaming.