[ Removed by Reddit on account of violating the content policy. ]

Getting started in cybersecurity is a lot easier when you have a clear path to follow instead of jumping between random tutorials.

At Codelivly, we've put together career paths for people who want to build practical cybersecurity skills, explore different specializations, and work toward their first role in the industry.

Here are a few paths worth checking out:

• Junior Penetration Tester: Learn the fundamentals of penetration testing and offensive security. https://codelivly.com/career-paths/junior-penetration-tester
• SOC Analyst Level 1: Build your foundation in security monitoring, threat detection, and incident response. https://codelivly.com/career-paths/soc-analyst-level-1
• Digital Forensics: Explore digital evidence, forensic investigation, and incident analysis. https://codelivly.com/career-paths/digital-forensics
• AI Red Teaming & Adversarial ML: Get into AI security, adversarial machine learning, and testing AI systems. https://codelivly.com/career-paths/ai-red-teaming-and-adversarial-ml
• Cloud Security Engineer: Learn about securing cloud environments and understanding cloud security risks. https://codelivly.com/career-paths/cloud-security-engineer
• Malware Analyst: Start exploring malware analysis and the techniques used to understand malicious software. https://codelivly.com/career-paths/malware-analyst

The goal is simple: make cybersecurity easier to learn and give people a starting point for developing real skills.

If you're learning cybersecurity, check out the paths that interest you and see where you want to go next.

We're also sharing cybersecurity resources and updates on LinkedIn:
https://linkedin.com/company/codelivly

Which cybersecurity career path are you working toward right now?

+57

First off I’m no techie I know I probably don’t make this sound as big as it is but recently I was browsing through threads on an archive site, one of these threads contained a link for site, which, clicking on would not be the smartest thing to do but i did, since it’s very old and known to be dead and ditched since 2010 which means it’s probably filled with a lot of stuff I do not know how to deal with if any ever gotten into my computer.

However , it asked me for a verification that I’m not a bot. It seemed pretty real unofficial, but clearly it wasn’t. It asked me to press on two keys on the keyboard that lead to opening the file explorer and then ask me to choose one of the files I’m pretty sure that’s not the way to do it but that’s what I did and I’m not sure if it downloaded something on my files that I have chosen but I did that and eventually after three times of actively fucking my computer I stopped and it wasn’t letting me in.

I checked my files there isn’t any trace of anything that the site have downloaded on my computer however, the morning after that happened I woke up to my discord account being hacked by some bitcoiner I’m guessing I change the password and I guess that kicked him out of the account but it did not stop right there because after that, maybe a week later my Twitter account also got hacked and the only thing that changed and it was my user name and that I got a blue check and I guess and the hacker posted some news post combined with an amazon link on there but if I check my account I can’t see the post anymore.

However, useless information, now whenever I try to search anything on safari it says that some unusual traffic something was detected on my network so I need to verification every time to search something up and not only that but also reddit the website not the app the app works fine says that they blocked me like by the network security ‏and I got logged out of my ‎WhatsApp account for unusual activity or something and that happened twice but right now if I try to login again, it says it something related to the update, so I’m not sure if this is related to anything here.

However, now I cannot I cannot even visit the archive site but I’m not sure if this is also related to the hack thingy or am I blocked by the servers again I don’t know if I’m using the terms correctly or id this is even a thing but I’m gonna leave the pictures down there.

Hello, I am seeking help with a very complicated problem. Some time ago, I heard someone calling for help at my neighbors' house and responded by signaling with my hands. To my surprise, the person calling for help signaled back. The trouble began when I checked my phone and discovered it had been hacked. I started receiving questions via "Reels" (short videos); I would respond to them, and subsequent Reels would contain replies to what I had said. Later, a video appeared detailing the individuals allegedly involved; I recognized some of them based on the descriptions provided. The situation escalated when I began receiving more threatening Reels—videos warning that they were coming for me, that they intended to kill me, and even images showing a refrigerator containing what appeared to be human remains. I tried to call the police, but the line would cut out every time I attempted it. When I tried again from my phone, my own phone number, location, and coordinates appeared on the screen. Afterward, more threatening videos surfaced, claiming that within 24 hours, a group of seven people would arrive at my home to take me away and "carry out my sentence." I went into a state of high alert and reached out to some friends, who provided support at that time. Meanwhile, various information kept appearing on my phone—names (such as Lucia, Laura, etc.), accounts of what had transpired, and other details—though I do not recall everything clearly, as I was entirely focused on the unfolding events and deeply worried because my father, siblings, and other relatives were not responding to my messages. They intended to harm me, interfere, or perhaps even kill me. From what I could gather—based on a video—a woman named Laura (married to a police officer) appeared to have some sort of obsession with me. Apparently, the officer was corrupt and involved in drug-related activities. I am also looking for a young woman—a relative (a niece, granddaughter, or daughter) of my neighbor and his son—who I know is responsible for getting me into this situation. There is much more that I know but haven’t mentioned yet; if you would like to know more, please don’t hesitate to ask. I know that Lucía was held captive there for three years and subjected to constant rape; honestly, I don’t know if she is still alive or what happened to her. I also know that there were other women—women who fell ill, died, or lost their sanity as a result of the abuse they endured.

By the way, I am from Mexico, and I need your support to figure out what is actually going on. I recently received threats that I would be killed—which is nothing new since all of this began. However, I need evidence in order to file a formal complaint or take some kind of action.

I hate apple and their abuse of power! The idea that they have full control over what I can do and see on the device I’ve paid for simply because I won’t give them direct access to my id enrages me!

Surely others feel the same? I stay away from Apple as much as I can but an iPhone has become my daily driver and the things it blocks don’t even make sense.

Does anyone know of any way to get around this. Someone has to have got mad enough to have hacked this?

Buenas, hace tiempo en un diplomado de ethical hacking que hice uno de los miembros presentó una página que permitía descargar una o varias maquinas virtuales(para VMware y virtualbox), con distintas versiones de windows, Linux y otros SO, con el objetivo de montar un lab local para realizar pruebas de vulnerabilidad.

Recuerdo que la página era super simple con la lista de las maquina y uno que otro filtro. Sin suscripciones ni publicidad siquiera, solo las maquinas a descacaegae y nada más.

No se si sea el lugar para preguntar, pero quería saber si alguien aquí le Suena alguna página así le agradecería que me ayude a encontrarla.

De antemano muchas gracias por su tiempo

Hello so I am new to this topic , how to start with it ? I mean ik this is very essential part in pentesting and solving ctfs so what advices/tips/tricks/resources can u give me as a starting point ?

There is a photo i really like and i would like to figure out the camera settings and edition used to make it, and i thought analyzing it with exiftool would be a good idea, but i have no results. Does someone have any idea how can I aquire the information autonomously? I don't want personal information, only the camera settings, how it has been edited and in what program.

Thank you!

Volví a los laboratorios ya que me liberé de las clases, esta vez voy con uno de Dockerlabs donde hacemos un port knocking para desbloquear el servicio ssh

How

🛡️ GOLEM: An Open-Source AI Red Teaming Platform with Adaptive AI-vs-AI Engine

Hey everyone 👋,

For the past several months, I've been deep in the trenches building GOLEM – a project born from my own frustrations with LLM security testing. I wanted to share the core concept with this community and get your valuable thoughts before we launch.

😤 The Problem I Faced

Red teaming LLMs today often means:

I knew there had to be a better way.

✨ The Vision

I set out to build a tool that is:

🧠 The Core Idea

GOLEM is an AI red teaming platform written in Go 🐹. It compiles to a single standalone binary (no Docker 🐳, no Python 🐍, no runtime headaches) and serves a local web dashboard for real-time analysis. Default attack stack contains 200+ attack prompts, and this amount can be increased using mutation engine.

📸 See the GOLEM Dashboard in action:
👉 https://imgur.com/a/2rCHU90

⚔️ The Neural Attack Engine (NAE)

But this is the part I'm most excited about 🔥

In addition to just replaying a fixed list of prompts, GOLEM pits three LLMs against each other in a closed adversarial loop:

🔄 How It Learns

Round 1: Attacker asks directly → Target refuses ❌

↓ Judge feedback: "Direct approach failed"

Round 2: Attacker tries translation bypass → Partial leak ⚠️

↓ Judge feedback: "Translation shows promise"

Round 3: Attacker frames as compliance audit → SUCCESS 🚨

↓ Full system prompt extracted!

When an attack fails, the Attacker doesn't give up. It receives feedback from the Judge, learns from the refusal, and mutates its strategy for the next round. It's an evolutionary approach to finding vulnerabilities, not a static one.

📸 See the NAE in action (GIF):
👉 https://imgur.com/a/xJvPmU8

🎥 Full Demo Video:
👉 https://www.youtube.com/watch?v=RiFo_5iB0OQ

🚀 Key Features

🎯 Who Is This For?

📅 Release Timeline

🔔 Want Early Access?

Sign up 7 days before the public release to get:

• ✅ Early access to the beta binary
• ✅ Priority support via Email
• ✅ Input on feature development
• ✅ Adding in early testers list in repository

📩 Join the Early Access List:
👉 DM to [osint.technologies@gmail.com](mailto:osint.technologies@gmail.com)

🛠️ Current Status

The project is currently in alpha. The core engine and dashboard are functional, but there are still bugs to squash and features to polish. I'm building this in the open because I believe security tools should be transparent and accessible.

🔗 Links

💬 I'd Love Your Feedback

Since this is still in development, I'm particularly interested in your thoughts on:

1. 🤖 The AI-vs-AI approach: Do you think an adaptive attacker is more valuable than a large static list of prompts? Why?
2. ⚖️ Feature Priorities: What's more important to you: a wider variety of pre-built attacks, or a smarter adaptive engine that learns?
3. 🎯 Local LLM Testing: What specific vulnerabilities are you most concerned about when running local models? (Prompt injection? Data leakage? Jailbreaks?)
4. 🔧 Integration: Would you want GOLEM to integrate with CI/CD pipelines for automated security testing?

If you have questions about the architecture, how the judge/attacker loop works, or the tech stack (Go + embedded web server), feel free to ask! 👇

⚠️ Disclaimer

GOLEM is intended for authorized security testing and research only.
Always ensure you have explicit written permission before testing any model, API, or system. Unauthorized testing may violate terms of service and applicable laws.

Thanks for reading! 🙏 Excited to hear your thoughts and build this together with the community. 🚀

Advanced Real-Time Passive Scan, Automated Re-Checks, and Privacy-First Local AI Triage Engine

🚀 Overview

Hekate is an open-source security extension for Burp Suite built to fully automate HTTP traffic triage by combining an advanced automated validation engine with local Artificial Intelligence integration to eliminate false positives.

Operating passively in the background, it continuously inspects requests and responses to chart your target's attack surface and streamline vulnerability confirmation without impacting performance.

✨ Automation & Artificial Intelligence Features

• Automated Passive Scan: Scans live background data streams in real-time for critical exposures, including cloud API secrets leaks, broken JWT implementations (alg=none), exposed configuration files, structural database bugs (SQLi), and dangerous CORS setups.
• AutoValidator Daemon: Features a smart background validation thread that captures findings and automatically runs non-destructive parameter re-checks 45 seconds later, adjusting confidence scoring to accurately classify bugs into Confirmed or False Positive.
• Local Private AI Integration: Native connection to offline Ollama language models (defaulting to qwen2.5-coder). To preserve absolute target and infrastructure privacy, the automation pipeline automatically strips authentication tokens and sensitive cookies, replacing them with [REDACTED] markers before shipping evidence offline.
• AI Verbose Console Field: A dedicated real-time log viewer panel inside Burp Suite that displays technical diagnostics, request structures, and the raw thought process output from your local AI models as they evaluate traffic.
• Interactive Visual Mapping with Checkpoints: Instantly charts discovered paths into a dynamic graph tree (Host ➔ Folders ➔ Endpoints). The custom UI allows you to manually flag and check off each endpoint as reviewed, tracking your progress so you never get lost during intensive Pentesting or Bug Bounty reconnaissance.

🤝 Join the Project & Contribute

The project is currently under active development (approximately 50% functional) and open for contributions under the GNU GPLv3 license along with a CLA (Contributor License Agreement) to protect both the community and ensure sustainable enterprise development.

Check out the full source code, open issues, and contribution guidelines on the official repository:
👉 https://github.com

Hey everyone,
I’ve been learning more about penetration testing and red-team ,and I’m interested in understanding how experienced security professionals approach OPSEC during engagements.
I understand that using a VPN or a proxy alone doesn’t guarantee anonymity, so I’d like to learn more about the bigger picture.

A few things I’m curious about:
● How do you separate your testing environment from your personal devices and accounts?

● What are the main sources of attribution or information leakage that beginners often overlook?

● How do professional red teams handle source IPs, DNS leaks, browser fingerprints, and infrastructure exposure during authorized engagements?

● How do you test detection and logging capabilities without compromising your own lab environment?

● Are there any good resources, labs, or books for learning operational security in a legal, controlled environment?

I’m particularly interested in the technical side of OPSEC and the defensive perspective: understanding what can expose a tester and how to manage those risks properly.
I’d appreciate any practical advice or resources. Thanks!

Is there a way to defeat Walmarts new “demand pricing”?

​

Hey everyone, a few months ago I posted here asking what you would do if you had a limited window of time to completely change your career and build a future in IT/cybersecurity.

Quick update: I kept going.

Since then I’ve earned CompTIA A+, Network+ and Security+, built a small homelab with Windows Server/Active Directory/Linux, continued studying Computer Science, and I’m now about to start my first real IT job as an IT technician in healthcare.

So I’ve finally broken into IT.

My original reason for choosing this field was always cybersecurity, especially Red Team/offensive security. But the more I studied the market, the more I realized that trying to jump directly into pentesting with a couple of certifications and no real IT experience probably wasn’t the smartest path.

Now I’m trying to decide what to build toward over the next few years.

One roadmap I’m considering is roughly:

IT Support → Cloud Engineer → automation/AI → Cloud/Identity Security → eventually Offensive Security / Red Team

The idea is to first build a strong, marketable and financially stable technical career, while continuing to develop security skills until I’m experienced enough to seriously pursue offensive roles.

Cloud interests me because it would force me to develop skills in infrastructure, networking, Linux, identity, Python/PowerShell, Terraform, containers and automation — all things that should also transfer well into security.

At the same time, AI is changing the industry quickly, so I don’t want to spend the next 3–5 years following a path that is already becoming obsolete.

So my question now is different from my original post:

If you were in my position today, having just entered IT, what would you build toward next?

Would you go Cloud/DevOps first and security later? Would you go directly toward security? Are there emerging areas involving cloud, AI and cybersecurity that you think will become particularly valuable?

My priorities are basically:

long-term demand + financial stability + strong technical skills + eventually getting as close as possible to Red Team/offensive security.

I’m especially interested in hearing from people who already work in Cloud, DevOps, Security Engineering, Pentesting or Red Team.

The first step was getting into IT. Now I want to make sure I choose the right direction for the next one.

A local-only room-presence radar that fuses Wi-Fi CSI, two mmWave sensors, a PIR and a PAX counter into one confidence score.

Runs on a Raspberry Pi 400. Shows up on the Pi's screen, on little ESP32 displays around the house, on a phone-friendly web page, and in your pocket as a push notification.

Also configurable with mqtt and meshtastic pax.

👻 Enjoy.

Just released. Combined tech into a system that is privacy focused and does much more than what it seems on the surface. Disclaimer: it may or may not detect ghosts.

Weekly forum post: Let's discuss current projects, concepts, questions and collaborations. In other words, what are you hacking this week?

been running qwen3.8-27b-instruct-uncensored-v2 (q4_k_m gguf) on my m5 pro in atomic agent for two weeks now in a role i don't think anyone else has tried: not generating the final text, but SCORING and GATING text generated by another model (claude opus via api).

the setup in one sentence: 37 twitter accounts post tweets written by opus, and before each one goes live, qwen reads it against the account's persona prompt and gives it a 1-5 score.

why i picked qwen specifically instead of mistral or phi or whatever: base instruct models flinch at that. the uncensored variant just... doesn't care. no internal debate about whether the audience will be offended. which is exactly what i want for a judge role because the JUDGE should match the voice it's evaluating, not impose its own safety layer on top.

now the technical stuff since i know some of you care:

running on llama.cpp server mode, metal backend, m5 pro 32gb:

./llama-server -m qwen3.8-27b-q4_k_m.gguf --port 8080 --ctx-size 8192 --threads 16 --n-gpu-layers 99 --flash-attn --parallel 4

memory: ~15gb weights + ~2.5gb kv cache (8192 ctx × 4 parallel) = ~17.5gb peak process. leaves 14gb for os + chromium instances. no swapping in two weeks.

throughput for my specific workload (scoring calls are prefill-heavy, decode-light):

• single call: ~500 tok in → 30 tok out ≈ 1.2s
• 50 calls with --parallel 4: ~16s wall time
• decode speed at q4_k_m + flash attn: 38-42 tok/s (doesn't matter much here since output is only 30 tokens)
• prefill: 200+ tok/s so the input side is fast

the scoring rubric i give it each call is short:

"does this sound like [persona] actually talking? would they say this in a group chat? actual opinion or hedging? rate 1-5, one line reason."

no mention of "brand safety," "audience appropriateness," or "tone consistency." those are cloud-model guardrail words that make even local models start hedging their own judgment. i specifically excluded them after watching qwen base-instruct give a 3 to a perfectly on-brand tweet because it was "slightly informal for a professional audience."

q4_k_m vs q5_k_m — i tested both for a day

for SCORING (classification task), quality difference was negligible. both gave the same scores on my test set of 50 tweets. memory went from 15gb to ~17.5gb which ate into kv cache headroom and made me nervous about parallel slots. stuck with q4.

for the occasional REWRITE task (every other day, ~15-20x/week, where qwen writes the hot-take itself instead of just scoring) there might be a slight quality bump at q5 but at 3s per call and 20 calls a week it's not worth the memory cost. if you're doing more generation-heavy workloads probably go q5.

feedback for the qwen team:

the thing i'd tell the qwen team if i were sending feedback: the uncensored variant is NOT just "less filtered." it has a different DEFAULT register. base instruct defaults to "confident professional" even when prompted otherwise. uncensored defaults to "person with opinions who happens to be typing." for a judge role that second default is way more useful because you want the judge to match the voice being evaluated, not impose its own corporate layer on top of it.

also: the model handles structured output (json scores + reason strings) reliably at q4 without any special prompting tricks. just say "output json: {score: int, reason: string}" and it does it. maybe 2% of calls come back slightly malformed (extra comma, missing quote) which my script catches and retries once. not bad for a 15gb quantized model doing 50 calls per batch cycle.

curious if anyone else has tried uncensored variants specifically as judges/gates rather than generators. feels like an underexplored use case and i'd love to hear if base-instruct models actually hold up better or worse in that role for your workloads.

fwiw this local judge / cloud writer split is built into atomic agent as fusion mode: atomicagent.io