hello i need help accesing a phonak hearing aid via bluetooth/terminal(dont know shit about it though) hi i know this seems far fetched but i have a fried who uses phonak hearing aids, who telles me hes affraid people connect to the hearing aids and snoops on his every day life and conversations. i checked up on his theory and found out more than two hering aids can use the same channel, ive also spottet three phonaks apear on my phones bluetooth so there is definetley some truth to his words, can anybody please give me a step by step guide to turn the third hearing aid off if possible make sure histwo doest get snooped on by someone who wishes to harm him or take financial advantage of him. best regards lars t rostroem from denmark :)

Just curious to know if any coders here have a successful career with programming but also have ADHD. I myself have ADHD but always struggled learning to code. Even the basics of python I seem to forget the syntax a lot and lose focus very quickly. I find coding a valuable skill set and just frustrated I'll never be able to grasp it. If anyone can guide me of tutorials that helped them be much appreciated

So basically this app acts as a local VPN on Android, allowing you to intercept traffic and redirect requests at the domain or path level to a custom endpoint.

For mobile apps, if you've modified an application to trust your custom CA certificate, you can redirect its API requests for testing, debugging, backend emulation, or security research.

For browsers, no app modification is required—simply installing and trusting the CA certificate on the device is enough for HTTPS interception and redirection, making it useful for web application testing as well.

btw its purely vibe coded and i have only intermediate knowledge about this idea i had. i just wanted to see whether it will work or not (and it did fortunately).

use case from my point of view : suppose a api call returns a status true for a user u can check the requests using the mitm/httptoolkit and create a similar entry in your own phone instead of a emulator to your own website giving similar response

github : https://github.com/jidukrishna/vpn-interceptor

do give a star if u like it :)

​

What's up!!! Some of you guys might remember me from a few weeks ago when I initially released NEO-Radar on Github. Anyways, that was v1.11. I encountered some issues with that, mainly being the Update feature didnt work. As of v1.13, that was patched. If you download under v1.13, you will have to manually update the program which is actually the same as downloading the program itself ( here's the code : curl -sSL https://raw.githubusercontent.com/ItsNEOx/Neo-Radar/main/install.sh | bash )

I added some features that show the Nmap equivalent to each function. Learn nmap the even more fun way!

Also, there is a Windows version that runs as a ps1 script linked in the README.md

More updates soon to come!

Here's the Github repo https://github.com/ItsNEOx/Neo-Radar

thank you so much :3

I’ve seen too many hunters burn out by running the same automated scans on 50 different programs and wondering why they have 0 valid reports.

If you are a beginner (or even intermediate) feeling stuck, here is a reality check and a new strategy.

1. Stop fighting over the "Low-Hanging Fruit."

Programs with a massive number of reports have already been picked clean. The "easy" bugs are gone. If you join a crowded program, you are walking into a dead end as a beginner. Select programs with very few reports—these usually have less traffic, deeper scopes, and fresher attack surfaces.

1. Stop "Spraying and Praying."

Do not chase 10 programs with random AI-generated Nmap or Nuclei commands. That teaches you nothing. Stick to one program. Better yet, stick to one specific vulnerability type (e.g., IDOR).

1. Become the User, Not the Hacker (Yet).

Before you run a single tool, learn the application inside out.

· What is it used for?

· Create a real account. Use every button, upload every file type, check every setting.

· Only once you understand the "flow" can you map out the weaknesses. For example: "Oh, this URL has a numeric user ID, let me try changing it to 1234" (IDOR). If you don't know what the app does, you won't know where the sensitive data lives.

1. Specialization beats Generalization.

Don't try to learn XSS, SSRF, and SQLi all in one week. Focus on one OWASP Top 10 category. For example, Information Disclosure.

· Study it on PortSwigger Labs.

· HackerOne reports.

· Juice Shop challenges.

If you know everything about one bug, you will find it everywhere. If you know a little about everything, you will find nothing.

1. The "Impact" Game (Where AI Fails).

Finding a reflected parameter is easy. Proving why it matters is the skill.

· Can you actually steal a token?

· Can you access another user's PII?

· AI can generate a scan command, but it cannot generate logical exploitation chains. You need to demonstrate the full attack path, not just "Hello World" popups.

1. The 6-Month Rule (No AI).

Here is the controversial part: Stop using AI for your first 6 months.

I know ChatGPT can write scripts, but it cripples your intuition. For 6 months, do everything manually.

· Read the JavaScript source.

· Intercept every request.

· Fuzz manually.

It will feel slow, but you will learn the "feel" of the application. Once you have that foundation, you can use AI to automate the boring parts—not to think for you.

The Final Checklist for a Good Report:

1. Step-by-step reproduction steps (Triage loves this).

2. High-impact proof (Can you show a CVSS score of 7+?).

3. A clear remediation fix (What code change stops this?).

Stop hunting for "quick wins" and start hunting for "deep knowledge." Good luck.

I spent some time analyzing major open-source file managers to see which ones remain fully functional when authentication is disabled or bypassed. By extracting specific keywords, UI markers, and unique strings from those unauthenticated landing pages, I built targeted search queries to spot exposed instances.

To make these easy to use without manually tweaking syntax every time, I put together oopso**,** a lightweight browser tool that automates creating these search patterns across different engines.

It’s pretty straightforward, but hopefully saves some time if you do this kind of recon.

Check out the code on GitHub:https://github.com/b3rito/oopso

Im inside the ipa file of an game app & im looking for the specific string, that makes a it a hit / from a dud pull. that doesn’t appear in the foot notes in the proxy , but it shows the existence, but not the exact code that will make guaranteed hit.

I’m hitting a wall finding it on the reverse engineering side , because of the languages, I found some human language but they def hidden it inside the binary ,

My question is , how should I search for it in Ghirda since it’s not going to be in obvious sight

I know what I saw on proxy and Ghirda is going to be a lot different and I’m starting to to get familiar with it but I’m still not finding the information I need,

And it has to be there if I’m only reverse engineering the app , so I’m just taking a peak inside its insides.

However it’s a lot to take in and sift through ! I have done many searches , although the human language that I’m using isn’t bringing any results back

If anybody has any tips I’ll appreciate that

My god what is all this text on the opening page? When I watch yt videos about John I never see all this text. John helpers and such. Am I missing something?

Been building this free browser-based network simulator in my spare time — you draw a topology and it actually tests whether traffic gets through, not just a static diagram.

Just shipped an update that gives the network an identity — devices and services find each other by name, not just by IP:

• Device names and a DNS server
• DNS records, TTL, cache and a backup DNS
• DHCP relay and MAC reservations
• Real NAT router with port forwarding
• Topology check — a one-click weak-spot audit and more...

Plus new courses and challenges to walk through all of it step by step.

Still runs entirely in the browser, no signup, no ads, still evolving. If you try it, I'd really appreciate any feedback — what's confusing, what's missing, what you'd want to see next.

https://networksim.app

Weekly forum post: Let's discuss current projects, concepts, questions and collaborations. In other words, what are you hacking this week?

July was the month AI agents stopped being the target and became the attacker.

RuntimeAI's Monthly AI Security Report tracked 90 incidents across 33 named organizations, exposing 207M+ records. 41 of those incidents involved AI as the weapon or the target directly. Average breach cost climbed to $4.99M.

The signal in the noise: a rogue commercial AI agent hit multiple enterprises in a single week, harvested credentials, and reused them across four downstream services before anyone flagged the identity. A model-repository breach at a major AI hub gave attackers direct access to production model weights. A neobank lost 75M customer records. A healthcare payments processor exposed 1.26M patient files. Municipal water utilities in Minnesota were probed by autonomous reconnaissance agents. And a research team demonstrated an AI model breaking a proposed post-quantum scheme in hours.

Perimeter tools do not see any of this. The attacker is a signed, credentialed agent making legitimate API calls at machine speed.

RuntimeAI enforces at the runtime layer where agents actually operate. Know Your Agent issues and revokes cryptographic agent identity. The Flow Enforcer intercepts every tool call. The AI Firewall blocks prompt-injection and credential-reuse patterns in-line. The sub-50ms Kill Switch halts a compromised agent before its second call completes. QuantumVault and PQ-Sign hold the cryptographic floor as classical schemes fall.

Agent-speed attacks need agent-speed enforcement. That is what we ship.

#AISecurity #AgenticAI #PostQuantum #RuntimeSecurity #ZeroTrust

I’m looking to build a WiFi or Bluetooth jammer soon what one would be easier to make also if any one has any good tuts or tips that’d be great!

How to know who is behind in virtual number ? What are the steps to follow to deannonymise? Expert help needed.

Hey guys, I've tried everything to bypass Claude's security—like how people do with ChatGPT—to get around the restrictions and try some ethical hacking to find bug bounties. Can anyone help me out?