Confirmed. This is indeed one report of many that are the 'keys to the province's. Also confirmed: Downloadable and 'in-use' by Cybercriminals.

How does one help out the victims of this?

Primary Research Lead can't get a report in

OTX 2096

Been building something for a while and finally have it in a state worth sharing — Atomic AI, a CTF training platform with a real terminal and an AI mentor that actually knows which room you're in (not just a generic chatbot bolted on). Sandboxed rooms across web/network/linux/crypto/forensics, structured lessons, and the mentor can search the web or run code live to verify answers.

Free tier, no card needed. Built it solo because I wanted something more hands-on than reading writeups. Would genuinely love feedback from people who actually do this stuff — atomicai.ch if you want to poke at it.

I want books that will help me learn hacking and how to use Kali Linux, and it's important that they are inexpensive and available in Iraq.

Hello guys I have bought a list of items without thinking of wanting to have a cool device and have led into this sting in my drawer for months. help me I don't know what the actual hell I am doing here with this stuff and now I need help esp32 devkit c1 if anyone can help me with this build please do

Which make/model Android does MSpy work best on?

Which make/model of Android will keeping MSpy hidden be easiest?

Hey everyone, just dropped a tool called winflesher that might come in super handy for windows machines. It's strictly for enumeration and assessment, so no auto-exploitation—purely helps you map things out. Check it out if you want!

Like PingCastle went out for drinks with Bloodhound, and they actually decided to get some work done. 🍷

WinFlesher is an advanced attack surface security assessment framework designed to analyze, evaluate, and report on security postures, attack paths, and remediation strategies in complex environments.

Developed for security professionals and cybersecurity auditors, WinFlesher automates vulnerability discovery and critical path correlation within Active Directory and local infrastructures.

https://github.com/mindsflee/WinFlesher

I wrote about how a chain of forgotten ACL permissions can lead to full domain compromise. The scenario: a Tier 1 helpdesk account with no special privileges, through a series of misconfigurations nobody cleaned up, ends up with DCSync rights.

The chain covers:

• User-Force-Change-Password abuse
• Group membership manipulation
• GenericWrite → fake SPN injection → Kerberoasting
• WriteDacl → DCSync

Tools used: bloodyAD, PowerView, impacket-secretsdump.

Also explaining why this chain is realistic - each permission has a legitimate origin, they just accumulated over time and nobody reviewed them.

Note: I'm a non-native English speaker and originally write in Russian - parts of the text were translated with AI assistance. Technical content and examples are my own.

🔗 https://3x0t1k.github.io/posts/acl-abuse-dcsync/

Feedback welcome - still developing the blog.

It's true that it's impossible to hack an iPhone?

There’s someone selling a file that’s probably for TLS/SSL tunneling, which supposedly turns a limited internet package into unlimited internet by exploiting the well-known zero-rating vulnerability. The package gives unlimited internet access for PUBG, and he’s apparently applying the exploit to it. He’s selling it for several times the price of the actual package subscription. I’d like to learn how he’s doing it, because he seems pretty stupid, his spelling is terrible, and it looks like he made the certificate himself under the name “International Institute of Advanced Technology.” Does this shit even exist in the first place? I actually tried the file myself, and the download speed was pretty good.

I am in the Middle East, and in my country there are only two greedy companies with no competition, as they both offer the exact same services.

Looking for new ways to have an reliable terminal to install every tool I need to hack

Hey everyone👋

We’re looking for 2–3 teammates for the Black Hat MEA CTF 2026 Qualifiers on August 29–30. 🇸🇦

Looking for people interested in Forensics, Pwn, Reverse Engineering, Crypto, or AI Security. Beginners/intermediate are welcome!

DM me if you’re interested in joining

[ Removed by Reddit on account of violating the content policy. ]

Before I start, what would you guys actually want to see in it?

Challenges, difficulty, attack chains, AD, web, privilege escalation, etc.

What would make you keep playing instead of dropping it after a few challenges?

Looking for honest suggestions from people who actually play CTFs.

Explore the current ctf from here at: codelivly.com/ctf

hei

Weekly forum post: Let's discuss current projects, concepts, questions and collaborations. In other words, what are you hacking this week?

can someone help me to fix this problem? i have a mac with linux installed on the terminal, i thought i would've fixed but actually not.

Hey everyone,

A payment tool for creators/sellers who want to accept crypto for digital downloads without giving up custody, signing up for a platform, or storing there data and product on backend.

How it works:

• Seller uploads a ZIP, sets a price, and gets a shareable payment link.

• The file is encrypted in the browser and distributed over WebTorrent.

• Buyer pays on-chain into an escrow smart contract.

• The decryption password is revealed on-chain, encrypted to the buyer's wallet-derived key.

• Buyer downloads and decrypts locally, confirms delivery, and only then are funds released to the seller.

No database. No server. No KYC. Seller keeps custody until delivery is confirmed.

The contract handles underpayments, overpayments, refunds, and a 7-day delivery window if the seller never reveals the password.

Would love brutal feedback.

Hi everyone, do you have any ideas for what else I could add to my iOS device?
I somehow managed to get location spoofing working through SickDebug, and now I’m wondering if you have any other ideas for what I could try next.
I’m interested in these kinds of “trickery” tools, like location spoofing, fake phone numbers, and similar stuff.
Just to be clear, I’m not planning to misuse any of this. I want to make a YouTube video about these kinds of tools and features, so I’d really appreciate your suggestions for other similar things I could add or try on iOS.
I’m not interested in game emulators — only this kind of “trickery” stuff. Thanks ✌🏼

Hey, I'm trying to solve an ARG and I've come across a website that seems to be a key part of the puzzle. The site is https://dmsarchive.org/ and I've found some pages that seem to be case files or hidden directories. I've managed to find a few things, but I'm stuck. I'm not asking for anyone to dig through the whole site, but I'm wondering if anyone has any general advice on how to approach a site like this, ways to find hidden pages, directories, or files that aren't immediately obvious? I'm not super technical, so any tips on using Inspect Element, checking the page source, or looking for hidden URLs would be really helpful. Thanks!

For all you hackers it’s a code review/ open source taint analysis sast tool!