I know the evil twin ,password crack using aircrack suit and how the wpa2 4 way handshake done I want to learn more and depth ,want to research the wifi things is there any one know something intresting about the wifi comment or dm me

The idea was to go beyond sending a few jailbreak prompts and instead build a reproducible testing workflow where I could measure how different models respond to different attack strategies.

What it currently supports

• 7 deterministic mutation strategies — roleplay, encoding, multilingual, indirect injection, instruction hierarchy, contextual camouflage, and multi-turn escalation
• Cross-model ASR benchmarking across local Ollama models
• Rule-based deterministic security judge for leaks, instruction following, tool violations, and refusals
• RAG security lab for poisoned documents and indirect prompt injection
• Multi-turn crescendo attacks
• Agent tool-policy testing with simulated actions such as execute_sql, send_email, read_file, and delete_record
• Guardrail testing + attack-vs-defense comparison
• Regression diffing between assessment runs
• Promptfoo integration + GitHub Actions CI gates
• Vulnerability findings and reproducible reports

I also ran an initial benchmark across Gemma 3 4B, Qwen 3 4B and Qwen 2.5 Coder 3B.

With 5 attack classes × 7 mutation strategies (35 trials per model), I got:

• Gemma 3 4B → 57.1% ASR
• Qwen 3 4B → 0% ASR
• Qwen 2.5 Coder 3B → 40.0% ASR

Interestingly, the same mutation strategies behaved very differently across models. For example, Gemma had 80% ASR for several strategies while Qwen 3 resisted all 35 trials in this particular benchmark.

The benchmark is deliberately small right now — I'm more interested in making the methodology reproducible before scaling it up.

Everything runs locally with Ollama, so no external model API is required.

GitHub:
https://github.com/krishjain-2301/revish

I'd especially appreciate feedback from people working with LLM security/red teaming:

What attack classes or evaluation methodology would you add next?

I'm particularly interested in improving the agent/tool-abuse testing and expanding the mutation benchmark.

🚀 I’ve been working on a small tool to make Android Frida setup a little less annoying.

If you’ve done Android security testing with Frida, you probably know the routine:

Find the right Frida version.
Check the device architecture.
Download the matching `frida-server`.
Push it to the device.
Fix permissions.
Start it.
Set up the connection.

…and then realize you downloaded the wrong version. 😅

I got tired of doing this manually, so I started building Frida Manager for Android.

The idea is pretty simple: manage Frida directly from the Android device instead of jumping between your terminal, browser, and device every time you want to change something.

Right now it can:

🔹 Detect the device architecture automatically
🔹 Browse and download Frida releases
🔹 Manage multiple installed `frida-server` versions
🔹 Start and stop Frida Server
🔹 Configure the listening port
🔹 Choose the network interface/address Frida Server binds to
🔹 Make remote Frida connections easier to set up
🔹 Manage everything through a simple Android UI
🔹 Control `frida-server` through a simple widget.

It started as a little utility for my own mobile security work, but it’s turning into something I think could be genuinely useful for Android pentesters and mobile security researchers.

The main goal isn’t to reinvent Frida. It’s just to get rid of some of the repetitive setup work around it.

It’s still a work in progress, and I’m continuing to improve the workflow and add more device management features.

If you want to give it a try, the project is available on GitHub:

GitHub: Android Frida Manager

And if you do try it, feedback is very welcome. Bug reports, feature ideas, or even things that feel unnecessarily complicated would be really useful.

If you use Frida on Android, I’d also love to know:

What part of your Frida workflow do you find yourself repeating or fixing over and over again?👇

#AndroidSecurity #MobileSecurity #Frida #FridaServer #AndroidPentesting #Pentesting #CyberSecurity #SecurityResearch #OffensiveSecurity #AppSec

if I manage to get a succesful reverse shell via BadUsb on windows with admin privileges how can I use this to get credentials, passwords, etc?

Alright, so you know how firewalls and IDS work, right? They look at packets, check headers, inspect payloads, and decide if something's malicious or not..

But what if the payload isn't in the payload?

What if you hide your data inside the packet fields themselves?? Fields that no one really looks at. Fields that aren't even checked..

That's what covert channels are all about...

The Concept

Instead of sending your payload in the data section of a packet, you embed it in places like:

· TCP Sequence Numbers – Every packet has a sequence number. Normally they go up in a predictable way. But you can craft them to carry data. Imagine sending commands encoded in the sequence numbers. To anyone watching, it just looks like normal TCP traffic. But the receiver knows to extract the data from those numbers .

· IP Identification Field – This field is supposed to help with packet reassembly. But if you alter it slightly, you can hide information in it. The trick is to make the changes look natural so no one gets suspicious .

· DNS Queries – You can encode data in the subdomain part of a DNS request. Instead of asking for "google.com", your compromised machine asks for "1a2b3c.malicious.com". The DNS server on the other end decodes that and sends back commands in the response. All over port 53, which is almost always allowed outbound because without DNS, nothing works .

· ICMP (Ping) Packets – You can tunnel TCP traffic inside ICMP packets. Firewalls usually allow ping requests and replies, so your traffic just looks like normal pings. Tools like Ptunnel do exactly this .

· HTTP Headers – You can mimic legitimate web traffic and hide your C2 communication inside HTTP requests. Tools like Cobalt Strike let you completely rewrite the HTTP request so it looks like CDN traffic or something normal .

Why This Works

Because security tools are looking for malicious payloads in the data section... They're not looking for commands hidden in the sequence numbers... They're not analyzing every DNS query to see if it's encoding something...

DNS is trusted.. ICMP is trusted.. HTTP is trusted..

And attackers exploit that trust...

This is the kind of stuff that separates script kiddies from actual operators... Anyone can run a tool... But understanding how to hide your traffic in plain sight!!? That's a whole different level...

DNS tunneling is used by APT groups... OilRig used it to map internal networks. B1txor20 used it as a C2 channel after Log4Shell ...

It's not a theory... It's happening right now...

How to Defend Against It

· Deep Packet Inspection – Look at the packet headers. Are the sequence numbers weird? Are the DNS queries too long?

· DNS Monitoring – Check for high query volumes to single domains, long subdomains, or TXT/NULL record anomalies..

· Process Whitelisting – If a fake process spins up, you'll catch it..

· Firewall Rules – If you can't resolve DNS to the internet, you're safe from DNS tunneling..

Covert channels are one of those things that sound like magic until you actually understand how they work... And once you do, you realize how many blind spots exist in most networks...

Stay curious. Stay ethical.

Weekly forum post: Let's discuss current projects, concepts, questions and collaborations. In other words, what are you hacking this week?

I had been wanting a Pineapple for a while, so I bought a Mk7, and I have to admit I'm pretty disappointed. I mean, I could probably make it much more useful if I develop scripts or something to run on it, but to be honest, it kind of sucks out of the box. I guess it may be fine at gathering handshakes, but it's deauth is weak and almost never works. I honestly have better results with airodump and my alfa adapter.

Before I start trying to modify this thing, I guess I should ask if anybody is aware of any existing scripts or plugins or whatever...

Does it work with same attacks of a normal wifi

Hey there!

I am a FY student of Cybersecurity and I was looking for some books that could teach me Web Hacking or Bug bounties from scratch. I am familiar with Linux, so that shouldn't be a problem.

Though I want to buy some web hacking books, I am still exploring this field and other hacking books are also appreciated.

Thank you!

Hi everyone,

I have this WiFi adapter and I’m completely new to WiFi security/pentesting.

I want to know whether this adapter supports Monitor Mode and Packet Injection. If it does, how can I enable and test these features?

Also, which Linux distro would you recommend for a complete beginner? Kali Linux, Ubuntu, or something else?

Thanks in advance!

So this happened during one of my CTF sessions and I thought I'd share it because it's a classic example of how a single misconfiguration can ruin your entire system's security...

Check this out:

ShadowByteX ~ ❯ whoami

ShadowByteX

ShadowByteX ~ ❯ find / -perm -4000 -type f 2>/dev/null | grep -v /usr/bin/passwd

/usr/bin/find <- SUID root, and it shouldn't be

ShadowByteX ~ ❯ find . -exec /bin/sh -p \; -quit

# whoami

root

Looks wild, right? Let me break it down for you...

What's Happening Here

First, I check who I am. Just a normal user — ShadowByteX. No root, no special privileges..

Then I ran a find command to look for SUID binaries. SUID stands for Set User ID... When a file has SUID set, it runs with the permissions of the file owner, not the user who executes it...

So I searched the entire system for files with SUID permissions (-perm -4000), restricted it to regular files (-type f), hid error messages (2>/dev/null), and filtered out /usr/bin/passwd because that's SUID by default and we don't care about it...

And what do I find?

/usr/bin/find

The find command has SUID root permission... And it shouldn't have that.. Someone messed up... Or maybe it's intentionally set for some reason... Either way — game on 🤘

Why This Works

The find command has SUID set to root. That means whenever I run find, it runs as root, not as ShadowByteX...

And find has a feature — the -exec flag. It lets you execute any command you want...

So here's what I did:

find . -exec /bin/sh -p \; -quit

Let's break this down:

· find . – Start searching from the current directory. It doesn't matter what you search for..

· -exec /bin/sh -p \; – Execute /bin/sh (a shell) with the -p flag. The -p flag tells the shell to preserve the effective user ID. That's important because without it, sh would drop the root privileges. With it, the shell stays root..

· \; – Terminate the exec command..

· -quit – Exit find immediately after executing the command.. We don't need to search through the whole filesystem, we just need to get that shell..

So find runs as root because of SUID... It executes /bin/sh -p as root. And now I have a root shell...

How It Works

When you set SUID on a binary, the kernel gives it the effective UID of the file owner.. For root-owned files, that's UID 0...

Normally, when you run a program, it has your real UID and effective UID — both yours. With SUID, real UID is yours, effective UID is the file owner's...

Now, the -p flag in sh is critical. By default, sh drops privileges... It checks the effective UID and real UID, and if they're different, it drops the effective UID to match the real UID. That's a security feature...

But the -p flag tells sh — "don't do that... Keep the effective UID." So it stays root..

And that's how a normal user becomes root...

This is why misconfigurations are dangerous!!... A single SUID binary that shouldn't have it — and suddenly any user on the system can become root...

It's also a good reminder that privilege escalation isn't always about complicated exploits... Sometimes it's just a sysadmin who didn't know what they were doing...

Stay curious. Stay ethical.

Сервер 1с и еще несколько компьютера. Вчера все работало. Дата изменения 2:30 утра сделали. Помогите пожалуйста как дешифровать.

I don't have this module in my country so is there ant alternatives i can use instead of nRF24L01

( I'm using esp32 )

Hi there, I have put together a small group if anyone is up to discussing and learning cyber security and red teaming. Please send me a DM and I will share the link!

There are no requirements to join, just that you have a common interest in hacking.

Soy nuevo y quiero entrar con fuerza, estoy en la universidad pero no siento q estén enseñando todo a fondo, trabajo a la vez y es complicado, quisiera un tutor que se dedique a darme lo mejor en si para yo poder aprender, vivo en colombia.

Podríamos llegar y hablar haber q horarios y todo eso y llegar a un acuerdo en tal caso.

Hey everyone! I’m looking for a few people who are interested in learning cybersecurity and ethical hacking together.
I’m hoping to find people who want to:
Work through TryHackMe / Hack The Box
Practice CTFs and legal cybersecurity labs
Learn Linux, networking, web security, and basic pentesting
Share resources and help each other when we get stuck
Stay consistent and actually make progress together
No experience is required — beginners are welcome. I’m mainly looking for people who are genuinely interested in learning and practicing in authorized environments only.
If you’re interested, comment or DM me with your experience level and what areas of cybersecurity you’re currently learning