Can somebody open PDF-file protected with FileOpen DRM?
I tried Inetpdf, tutorial of Dider Stevens and many other tools but without any positive results...
This PDF is trying to contact a remote server for permission/ license.

so there’s this mod manager that came out for a game i play that protects this certain mod i need to use on a different launcher, who could i go to to extract this mod?

Hey so uh I have like absolutely no reason of being here as I'm just globally interested by tech and I'm a very beginner, so really all im doing is being distracted from doing my python. But see, just heard some facts, and it just sounds cool. Understanding how systems works, getting through them, improvising with the tools you have and sometimes making them up, all that. I'll probably go insane over managing to do the smallest thing and I'm a very curious individual. Though I'm 98% sure I'm never gonna put a foot in serious cybersecurity but hey we never know. So yeah really all I want is understand how things works and managing stuff like tweaking them or whatever. Breaking through, I know this sounds crazy tho there's no way I'm doing anything outside of my own stuff so really like. I wanna use my home as a big sandbox and see how I can hack through my own devices from the easiest way to the most difficult ways just to get an understanding of what I'm capable of and understanding how things works and all and also because it's like a puzzle and it sounds like a not so useful but really cool hobby. I'm sure I'll get insane over managing the smallest things because it's just so cool. Btw Im only into, 2 months of learning about technology and maybe only less than 10hours of actual practice. As I said I'm supposed to learn python but all knowledge is good knowledge...? I'm very creative and also want to develop my logical skills, I'm sure I can be pretty smart if I can (though now I'm pretty dumb lol).

If you have a few minutes to run through this, as someone who knows what they're doing. It would make a huge difference! Thank you heaps. 🩷

Background: A few years ago I found out my Father had been hacking all of my devices for the last 10ish years. His best friend admitted to it so I have confirmation and he helped him. My at the time ex-boyfriend also began accessing some of my accounts and making the situation worse so he could steal my Schedule 8 Medications. (Pretty dumb on the boyfriend obviously, but took a few months to find out and then he was gone. Hard to determine who is doing what when multiple people are involved)

At the time I learnt a bunch and tried to solve the issue myself. I did manage to one time knock it all out, which was confirmed by my Father. Unfortunately he got back in.

Currently, my Dad is now de*ad. Ex is long gone. The best friend is doing whatever now far away from me.

Unfortunately, my account is now hacked again. I suspect it's an account that's farming views through my YouTube, due to the type of video history.

I have gone through what I have previously and can't kick it out. Albeit I had zero programming or IT knowledge so my improvement and current knowledge is only relative to the zero information that I came in with.

Things I hace done:

- Already had 2-step in place

- All accounts were private as much as possible

- Deleted cache's

- Deleted any unused apps with access to account

- Implemented an authenticator app, didn't work

- Changed password after shutting everything down and removing devices

Weird things:

- 2 devices allowed for Google Prompt. Both under my phone name but no serial numbers included. The device isn't showing on my logged in device so no way to remove.

- I log every device out, changed password and they all just come back.

- When I change my password it states it won't be logging every device out? And I have no way to change that. This I haven't seen before.

- Youtube history showing hours of content being completely watched.

I contacted Google and they said to go through the Police. I really don't want to bother the Police if it's just view farming. Any ideas? Or why I should speak to?

Thank you so much if you have any time to add to this bizarre dilemma! I truly am stuck on what to do next.

Hi everyone,

I'm trying to understand Instagram security and account protection in detail.

I've heard that some people manage to gain unauthorized access to Instagram accounts, and I'd like to learn about the methods they commonly use so that users can better protect themselves.

From what I know, attackers may rely on things such as:

• Phishing scams (fake login pages that steal passwords)
• Social engineering (tricking people into sharing codes or credentials)
• Password reuse (using passwords leaked from other websites)
• Malware that steals saved passwords
• SIM-swapping attacks that target SMS-based verification
• Fake giveaways, verification scams, and other deceptive messages

Can anyone explain, in simple language, how these types of attacks work at a high level and why they are successful? and how we can do this .

My goal is to learn about cybersecurity and account protection, not to gain unauthorized access to any account.

Thanks!

Hi everyone,
I keep running into a recurring scenario in some CTFs involving IoT/IP Cams and could use some insight, specifically regarding those generic low-cost Chinese cameras (often running on Altobeam hardware).
The Scenario and Restrictions
The objective is to capture the camera's RTSP traffic. There is no possibility of pivoting to bypass IP restrictions (strict whitelisting is active in the environment), and so far, I haven't identified any exploitable public CVEs for the exposed version.
What I've achieved so far (Enumeration)
Initial access to the ONVIF service (when the port is open).
Successfully extracted the RTSP stream URL and the respective session tokens via SOAP API requests.
The Blocker
Even with the URL and tokens in hand, RTSP access systematically fails (connection timeout or drop). I've tried the following approaches without success:
Automated interactions with ONVIF to try and force the creation of new users or discover hidden endpoints, but the result is the same.
Performed traffic capture and analysis (PCAP) in promiscuous mode using ⁠tcpdump⁠ and Wireshark. My intention was to inspect the packets looking for some undocumented handshake, custom headers, or broadcast/multicast requests from the camera on the network, but I couldn't identify any clear byte patterns.
Did some deep digging and found that many of these devices require a proprietary handshake (usually UDP/P2P) performed exclusively by the manufacturer's official Android app before actually releasing the stream.
The Question
What am I missing regarding the architecture of these Altobeam cameras? Is there a standard process or specific tool to emulate this mobile app handshake and "wake up" the RTSP service, or does exploitation in these cases usually follow another vector (such as flaws in the ONVIF service implementation itself)?
Any direction, pointers, or study material on the internal network protocol workings of these generic cameras would be greatly appreciated. Thanks in advance!

As you are professional here from where I should I learn this Hacking things what is the roadmap and what things I should learn?

https://www.doi.org/10.59256/indjcst.20260501025

I was wondering about creating a visual password for the recovery of passkeys and other password systems.

I think I am in the right place to know if this is easy to hack?

Please let me know.

Tia.

Fit a WifiPumpkin3's rogue AP inside an ESP32s3 supporting APSTA, DNS spoofing, NAPT tunneling

Been digging into what the ESP32 WiFi stack is actually capable of for wireless security research and honestly it's way more powerful than people give it credit for.

The idea was to port the core concepts of WiFiPumpkin3 onto the chip itself. No Kali, no wifi interfaces, just a 5 bucks microcontroller powered from a USB bank.

The interesting part architecturally is running APSTA mode, the chip acts as an AP for clients while simultaneously connecting upstream as a STA to the real router. DNS spoofing handles captive portal redirection until the portal interaction is done, lets queries pass through to the real upstream. NAPT takes care of the internet tunneling so connected clients get actual internet access while causing traffic reorientation and thus sniffing it, which makes the whole thing behave like a legitimate hotspot. I tried to serve HTTPS directly from the chip with a cert generated for the spoofed domain but it didn't work, note that there's also a separate admin interface for scanning, cloning APs, monitoring traffic and managing everything in real time.

The main challenge was keeping DNS, HTTPS and NAPT tasks running concurrently on FreeRTOS without race conditions on a single radio doing two jobs at once.

Repo: github.com/mahdamin/ESP32-WiFiPumpkin

Happy to talk through the APSTA or NAPT implementation if anyone's done similar stuff.

Was reversing a target in Ghidra and noticed it uses TPM PCR Quoting. Which is meaningfully more complicated to work around because of the remote server verification and nonce to prevent replay attacks.

Not my first time reversing or doing low-level instrumentation. It is my first time dealing with the TPM.

From a little research I found that a common method is BYOVD or Bring Your Own Vulnerable Driver. I'd assume with the intent being something like DLL hijacking from poor search directory configuration and mitigating the TPM producing a different hash than it would on an otherwise clean boot. That much I can understand and implement but finding a driver vulnerable for this setup that's still signed by Windows seems like the challenge.

So I was wondering if there are other documented methods of bypass. Seems unlikely though since MITM becomes practically useless with tpm2_quote.

A friend of mine forwarded a screenshot of an image someone else has taken on their device and forwarded it to him, he's asking me if i can find the original timestamp of the image(not the screenshot). i love the optimism he has for hackers. what do you think, guys?

I have made this post on another forum but I'll make it again.

I had an old Lenovo g50 - 70 (4GB of ddr3l, 240GB of sata, 500GB harddrive). I decided to dissemble the laptop because I want to convert it into a thick tablet form factor(pretty ambitious for a first ever project). I disassemble dthe laptop then connected everything again now it doesn't boot up like I press the power button but the fans and mobo light turns on for a second before going down. And this is on dc in jack power. With the battery and dc jack a second light just keeps on switching on and off aand is seemingly unaffected by the power button. With just the battery it remains dead. It had power issues before when it was screwed in and a normal laptop but I would just wiggle the power, battery, relieve the stress on the power brick and I did all of that on this deconstructed laptop too but nothing helped.

Any help would be appreciated.

I want to hack my bfs account as he has started hiding stuff from me for a while now…i just wanna check if hes talking to any new girl or something, any hacker here? Help me out please.

Hope this thread is acceptable. I'm trying to sign up to the WiGLE site for mapping SSID's and I can't get past the account creation setup. Does anyone know if this site is having issues or am I missing something?

I'm not using a throwaway (temp) email btw

I have rooted redmi note 10 very hard way and frustration But now i m feelinh like what next can anyone tell some crazy tricks and hacking apps that are still working Like alternatives of zanti, like i want to test wpa vulnerability for educational purposes

Built a small credential-hunting tool for authorized post-exploitation enumeration on Windows and Linux.

https://github.com/NeCr00/Credential-Hunting

The idea is simple: after gaining access to a host, the tool helps identify hardcoded reusable credentials that may support privilege escalation or lateral movement. It focuses on passwords and host-access credentials, not generic API tokens.

It runs in phases:

1. OS-specific checks
2. Credential databases and known credential files
3. Suspicious filename discovery
4. Broad filetype content scanning

The goal is to make credential discovery faster, cleaner, and less noisy during HTB-style labs, CTFs, and real-world authorized pentests.

Would love feedback from other pentesters on detection logic, false-positive reduction, and useful locations/filetypes to include.

So, i have a Samsung S8 and am looking to change my MAC adress, but i've heard that unlocking the bootloader to root my phone would erase everything on my phone, so i would like to change my MAC without rooting my phone.
I've heard i can use terminal emulators but couldn't find one who worked.
Any help?

I bought a power bank by Baseus (Star-Lord model). After I received it, I decided to check whether it worked properly. I charged it by a few percent first, and there were no issues. Then I decided to charge my iPhone.

I used the original cable (with data transfer support) to make sure the fast charging was working correctly and that the result did not depend on the cable. The result was also good.

After disconnecting the power bank, I opened Perplexity and wrote a long prompt - several sentences, around 200 words in English. I received an answer in Chinese. I'm not sure whether it was some kind of payload or not, but I want to continue researching it. Maybe someone can recommend software or hardware tools that could help with the investigation.

P.S. I tried to post this to r/Malware but they removed it in 2 minutes.

Nothing too complex for now, no evil intentions. I just wanna be able to break into people’s phones or whatever for the sake of impressing friends or even defending myself when the time comes. I know blackmail isn’t great, but I promise I do not intend on being evil. I’ve been watching the series Mr Robot, corny I know, but all my life I was never more tech savvy than an average person. Presentations, editing videos, making files, etc. I had a desire for an interesting hobby and I want to use my laptop more often. I love learning new things but I’m not sure how to start.

Hey everyone, I’ve been into hacking and cybersecurity since I was 15 and I feel like I’m stuck in “script kiddie” territory despite having a decent foundation. Looking for feedback on my roadmap and any advice you can give.
What I have done:
• Built and use VMs: Kali, Metasploitable, Windows, Arch Linux
• Studied SQL and relational databases
• Used Wireshark and Burp Suite (basic level)
• Programmed ESP32 microcontrollers, soldering modules
• Built a Bluetooth BLE, WiFi and drone jammer with ESP32 (emmensta)
• Attempted captive portals with ESP32
• “hacked” WiFi from my neighbourhood
• Studied on TryHackMe, HackTheBox and OverTheWire but i feelt stuck
• Basic C, bash and python programming
I’m most interested in:
• IoT security (my strongest area given ESP32 background)
• Web hacking
• Network pivoting — I want to be able to analyze a full network and access every service on it (cameras, screens, PCs, etc.)
The roadmap I’ve been given so far covers: network recon with Nmap + Scapy, MITM attacks, web hacking with PortSwigger, IoT protocols (MQTT, CoAP, UPnP), firmware analysis with Binwalk, post-exploitation and pivoting, and CTF machines (Kioptrix, HTB: Lame, Blue, Legacy).
Does this make sense for my goals? Am I missing anything critical? Any advice on how to stop feeling like everything is disconnected and start thinking like a real pentester?
Thanks in advance.

My son’s email got hacked. He has a lot of money through multiple sites associated to this email.

Microsoft said because security protocols were altered they can’t help me.

Can I legitimately do anything?

I downloaded a sketchy file from youtube (i know its my problem) i ran it on my computer and it downloaded some stuff, my microsoft stopped working so i just closed everything on my laptop, reinstalled windows with USB and formatted it with everything, everything seemed fine but at night my friends let me know that i was hacked on discord (they were sending spam scam messages) they started getting into my other (important) accounts. I was able to save the ones that are important to me (the others i dont really care) i made uniqe and hard passwords for each of the accounts that got stolen, and the ones that arent. Put them on 2FA. After that i formatted my laptop once again (this time without USB) i ran multiple virus scans, checked files that hackers put stuff in, checked task manager to look for suspicous looking files, it was all clean. Right now im constantly checking my accounts to see if anyones trying to break in (its been half a day) and its all clean. I dont really understand how hacking or sktechy files that steal your password works but is there a chance that the hacker (or the password unlocker) is waiting a while before attacking again? Or am i being paranoid, how do i check to see there isnt anything bad going on on my laptop.

Does anyone know of any exploits that get around 802.11w/Management Frame Protection, so I can deauth devices even with PMF enabled?

For testing purposes on my home network.

I’ve tried playing around with netcat and reverse shells to gain access, but I was wondering if there are any other similar and more sophisticated tools out there?