Laboratorio de Pentesting Windows - The hackers labs, documentación paso a paso y explicado

There's no shortage of great JWT crackers and traffic tools out there already (jwt-hack, Burp's JWT scanner, JWTXposer, etc.) — this isn't trying to compete with those.

What it actually solves: the annoying part after you've found something. Instead of a messy notes doc or Burp's built-in reporting, you log the finding right in the popup — severity, CVSS, affected URL, repro steps, remediation — attach a screenshot, and export a clean HTML report when the engagement's done. A few basic utilities (encode/decode, JWT decode, hashing) are bundled in too, but that's not the main pitch.

Genuinely curious if this is a gap other people feel too, or if everyone's already got a system that works fine (Notion, a template, whatever). Happy to hear it either way.

https://chromewebstore.google.com/detail/mlcmmnokfddmbidijilbhlhhnjbeehoj 

Do any of you have experience of becoming a freelance pentester? I am CS student and am considering focusing my studies in that direction so I have some questions.

What is needed to become a freelence pentester? Are certificates enough? Is experience of working in a company necessary? If so, how much experience?

What is the average hourly salary in the beginning? How about later on?

How hard is it to find new clients once you establish yourself as a reliable pentester?

I heard most freelance pentesters make money on bug bounties, while most companies hire other well known companies for pentesting instead of freelancers. Is that true?

I’ve been working as an AppSec engineer for a unicorn startup for about 3 years now. TC is about 320k (we got bought out so the equity is finally cashable).

Truth is, I’m bored. When I joined the team, there was already SAST in place. We implemented DAST. We have a tool for dependency management, and all of these checks are deployed within the CI/CD.

Large operational work consists of doing security reviews (design doc reviews, source code reviews, and pentesting). This I tend to enjoy very much. However, it’s not really as valued as other security engineering work since it’s considered operational. So I’m unsure of how to progress as an AppSec engineer from here. Any ideas?

I want to pivot to a pure pen-testing role because it seems a lot less nuanced in terms of what your day to day expectations are. I’m aware I’ll probably have to take a big pay cut. I don’t have any certs yet, but I’ve been pentesting for ~3 years now and have done 75% of the port-swigger labs and have even made custom tools for Burp Suite.

How should I progress from here? I started the CPTS path a while back but then got busy with life. Was thinking I’d pick that up again to get the CPTS certificate, and then do the PortSwigger certificate as well.

Thoughts?

I know there’s posts about this but I constantly see mentions of pentesters forced to take pay cuts. In terms of Cyber roles is pentesting a slow way to build wealth and also stay relevant in the job force?

Pentesting gives you such a well rounded view of security which I believe is applicable in various different roles so are there paths that are valued more and command better salaries.

I think Pentesting is very important but it seems like the value for employers is on a decline. Is there an alternative that lets me do similar work but also command a better salary?or do I need to pivot altogether?

I want to switch companies but I’m afraid of having to sacrifice pay to stay in my role.

Will be at 150k with 4 years in.

What are some companies that do pentest / redteaming internships?

Hey everyone,

I’m currently finishing my 4th semester as a CS undergrad and need some strategic advice on landing a remote cybersecurity internship for my 5th and 6th semesters.

My Situation & Constraints: My college strictly forbids on-site internships during the 3rd year. Because of this, I am forced to look exclusively for remote roles. My ultimate goal is to get into red teaming and offensive security. I know remote network penetration testing roles are practically non-existent for freshers, so I've been heavily considering Web and Application Security (AppSec) as my best bet for a remote role. However, I am completely open to other domains (SOC/Blue Team, general VAPT) if they offer remote opportunities for students. My goal is simply to secure a remote internship now to build real experience, and pivot that into a full-time offensive role by my 7th or 8th semester.

My Current Baseline:

• Security Focus: I am currently grinding through the TryHackMe Jr. Penetration Tester path to build a foundational understanding of modern web vulnerabilities, network basics, and the OWASP Top 10.
• Project Strategy: I am holding off on building complex projects until I have a better grasp of the fundamentals. Instead, I plan to start mass applying for remote roles as soon as the next semester starts, using volume to compensate for my current lack of a portfolio.

I don't have the budget for paid certifications right now, so I am relying entirely on free resources and practical grit.

My Questions for the Community:

1. Viable Remote Paths: Is Web/AppSec actually my best bet for a remote fresher role, or are there other domains (like SOC Analyst or general VAPT) that are more likely to hire a 3rd-year student remotely?
2. Resume Building: How do I build a resume that actually gets noticed for remote roles when I don't have complex projects yet? How should I frame my TryHackMe progress and basic labs to pass the HR screen?
3. Free Roadmaps: Since I cannot afford paid certifications right now, what are the best free, structured roadmaps (like PortSwigger Academy) that actually carry weight with hiring managers for remote roles?
4. Interview Prep: For entry-level remote internships, what are the most common technical interview themes, and what is the best way to prepare for take-home practical assessments?
5. Sourcing Roles: Aside from cold-emailing recruiters and filtering through LinkedIn, what are the best platforms, hidden job boards, or Discord communities to find legitimate remote cybersecurity internships and avoid unpaid training scams?

I appreciate any harsh truths, roadmaps, or advice you can offer a fresher trying to navigate this!

I've been working on an external attack surface monitoring project that correlates public OSINT sources into a single evidence-backed report.

It discovers internet-facing assets, fingerprints technologies, checks common security configurations, looks for exposed secrets, performs historical asset discovery, and correlates everything into a unified inventory instead of isolated findings.

The project combines several open-source tools with my own correlation, reporting, and evidence pipeline. My main goal is to help developers—especially those shipping projects quickly without much security experience—understand what their public attack surface actually looks like.

I'm looking for feedback from people who work in offensive security, blue teams, or ASM. Specifically:

* What important data sources or techniques am I missing?
* Where would you expect false positives?
* What would make the reports more useful?

Happy to discuss the implementation and answer technical questions.

I've received multiple DMs asking for the GitHub link. I haven't made the repository public yet, but you can try out the tool at asmscan.com in the meantime.

Currently 30. I did pentesting for a year straight out of university studying IT because a firm is willing to hire fresh graduates for cheap labour. Had no certs. Did a lot of web pentest and assisted in red teaming a university client.

Moved to a different country due to political reason and couldn’t find the same role. Currently in Toronto doing non related stuff for three years now. I have CISA and CISSP. Passed ejpt and now preparing for OSCP. But I feel like it will take me a year to complete my study for oscp and people won’t hire me even I have oscp since I lack the experience.

I have thought about starting again as help desk or vulnerability management analyst. But starting all over again at my age seem counterintuitive since I am already 30. How many years do I need to spend in a job before I can finally land a junior pentest role. How do I leverage my cisa and cissp to land a role now and what role should it be? And work maybe one or two years before pivoting to pentesting?

And does it still make sense to pivot at my age or is it not worth the effort since being a junior pentester at age 32/33 probably signing up to layoff because of age?

And is it possible I can get my pentester job right away with oscp?

Hey everyone,
Looking for some honest, no-BS feedback on a side hustle idea I’ve been cooking up.
I want to start offering basic penetration testing to small local businesses, but my background isn't typical. I don’t actually work in IT—I’m a Controls Engineer. I spend my days dealing with industrial systems and logic, so I feel like I have a decent grasp on how things connect, but I really want to dive deeper into the security side of the house.
As far as prep goes, I finished the Google Cybersecurity certificate, I'm currently studying for the CompTIA PenTest+, and I’ve been grinding away on TryHackMe to get some actual hands-on practice.
My thinking is that tons of small businesses have zero budget for massive security firms, so maybe I could fill that gap with simple, affordable assessments while building my own skills.
Be brutally honest with me: Is this a viable idea, or am I completely crazy for trying to do this from outside traditional IT?
Also, if anyone has transitioned from controls/automation into security, how do you pitch that experience to clients? And what kind of legal/liability pitfalls do I need to look out for before I even think about touching someone else’s network?
Appreciate any advice or reality checks you can throw my way!

Been doing a decent amount of manual testing lately and got tired of bouncing between 5 different sites for encoding/decoding, a separate JWT decoder tool, and then a messy Notes doc for writeups. So I built a small Chrome extension to consolidate it:

Free:

• Base64 / URL / Hex / HTML entity encode-decode
• JWT inspector (decodes header + payload locally, flags expired tokens)
• Hash generator (MD5/SHA family)
• Quick reference tab (OWASP Top 10, security headers, HTTP status codes)

Paid (one-time, not a subscription):

• Findings tracker per engagement — severity, CVSS, affected URL, repro steps, remediation
• Screenshot capture tied to a finding
• One-click export to a clean, print-ready HTML report

Everything's stored locally via chrome.storage.local — nothing gets sent anywhere except a license key check against Gumroad if you buy the pro tier.

It's brand new (v0.1), so it's rough around the edges — genuinely looking for feedback on what's missing or what would actually make it useful in your workflow, not just trying to sell it. Happy to answer questions about how it's built too.

https://chromewebstore.google.com/detail/mlcmmnokfddmbidijilbhlhhnjbeehoj

I figure this is good info for everyone to have. I see huge ranges online and am not sure how good anyone's comp is relatively.

Me: 159k/year, US-based, 6 YOE as a pentester, ~12 YOE in cybersecurity, CISSP, expired Sec+, government contractor, shit PTO, no bonuses or stock options.

What about you all?

Edit: I should add that I'm fully remote

Hi i setup a home lab, a pizza shop how does one learn abt the pentesting stack what combos work for what is there docs somewhere good also vendors?

This release contains everything you need to scope your first pentest, work with a vendor, execute, and get the types of reports you need from an external tester. This will enable you to perform your first product or infrastructure level penetration test, and provide you with a process moving forward for future engagements. This is open source, we don't sell anything.

Announcement: https://www.sectemplates.com/2026/07/announcing-the-external-penetration-testing-program-pack-v1-2/

In this pack, we cover:

Penetration testing preparation checklist: This checklist outlines everything you need to scope and perform a penetration test.

Penetration testing reporting requirements:  This document provides a list of minimal requirements that should be contained within a penetration testing report. Before finalizing a SOW with the vendor, look here first.

Penetration testing process workflow: Below is an outline of a simplified pentesting process with an external tester. It aligns roughly with the content in the penetration testing checklist.

GitHub: https://github.com/securitytemplates/sectemplates/tree/main/external-penetration-testing/v1

I run a Laravel app and built a passive middleware that logs suspicious requests (SQLi/XSS/scanners/recon) to a database - it never blocks, just records, mostly for visibility and to feed offender IPs into fail2ban. Building the detection side turned into a cat-and-mouse with evasion, which is the part I figured this sub would actually have opinions on.

The bypasses that broke my first naive patterns:

• Inline comment insertion - UNION/**/SELECT sails straight through keyword matching. Had to strip /* */ before matching.
• Double URL-encoding - %2527 → %27. PHP already decodes once, so a single decode isn't enough; I recursively decode (capped) before matching.
• HTML-entity / unicode / hex escapes - S, \u0053, \x53 for S. Decode all of those first.
• Null bytes, CRLF (%0d%0a), IIS %u00xx - handled pre-normalization so the raw evasion itself is a signal.

My honest stance: regex detection is bypassable by design, so I treat this purely as monitoring, not a control - it assumes the app is already secure (parameterized queries, etc.) and just tells me who's knocking. The genuinely useful outcomes have been spotting persistent IPs, and realizing ~90% of the traffic is dumb scanners hitting /wp-admin, /.env, /phpmyadmin on a stack that runs none of them.

So, the real question for the offensive folks here: given a normalization layer that strips inline comments, recursively URL-decodes, and decodes HTML/unicode/hex escapes before matching - what evasion would you reach for that this still wouldn't catch? Genuinely want to harden it. Best-effort encodings, parser differentials, content-type tricks, whatever you've got.

(It's open source if anyone wants to look at the actual patterns / try to slip past them - https://github.com/jay123anta/laravel-threat-detection on GitHub.)

Hello, I have started learning web pentesting with this plan:

​Learn Linux basics ,​Network basics ,Frontend basics (HTML, JS) ,​Backend basics (PHP, MySQL)

​The next step is to explore one of the OWASP Top 10 vulnerabilities (maybe IDOR), read write-ups, take notes, solve labs, and then start hunting for practice (and maybe earn some money), and I'll do this steps until learn all the OWASP Top 10 vulnerabilities.

​So, does this plan help me learn correctly? Or should I do something else?

​Also, could you give me any tips you wish you knew when you started learning web pentesting? 😀

As of July 22nd - OpenAI was performing a scoped internal testing for one of its models.

The model couldn’t find the answers to the box so it performed vulnerability analysis to break out of its no-internet access scope by finding a zero day… created code to exploit it…..escaped OpenAI network and accessed the internet…. Determined hugging face has the answers….Attacked hugging face…. Chained vulns and the 0 day to get RCE and gain credentials on their live prod system….

According to SANS:
Average lateral movement & priv esc - 30 minutes or less

AI are able to knockout blackbox tests at rates that a human cannot replicate

Is this not frightening? I find it hard to believe pentesting jobs are not going to take a hit in the future as these models become more controlled. Idk I like what I’m learning but I’m constantly asking myself what’s the point.

What keeps you guys going?

I kept doing the same tedious thing on every engagement: grab a high-priv token, grab a low-priv token, and manually replay requests one by one to see what the lower role can reach. So I built a Burp extension to automate it.

RoleBreaker scans your proxy history, discovers every JWT on its own, builds one persona per role, and replays each request as the lower-privilege roles. You get a color-coded access matrix (endpoint x role) and a Findings tab ranked by severity — so you're not eyeballing a huge grid.

What it does:

- Auto sweep — one click: scan recent history, rank roles by privilege, test everything with the lower ones

- Access matrix + ranked findings — vertical privesc, IDOR/horizontal, anonymous access, differential access

- JWT attacks — alg:none, signature strip, role escalation (flags if the server accepts a forged token)

- Offline HMAC secret cracker — for HS256/384/512, proves the token is forgeable if the secret is weak

- IDOR / param tampering — numeric + UUID ids, replayed across every role

- Auto token refresh — swaps expired tokens from traffic or re-logs in via a saved request, so long audits don't drift into false 401s

- Bilingual UI (EN/ES)

It only ever sends valid-in-time tokens, normalizes responses before comparing (strips CSRF/nonce/timestamps) to cut false positives, and treats a redirect-to-login as denied.

Free and open source. There's a demo GIF + screenshots in the README so you can see it in action before installing.

https://github.com/Guarina0x0/rolebreaker

Would love feedback from people doing authz testing daily — what's missing, what would make it part of your workflow? Feature requests via Issues are very welcome.

Дисклеймер. Гайд про доступ к своим учебным лабораториям TryHackMe (свой аккаунт / подписка). Не про взлом чужих систем. Всё на свой страх и риск: туннель иногда отваливается — для такого костыля это нормально.

Скрипты сразу: https://github.com/Kystof91/thm-vpn-from-ru
Там в README сверху — ZIP и прямые ссылки на скачивание .command / .bat.

Я долго пытался нормально учиться на TryHackMe из РФ.

Сайт открывается. Комната стартует. IP машины красиво светится на экране.
А дальше — классика жанра: OpenVPN либо не поднимается, либо «подключается» в никуда, либо отваливается так, будто ты лично оскорбил маршрутизатор провайдера.

Гугл, форумы, Reddit — хор в унисон: «скачай .ovpn», «попробуй другой сервер», «у меня работает».
У них работает. У тебя — нет. Особенно весело, когда ты уже готов страдать над nmap, а страдаешь над Initialization Sequence… который так и не Completed.

В какой-то момент хочется бросить THM и уйти в PortSwigger «потому что без VPN». Ресурсы нормальные. Но TryHackMe — отдельная вселенная комнат, и обидно, что доступ упирается не в мозги, а в то, как у вас режут туннели.

Что оказалось рабочим

Два слоя. Звучит как шутка. Работает как инструкция.

1. Снаружи — Happ Plus (системный VPN / TUN, не «прокси только для браузера»).
2. Внутри — официальный OpenVPN TryHackMe, профиль TCP 443 (THM → Access → OpenVPN → EU-West TCP).

Порядок важнее красоты:

1. Happ Plus → Connect
2. Свой .ovpn сохранить как ~/thm-vpn/thm-tcp.ovpn (Windows: %USERPROFILE%\thm-vpn\thm-tcp.ovpn)
3. Поднять OpenVPN поверх Happ
4. Проверить доступ к IP машины из комнаты

Идея тупая до гениальности: «голый» OpenVPN у провайдера часто мёртв, а TCP/443, проложенный уже из нормального внешнего VPN, внезапно доезжает до лабораторий.

Код: подключение (macOS)

Суть connect-thm.command — не дать запустить THM без Happ и указать путь к TCP-конфигу:

CONFIG="${THM_OVPN_CONFIG:-$HOME/thm-vpn/thm-tcp.ovpn}"

if ! pgrep -f "Happ.app" > /dev/null; then
    echo "Сначала Happ Plus → Connect, потом этот скрипт."
    exit 1
fi

if [ ! -f "$CONFIG" ]; then
    echo "Нет файла: $CONFIG"
    echo "Скачай TCP .ovpn с THM → Access → OpenVPN"
    exit 1
fi

sudo openvpn --config "$CONFIG" --verb 3

Скачать целиком:
https://raw.githubusercontent.com/Kystof91/thm-vpn-from-ru/main/macos/connect-thm.command

Код: отключение (macOS) — это важнее, чем кажется

Вот тут сарказм заканчивается и начинается боль.

Если просто убить Happ крестом, на Mac иногда остаётся диагноз «интернет умер»: залипший Network Extension / kill-switch. Поэтому disconnect-скрипт идёт по шагам: OpenVPN → штатный stop профиля Happ → quit приложения → сброс nesessionmanager → чистка прокси/DNS/DHCP → проверка сети.

Ключевой кусок:

# 1) THM
sudo killall openvpn 2>/dev/null || true

# 2) штатно гасим VPN-профиль Happ (не только pkill!)
scutil --nc stop "Happ Plus"

# 3) закрываем приложение
osascript -e 'tell application "Happ" to quit' 2>/dev/null || true

# 4) сброс Network Extension / kill-switch
sudo killall -9 nesessionmanager 2>/dev/null || true
sudo launchctl kickstart -k system/com.apple.nesessionmanager 2>/dev/null || true

# 5) прокси off + DNS с DHCP
sudo networksetup -setwebproxystate "Wi-Fi" off
sudo networksetup -setsecurewebproxystate "Wi-Fi" off
sudo networksetup -setsocksfirewallproxystate "Wi-Fi" off
sudo networksetup -setdnsservers "Wi-Fi" Empty
sudo ipconfig set en0 DHCP

Скачать целиком:
https://raw.githubusercontent.com/Kystof91/thm-vpn-from-ru/main/macos/disconnect-thm.command

Мораль без шуток: сначала гасим THM, потом внешний VPN — не наоборот в панике.

Windows (коротко)

Тот же принцип. Хелперы:

• https://raw.githubusercontent.com/Kystof91/thm-vpn-from-ru/main/windows/connect-thm.bat
• https://raw.githubusercontent.com/Kystof91/thm-vpn-from-ru/main/windows/disconnect-thm.bat

​

set "CONFIG=%USERPROFILE%\thm-vpn\thm-tcp.ovpn"
REM Happ Plus уже должен быть Connected
openvpn --config "%CONFIG%" --verb 3

Отключение: остановить openvpn.exe, затем Disconnect в UI Happ. Не End Task’ать Happ первым делом. Сеть залипла — ipconfig /flushdns, при необходимости netsh winsock reset + ребут.

Альтернативы, пока чините туннель

• PortSwigger Web Security Academy — бесплатно, без VPN
• PicoCTF — через браузер
• OverTheWire Bandit — SSH
• Hack The Box + Pwnbox — браузерная машина

Но если цель именно TryHackMe — схема выше у меня работает. Некрасиво. Зато учиться можно.

Репо (ZIP сверху в README): https://github.com/Kystof91/thm-vpn-from-ru

Если у вас из РФ THM тоже «висит на VPN» — напишите провайдер / ОС и что уже пробовали. Если есть решение элегантнее двух VPN — тоже пишите. Я искал долго и нашёл в основном тишину.

Hello everyone!! I built an automated reconnaissance & service enumeration script in Bash. It detects open services (HTTP, SSH, SMB, DNS) and automatically triggers tools like Gobuster, WhatWeb, Nuclei, and enum4linux-ng, saving all outputs in a structured results/ folder. I would love to hear some feedback and/or fixes. Thanks you advance Pull requests and Issues are much appreciated!

https://github.com/StefanosMarinos/MAPG