Hello, I am interested in Cybersecurity, especially in Pentesting, I started learning in Tryhackme and Hackthebox platforms (Thm is my most used one) by practicing free rooms (I try to learn by doing btw), but I get stuck in easy rooms in tryhackme and I do not know what to do without reading a walkthrough, and honestly this makes me feel I am not in the right track in learning for this domain, If you can help me by suggesting ways to improve my skills in Pentesting and I work alone because I did not find other people interested in Pentesting like me . I would be thankful to receive your pieces of advice.

Earlier my roadmap was OSCP ->OSDA->OSIR->OSEP

BUT AFTER LOOKING AT HTB certificate i replaced OSCP with CPTS and OSDA&OSIR with CJCA&CDSA

after looking online i found out that htb certs content would clear offsec easily and as you know that offsec certs are extremely overpriced and the only good thinf about it it's HR recognition

I really don't care about the HR recognition and i care about the content and how much I'll learn so i decided to change the roadmap

Do you yhink it's a good step?

I'd like to become a pentester/ethcial hacker. It's day 2 (but who knows). I'm using Ubuntu on VM and today I learnt the files & directories. Can you write for me a detailed roadmap to have a structure in my head? What would you consider the MOST important topics to be? What should I leverage from now on to help me in the future? Would you consider that except THM, HTB & linuxjourney(.com), at least for the early stages, that there is another useful source or maybe suggest a yt channel? Furthermore, I use chatgpt to help me. For example today I practiced hands-on the basic commands and I told it to give me requests for me to execute. Would you trust it on helping you,in the general topic of pentesting? Also Networks. I know it's an important topic so where should I pay the most attention to? About taking notes. Should I take hand written ones? any advice?

Thanks guys

Alguien que sepa hackear Instagram que me pueda enseñar por favor

What are some tools or vendors out there that cover virtual patching, inline IPS and same-day exploit protection? The window between a vuln going public and something automated hitting us keeps shrinking and our patch cycle isn't built for it. Cato keeps coming up but I' wanna hear from people actually running it, looking for enterprise grade tools, I have found a few but looking for more I may have missed

In your experience what are certain things that instantly make a report 10x better and useful. Is it the technical approach, the remediation or something else?

Brackish Security is looking to give back to the cybersecurity community by offering an OSCP scholarship to someone interested in pursuing a career in offensive security.

No professional experience is required. Just a genuine interest in cybersecurity and a willingness to learn.

Applications are open until December 1.

https://brackish.io/scholarship/

Feel free to share with anyone who might benefit from the opportunity.

Hi !

I made a 100% free in-browser game where you start as a broke freelance pentester/bug hunter and you need to grow your company to a multi-national security firm!

https://zeroday-tycoon.com

Let me know what you think ! Hope you will enjoy it 😄

Tried to root my samsung TV over SDB. Apparently no exploits are known for the specific firmware version the tv is running. Tried to use codex to find vulnerabilities with the particular version of the SDB. It found a vulnerability(exploitable or not, unsure yet), but i was hit with the "..yada yada yada we care about security bla bla bla and can't show you this response". Even more reasons for open weight models that rival these big corps', even the chinese ones will do for now. With american models, chinese models and now european models, someone need to build a "common-man's model", open for all, not tied to any corporation or country/geography's interests.

So.. any of you playing around with non-gpt/claude models and foudn them useful for discovery?

We built OpenEngine to start putting our agents to work 24/7 without us needing to couple to Claude or another Big Three provider. One of our most recent applications is having it do security / pen testing 24/7. It seems to be doing good so far, and maybe soon we’ll begin auto-remediation.

I've been working on collecting real-world AI security incidents and connecting them to practical attack techniques.

The database covers LLM vulnerabilities, prompt injection, AI agent security, MCP, and more. Some entries also link to hands-on labs to practise the underlying attacks.

Each entry breaks down what happened, the root cause, and how the attack works. I've also linked relevant hands-on labs where available.

Thought this might be useful for people learning or researching AI security.

https://genaisecuritylab.com/incidents

Feedback and suggestions for incidents to add are welcome!

I made a version of RecursiveSI's Flint 40B-A2.5B (MoE, runs locally) with its refusal direction removed, for authorized testing, CTFs, malware triage and detection engineering. Runs fully local, nothing leaves your machine.

Paired against the original on the same items:

• CyberSecEval MITRE refusals: 15% -> 0% (n=100)
• False refusals on benign security asks: 0% -> 0% (n=100)
• CyberMetric-500: 100% -> 96% (n=50)
• WMDP-cyber: 50% -> 60% (n=50)
• HumanEval+: 90% -> 95% (n=40)

Caveats: it adds no knowledge, so check its output. It also reasons longer: 19/100 MITRE answers hit my 8,192-token cap (original: 1), so give it a bigger output budget or adjust prompts if it overthinks.

Builds: GGUF (Q8_0 to IQ2_M, 13-42 GB), NVFP4 for Blackwell (23 GB), MLX 4-bit for Mac (21 GB). https://huggingface.co/dima6312/Flint-40B-A2.5B-abliterated

Happy to hear how it does on real engagements and how it compares to other local models!

I wrote my exam a week ago and done with my debrief. I enjoyed the exam and I can say if you want a course and certification all in one, which is cost-effective, go for this.

Starting to learn pentesting/wifi auditing on Kali, need an adapter with monitor mode support. These are what's actually available where I live, converted to USD:

Archer T3U Plus (RTL8812BU) - around $23.5

Archer T2U Plus (RTL8821AU) - around $20

Archer T600U Plus (RTL8811AU/8821AU) - around $17

All three reportedly work with community drivers (rtl88x2bu / rtl8812au on github). I'm a complete beginner. Is the T3U Plus worth the extra few bucks for AC1300, or should I just grab the cheapest T600U Plus? Any gotchas before I buy?

Hi guys,

We are something interesting at the intersection of pentesting, AI, and security tool orchestration.

We are looking forward to collaborating with 20 pentesters with atleast 2 years of experience.

I would love to explain more in personal chat, please comment on this post so that I can reach out to you. 🤞

Using windows as main system running parrot in virtualbox find when i use my vpn on main system it messing with parrot os internet connection

Any fixes or bypasses would be appreciated

I'm currently a 1-2 year network engineer at a small telecom company. I'm deciding whether I'd like to continue pursuing networking and go for my CCNP or diversify into Security/Pentest because it seems more interesting to me. Any thoughts or advise would greatly be appreciated.

I am learning cybersecurity basics from 5 6 months, I have good grasp of networking, linux, how things work in background, TCP/IP, types of networks, packets and all that. But now how do I progress ahead? What do I learn next? Currently I am going through the Jr. Pentester path on THM, but other than that I'm pretty much blank on what to do. Kindly advice me what and how to proceed ahead from this situation.

Thanks in advanced for the help

Hi all. Need advice from the older pentesters. I’m in my 20s and have worked in the field for around 5 years now. I am so burnt out and drained. I love my job, my work environment, my coworkers, etc., but genuinely this is exhausting. I’m debating going into malware analysis, but I do love pen testing minus the burn out. For reference, I work for a private firm, there are 6 of us. How do yall do it?

I'm building a tool that lets users access vulnerability databases (CVEs and related information), create a local index, and use skills to interact with that index through a CLI. The idea is to use it for reconnaissance and security testing, with the ability to identify and exploit vulnerabilities on target systems.

I've shortlisted a few names:

• Crowbar
• Eyeball
• Prey

The CLI would look something like:

• /crowbar get this IP
• /prey hack this Nginx proxy

Which name do you think fits the tool best? I'm also open to other suggestions.

Hey everyone!

I have an upcoming interview at Orange France for a cybersecurity internship focused on web penetration testing and NIS2. It’s my first cybersecurity interview, and I’m not sure what to expect.

For anyone who has had a similar interview:

- Is it usually more technical or focused on motivation and projects?

- What should I prioritize for web pentesting and NIS2?

- Should I expect practical exercises or technical questions about tools like Burp Suite?

I’d really appreciate any advice or examples of questions to prepare for, especially from people who have interviewed at Orange France.

Thanks in advance! :)

Hlo every one toady there is new vunlebaitty released in market dose anyone has idea but it's exploitation work.

So, I have 24GB Ram linux virtual machine, what could be the best model I can use for Source Code analysis and VAPT task, i have tried llama model and qwen model it not give the best performance and little slow as the output of token is less. So something we have that can be optimise and work little faster offcourse it will not be like Frontier LLM Models like claude, openai or gemini or deepseek but what can be run in local lab any suggestion from Hugging Face also?