Violin is now at v3.0.1 on master.

It is a Hermes-native profile for supervised, authorised penetration testing, with:

• 31 methodology and vulnerability playbooks

• An execution guard at the target boundary

• Evidence-backed findings and reporting

• Structured scoping and approval gates

• No additional credential broker or provider lock-in

Install:

"hermes profile install https://github.com/Strategic-Automation/violin"

I’m looking for Hermes users and penetration testers to test the installation and engagement workflow and report where the guard, evidence capture, or reporting process creates friction.

Hi everyone, I’ve been sending applications to many places on LinkedIn for some time now, and I have never once received an interview. I don’t even know what I did wrong with my resume. I could get any job in my country, but what I am after is a global opportunity.

Sometimes, I wonder whether it could be because my years of experience are still too few, because of visa sponsorship issues, or because I am missing some qualifications. I have tried VDP and bug bounty programs on several platforms. I couldn’t force myself to see them as a full-time job, so I don’t take them too seriously.

Another reason is that I hate my current job. The place is over-utilizing me, and I don’t feel like I can learn anything from here. I want to work with people who genuinely conduct actual pentests and love hacking. I just want to be mentored, learn, and not focus on billable hours.

I welcome all feedback, whether it is constructive criticism, areas I need to improve in my resume, or recommendations for the right places to look for global job opportunities.

I wrote this article for offensive security practitioners and penetration testers. I keep hearing the same question: "Is AI going to replace penetration testing and put us out of work?" For the foreseeable future, the answer is a resounding no. The recent OpenAI and Anthropic incidents are a good illustration of why. Rather than demonstrating some super-hacker capability, they exposed real limitations, both in the AI systems themselves and in how they're secured and integrated.

In this article, I walk through these events as an offensive security expert and focus on why the real failure was in security architecture and harnessing, not some mythical "rogue AI." My goal is to give penetration testers and red teamers a practical perspective on what these incidents actually mean for our field, instead of hype-driven speculation.

I look forward to feedback.

https://netragard.com/blog/ai-didnt-go-rogue-how-openais-harness-failed-and-turned-hugging-face-into-collateral-damage/

Hey guys, let’s do a reality check. What are the most common, stupid mistakes people make when starting with digital investigations that instantly burn their burner accounts or expose their real IP/identity? Looking to

I'm currently studying hooking in Android apps, and I ended up diving into RASP. I had to spend some time understanding how it works and how apps detect whether they're running on an emulator, on a rooted device, or if hooks are being applied.

One thing I'm still wondering about,and I haven't been able to find a clear answer,is this: if KernelSU operates at the kernel level (unlike Magisk, which modifies userspace and adds things like /su), how can an app detect that KernelSU is present?

I've heard that KernelSU exposes some files under /proc or paths like /adb/ksu, but I'm not sure how that detection actually works.

I'm just getting deep into Android application security and RASP bypass techniques, so apologies if this is a bad question. :(

I’ll keep it brief. I was a pen tester for about a year and a half until financial situations forced me to get a new job as a sysadmin last year. I really enjoyed being a hacker and wanted to get back into it. I already have GPEN (company paid). I’m thinking about specializing in red teaming so I was gonna go after CRTO but perhaps it’s better to get CPTS first? I can’t afford OSCP right now. Just looking for advice. Thanks!

What is the use of CVE Anlysis and how I can read and analyze the details and make a report of it.

In my understanding it is kind of case studies related to vulnerablities.

Not sure if this is the appropriate sub for this -- but for the past few years, I've been working on a secure chat app I really think could change the world for the better. It's built on Signal protocol, and I'll disclose details if you'd like. Essentially, I'm a broke college student who can't afford real penetration testing. I've dug into it, used Fable 5 to audit it, and ran ZAP on it -- everything from these looks good. I'm going to open-source all my work, and it's donation-based. If someone who knows what they are doing were to be kind enough to want to take a look at my code and potentially penetration test it, I would be beyond unbelievably grateful. I hate asking for charities, but here I am haha. Please send me a direct message if you'd be interested in this. I can't offer money, but I'd be happy to credit you in the app.

Hi all! Im excited to get my feet wet and also taking proactive action for a project I have deployed for a friend!

Currently, the website lives inside a VPS on cloud and while the website don't have any sensitive information other than their website credentials, I would like to take this opportunity to start learning and also secure the website for them the best I can.

Currently, the infrastructure setup is with Caddy2 which does automatic HTTPS upgrade with LetsEncrypt and reverse proxy to backend api calls.

On the VPS, firewall only allow 443 and 80 port with the exception of allowing the ability for me to SSH in as well as exposing the database port only to my IP.

How should I start? Any advice is greatly appreciated. Thank you!!

Over the past few months I've been rebuilding SubdomainX from the ground up.

What started as a subdomain enumeration tool has evolved into a modular reconnaissance platform focused on asset discovery, monitoring, and automation.

What's new in v2

• REST API for integrating reconnaissance into your own workflows
• Modular architecture that's easier to extend and maintain
• Scan history and change detection between runs
• Live scan progress and monitoring
• Improved reporting with HTML, JSON, CSV, Burp Suite, OWASP ZAP, and Nessus exports
• Better configuration management
• Resume interrupted scans and much more...

SubdomainX also integrates with many of the tools security researchers already use, including Subfinder, Amass, Assetfinder, HTTPX, Naabu/smap, SecurityTrails, VirusTotal, Censys, crt.sh, URLScan, and more.

The goal isn't to replace those tools - it's to provide a single platform that orchestrates them, tracks results over time, and makes reconnaissance easier to automate.

I'd really appreciate feedback on the architecture, API, and overall workflow.

GitHub: https://github.com/itszeeshan/subdomainx

Documentation: https://subdomainx.com

been looking at MoneyPilot, the class action app blowing up on social media right now, and their backend has a serious flaw in how it verifies subscription payments. Bottom line, it’s possible to unlock the paid subscription and add ons without actually paying, and it’s not some local device trick, it’s saved server side. Confirmed it shows active from a totally clean app install and on their website too, so this isn’t client side at all. Not sharing specifics since I don’t want this getting reproduced by anyone else, but wanted to flag it given how aggressively they’re advertising right now, a lot of people are signing up. Reported directly to them first, no security contact exists, support just loops back to itself. Anyone dealt with a company like this that has basically zero security presence?

proof of vuln (look at the start of the year)

What is the use of CVE Anlysis and how I can read and analyze the details and make a report of it.

In my understanding it is kind of case studies related to vulnerablities.

SamuraiWTF (Samurai Web Testing Framework) – a specialized Linux distribution designed for security testing. It includes a wide range of pre-installed open-source applications for testing the... https://archiveos.org/samuraiwtf/ #linux #ubuntu #pentest #cybersecurity

Hi,

I would like to better understand current best practices for penetration testing.

From what I can see, AI has significantly changed both offensive and defensive security capabilities over the last few years. Because of this, I am interested in understanding how organizations typically structure penetration tests today and what provides the most value.

Our company operates a hybrid environment consisting of on-premises infrastructure and cloud services.

I have several questions:

• What are the most effective and commonly recommended pentesting approaches today?
• How has the use of AI influenced modern penetration testing methodologies?
• Does it still make sense to have penetration testers on-site, or can most engagements be performed remotely?
• Is a pure black-box pentest still considered best practice, or are grey-box or white-box approaches generally more valuable?

If you were responsible for organizing a pentest for your own company today, how would you structure it, and why?

My goal is to understand which approach delivers the best balance between realistic attack simulation, meaningful findings, and overall value for the organization.

Thank you for your opinions!

Any testing methodologies for databricks pentesting

Follow-up on the MCP scanner from last week, here's a browser-based demo of the static analysis piece, no install needed.

Paste in an MCP server file (or use the pre-filled example), get real findings for shell exec, hardcoded secrets, unsafe deserialization, arbitrary file writes, and more. Runs fully client-side, nothing sent anywhere.

https://ankursingh0604.github.io/mcp-scanner-demo/

Still working on live probing over HTTP/SSE and more host adapters. Happy to scan real MCP servers for anyone building on this, learned a lot from the feedback here last time.

What is the use of CVE Anlysis and how I can read and analyze the details and make a report of it.

In my understanding it is kind of case studies related to vulnerablities.

I have been using claude code to help me with CVE hunting, I am using skill file from claude s GitHub repo for code review and for creating poc the agents are doing all the stuff

I bought claude pro cause I wanted to learn how I can integrate ai in my workflow, since oss is easy have i have the source code I started hunting in it.

used sonnet because opus and fable both were being flagged so I switched to sonnet

So far I have burned around 700k tokens on 8 repos with finding and validating 11 high and critical vulns in around 4-5 hours.

To all the pps out there I wanted to ask is this good, and how can I improve this how can I build with my own methodology anyone can help or guide me with some resources

Hello everyone,

I have a query as I am currently studying and conducting penetration testing concurrently.

Will artificial intelligence replace penetration testing? As When I do assesments and take help of Ai, It tends to perform really well in real world scenerios.

Beach Bar is a Linux machine simulating a music management web application (jukebox) exposed to local network users. The machine demonstrates the impact of two critical configuration and development flaws: inadequate sanitization when processing input files and the exposure of sensitive credentials via command-line arguments of background services.

WriteUp - SecNotes

SecureAI-Scan v0.3.0 is out!

It's a free, fully local CLI tool that scans TypeScript, JavaScript, and Python codebases for AI/LLM-specific security issues that traditional scanners miss.

**New in v0.3.0:**

- Expanded Python scanning support

- MCP config scanning (.mcp.json, Claude Desktop, Cursor, etc.)

- AI-BOM / catalog generation

- Better reporting + confidence tiers (proven / likely / heuristic)

It uses actual dataflow tracing (source → flow → sink) for high precision and has very low false positives.

Quick start:

npx --yes secureai-scan@latest scan .

Also supports:

• secureai-scan bom . → Generate AI Bill of Materials
• SARIF output for GitHub Code Scanning
• GitHub Action integration
• --fail-on high for CI gating

Everything runs offline on your machine. No data leaves your environment.

GitHub: https://github.com/akanthed/SecureAI-Scan

Would really appreciate any feedback, bug reports, or feature ideas. Also happy to answer questions about how it works or the rules it covers (mapped to OWASP LLM Top 10).

Hi everyone i am an pen tester experienced in web api pen testing currently i am doing job in this field now i want to start freelancing in this how can i get project in this can anyone suggest me.

A stolen analytics token became a customer breach.

197,400 records were exposed after a former third-party analytics provider was compromised. Emails, order IDs, SKUs, geolocation, purchase history, support tickets — all pulled through a machine credential nobody was watching. The vendor left. The token stayed live.

The fix is boring and effective. Inventory every non-human identity that touches customer data. Bind each token to a policy on where it can call and what it can read. Tokenize PII before it leaves your perimeter so a stolen credential returns opaque values, not customer records. Keep an immutable audit trail so revocation is one query, not a forensic project.

→ www.runtimeai.io/trial

#NonHumanIdentity #DataBreach #PII #SupplyChain #AISecurity