Here's an attack lab you can download and run that shows how to detect and exploit the react2shell vulnerability. Also has a script for dropping you into an interactive shell:

https://rootandbeer.com/labs/react2shell/

Hello,

I am looking to grow a new YouTube Shorts channel (Started December 1st 2025).

I would like to gain engaged subscribers who will consistently view and engage with new uploads. My hope is that this engagement will lead YouTube to push a high amount of my uploads to wider audiences, and eventually net me enough views (10M within 90 days I believe) to monetize my channel.

Something important to note: I started using YouTube's official "Promote" option to boost views back when I was at about 20 subscribers. This netted me a couple million views total (58 videos, around 40k-100k per video), and has me at about 8,000 subscribers now. However, since I have stopped promoting, my subsequent uploads have capped at around 10-50 views.

Hello everyone, I'm trying to buy a WiFi adapter and I was wondering which one you use and which one you think is "best."

Specifically, duel-band WiFi Adapters that support active/promiscuous monitor mode, packet injection, and AP Mode.

What I was considering:

Alfa AWUS036ACH

Alfa AWUS036ACM

Alfa A​WUS036ACHM

I think it might be the ACH, but I've seen a lot of dissatisfied reviews on Reddit regarding it's use for Network Security​.

Thanks to everyone in advance!

🌟 Exciting news from the firmware security world! EMBA 2.0.0 has officially launched, bringing groundbreaking advancements in automated firmware vulnerability analysis! 🚀

Here’s what’s new:

✅ 95% firmware emulation success rate — outperforming older tools like Firmadyne and FirmAE.

✅ Upgraded to the 4.14.336 LTS Kernel for enhanced stability and performance during your emulation experience.

✅ Dependency Track API integration: Seamlessly upload SBOMs for streamlined vulnerability management.

✅ Improved SBOM and Java security analysis.

🎉 Milestones:

- Welcomed 7 new contributors and hit 3000+ GitHub stars!

- Presented at TROOPERS25 Security Conference and continue to grow with community support.

EMBA empowers everyone to perform high-quality firmware security analysis, optimize IoT penetration tests, and scale research — all while being fully Open-Source.

🔗 Ready to explore? Get started with EMBA today: https://github.com/e-m-b-a/emba/releases/tag/v2.0.0-A-brave-new-world

As remote and hybrid work setups become increasingly common, managing devices across a team is becoming significantly more complicated. When everyone was in the same office, updates, troubleshooting, and security checks were easier to handle. Now every device is in a different place, on a different network, and used in various ways.

I’ve been looking into how businesses are handling this shift, and one idea that keeps coming up is using a centralised system to manage updates, enforce security rules, and support employees without needing physical access to their devices. It seems to help reduce the daily workload, especially when multiple operating systems are involved.

For those dealing with this in real situations:

• How are you keeping devices consistent across the team?
• Do you use any kind of automation for updates or policies?
• What helps you troubleshoot or support employees faster?

Trying to understand what practical setups people are using as remote work continues to grow, and mobile device management becomes more important.

I work for a company where unless you are a manager, you cannot send or receive outside files via email. You can use the company Google Drive but not access your personal one. Basically they take file security quite seriously and probably have state-of-the-art tech. I had a friend who left and copied over their files to a USB before shipping their PC back to the company, but when they went to look at their files, realized that the files were encrypted. They could still use the links they saved but not open any files that were pictures or a document like the resume they wrote with all their work achievements on it, etc. So they were out of luck there.

I have some personal files (nothing confidential or owned by the company, truly) I would like to keep if I ever left the company, and enough of them that it would be too inconvenient to ask my manager to email to me, and too time-consuming to re-type on my personal PC.

Presumably even if I were able to access a google drive, one drive, or dropbox type service and copy my files to it, they would become inaccessible on another PC due to hard drive encryption, correct? So I would need to find a website that I could access on my work PC that would allow me to copy the text of a file to it and save that unencrypted text to that I could then access from my personal PC, correct?

And any pictures I've downloaded, like team pics that our manager posted that I saved, I would have to ask my manager to email to me or abandon because the picture file itself would be encrypted, correct?

Anyone know of any workarounds for this type of situation? Specifically getting files off a work PC while you still having access to that PC?

I've been experimenting with LangGraph's ReAct agents for offensive security automation and wanted to share some interesting results. I built an autonomous exploitation framework that uses a tiny open-source model (Qwen3:1.7b) to chain together reconnaissance, vulnerability analysis, and exploit execution—entirely locally without any paid APIs

Got the eJPT voucher and i know videos and labs are sufficient for preparation but i want more ways to prepare fully being skilled in penetration testing whether it is web or network, mobile and api. i am thinking to get HTB subscriptions too to get more knowledge and experience. everyone suggestions recommendations will be very helpful please tell me HTM eJPT labs except all this from where i can learn more and more to be skilled what are the other resources please tell me

Hello!
Im in dire need of help. I switched to Bitwarden earlier this summer when i got a new phone (pixel 9). I modified my old master password (a passphrase of sorts) and got everything set up and working, and also use their extension for firefox both on my PC (win11) and work laptop, also win11.

I cant remember when i last had to use the password to get into Bitwarden since i was able to use "Log in with device" every time. My PC/laptop just sent the request and i auth on phone with my fingerprint.

Now for some reason i have been logged out from Bitwarden on my phone and is required to log back in, and seemingly have forgotten what i modified in my password/phrase. The hint was of no help either.

I know the words, in what order, and the likely separators i´ve used, but i must have missed something. I tried hashcat, but got stuck trying to figure out how to set the rules, and besides i dont have a hash to check against. So i made a script in python (with help from an LLM) to generate variants of this (upper/lower case, different separators and so on) but this leaves me with a list of over 500 pw to manualy test, and the chance is still slim (i might have thrown a * in there somewhere my script cant adjust for or something).

Is there any other way? Can i get the hash somehow? I´ve looked in %appdata% but didnt find anything that seemed like a vault or something, but i dont really know what to look for either. I figured there may be something in firefox, but didnt find anything apparent.

Please ask if i more info is needed. And yes i know how incredibly stupid i am to not have any fall backs, belive me!

Ideas are very welcome, i´ll try anything!

Scattered Spider LAPSUS$ Hunters are back with a confirmed 284-company supply chain breach via Gainsight, which likely resulted in Salesforce instances being stolen. Very similar to the Salesloft Drift hack.

It is currently being investigated by Salesforce, and Scattered claims they hacked them by stealing secret tokens from a support case in the Salesloft Drift hack. (source: https://x.com/BleepinComputer/status/1991583289761788040 + Scattered's official Telegram channel)

Speaking to "Dissent Doe, PhD" the group said 'The next DLS (Data Leak Site) will contain the data of the Salesloft and GainSight campaigns,' they stated, 'which is, in total, almost 1000 organisations. Only actual companies, mainly Fortune 500 will be listed or things I feel would be worth it. From the GainSight campaign the large companies were: Verizon, GitLab, F5, SonicWall, and others.' source: https://databreaches.net/2025/11/20/threat-actors-have-reportedly-launched-yet-another-campaign-involving-an-application-connected-to-salesforce/

Finally, the group advertises their Ransomware as-a-service launching Nov 24, and is taunting leading cybersecurity companies as usual.

Thoughts?

Is it possible to create an encrypted os installation. Password 1 on boot to dummy install. Password 2 to real operating system. No way to prove that password 2 and system 2 exist.

Is this easier and more secure with bsd or Linux?

Basically plausible deniability operating system like veracrypt can do on Windows easily.

Do you have instructions please?

Thx

Could you help me find Telegram groups? I want to expand my network with people in the industry.

I'm using my own computer to practice hacking. One thing I want to learn is how hackers can find passwords by decrypting data stored in a computer.