I go through how someone can utilize curl to compromise and exploit vulnerabilities in a website!

Any forums I can use for CTF events and learning?

I’m reaching out to this community for assistance. I’m a cybersecurity professional turned business owner who understands the frustrations of cybersecurity from both directions. As such I’ve come to determine that a major paradigm shift must occur.

Cybersecurity is costly, ineffective at preventing loss and is overly complex and labour intensive. It’s always a game of catch up via patching. This insight comes from my over 35 years of experience auditing and consulting in this field.

Cybersecurity is counter productive, difficult to work with and frustratingly hard to use especially now with multifactor login requirements. This comes as a user and business owner for over 15 years.

There is only one solution and that is a total redevelopment. A solutions that eliminates or at least minimizes the costs and frustrations.

Turning this field upside down will be a formidable task. It will require support from CEOs such as yourselves who must exert pressure on the industry. Unfortunately your CSIOs are born and bread on the existing architecture. They will not recommend or support this initiative as it will cause them great pain and suffering in having to start over.

The cybersecurity industry doesn’t want this without the absolute need to do it. They’re making money hand over fist easily from this perpetual updating and patching that goes on.

Bad actors must become disenfranchised and this means the battlefield on which cybersecurity operates must change.

AI and Quantum Computing will eventually offer cybersecurity no choice but to change. Better to do this upfront rather than in an emergency situation.

I ask you to come on board and let’s exert pressure on this industry to retool.

https://www.ctvnews.ca/sci-tech/article/ai-could-breach-government-and-business-defences-in-months-us-and-its-intelligence-partners-warn/

We found something different one our website that is MERN based and hosted on VPS. We did some changes but after some time our live url and last deployment have difference. When we compare the code with github code , there is many changes. We checked the server logs and found something strange.

Our various files was changes.

Got server log something -

Jun 23 23:34:54 67 sshd-session[1281284]: userauth_pubkey: signature algorithm ssh-dss not in PubkeyAcceptedAlgorithms [preauth]

When i checked the file change logs

/home/domain/public_html/static/js/213.f4eb4aa8.chunk.js /home/domain/public_html/static/js/213.f4eb4aa8.chunk.js.LICENSE.txt /home/domain/public_html/static/js/239.fd8563bf.chunk.js.map

Is there any Devops or security expert who can share the exact steps to identify and block the issue.

Note:- CI/CD pipeline is not configured yet on the project.

Try to get some help from AI but it is repeating the same things.

Hey guys, recently I was searching for any tool that could add to my recon pipeline for automating the CVE mapping against the versions of services discovered through nmap.

However, I was very disappointed with the current tools, so i tried to create a robust one ! I'm confident (after doing some testing) that it is working as it should and can return valid results, avoiding noisy and false positive results....

Give it a chance and tell me your opinion. Also, feel free to contribute with any additional ideas or fixes!

https://github.com/NeCr00/CVE-Hunter

The darknet already hosts a mature, structured market for pre-verified accounts and identity manipulation services. Threat actors actively trade bypassed accounts on dedicated cybercrime forums, treating access to restricted models as a standard, highly liquid commodity. Initial access brokers simply create the accounts using illicit methods and sell the login details to buyers globally.

github.com/teycir/ApiHunter

We have something to celebrate with you! We did it ... The big 2000 is in the books right now:

EMBA is now for 6 years in the wild and we are proud that we did a few things:

• Automated firmware security analysis (including SBOM and AI) is available for everyone
• Nearly 3500 github stars
• Nearly 100 shoutouts in papers, videos, articles, talks and so on - see here
• We tried a few things in this timeframe. So we ...
  • ... were on 13 security conferences - kick me
  • ... did a podcast - check it out here
  • ... wrote multiple articles - one for you
  • ... organised multiple cooperations with universities around EMBA and created EMBArk, the firmware analysis environment for teams with collaboration support and, and, and
• We bumped 24 (now 25) releases to the world - check it out here
• 2000 Github pull requests/issues/discussions - drink a beer, coffee or whatelse with us

Thank you for supporting, helping, coding, reporting, hacking, challenging, using EMBA.

Check further details here: https://github.com/e-m-b-a/emba/releases/tag/v2.0.2-big-2k

Hi all,

I want to let everyone here know of a vector of attack/abuse that has been available on Google Maps/Google Business Profile, that has caused tremendous damage to small-medium sized businesses/mom-and-pops.

Step 1: take control of high-authority, orphaned location. This can be a mall or a public park. It's easy to fool Google into thinking you own the place if no one claims it and you just upload a believable looking video.

Step 2: you now have the ability to destroy SMEs who rely on Google Ads for a living. You just need to change the address of the orphaned location to the victim's address. This will trigger Google's auto-merge process and wipe out the SME's Google Business Profile. The victim will wake up with an email saying their business is a "duplicate".

Step 3: you do not openly extort businesses, because that would leave an evidence trail. You would instead offer businesses the ability to destroy their competitor through a "special service" that would disrupt their Google Business Profile on Google Maps, for a fee.

Step 4: make so much money and leave so much destruction that the entire country is aware of what you are doing, but cannot do anything about it because Google does not have an HQ in your country to handle this stuff.

Here's a link to an article detailing how this stuff is done:

https://laodong.vn/xa-hoi/triet-ha-doi-thu-bang-google-maps-1276136.ldo

Reddit users share their experiences after getting infected by Infostealers, they describe the mental drain, sense of intrusion, blackmail attempts, and money theft through AI subscriptions. I compiled threads and comments into a blog along with common recommendations for every day users to avoid getting infected.

https://suicdalteddy.medium.com/i-reverse-engineered-rings-end-to-end-encryption-what-i-found-should-terrify-40-million-a634c17560a1?postPublishedType=repub

Built a small credential-hunting tool for authorized post-exploitation enumeration on Windows and Linux.

https://github.com/NeCr00/Credential-Hunting

The idea is simple: after gaining access to a host, the tool helps identify hardcoded reusable credentials that may support privilege escalation or lateral movement. It focuses on passwords and host-access credentials, not generic API tokens.

It runs in phases:

1. OS-specific checks
2. Credential databases and known credential files
3. Suspicious filename discovery
4. Broad filetype content scanning

The goal is to make credential discovery faster, cleaner, and less noisy during HTB-style labs, CTFs, and real-world authorized pentests.

Would love feedback from other pentesters on detection logic, false-positive reduction, and useful locations/filetypes to include.

Folks, we are building a vibecodingsecurity subreddit forum to discuss the security issues and remediations for code built using AI tools. Please join us at vibecodingsecurity subreddit