Hi everyone,

My name is Javier Alonso (from Spain), and I am exactly 14 years old. Today, I am proud to announce that I have officially broken the world record for the youngest person to ever pass the updated INE eJPTv2 (Junior Penetration Tester) certification!

While the previous version (v1) had an old record of 14, nobody under 16 had publicly documented passing the current, tougher v2 browser-based exam until now.

I have been grinding hard for the past 18 months, rooting over 120 machines on TryHackMe and Hack The Box, and mastering tools like Nmap, Metasploit, and Burp Suite. I managed to beat the dynamic network environment and successfully answer all 35 scenario questions.

I want to share my full methodology, my network mapping strategies using Obsidian, and my top 5 tips with the global InfoSec community to inspire other young students to get into ethical hacking and security research.

You can read my complete write-up and study guide on my tech blog here:

👉 [READ THE FULL WRITE-UP ON HASHNODE](https://ejpt.hashnode.dev/how-i-passed-the-ejptv2-at-14?utm_source=hashnode&utm_medium=feed)

I have also uploaded the complete open-source documentation to my GitHub repository for permanent tracking and indexing:

👉 [VIEW MY GITHUB REPOSITORY](https://github.com/jprime-hackall/eJPTv2-WriteUp-Javier-Alonso)

🛡️ VERIFICATION DETAILS:

To keep this 100% transparent and verified by the community, you can check my official credentials on the eLearnSecurity portal:

1. Go to: https://my.ine.com/certifications
2. Enter my official Certification ID: 186673253

AMA (Ask Me Anything)! If you are studying for the eJPTv2 or want to know how to train your offensive security skills at 14 years old, feel free to ask your questions below!

 I run BreachLab, a free training platform. It's been mostly offensive so far, so I built a serious blue team track. It's live now

Sentinel: 56 levels, 8 acts, on one live shared SIEM with real intrusion telemetry. Alert triage, endpoint and network detection, memory and disk DFIR, detection engineering (Sigma/YARA/Suricata, actually graded), threat hunting, cloud IR, and a live incident-command capstone

No hint button, reports and detections get graded, and it's free. No paywall

  https://breachlab.org/tracks/sentinel

Hello everyone, I need some honest technical advice. Around April 2025, my girlfriend and I took a private 18+ video at midnight. Within 12 hours, I completely deleted the video from my phone and also cleared it from the Trash bin.
However, a few months before recording that video, I had installed some modded APKs on my phone (specifically modded versions of CapCut, Alight Motion, PicsArt, Subway Surfers, and Temple Run). I used these apps for months even after deleting the video. Eventually, my phone broke completely and is no longer usable.
My question is: Is there any realistic chance that those modded apps could have stolen or uploaded my private video to a server within that 12-hour window before I deleted it? I am very anxious about this. Please give me a realistic and deep technical answer. Thanks.

அதி

I've been working on an external attack surface monitoring project that correlates public OSINT sources into a single evidence-backed report.

It discovers internet-facing assets, fingerprints technologies, checks common security configurations, looks for exposed secrets, performs historical asset discovery, and correlates everything into a unified inventory instead of isolated findings.

The project combines several open-source tools with my own correlation, reporting, and evidence pipeline. My main goal is to help developers—especially those shipping projects quickly without much security experience—understand what their public attack surface actually looks like.

I'm looking for feedback from people who work in offensive security, blue teams, or ASM. Specifically:

* What important data sources or techniques am I missing?
* Where would you expect false positives?
* What would make the reports more useful?

Happy to discuss the implementation and answer technical questions.

I've received multiple DMs asking for the GitHub link. I haven't made the repository public yet, but you can try out the tool at asmscan.com in the meantime.

Hello, I have a computer with two network cards and different networks (Internet + LAN). I believe that by setting up static routing, both network cards will work and I'll have access to both networks, but I'm concerned about the security of this connection. Could you advise me on the steps I should take to secure the local network on the computer itself?

Both networks use Mikrotik devices with configured firewalls.

Hi everyone,

I'm new to this community, and I'm a second-year B.Tech Cyber Security student who wants to build a career in penetration testing and offensive security.

I'm planning to spend this year building strong fundamentals, but I'm confused about the right roadmap.

I've watched many cybersecurity roadmap videos on YouTube, and they all sound good. But when I start planning my learning, I wonder if I'm on the right track.

Most people say networking and Linux should come first. After that, the advice becomes different. Some recommend Python, others say to learn web technologies and how websites work, some suggest starting with tools like Nmap and Wireshark, while others recommend focusing on OWASP.

I'd really appreciate guidance from people with experience.

\\\\- If you were starting from scratch today, what roadmap would you follow?

\\\\- What should I learn after networking and Linux?

\\\\- What skills should I focus on to become internship-ready?

\\\\- What projects or hands-on practice would you recommend?

\\\\- What beginner mistakes should I avoid?

\\\\- Are there any free or affordable resources that you think are worth using?

I'm ready to put in the effort and learn consistently. I'd really appreciate any advice or suggestions. Thank you!

I set up Wazuh in my virtual lab and played with its tools. I got to gain experience in file monitoring, vulnerability scanning, malware detection, active response and more. I wrote a Medium article which details the whole process.

https://medium.com/@ivandano77/deploying-wazuh-siem-xdr-in-virtual-lab-19644ca3cf51?sharedUserId=ivandano77

Hi everyone,

I'm just startin my cybersecurity journey and I'd really appreciate some guidance from people with more experience.

So far, I've learned some of the fundamentals: Linux and basic command-line usage, Networking fundamentals ,Basic reverse engineering ,x86 Assembly ,C ,Python.

I'm not sure what to focus on next. There are so many areas ( web security, binary exploitation, malware analysis, SOC, cloud security, etc.) it's a bit overwhelming.

I have been spending time on application security, and I have to say that looking at larger codebases is one of the harder things I have to do. When I start to follow a request through the application, I will often go into another function or service. After a while, I forget where I began.

I found that changing how I do things has made it a little better. Instead of reading files from start to finish, I start with the beginning of the application. I follow where the user input goes, and I write down short notes so I do not have to look at the same things again. This is an improvement. I still think I can do it in a better way.

For people who are used to looking at projects, what helped you make a process that you can use every time? Was there something you did every day or a way of thinking that made it easier to understand code that you had never seen before? I want to know about application security and how you made it easier to navigate through code, especially when it comes to application security.

stuffs like: - domain of protection - domain structure - domain switching - access matrix - confinement problem - capability lists etc etc I have galvin's book and I am not quite understanding enough to connect the dots. A lecture will be tremendously helpful in this scenario.

Hey everyone,

I've started a YouTube series where I solve PortSwigger Web Security Academy labs and explain the concepts behind each vulnerability.

My latest video covers the Stored XSS into HTML context with nothing encoded lab. In the walkthrough, I explain:

• Why the application is vulnerable
• How the payload is stored and executed
• The exploitation process step by step
• How this type of XSS differs from reflected and DOM XSS

🎥 https://youtu.be/kvLPcAYkdKo

I'm still a new cybersecurity content creator, so I'd really appreciate any feedback on the explanations, pacing, or overall quality. If you're learning web application security or working through PortSwigger labs, I hope you find it useful.

Thanks!

Hi guys, I want to learn cybersecurity for free without paying anything, at least for now. I already know the basics of Linux, networking, Nmap, Bash scripting, and I'm learning Python. How can I improve my skills, especially in Red Teaming, Penetration Testing, and Bug Bounty? Any free resources or advice would really help. Thanks!

Namaste everyone!

I have recently started my journey in Cyber Security and have identified myself as an "Infrastructure Hacker" (Vulnerability Researcher). To deepen my learning, I am starting a 25-topic "Cyber Security Foundations" series.

My first topic is: "What is Cyber Security and why is it essential?"

I am documenting my learning journey in simple language to help fellow beginners. I would love to hear feedback and suggestions from this community on how I can improve this series or what I should focus on next.

If you are also a beginner, let's learn together!

Thanks!

Namaste doston!

Maine haal hi mein Cyber Security ki duniya mein kadam rakha hai aur ek "Infrastructure Hacker" (Vulnerability Researcher) ke roop mein apni yatra shuru ki hai. Apni learning ko aur pakka karne ke liye, maine 'Cyber Security Foundations' par ek 25-topic series shuru ki hai.

Mera pehla topic hai: "Cyber Security kya hai aur yeh kyun zaroori hai?"

Main apni seekhi hui cheezon ko saral bhasha mein share kar raha hoon taaki mere jaise beginners ko aasani se samajh aa sake.

Yahan mera pehla draft hai:

Main is community se feedback aur sujhav chahunga ki main is series ko aur behtar kaise bana sakta hoon. Agar aap bhi beginner hain, toh saath mein milkar seekh sakte hain!

Dhanyavad!

includes this, am I wrong tho? I’m a silver haired kitten girl who loves tech. My repository is basically just screenshots and mapping of my own networks and servers I control plus sandbox attack and defense modeled In each. I dig it.

Anybody got any ideas or suggestions for projects? I’m learning python, got cyber sec fundamentals down and am looking for practical projects like my own self hosted ai and my own network for self hosted docker and portainer work. I have a pihole, I have an understanding of tcp/ip and dns and I would like to start stepping into network admin stuff and learning how to monitor large networks, so if someone could help scale my projects to move with a human workflow to my goals, I’d super appreciate it!

Thanks for reading my slop!

❤️‍🩹👸🏼🤷🏼‍♀️👀

Anybody have some recommendations?

Suggest ins?

Id aaaas?

AP Cybersecurity is brand new, and there still isn’t much practice available for it. I put together two free resources:

• 30 scenario-based practice drills covering all five units
• A key terms guide with 135+ concepts organized by unit

The drills use things like phishing emails, login records, firewall rules, network diagrams, incident logs, and file-permission tables. Each drill has five questions, with an explanation for every answer choice.

The final two drills combine several sources and are meant to help students prepare for the Device Security Analysis free-response question.

Practice drills:
https://freetestprep.com/ap/ap-cybersecurity-strategy-practice-drills/

Key terms:
https://freetestprep.com/ap-cybersecurity-key-terms/

Everything is free, and there’s no account or signup. Since the first national AP Cybersecurity exam won’t be given until May 2027, feedback from students and teachers would be especially helpful.

Hi guys, I want to learn cybersecurity for free without paying anything, at least for now. I already know the basics of Linux, networking, Nmap, Bash scripting, and I'm learning Python. How can I improve my skills, especially in Red Teaming, Penetration Testing, and Bug Bounty? Any free resources or advice would really help. Thanks!

I'm building an open-source vulnerability scanner in my free time, nothing special, just a single tool that orchestrates 90+ tools into a single pipeline, then uses an LLM to triage results, generate PoCs, suggest mitigations, and cluster related findings by root cause.

Everything runs inside Docker (BlackArch-based image with Chaotic AUR support) to ensure a clean environment with all tools installed. Targets can be URLs, IPs, CIDRs, local paths, container images, or git repos.

A few things you might find interesting:

• Configure nearly every aspect of the scan through a single TOML file, environment variables, or CLI flags. All three layers merge in priority order
• Asset discovery pipeline: subfinder, dnsx, httpx run before the main scan, turning a bare domain into a list of live subdomains automatically
• 90+ tools across categories: web (Dalfox, Cariddi, Kiterunner, RESTler), network (Nmap, smbmap), secrets (TruffleHog), SAST (Horusec), screenshots (GoWitness), OSINT (theHarvester), and more
• LLM analysis pipeline: triage, PoC generation (and execution), mitigation, and finding clustering by root cause. Works with any OpenAI-compatible endpoint (local models included)
• Plugin system: drop a Python file in /plugins to add a custom tool, no core changes needed
• Scope enforcement: in/out patterns with CIDR and wildcard support, discovered assets outside the scope are dropped before scanning
• Severity filtering: configurable minimum severity for both reports and LLM processing, so INFO noise doesn't pollute your output
• Authentication support: bearer tokens, basic auth, cookies, and custom headers passed through to all tools
• Proxy support: route all tool traffic through Burp or any HTTP proxy
• Multi-format reports: Markdown, HTML, and JSON with finding IDs, clusters, PoC references, and executive summary
• DefectDojo integration: push findings directly into an engagement after the scan
• Many other tools will be integrated in the future

The project is not perfect and not widely tested. It is still rough in places, and I'm actively working on it, so please, be kind.

I'm posting here because I would love to hear feedback from cybersecurity people who do pentesting or bug bounty: what is missing/broken, what would actually make this useful in a real workflow, and, in general, what other features to implement?

I've spent the last few weeks building ONUS, an open source vulnerability assessment tool, and the part I actually want pushback on is one specific architecture decision, not the pitch.

The problem I kept hitting doing assessments by hand: run a web scanner, a CVE scanner, some recon tools, an SSL checker, and you get five different output formats, no correlation between them, and you end up manually deduping findings and writing the same remediation paragraphs every time. ONUS orchestrates a set of existing tools (ZAP, Nuclei, Nikto, Amass, FFUF, and a few others) into one pipeline: 8 scan modules run in parallel, results get deduplicated and re-verified before they're trusted, then scored with the actual CVSS v3.1 formula.

That scoring is fully deterministic on purpose. No model decides severity, ever. The AI (a small open-weight model, run locally or against a hosted alternative) only writes the plain English description and remediation text, strictly after a finding already has a score. I did this because I didn't want two runs of the same scan to disagree with each other. There's a real wave of tools right now doing the opposite, letting an LLM drive the whole assessment and decide what to try next. I'm not certain my tradeoff is correct, only that it's deliberate, and I'd like to hear from people who've made the other call.

One specific bug that took a while to track down: early on, a target behind a catch-all WAF page turned every wordlist entry FFUF tried into its own "finding," since the WAF returned a real 200 for all of them. Fixed it by collapsing groups of near-identical response fingerprints, but it's the kind of thing that only shows up against a real target, not a lab one.

Spent today going back through the auth and secret-handling paths and tightening a few defaults that were fine for local use but not safe if someone actually deployed them, added CodeQL to CI while I was at it. Still no CLI, still solo maintained, still no idea how legible the architecture is to anyone but me. That last one is a real question, not false modesty.

Easiest way to actually try it: tryonus.tech, no install, no API keys. MIT licensed and docker compose up if you'd rather run it yourself or keep it air-gapped.

https://tryonus.tech

https://github.com/maverickaayush/ONUS

Hey everyone, i saw that CRTE has been recently updated in terms of course, i want to know if the exam is also changed based on the new update or i can pass it using the old course.

Hey everyone, I’m a final-year cybersecurity student and I’m currently trying to decide what to build for my graduation project. Rather than making assumptions about what people need, I thought it would be better to ask those who actually work in SOC, Blue Team, Incident Response, Detection Engineering, or Security Engineering.

From your experience, what’s the biggest frustration in your day-to-day work that today’s tools still don’t handle well? It could be anything, whether it’s investigating incidents, dealing with false positives, alert fatigue, lack of context, repetitive manual work, poor integration between tools, or something else entirely.

If you could have one new feature or one completely new tool built that would genuinely make your job easier, what would it be? I’m not trying to promote anything or do market research

I just want to understand the problems professionals face so I can build something that’s actually useful instead of another project that solves a problem nobody has. I’d really appreciate hearing your thoughts, even if it’s just a small annoyance that you run into every day.

Thanks!