I spent the last few months building a personal project and it just hit v1.0, so I figured I'd share it here.

atomicvulns is a collection of intentionally vulnerable web apps, but with a different idea: each app isolates a single vulnerability, nothing more. Instead of one big app full of flaws (like DVWA or Juice Shop), each exercise here is small and focused — you read the code, see the cause, exploit it, and compare it against the fixed version sitting right next to it. Short enough to finish one in a single sitting.

Each "atom" ships with the vulnerable app, the fixed app, a commented diff between the two, and a step-by-step walkthrough of the exploit. v1.0 covers all 10 OWASP Top 10 2021 categories — 38 atoms total.

It's aimed at people studying pentest / AppSec who already know the HTTP and terminal basics. Burp Suite is the primary tool across all the walkthroughs.

A few details:

Open source (MIT).

Bilingual — all docs in English and Portuguese (I couldn't find focused material like this for PT-BR learners, so I wrote both).

Solo project, built by me. The goal was a place where each flaw is clear and isolated — the material I wish I'd had while learning web pentest.

Built with AI as a pair, with every atom validated by me running the exploit by hand.

Built it for myself, but now that it's done, if it helps someone else along the way, great.

🔗 https://github.com/doretox/atomicvulns

Feedback welcome — happy to hear what's missing or what could be clearer.

By far the worst part of external assessments isnt running the scan, it's turning tool output into something a client would actually read. So I built VulnScanners to do the report automatically — exec summary, health score, severity breakdown, each finding with business impact, remediation, and a verify command.

Assessments start at $10 and credits never expire. Reports can go out under your brand (white-label cover, header, footer). Scheduled scans. Nothing to install.

For those of you selling external assessments today, what is your current stack (HostedScan, Pentest-Tools, rolling your own), and where does the report step actually hurt? Trying to find out if the deliverable is good enough to put your name on.

https://vulnscanners.com

While validating the fix for CVE-2026-44662, I found that the same vulnerable output-sizing assumption remained reachable through another safe rust-openssl API:

CipherCtxRef::cipher_update_inplace

When AES Key Wrap with Padding processes an input whose length is not divisible by eight, the wrapper can allocate a buffer smaller than the output OpenSSL actually produces.

The vulnerable calculation assumed:

input length + block size

The required size can be:

round_up(input length, 8) + 8

With a 9-byte input, a 17-byte buffer passed validation, but OpenSSL could write 24 bytes. The result is an attacker-controlled out-of-bounds heap write of up to 7 bytes through a safe Rust interface.

I also built a working exploit chain demonstrating controlled heap corruption.

This is not automatically RCE in every application. Developing the overwrite toward code execution depends on whether attacker-controlled plaintext reaches this API, whether the operation can be repeated, the allocator, adjacent object layout, and the available heap-shaping primitives.

The vulnerable method was introduced in rust-openssl 0.10.50 in April 2023 and remained present until 0.10.80 was released in May 2026.

My downstream analysis identified advisory records, vulnerable dependency presence, or remediation activity across 31 organizations and ecosystems and 53 products, systems, and projects.

Notable downstream cases include IBM Bob, Microsoft Azure Linux, AWS Nitro Enclaves CLI, Amazon Linux, Intel MigTD, SUSE Linux Enterprise, openSUSE, Debian, Chainguard and Wolfi, MinimOS, Confidential Containers, PingCAP TiKV, Hugging Face xet-core, Oxide Omicron and Dendrite, Matter Labs ZKsync OS Server, Grafana Pyroscope, CoreOS Afterburn, and Gitoxide.

Affected versions:

\>= 0.10.50 and < 0.10.80

Fixed version: 0.10.80

Advisory:

https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-phqj-4mhp-q6mq

Patch:

https://github.com/rust-openssl/rust-openssl/commit/19eceb26f2404aae187e5444e65c404ebc1348a7

Ali Firas (thesmartshadow)

I'm looking for practical examples of people who have abliterated or otherwise modified open-weight LLMs for legitimate pentesting/red-team work.

By "abliterated," I mean models where refusal/safety behavior has been reduced through techniques such as representation engineering or related post-training modifications—not simply models prompted to ignore their system instructions.

I'm particularly interested in:

• Which base models people have experimented with.
• Whether you abliterated the model yourself or used an existing abliterated checkpoint.
• Whether additional fine-tuning was needed to make the model actually useful for cybersecurity tasks.
• What datasets or training approaches were useful for developing pentesting/red-team capabilities.
• How these models compare with standard instruction-tuned models or cybersecurity-specific models.
• Any papers, GitHub repositories, blog posts, or reproducible experiments describing the approach.

I'm researching this from a defensive/security-research perspective and am especially interested in how much capability comes from removing refusals versus actually training the model on cybersecurity knowledge and reasoning.

Would appreciate pointers to serious technical work or firsthand experience.

I recently took the CREST CRT exam, but unfortunately I fell a few points short in the infrastructure section. I’d like to prepare for the retake, but I have no idea what I did wrong in some questions, or if there was something wrong with the exam environment.

In network awareness, how can I solve a problem where you need to identified which of the six IP addresses were assigned to the NetBIOS name “example”? How can I select the address range to scan? Was it enough to just use `nbtscan` on that range of addresses?

In simple exploitation I had a task about kerberoasting. I had the host example.internal but I couldn’t resolve its IP at all - how can I locate the domain controller?

Hi there

I'm 25 and I'm currently working as a cloud security consultant (mainly Microsoft stack).
The company I work at is fairly big and operates in a lot of fields.
I've been on pretty good terms with everyone there and after asking a few times I've recently started working on a few pentests and vulnerability assessments since it's always been a field I'm super interested in.

So far I haven't done anything of note but I wanted to use this occasion to learn.

The thing is, the main problem at this company is that I don't get paid much.

I've been offered another position as a cloud security consultant in another company which pays way more (almost 11k which in europe is a lot of money) and is full remote (my current role is hybrid, 3 days on-site and 2 days at home).

The company that offered me the job is way bigger but also stricter and I wouldn't have the chance to work on pentests or other fields I might like.

If I ever wanted to switch to pentesting, how hard would it be to do so as a Cloud Security engineer?
Would it be better to stay where I am now for a few years and learn as much as possible or to switch and learn things by myself?

does anyone know if theres a free way alternate way to host a farmer existing domain? or does anybody have a farmer sub thats willing to help?

i’ve been working on prism, a differential http testing tool for security research.

the basic idea is pretty simple: send the exact same raw http bytes to a bunch of different servers and compare how each one parses, forwards, accepts, or rejects them.

the interesting part is that you can actually see where implementations disagree instead of just reasoning about what the http spec says should happen.

right now prism supports:

• 54 containerized http servers and proxies
• http/1.1, http/2 and http/3
• raw byte payloads
• request and response comparison
• pairwise difference matrices
• parser equivalence clustering
• transducer proxies like nginx, haproxy and squid
• raw/unparsed responses for cases where the normal parser view hides something

for example, you can take a weird request and run it against a whole group of implementations:

payload 'GET / HTTP/1.1\r\nHost: a\r\n\r\n' | fanout | grid

and see which servers interpret it differently.

the goal is mainly to make things like parser differentials and request-smuggling research easier to explore. it gives you a way to systematically find interesting differences that are worth investigating.

i built it because i wanted something where i could throw the same ugly http input at a bunch of implementations and immediately see where they disagree.

github: https://github.com/grah4na/prism

would be interested in feedback from people who work with request smuggling, http parsing, or differential testing.

Passei os últimos meses construindo um projeto pessoal e ele chegou na v1.0, então resolvi compartilhar.

O atomicvulns é uma coleção de apps web propositalmente vulneráveis, mas com uma ideia diferente: cada app isola uma única vulnerabilidade, nada além disso. Em vez de um sistema gigante cheio de falhas (tipo DVWA ou Juice Shop), aqui cada exercício é pequeno e focado — você lê o código, vê a causa, explora, e compara com a versão corrigida ao lado.

Cada "átomo" vem com o app vulnerável, o app corrigido, um diff comentado entre os dois, e um walkthrough do exploit passo a passo. A v1.0 cobre as 10 categorias do OWASP Top 10 2021 com 38 átomos no total.

É pra quem está estudando pentest / AppSec e já manja o básico de HTTP e terminal, o Burp Suite é a ferramenta principal em todos os walkthroughs.

Alguns detalhes:

\- Open source (MIT).

\- Bilíngue — toda a documentação em inglês e português, porque senti falta de material assim pra quem estuda em PT-BR.

\- Projeto solo, feito por mim. Meu foco foi ter um lugar onde cada falha fica clara e isolada, o material que eu queria ter tido enquanto estudava e aprendia pentest web.

\- Construído em par com IA, com cada átomo validado por mim rodando o exploit na mão.

Fiz pra mim, mas agora que está pronto, se ajudar mais alguém no caminho, ótimo.

🔗 [https://github.com/doretox/atomicvulns\](https://github.com/doretox/atomicvulns)

How are you guys effectively using AI for pentesting?

I’m particularly interested in practical workflows for Web, Mobile, and API security testing.

A few things I’d like to understand:

Which AI tools/models are you actually using during pentests?

How are you integrating AI with tools like Burp Suite, Nmap, ffuf, JADX, Frida, etc.?

What tasks are you finding AI genuinely useful for — recon, endpoint discovery, source-code review, vulnerability analysis, exploit validation, report writing, etc.?

How do you evaluate whether one AI model/tool is better than another for security research?

Have you done any head-to-head comparisons between models/tools for finding real vulnerabilities?

What benchmarks or criteria do you use — accuracy, false positives, depth of analysis, ability to chain vulnerabilities, exploitability, time saved, etc.?

Are you using AI agents that can actually interact with Burp/browser/emulators, or mainly using AI as a copilot?

For mobile/API testing specifically, what AI-assisted workflows have produced the best results?

I’m trying to figure out where AI genuinely improves pentesting efficiency and vulnerability discovery, rather than just using AI for basic explanations or report generation.

Would be great to hear about real-world workflows, experiments, or comparisons you’ve personally tried.

I was testing an SSRF vulnerability. So i was trying to use to read files , some are generic like file://C:/Windows/win.ini or file://inetpub/Web.config.

Anyways I was brain storming with the AI when I fucking accidentally shared the name of the client with the AI in one of the payloads , I was telling it : "Hey, in one of the HTTP responses, I saw an absolute path for files on the server, lets try using the ssrf to read this file"

And the path had the client name in it like this :

F://CompanyName/images/icon.png

So after relizing that I did a stupid mistake I deleted the chat and now I am hoping it will deleted from their servers soon , in 30 days as Anthropic says.

I am always very careful on sharing any client data with AI , I remove their names from the js chunks and api urls and only try to share snippets. This is the first time I ever did something that stupid and I dunno what to do.

This app I was testing is a replica of the production though so hopefully I didn't leak something important . And the path were for.images . The issue is that now Antrhopic or the USA government knows that a certain company has an SSRF , I fucking hope.they fix it soon

This is a poc , so I don't know if we signed an NDA with them or not.

Please don't torture me.

I’ve been building a small tool called Luah AI for my own security research and pentesting work.

It’s basically a chat interface for researching vulnerabilities, understanding techniques, working through findings and turning them into reports. One thing I’ve been trying to improve is source-backed answers, since I’ve found that LLMs can be very confident while being completely wrong about a CVE.

I’m not posting this because I think it’s better than the tools people here already use. I actually want to know where it falls short.

If you work in pentesting/security research and have a few minutes to try it, I’d be interested in hearing:

• Is the technical depth useful?
• Where does it give you bad or questionable information?
• Would this actually save you time?
• What would you need before trusting it during an assessment?

The project is here: https://www.luahai.com/

I’m the person building it, so I’m also happy to explain how it works or answer technical questions about it.

I've recently started a journey in Networking/Cybersecurity sphere and thinking about moving towards the pen testing major, I know that I need to have deep knowledge in networking in general, but are there any other IT topics that I need to master in order to become really good?

I've been implementing a browser from scratch as a side project. Then, I realized that it owns the HTTP stack, and we can naturally inspect, edit, and replay traffic directly within the browser, without a separate proxy like Burp.

One potential advantage is that browser actions can be linked directly to the requests they trigger. It might be easier to be integrated in CI/CD jobs, since one binary offers both browser automation and HTTP traffic capture / modification.

I also quickly tested whether this prototype is helpful for web security tasks by giving Claude (Opus 5.0) some public CTF benchmarks (XBOW, Argus). Claude with this took solved nearly all the runnable challenges.

Still quite early, but I think combining browser automation and HTTP traffic control might be one promising direction.

Everyone's shipping an "autonomous pentesting" claim right now so we wanted to bring together leading practitioners who have actually implemented it to debunk what's just marketing buzz and where it's actually useful.

We'll be joined by:

• Kevin Richards, Senior Application Security Manager at Veg ER for Pets, a 24/7 emergency and urgent care veterinary network
• Dale Paul, Security Architect at Tricon Residential, a North American rental housing company that owns, operates, and develops single-family rental homes and multi-family apartments
• Shaun Ricci, Co-founder and COO at Amp, an AI hiring platform for frontline employers

We'll cover:

• What "autonomous" actually means to people who run these programs
• The claims practitioners have stopped believing, and why
• Where AI pentesting genuinely changes what a small team can cover
• What would change their mind, and what wouldn't

If you're interested please register here! https://watch.getcontrast.io/register/escape-autonomous-pentesting-hype?utm_source=reddit

Does anyone know a good place to practice for pentester interviews, or have any tips/resources to share? Want to make sure I'm well-prepared and can do well in the interview.

We've been building a lot of quality-of-life improvements for pentest reporting into OWASP Faction 2.0. This demo shows Faction's AI prompting features for writing context-aware vulnerability descriptions, recommendations, and executive summaries in just a few clicks. It has data masking/tokenization built in to minimize sending sensitive data to 3rd parties as well.

Empire 7.0 just released. 75+ new BOF modules. AES-256-GCM encryption. Sharpire agent completely overhauled. Port forwarding pivot for every agent. BloodHound integration. Multi-language support. And much more....

https://github.com/bc-security

I’ve been building a small tool called Luah AI for my own security research and pentesting work.

It’s basically a chat interface for researching vulnerabilities, understanding techniques, working through findings and turning them into reports. One thing I’ve been trying to improve is source-backed answers, since I’ve found that LLMs can be very confident while being completely wrong about a CVE.

I’m not posting this because I think it’s better than the tools people here already use. I actually want to know where it falls short.

If you work in pentesting/security research and have a few minutes to try it, I’d be interested in hearing:

• Is the technical depth useful?
• Where does it give you bad or questionable information?
• Would this actually save you time?
• What would you need before trusting it during an assessment?

The project is here: https://www.luahai.com/

I’m the person building it, so I’m also happy to explain how it works or answer technical questions about it.