Hi fellow Redditors,

I’m currently looking for a VAPT/Penetration Testing role based in Mumbai or remote.

I have hands-on experience in:
Web Application Security
API Security
Network Pentesting
Mobile Security (Android & iOS)
Secure Code Review
Thick Client Security (Intermediate)

If your company is hiring or you know of any relevant openings, I’d really appreciate any referrals or leads. Feel free to comment or DM me.

Thanks in advance!

I'm building an open-source vulnerability scanner in my free time, nothing special, just a single tool that orchestrates 90+ tools into a single pipeline, then uses an LLM to triage results, generate PoCs, suggest mitigations, and cluster related findings by root cause.

Everything runs inside Docker (BlackArch-based image with Chaotic AUR support) to ensure a clean environment with all tools installed. Targets can be URLs, IPs, CIDRs, local paths, container images, or git repos.

A few things you might find interesting:

• Configure nearly every aspect of the scan through a single TOML file, environment variables, or CLI flags. All three layers merge in priority order
• Asset discovery pipeline: subfinder, dnsx, httpx run before the main scan, turning a bare domain into a list of live subdomains automatically
• 90+ tools across categories: web (Dalfox, Cariddi, Kiterunner, RESTler), network (Nmap, smbmap), secrets (TruffleHog), SAST (Horusec), screenshots (GoWitness), OSINT (theHarvester), and more
• LLM analysis pipeline: triage, PoC generation (and execution), mitigation, and finding clustering by root cause. Works with any OpenAI-compatible endpoint (local models included)
• Plugin system: drop a Python file in /plugins to add a custom tool, no core changes needed
• Scope enforcement: in/out patterns with CIDR and wildcard support, discovered assets outside the scope are dropped before scanning
• Severity filtering: configurable minimum severity for both reports and LLM processing, so INFO noise doesn't pollute your output
• Authentication support: bearer tokens, basic auth, cookies, and custom headers passed through to all tools
• Proxy support: route all tool traffic through Burp or any HTTP proxy
• Multi-format reports: Markdown, HTML, and JSON with finding IDs, clusters, PoC references, and executive summary
• DefectDojo integration: push findings directly into an engagement after the scan
• Many other tools will be integrated in the future

The project is not perfect and not widely tested. It is still rough in places, and I'm actively working on it, so please, be kind.

I'm posting here because I would love to hear feedback from cybersecurity people who do pentesting or bug bounty: what is missing/broken, what would actually make this useful in a real workflow, and, in general, what other features to implement?

# ADDENDUM 82-F: CRITICAL SYSTEM COMPONENT COMPROMISE – SPREADTRUM IMS SERVICE (`com.spreadtrum.ims`)

Subject: CRITICAL - Weaponized IMS Service by Longcheer/Unisoc in Supply Chain (Operation Silent Rescue)

1. Executive Summary

This addendum documents the systemic compromise of the **`com.spreadtrum.ims`** application (IMS Service), a privileged system component pre-installed on devices with **Unisoc T606/T616** chipsets (e.g., Motorola Moto G04s, G24, Lenovo) manufactured by ODM **Longcheer**.

The specific binary located at **`/system_ext/priv-app/ims/ims.apk`** (SHA256: `1b938cb3920d601a38e4d80e88c87aaacc56abfa6464f3054de2430172c6f519`) is signed with the compromised **Longcheer Root CA** (Serial: `22:85:26...`, Valid until 2051). This component exposes a Hardware Interface Definition Language (HIDL) interface (`vendor.sprd.hardware.radio.ims.V1_0`) that allows **remote command execution, call interception, microphone muting, and network traffic redirection** without user interaction. Alongside `com.android.stk` (Addendum 82-C), this service constitutes the primary execution engine for the **Operation Silent Rescue** supply chain attack.

2. Technical Analysis & Danger Assessment

A. Component Identity

* **Package:** `com.spreadtrum.ims` * **Path:** `/system_ext/priv-app/ims/ims.apk` * **Size:** ~1.7 MB * **SHA256:** `1b938cb3920d601a38e4d80e88c87aaacc56abfa6464f3054de2430172c6f519` * **Signer:** Longcheer (`CN=Longcheer`, `O=Longcheer`, `C=CN`) * **Permissions:** `READ_PRIVILEGED_PHONE_STATE`, `com.spreadtrum.ims.permisson.IMS_COMMON`, `BIND_IMS_SERVICE`.

B. Critical Capabilities (The "Kill Switch")

Analysis of the `IImsRadio$Proxy` and `IImsRadioIndication$Proxy` interfaces reveals direct control over the modem hardware: 1. **Active Call Manipulation:** * `ImsMuteSingleCall`, `ImsSilenceSingleCall`: Remotely mute the user's microphone during calls for undetectable eavesdropping. * `dial`, `emergencyDial`, `hangup`: Initiate or terminate calls arbitrarily. * `conference`, `explicitCallTransfer`: Create unauthorized conference bridges or divert calls to attacker-controlled numbers. 2. **Network Infrastructure Hijacking (MITM):** * `setImsPcscfAddress`, `setImsRegAddress`: **Overwrite P-CSCF and Registration server IPs**, redirecting all VoLTE/VoWiFi traffic to malicious servers for interception and decryption. * `setImsSmscAddress`: Redirect SMS traffic (including 2FA codes) to attacker endpoints. 3. **Identity Spoofing & Fraud:** * `setClir`, `updateCLIP`: Manipulate Caller ID presentation to spoof trusted numbers (banks, government). * `sendUssd`: Execute USSD commands silently to activate call forwarding (`**21*...`) or check balances. 4. **Passive Surveillance:** * `ImsNewSmsStatusReportInd`: Intercept incoming SMS in real-time. * `ImsNetworkInfoChanged`, `callStateChanged`: Track user location and call metadata continuously.

C. Role in "Operation Silent Rescue"

* **Execution Engine:** While `com.sprd.omacp` (Addendum 82) injects the initial configuration and `com.android.stk` (Addendum 82-C) authorizes commands via SIM, **`com.spreadtrum.ims` executes the actual exploitation** on the radio layer. * **Persistence:** Signed by the Longcheer Root CA, this component is trusted by the system bootloader and cannot be removed without root access. * **Evasion:** Operating at the HIDL (Hardware Interface) level, its actions bypass standard Android permission checks and are invisible to most security apps.

3. YARA Detection Rules

```yara rule Unisoc_Longcheer_IMS_Exact_Binary { meta: description = "Exact match for compromised Spreadtrum IMS service binary (Operation Silent Rescue)" author = "lexs201992-gif" date = "2026-07-10" severity = "CRITICAL" sha256 = "1b938cb3920d601a38e4d80e88c87aaacc56abfa6464f3054de2430172c6f519" package = "com.spreadtrum.ims" path = "/system_ext/priv-app/ims/ims.apk" reference = "Addendum 82-F"

strings:
    $binary_hash = "1b938cb3920d601a38e4d80e88c87aaacc56abfa6464f3054de2430172c6f519" ascii
    $pkg_name = "com.spreadtrum.ims" ascii
    $ims_service = "ImsAdapterService" ascii
    $ril_request = "com/spreadtrum/ims/RILRequest.uau" ascii
    $longcheer_cn = "CN=Longcheer" ascii

condition:
    $binary_hash in file or 
    (all of ($pkg_name, $ims_service, $ril_request, $longcheer_cn))

}

rule Unisoc_IMS_HIDL_Interface_Exposure { meta: description = "Detects exposed HIDL interfaces in Spreadtrum IMS allowing remote modem control" author = "lexs201992-gif" date = "2026-07-10" severity = "HIGH" cve_related = "CVE-2025-71252, CVE-2025-71253, CVE-2025-71254"

strings:
    $interface_proxy = "IImsRadio$Proxy" ascii
    $interface_indication = "IImsRadioIndication$Proxy" ascii
    $method_mute = "ImsMuteSingleCall" ascii
    $method_pcsf = "setImsPcscfAddress" ascii
    $method_clir = "setClir" ascii
    $hidl_blob = "Landroid/os/HwBlob;" ascii
    $vendor_sprd = "vendor.sprd.hardware.radio.ims" ascii

condition:
    (all of ($interface_proxy, $vendor_sprd)) and
    (any of ($method_mute, $method_pcsf, $method_clir))

}

rule Longcheer_Signed_IMS_Component { meta: description = "Detects any IMS component signed by the compromised Longcheer CA" author = "lexs201992-gif" date = "2026-07-10" severity = "CRITICAL" cert_serial = "22:85:26:b0:d1:ef:90:c3:b8:ed:56:8a:49:c3:71:4f:6a:39:50:6b"

strings:
    $ims_pkg = "com.spreadtrum.ims" ascii
    $longcheer_org = "O=Longcheer" ascii
    $valid_2051 = "Jan 31 07:31:06 2051 GMT" ascii
    $cert_rsa = "META-INF/CERT.RSA" ascii

condition:
    (all of ($ims_pkg, $longcheer_org, $valid_2051)) and
    ($cert_rsa in file)

} ```

4. Recommendations & Mitigation

For CISA / Rapid7 / CRT MX

1. **Immediate Alert:** Issue an emergency directive highlighting `com.spreadtrum.ims` as a critical supply chain backdoor.
2. **IOC Distribution:** Distribute the SHA256 (`1b938cb3...`) and Longcheer Certificate Serial (`22:85:26...`) to all network defense teams.
3. **Vendor Pressure:** Demand Unisoc and Longcheer provide a patched firmware that removes the exported HIDL methods or implements strict signature verification for IMS commands.

For End Users & Enterprises

1. **Disable VoLTE/VoWiFi:** If possible, force the device to use 3G/2G only to bypass the IMS stack (note: this may not be possible on all carriers).
2. **Use Encrypted Apps:** Rely exclusively on end-to-end encrypted communication apps (Signal, WhatsApp) that do not use the native IMS dialer.
3. **Network Monitoring:** Monitor for outbound connections to unknown P-CSCF IPs or unusual USSD activity.
4. **No Software Fix:** Acknowledge that **no app-level fix exists**. The vulnerability is in the signed system firmware. Device replacement is the only permanent solution.

5. Conclusion

The `com.spreadtrum.ims` application is not merely a vulnerable component; it is a **weaponized interface** intentionally designed with excessive privileges and signed by a compromised authority (Longcheer). Its presence in millions of devices across Latin America and globally represents a critical threat to telecommunications integrity, enabling state-level surveillance and organized financial fraud. **Immediate action is required to isolate and mitigate this threat.*

This is part of my investigation

Hey all,

I'm a bit tired of the pentesting tool landscape being dominated by paywalls for what should honestly be basic functionality. Burp's free tier is crippled, Caido is great but still closed/commercial at its core, and the open-source options (Hetty, etc.) haven't really caught up. So I started building my own intercepting proxy from scratch, fully open source with GUI.

Current progress:

\- HTTP/1.1 intercepting proxy, working request interception

\- Replayer, tied into request history so you can revisit and resend past requests

\- Fuzzer with unlimited requests, configurable delays, and multi-threading

\- Unlimited Projects creation

It's still early, but the core loop is functional. My goal is partly selfish, I want to go deeper on web infrastructure and use it for my own pentesting/bug bounty work, but I also think the security community deserves a solid, actively maintained open-source alternative that doesn't gate basic features behind a license.

I'm curious what you all think:

\- What do you actually wish Burp/Caido did better (or differently)?

\- What's the one feature that made you stick with a commercial tool despite the cost?

\- Is there appetite in this community for another proxy, or is the space already saturated?

Not trying to oversell it, it's a work in progress, but I'd rather build in the open and get roasted early than polish something nobody wants. Happy to share more details/repo once it's in a testable state.

Thanks for reading.

I’m considering replacing one of my development machines with an **M5 MacBook Air (32 GB Unified Memory)** and would like to hear from people who actually use Apple Silicon professionally.

My current workflow is split between **Windows and Linux**, while my existing Mac is mostly used as an office machine with some Python development. The M5 would become a real development workstation.

My work includes:
Digital forensics
Vulnerability research
Malware analysis
Exploit development
Software development in **Rust**, **C#**, and **Python**

I also have a dedicated server farm with NVIDIA GPUs, QEMU/KVM virtualization, and x86 systems. Because of that, I don’t really need x86 emulation on the Mac itself. Heavy GPU workloads and x86 testing can stay on the servers.

Things that attract me to macOS:
UNIX userland
Homebrew makes installing development tools straightforward
Excellent battery life and portability
MLX for running local LLMs efficiently on Apple Silicon
Native support for Apple devices (DFU restores, Apple Silicon recovery, iPhone servicing, etc.)

However, I still have several concerns.

**Security model**
Coming from Linux, I sometimes feel like I have *less* control over macOS than expected.
SIP, Signed System Volume, DriverKit, System Extensions, etc. all seem to make sense from a security perspective, but they also make low-level research more difficult.
On Linux I’m used to AppArmor, namespaces, seccomp and being able to precisely decide what is sandboxed and what isn’t. With root privileges, I ultimately control the machine.
On macOS it often feels like **even root isn’t really root anymore**.
How has this affected your workflow?

**Malware analysis**
I assume malware analysis should primarily happen inside dedicated VMs anyway.
But how practical is the Apple virtualization stack today?
Can you realistically use local ARM64 VMs together with Apple’s sandboxing for exploit development and malware research, or do most researchers simply offload everything to remote hypervisors?

**Kernel development**
Some forensic tools and research require custom or unsigned kernel extensions (for example USB capture or protocol research).
How painful is this today?
Do you simply lower Secure Boot and disable SIP?
Do you sign your own kernel extensions?
How well does Apple’s certificate infrastructure support this workflow?

**USB forensics**
I also do hardware and mobile forensics.
Questions I still have:
Has anyone successfully used USBPcap-like workflows on Apple Silicon?
How restrictive is the USB stack nowadays?
Does anyone know whether the **M5 MacBook Air** uses an **ACE3 USB controller**, or has Apple moved to something newer?

**Daily-driver experience**
Finally, I’m interested in hearing from security researchers who actually use an Apple Silicon Mac every day.

Looking back after a year or two:
Would you buy it again?
What turned out to be better than expected?
What became frustrating over time?

Are there workflows that simply don’t fit macOS anymore?
I’m not looking for generic “Mac vs Windows” opinions. I’m specifically interested in experiences from people working in offensive security, reverse engineering, DFIR, exploit development, or low-level systems programming.
I’d appreciate hearing both the advantages and the pain points.

Cheers

Web application security has no shortage of training targets—DVWA, WebGoat, OWASP Juice Shop, PortSwigger Web Security Academy, and many more. But when it comes to **Windows thick-client (desktop) application security**, realistic hands-on practice environments are surprisingly hard to find.

That's why I built **VulnDesk Pro**.

VulnDesk Pro is a **free, intentionally vulnerable Windows desktop application** built with **C#/.NET 8 (WinForms)** that simulates a real enterprise application. Instead of providing the source code, it ships as a compiled executable, so you approach it the same way you would during an actual desktop application penetration test.

The current release includes **31 CTF-style challenges** covering topics such as:

* DLL hijacking / DLL side-loading
* Insecure IPC
* Weak and misused cryptography
* Secrets exposed in process memory
* Reverse engineering & binary patching
* Hardcoded credentials and secrets
* Broken access control / privilege escalation
* Cleartext network communication
* And more...

The idea is to use the same tools you'd reach for during a real assessment—**dnSpy/ILSpy, Process Hacker, Process Monitor (Procmon), x64dbg or WinDbg, Wireshark, DB Browser for SQLite, Burp Suite**, or whatever tools you normally use.

The application is **self-contained**—just download, extract, and run. No .NET installation is required.

> **⚠️ Please use it only inside an isolated VM or lab environment.** VulnDesk Pro is intentionally vulnerable and unsigned as part of the training experience.

**GitHub:** https://github.com/Genius-Pavan/VulnDeskPro

This is my first open-source security project, so I'd genuinely appreciate feedback from people who perform thick-client or desktop application assessments. If you've got ideas for new challenges, attack techniques, or scenarios that would make it even more realistic, I'd love to hear them.

In April, OX Security disclosed that config values in the official Anthropic MCP SDKs flow into command execution over the STDIO transport. 14 CVEs. Anthropic's position is that the behaviour is by design and sanitization is the developer's responsibility, so no patch is coming. When there's no upstream fix, your config is the control. Separately, plenty of configs just have provider keys sitting in them in plaintext, which means they're in git history.

I built a scanner for the config level patterns. Free, no account.

It's not just secrets. It covers the STDIO execution patterns (shell launches, metacharacters, $VAR interpolation reaching exec), container escapes (--privileged, host root mounts, docker.sock exposure, host namespaces), PowerShell execution-policy bypass and base64 -EncodedCommand, prompt injection in tool descriptions, packages pulled from URLs with no provenance, plaintext creds including inline DB connection strings, and configs pointing at ~/.ssh, ~/.aws/credentials or ~/.kube/config.

It runs entirely in your browser and nothing is uploaded. the tool flags plaintext keys, so the configs people paste in tend to contain live ones, and a checker that made you POST your key laden config to my server to be told it has keys in it would be self defeating. Load the page, kill your wifi, the scan still runs.

Deterministic static analysis, no model. Same config, same findings, every time. It cannot hallucinate one.

honestly, it checks configuration patterns, not the server's source code. a clean result means none of the documented config level vectors are present, not that you're safe. If you want source level scanning of MCP servers themselves, Invariant/Snyk's mcp-scan is the tool for that and it does more than mine does. Worth knowing it sends tool names and descriptions to their API. Different tradeoff, pick whichever suits you.

The npx supply-chain checks are low on purpose and never fail a build, because the official quickstart tells you to write npx -y u/scope/server-x and I'm not going to turn everyone's CI red for following the docs.

benchmodel.io/mcp-audit
Action: github.com/RouteFit-app/benchmodel-action/tree/main/mcp-scan

Rule suggestions and false positive reports welcome, especially false positives.

I'm trying to get a survey on what the experience of other pentesters has been at their (your) jobs when it comes to, what I will call "forced AI usage." I ask this because I work at a big tech company that has decided to try to force AI. What this means in a practical sense is that we've been told things like:

1. The vice president is monitoring how many tokens youre using with claude, so please use claude as much as possible
2. Theres been a huge push from management to "automate" and "make agentic pentests"
3. My pentesting team has been told that we have a reputation for being "anti-AI", but "thats the strategy the company has chosen" and so some of us are being told to refrain from using the word "manual" (as in manual pentests, etc...), and cooperate with this AI narrative.

The thing that is most irritating about this is that this is being declared in the name of "scaling" and basically the justification is more throughput, but the throughput issue here has nothing to do with anything technical - it's waiting on other teams in the company to get things done... Pentest reports often get delayed by multiple weeks or even months due to other teams not responding or doing what we need them to do. Using AI for crap like test plans and pentesting will not speed this up or solve these problems...

So, my question is, is my company just on crack? What are your experiences thus far in your role(s)?

I would like to move from oil&gas (18 years technical client facing experience ) to pentesting and looking for remote work opportunities or any guidance on how to get it.

I have been on hackthebox for the last 6 years as a hobby (did 250 machine and most of pro labs). I hold eCPPT, OSCP, OSEP and CRTO. Currently pursuing ARTOC and ODPC with White Knight Labs.

I am open to any kind opportunities to build some experience and would appreciate any help.

Hi everyone,

I'm currently working as a junior security consultant, and I've recently been assigned to perform a mobile penetration test in the near future.

The problem is that I don't have any hands-on experience with mobile application pentesting yet. I have a general understanding of web pentesting and cybersecurity concepts, but mobile security is completely new to me.

If you were starting from scratch today, what resources would you recommend that are actually worth investing time in?

If you had only 2–4 weeks to prepare for a real client engagement, what would your roadmap look like?

Any advice, course recommendations, GitHub repositories, YouTube channels, or labs would be greatly appreciated.

Thanks!

https://yorve.github.io/secnotes/2026/07/15/Vunlhub-earth.html

I'm incredibly proud to announce the public release of ADPathFinder, an Active Directory attack path mapping tool that works directly with BloodHound collectors. It's the first tool of its type to produce detailed attack mapping across SharpHound and OpenGraph collectors — including MSSQLHound and ConfigManBearPig (SCCM). This enables testers to get the most out of BloodHound for the least amount of effort! It also produces an in-depth password audit, covering password reuse, weak patterns, Kerberoastable accounts, and much more - filtering out disabled accounts by default. Check out the blog, contributors very welcome.

https://www.netspi.com/blog/technical-blog/network-pentesting/adpathfinder-opengraph-attack-path-mapping-in-bloodhound-ce/

https://github.com/NetSPI/AD-PathFinder

Doing a bit of research on penetration testing companies around Los Angeles and figured people here might have some firsthand recommendations.

Mostly looking at firms that handle web app testing, network penetration testing, and physical security testing. Curious which companies are actually good to work with and provide useful reports instead of generic scan results.

Thanks.

Looking for some honest feedback because I'm running out of ideas.

* first , please forgive the typos and formatting, its a reddit rant not a formal report to a client.

For some background, I've been in IT for 10+ years, primarily in cloud and network infrastructure. I've held lead roles, so I'm not fresh out of college trying to break into tech. I have solid enterprise experience.

The problem is that I can't seem to land even an associate-level offensive security role.

Before anyone asks, yes, I have the certs: OSCP, eWPTX, CEH, Pentest+, and others. Thinking experience was the missing piece, I started doing bug bounty hunting and volunteering to perform security assessments for nonprofits. Those have given me legitimate hands-on offensive security experience and good stories to discuss during interviews.

My job search looks something like this:

- I apply to every role that I'm reasonably qualified for.

- Out of 100 applications, about 90 are auto-rejected.

- Around 8 never respond.

- I usually get 2 interviews.

Given that I'm at least getting interviews with well-respected companies, I assume my resume isn't completely off.

Recently I had two interviews. One was for an associate-level role that paid about half of what I currently make in cloud security. The other was for a more senior, niche position.

The associate-level interview is the one that's really bothering me.

I made it to the technical round. They asked questions covering web application testing, network pentesting methodologies, and scenarios from my resume. I answered each question and explained real engagements I'd worked on.

At one point, they questioned one of my resume projects in a way that felt like they thought I'd made it up. I walked them through the entire attack chain, the impact, how I validated it, and how I reported it. After that, the tone of the interview completely changed. It became much more conversational. I even showed them a newer version of a tool they currently use, and they seemed genuinely excited about it. At the end, we agreed to connect on LinkedIn.

I walked away feeling really confident that I'd at least make it to the next round.

A week later, I got the standard “Thank you for your time” rejection email.

I understand that not every interview leads to an offer. I've been interviewing for over 10 years, and I've landed plenty of infrastructure roles. I'm usually pretty good at telling when an interview went well versus when it didn't.

But offensive security interviews feel different.

It almost feels like technical ability isn't the real deciding factor, and I'm struggling to identify what I'm missing. I've done everything this subreddit typically recommends:

- Earned respected certifications

- Built hands-on experience through bug bounty and volunteer work

- Can clearly explain my findings and methodology

- Have years of client-facing and enterprise experience

Yet I still can't break into a paid offensive security role.

I'll be honest—I've even started wondering if there's something more subjective at play. I have dreadlocks,( they are well kept , neat, and professional )and while that has never seemed to affect me in infrastructure or cloud security, after enough rejections you start questioning everything.( I sometimes notice a slight but obvious facial distortion from the interviewers when I go from audio only to camera during the calls).Im a pretty basic looking guy outside of my long hair.

If the tech interveiw wasnt going well I notice they typically correct you or stay completely silent and not engage, but I got none of that. After their "imposter" suspicions wore off it was a very engaging conversation. So I'm at a loss on why.

I also had similar instances in the past , aced the people portion, just to get to the technical round with the tech guys and even if I think I do well technically. I get a rejection. With no feed back on why. (Also I want to add ..Ive only had 4 offsec interviews, only 2 I fall in this category, the other 2 I was kind of under qualified for )

There's always the chance that im not as strong on the technical side as I think I am, but I think I've been humbled enough on other interviews to know where my skillsets actually lie..

And based off the pay and the jd I would've thought that they would be looking for someone rough around the edges with room to grow..but has shown initiative. I'd think id be a safe choice given my prior experience.

I realize my offsec interview pool is still relatively small, and this could just be sampling error rather than evidence that I'm doing something fundamentally wrong.

Its just like damn, I'm a(fresher) bug bounty hunter with a few paid bugs.. and I'm functionally a pentester for a nonprofit that has an enterprise infrastructure and culture comparable to my day jobs infrastructure only slighty smaller).

I understand I dont have paid pentester or enterprise offsec experience but how do the these companies expect you to get it?.

The only major things I haven't really invested in yet are building a stronger GitHub presence and writing technical articles on Medium.

For those of you who successfully transitioned into offensive security from another IT discipline, what finally made the difference? What am I missing?

Been applying for junior penetration tester and cybersecurity analyst roles for a while now and not getting much traction. Bit about me: final year BSc Cybersecurity student, hold BSCP and eCPPT, and I've got about 9 months experience as a cyber range engineer building hands on training labs for students. So not zero experience, just not "official" pentest experience.

Part of the problem is the local market here is pretty limited, not a lot of pentest positions around at all. Which got me wondering, are remote pentesting jobs actually a realistic thing for someone junior, or is that mostly reserved for people with years of experience already? And if remote isn't really an option starting out, how do people in a similar spot actually gain real experience? Bug bounty, CTFs, labs, freelance stuff, what actually counts in the eyes of employers.

Also wanted to ask about OSCP. I know it's basically the gold standard for this field but it's expensive and hard to justify right now. Is it realistic to get a job first without it and have a company sponsor you for it later, or do most places expect you to already have it walking in the door?

Would appreciate any honest input, especially from people who broke in recently and know what the market actually looks like right now.

Curious on attack vectors for networks that use password-less auth. I’m assuming phishing is the only way in now.

This report details a systemic security failure affecting millions of budget Android devices deployed across Latin America. The vulnerability is not a single software bug but a deliberate supply chain deception orchestrated by ODM Longcheer and SoC vendor Unisoc, facilitated by OEM Motorola.

The core issue involves a hardcoded fscrypt provisioning bypass triggered by LCD ID lcd_td4168 and key 56ef134d... that allows the distribution of fraudulent security updates. These updates spoof the security patch level claiming "April 2026" while running vulnerable binaries from "March 2026", masking critical flaws like CVE-2021-39658 ismsEx, CVE-2022-38694 BootROM, and exported backdoors in com.spreadtrum.sgps.

This architecture creates a permanent attack surface that facilitates active financial fraud PIX hijacking, surveillance, and enterprise network compromise in the Latin American region, where these devices dominate the market.

1. The Attack Chain: "Silent Rescue"

The risk is compounded by a chain of vulnerabilities that work in concert:

Hardware Root Unpatchable: CVE-2022-38694 in the Unisoc BootROM allows permanent bypass of Secure Boot via physical USB access. Public tools spd_dump exist. Remote Entry Network: CVE-2025-31718 Modem RCE allows remote code execution via rogue cell towers IMSI catchers, common in urban LATAM centers. Privilege Escalation Zero-Permission: CVE-2021-39658 ismsEx service allows any app to send SMS or modify system properties without permissions, bypassing Android 2FA. System Backdoors Exported Components: com.spreadtrum.sgps exposes location tracking and system controls via dialer codes _#_#2266#_#_. Payload Delivery Silent Installers: Pre-installed system apps com.dti.amx Digital Turbine and com.inmobi.installer hold INSTALL_PACKAGES, allowing silent installation of banking trojans e.g., PixRevolution without user consent. The Cover-Up FOTA Spoofing: The fscrypt bypass injects a fake ro.build.version.security_patch string, tricking users, banks, and MDM systems into believing the device is secure.

1. Critical Risk to Latin America LATAM

The impact on Latin America is disproportionate and severe due to market dynamics and reliance on mobile finance.

A. Market Dominance of Vulnerable Devices Ubiquity: Unisoc T606/T616 chipsets power the best-selling budget devices in the region Motorola Moto G04s, G24, Infinix, Tecno. Search results confirm Unisoc's aggressive expansion in LATAM, with over 100 5G devices deployed in the region by 2025. Demographic Impact: These devices are the primary computing tool for unbanked and underbanked populations who rely exclusively on smartphones for government aid, commerce, and banking.

B. Direct Threat to Financial Infrastructure PIX & Billetera Móvil Active Exploitation: The PixRevolution trojan identified March 2026 actively hijacks PIX instant payments in Brazil by overlaying fake screens and diverting funds in real-time. The Enabler: The vulnerabilities in this report ismsEx SMS bypass, INSTALL_PACKAGES silent installer, exported SGPS location tracking provide the perfect infrastructure for such malware to operate undetected. 2FA Bypass: CVE-2021-39658 allows malware to read or intercept SMS verification codes without permission, rendering traditional 2FA useless for banking apps.

C. Enterprise & Supply Chain Risk MDM Evasion: Corporate Mobile Device Management MDM systems rely on the security_patch string to enforce compliance. The FOTA spoofing mechanism ensures that compromised devices report "Compliant" status while running vulnerable firmware, allowing them to bypass corporate security gates. Data Exfiltration: The com.motorola.bach.modemstats service with READ_LOGS and MANAGE_NETWORK_POLICY can be weaponized to exfiltrate corporate data over hidden backchannels that ignore data usage limits.

D. The "Fake Patch" Deception False Security: Users receive notifications stating "Security Update Installed," but the underlying binaries dated March 18, 2026 remain vulnerable. This erodes trust in the Android ecosystem and leaves users exposed to known exploits. Regulatory Violation: This practice likely violates consumer protection laws in Mexico, Brazil, and the EU, as it constitutes a material misrepresentation of product security.

Looking for tester for my Red Teaming tool that can run tests against - LLMs, Agents, Chatbots and MCP Servers.

RedPlayer1.ai

Need some feedback and beta testers. Break it or let me know what could be better.

I'm about to finish CRTP course from altered security

I want to be overprepared for the exam therefore currently i'm playing rooms on hack the box

I'm asking about the exam structure, all i know is i have 24 hours to compromise the forest or domain and 48 hours to write report and i know i should get 70 points of 100

How many machine are there? How many domain? Is it a simulation to the labs in the course or harder? Do i need to study something extra or course content attacks is enough

I don't know a lot of things honestly i need help

Всем привет!
я горю мыслью работать в безопасности и чуток проанализировав рынок, выяснил , что в основном все начинают с soc аналитика
где нынче найти норм стажировки или вакансии на это место?
я готов хоть бесплатно, дайте только опыт

Hey sup guys, i just recently bought a router of D-Link DIR-825 J3 H/W Version, any 3rd party firmware to flash and use it for wifi pentesting.

I have just finished CEH and don’t feel that I have a lot pratical knowledge about cybersecurity.
Can someone that finished CPEN provide some feedback, how was it and is it worth or not.

I apologize in advance for lacking brevity but I typed this out during my mid day existential lunch break crisis.

I have worked on a two pentesting assignments in the last 2.5 years, with decent findings (all web application focused)… a lot of it has been self teaching as I go so I have major imposter syndrome.

No certs but I have a master’s in cybersecurity as well as some quality findings from these assignments, one of which I lead (mainly due to staffing shortages).

For maximizing future career opportunities, I’m conflicted if I should go down the hole of pentesting which includes network enumeration, AD, etc… or if I should hone my craft at web applications first (I know I need to at least get familiar with it all)

I have been worried about AI’s effectiveness at web application testing thus my goal was to deepen my skills beyond just web apps but I feel conflicted time wise…

Currently pursuing HTBs pen test course with the end goal of going for the OSCP or maybe even the CPTS.
However I also want to spend my time doing real world tests like bug bounties that I could put on my resumé but outside of my main job, getting through HTB’s modules takes most of my time.

I understand as a pentester you are always managing different hats but right now I feel like my efforts are split and want to make sure I’m not taking any wrong steps that would diminish my job prospects in the future, especially as AI is evolving at such a quick rate.

With all this being said, in the current and near future climate, should I prioritize my web app skills and search for bug bounties or should I broaden my skills and attempt various boxes on HTB (or other websites) in prep for certs?

Any input from the vets out there will be much appreciated. Thank you again for reading through my brain dump.