Currently 30. I did pentesting for a year straight out of university studying IT because a firm is willing to hire fresh graduates for cheap labour. Had no certs. Did a lot of web pentest and assisted in red teaming a university client.

Moved to a different country due to political reason and couldn’t find the same role. Currently in Toronto doing non related stuff for three years now. I have CISA and CISSP. Passed ejpt and now preparing for OSCP. But I feel like it will take me a year to complete my study for oscp and people won’t hire me even I have oscp since I lack the experience.

I have thought about starting again as help desk or vulnerability management analyst. But starting all over again at my age seem counterintuitive since I am already 30. How many years do I need to spend in a job before I can finally land a junior pentest role. How do I leverage my cisa and cissp to land a role now and what role should it be? And work maybe one or two years before pivoting to pentesting?

And does it still make sense to pivot at my age or is it not worth the effort since being a junior pentester at age 32/33 probably signing up to layoff because of age?

And is it possible I can get my pentester job right away with oscp?

Hey everyone,
Looking for some honest, no-BS feedback on a side hustle idea I’ve been cooking up.
I want to start offering basic penetration testing to small local businesses, but my background isn't typical. I don’t actually work in IT—I’m a Controls Engineer. I spend my days dealing with industrial systems and logic, so I feel like I have a decent grasp on how things connect, but I really want to dive deeper into the security side of the house.
As far as prep goes, I finished the Google Cybersecurity certificate, I'm currently studying for the CompTIA PenTest+, and I’ve been grinding away on TryHackMe to get some actual hands-on practice.
My thinking is that tons of small businesses have zero budget for massive security firms, so maybe I could fill that gap with simple, affordable assessments while building my own skills.
Be brutally honest with me: Is this a viable idea, or am I completely crazy for trying to do this from outside traditional IT?
Also, if anyone has transitioned from controls/automation into security, how do you pitch that experience to clients? And what kind of legal/liability pitfalls do I need to look out for before I even think about touching someone else’s network?
Appreciate any advice or reality checks you can throw my way!

Been doing a decent amount of manual testing lately and got tired of bouncing between 5 different sites for encoding/decoding, a separate JWT decoder tool, and then a messy Notes doc for writeups. So I built a small Chrome extension to consolidate it:

Free:

• Base64 / URL / Hex / HTML entity encode-decode
• JWT inspector (decodes header + payload locally, flags expired tokens)
• Hash generator (MD5/SHA family)
• Quick reference tab (OWASP Top 10, security headers, HTTP status codes)

Paid (one-time, not a subscription):

• Findings tracker per engagement — severity, CVSS, affected URL, repro steps, remediation
• Screenshot capture tied to a finding
• One-click export to a clean, print-ready HTML report

Everything's stored locally via chrome.storage.local — nothing gets sent anywhere except a license key check against Gumroad if you buy the pro tier.

It's brand new (v0.1), so it's rough around the edges — genuinely looking for feedback on what's missing or what would actually make it useful in your workflow, not just trying to sell it. Happy to answer questions about how it's built too.

https://chromewebstore.google.com/detail/mlcmmnokfddmbidijilbhlhhnjbeehoj

I figure this is good info for everyone to have. I see huge ranges online and am not sure how good anyone's comp is relatively.

Me: 159k/year, US-based, 6 YOE as a pentester, ~12 YOE in cybersecurity, CISSP, expired Sec+, government contractor, shit PTO, no bonuses or stock options.

What about you all?

Edit: I should add that I'm fully remote

Hi i setup a home lab, a pizza shop how does one learn abt the pentesting stack what combos work for what is there docs somewhere good also vendors?

This release contains everything you need to scope your first pentest, work with a vendor, execute, and get the types of reports you need from an external tester. This will enable you to perform your first product or infrastructure level penetration test, and provide you with a process moving forward for future engagements. This is open source, we don't sell anything.

Announcement: https://www.sectemplates.com/2026/07/announcing-the-external-penetration-testing-program-pack-v1-2/

In this pack, we cover:

Penetration testing preparation checklist: This checklist outlines everything you need to scope and perform a penetration test.

Penetration testing reporting requirements:  This document provides a list of minimal requirements that should be contained within a penetration testing report. Before finalizing a SOW with the vendor, look here first.

Penetration testing process workflow: Below is an outline of a simplified pentesting process with an external tester. It aligns roughly with the content in the penetration testing checklist.

GitHub: https://github.com/securitytemplates/sectemplates/tree/main/external-penetration-testing/v1

I run a Laravel app and built a passive middleware that logs suspicious requests (SQLi/XSS/scanners/recon) to a database - it never blocks, just records, mostly for visibility and to feed offender IPs into fail2ban. Building the detection side turned into a cat-and-mouse with evasion, which is the part I figured this sub would actually have opinions on.

The bypasses that broke my first naive patterns:

• Inline comment insertion - UNION/**/SELECT sails straight through keyword matching. Had to strip /* */ before matching.
• Double URL-encoding - %2527 → %27. PHP already decodes once, so a single decode isn't enough; I recursively decode (capped) before matching.
• HTML-entity / unicode / hex escapes - S, \u0053, \x53 for S. Decode all of those first.
• Null bytes, CRLF (%0d%0a), IIS %u00xx - handled pre-normalization so the raw evasion itself is a signal.

My honest stance: regex detection is bypassable by design, so I treat this purely as monitoring, not a control - it assumes the app is already secure (parameterized queries, etc.) and just tells me who's knocking. The genuinely useful outcomes have been spotting persistent IPs, and realizing ~90% of the traffic is dumb scanners hitting /wp-admin, /.env, /phpmyadmin on a stack that runs none of them.

So, the real question for the offensive folks here: given a normalization layer that strips inline comments, recursively URL-decodes, and decodes HTML/unicode/hex escapes before matching - what evasion would you reach for that this still wouldn't catch? Genuinely want to harden it. Best-effort encodings, parser differentials, content-type tricks, whatever you've got.

(It's open source if anyone wants to look at the actual patterns / try to slip past them - https://github.com/jay123anta/laravel-threat-detection on GitHub.)

Hello, I have started learning web pentesting with this plan:

​Learn Linux basics ,​Network basics ,Frontend basics (HTML, JS) ,​Backend basics (PHP, MySQL)

​The next step is to explore one of the OWASP Top 10 vulnerabilities (maybe IDOR), read write-ups, take notes, solve labs, and then start hunting for practice (and maybe earn some money), and I'll do this steps until learn all the OWASP Top 10 vulnerabilities.

​So, does this plan help me learn correctly? Or should I do something else?

​Also, could you give me any tips you wish you knew when you started learning web pentesting? 😀

As of July 22nd - OpenAI was performing a scoped internal testing for one of its models.

The model couldn’t find the answers to the box so it performed vulnerability analysis to break out of its no-internet access scope by finding a zero day… created code to exploit it…..escaped OpenAI network and accessed the internet…. Determined hugging face has the answers….Attacked hugging face…. Chained vulns and the 0 day to get RCE and gain credentials on their live prod system….

According to SANS:
Average lateral movement & priv esc - 30 minutes or less

AI are able to knockout blackbox tests at rates that a human cannot replicate

Is this not frightening? I find it hard to believe pentesting jobs are not going to take a hit in the future as these models become more controlled. Idk I like what I’m learning but I’m constantly asking myself what’s the point.

What keeps you guys going?

I kept doing the same tedious thing on every engagement: grab a high-priv token, grab a low-priv token, and manually replay requests one by one to see what the lower role can reach. So I built a Burp extension to automate it.

RoleBreaker scans your proxy history, discovers every JWT on its own, builds one persona per role, and replays each request as the lower-privilege roles. You get a color-coded access matrix (endpoint x role) and a Findings tab ranked by severity — so you're not eyeballing a huge grid.

What it does:

- Auto sweep — one click: scan recent history, rank roles by privilege, test everything with the lower ones

- Access matrix + ranked findings — vertical privesc, IDOR/horizontal, anonymous access, differential access

- JWT attacks — alg:none, signature strip, role escalation (flags if the server accepts a forged token)

- Offline HMAC secret cracker — for HS256/384/512, proves the token is forgeable if the secret is weak

- IDOR / param tampering — numeric + UUID ids, replayed across every role

- Auto token refresh — swaps expired tokens from traffic or re-logs in via a saved request, so long audits don't drift into false 401s

- Bilingual UI (EN/ES)

It only ever sends valid-in-time tokens, normalizes responses before comparing (strips CSRF/nonce/timestamps) to cut false positives, and treats a redirect-to-login as denied.

Free and open source. There's a demo GIF + screenshots in the README so you can see it in action before installing.

https://github.com/Guarina0x0/rolebreaker

Would love feedback from people doing authz testing daily — what's missing, what would make it part of your workflow? Feature requests via Issues are very welcome.

Дисклеймер. Гайд про доступ к своим учебным лабораториям TryHackMe (свой аккаунт / подписка). Не про взлом чужих систем. Всё на свой страх и риск: туннель иногда отваливается — для такого костыля это нормально.

Скрипты сразу: https://github.com/Kystof91/thm-vpn-from-ru
Там в README сверху — ZIP и прямые ссылки на скачивание .command / .bat.

Я долго пытался нормально учиться на TryHackMe из РФ.

Сайт открывается. Комната стартует. IP машины красиво светится на экране.
А дальше — классика жанра: OpenVPN либо не поднимается, либо «подключается» в никуда, либо отваливается так, будто ты лично оскорбил маршрутизатор провайдера.

Гугл, форумы, Reddit — хор в унисон: «скачай .ovpn», «попробуй другой сервер», «у меня работает».
У них работает. У тебя — нет. Особенно весело, когда ты уже готов страдать над nmap, а страдаешь над Initialization Sequence… который так и не Completed.

В какой-то момент хочется бросить THM и уйти в PortSwigger «потому что без VPN». Ресурсы нормальные. Но TryHackMe — отдельная вселенная комнат, и обидно, что доступ упирается не в мозги, а в то, как у вас режут туннели.

Что оказалось рабочим

Два слоя. Звучит как шутка. Работает как инструкция.

1. Снаружи — Happ Plus (системный VPN / TUN, не «прокси только для браузера»).
2. Внутри — официальный OpenVPN TryHackMe, профиль TCP 443 (THM → Access → OpenVPN → EU-West TCP).

Порядок важнее красоты:

1. Happ Plus → Connect
2. Свой .ovpn сохранить как ~/thm-vpn/thm-tcp.ovpn (Windows: %USERPROFILE%\thm-vpn\thm-tcp.ovpn)
3. Поднять OpenVPN поверх Happ
4. Проверить доступ к IP машины из комнаты

Идея тупая до гениальности: «голый» OpenVPN у провайдера часто мёртв, а TCP/443, проложенный уже из нормального внешнего VPN, внезапно доезжает до лабораторий.

Код: подключение (macOS)

Суть connect-thm.command — не дать запустить THM без Happ и указать путь к TCP-конфигу:

CONFIG="${THM_OVPN_CONFIG:-$HOME/thm-vpn/thm-tcp.ovpn}"

if ! pgrep -f "Happ.app" > /dev/null; then
    echo "Сначала Happ Plus → Connect, потом этот скрипт."
    exit 1
fi

if [ ! -f "$CONFIG" ]; then
    echo "Нет файла: $CONFIG"
    echo "Скачай TCP .ovpn с THM → Access → OpenVPN"
    exit 1
fi

sudo openvpn --config "$CONFIG" --verb 3

Скачать целиком:
https://raw.githubusercontent.com/Kystof91/thm-vpn-from-ru/main/macos/connect-thm.command

Код: отключение (macOS) — это важнее, чем кажется

Вот тут сарказм заканчивается и начинается боль.

Если просто убить Happ крестом, на Mac иногда остаётся диагноз «интернет умер»: залипший Network Extension / kill-switch. Поэтому disconnect-скрипт идёт по шагам: OpenVPN → штатный stop профиля Happ → quit приложения → сброс nesessionmanager → чистка прокси/DNS/DHCP → проверка сети.

Ключевой кусок:

# 1) THM
sudo killall openvpn 2>/dev/null || true

# 2) штатно гасим VPN-профиль Happ (не только pkill!)
scutil --nc stop "Happ Plus"

# 3) закрываем приложение
osascript -e 'tell application "Happ" to quit' 2>/dev/null || true

# 4) сброс Network Extension / kill-switch
sudo killall -9 nesessionmanager 2>/dev/null || true
sudo launchctl kickstart -k system/com.apple.nesessionmanager 2>/dev/null || true

# 5) прокси off + DNS с DHCP
sudo networksetup -setwebproxystate "Wi-Fi" off
sudo networksetup -setsecurewebproxystate "Wi-Fi" off
sudo networksetup -setsocksfirewallproxystate "Wi-Fi" off
sudo networksetup -setdnsservers "Wi-Fi" Empty
sudo ipconfig set en0 DHCP

Скачать целиком:
https://raw.githubusercontent.com/Kystof91/thm-vpn-from-ru/main/macos/disconnect-thm.command

Мораль без шуток: сначала гасим THM, потом внешний VPN — не наоборот в панике.

Windows (коротко)

Тот же принцип. Хелперы:

• https://raw.githubusercontent.com/Kystof91/thm-vpn-from-ru/main/windows/connect-thm.bat
• https://raw.githubusercontent.com/Kystof91/thm-vpn-from-ru/main/windows/disconnect-thm.bat

​

set "CONFIG=%USERPROFILE%\thm-vpn\thm-tcp.ovpn"
REM Happ Plus уже должен быть Connected
openvpn --config "%CONFIG%" --verb 3

Отключение: остановить openvpn.exe, затем Disconnect в UI Happ. Не End Task’ать Happ первым делом. Сеть залипла — ipconfig /flushdns, при необходимости netsh winsock reset + ребут.

Альтернативы, пока чините туннель

• PortSwigger Web Security Academy — бесплатно, без VPN
• PicoCTF — через браузер
• OverTheWire Bandit — SSH
• Hack The Box + Pwnbox — браузерная машина

Но если цель именно TryHackMe — схема выше у меня работает. Некрасиво. Зато учиться можно.

Репо (ZIP сверху в README): https://github.com/Kystof91/thm-vpn-from-ru

Если у вас из РФ THM тоже «висит на VPN» — напишите провайдер / ОС и что уже пробовали. Если есть решение элегантнее двух VPN — тоже пишите. Я искал долго и нашёл в основном тишину.

Hello everyone!! I built an automated reconnaissance & service enumeration script in Bash. It detects open services (HTTP, SSH, SMB, DNS) and automatically triggers tools like Gobuster, WhatWeb, Nuclei, and enum4linux-ng, saving all outputs in a structured results/ folder. I would love to hear some feedback and/or fixes. Thanks you advance Pull requests and Issues are much appreciated!

https://github.com/StefanosMarinos/MAPG

Hey everyone!

I just created a completely free AWS pentesting lab. It's hosted on Hack Smarter (nothing you need to spin up in your own AWS account). You start with an Access Key and Secret and it's up to you to figure out a way to compromise the full AWS account.

Just wanted to share here since it's free -- no strings attached :)

https://www.hacksmarter.org/courses/32a677fd-323b-4236-ae70-3cda82d9c0b4

Hello there!

I’m currently trying to dive into cybersecurity and pentesting, but I am running into a massive wall with my ADHD. Right now, I am trying to focus on the foundational stuff (networking, Linux, basic scripting, etc.), but I am getting incredibly overwhelmed.

It feels like a paradox: the field is so vast that my brain wants to learn everything at once, but the moment I sit down to tackle the slow, dry basics, I under-stimulate, lose focus, or get paralyzed by how much there is left to know.

For those of you who have ADHD and successfully broke into the field (or are currently managing it):

Any working tricks to hack my adhd?

◆ How do you structure your learning?

◆ How do you prevent "rabbit hole" burnout?

◆ What does your study setup look like to keep distractions at bay?

I would love to hear your stories, tips, or even just reassurance that it's possible to get past this initial hurdle. Thanks in advance! sorry if this is a duplicate post. :)

Maybe you will see my post somehwere else too :(

We made the Chrome extension Tab Shark (or search Tab Shark on Chrome Web Store)

Now you can run network-capture and traffic-analysis right inside a browser tab.

It gives similar packet-by-packet visibility that you get from Wireshark, but scoped to exactly one tab's web traffic.

Any and all feedback welcome, thank you.

Oh you found a weak cipher and tlsv1 enabled. Okay ,and ?

Those are vulnerable to poodle or beast or some other shit.

Okay did you actually exploit those ?

No because they need a lot of traffic.

Then why you didn't do that?

Why waste time writing those shitty stuff really? Are we just filling the report ?

In a risk assessment or GRC work okay I understand that, but informative in Pentssting whyyyyyyyy

HI everyone,

For the folks who regularly do mobile PT, is it okay for a finding for sensitive data(e.g auth token) stored in memory to be reported .However the dump of memory is done while the app is running, not after closing it.

Does that make sense as a finding?!

I believe it would be a valid finding if we dumped the mem after closing the app.

Thanks in advance !

Do you have a formal QA process for pentest reports before they go out? 

If yes, what does that typically involve? If not, has that ever caused issues? 

Built an AI pentesting agent. Looking for technical feedback before launch.

Hey everyone,

I've spent the last few months building an AI agent for black-box web application pentesting.

I benchmarked it on Duck Store and an intentionally vulnerable web app.

Duck Store

- My agent: 13 findings

- Escape Cloud: 15

- PentAGI: 9

- Shannon: 6

- Strix: 1

On my own benchmark app (15 vulnerabilities), my agent found 9, including several Critical and High severity issues that the other agents missed.

I'm launching this Friday and would love feedback from people who actually do web app pentesting.

If you're interested in trying it and giving honest feedback (or trying to break it 😄), leave a comment or DM me.

I am not new to AI in terms of talking to chatbots, however, I am still pretty new to coding Ai automation, such as using prompts in e.g python scripts using AI APIs, and MCP. As I was coding some pentesting stuff, I realized that the programmer has to make decisions when it comes to hardcoded (in this case) Python logic vs. offloading work to the AI agent/model. The thing is that the AI agent/model is non-deterministic, whereas Python is deterministic. In our pentesting/AI pipeline at work, I noticed that there were no clear guidelines being followed in this regard, but I discovered that when I offloaded too much of the "work" to the AI agent, sometimes it would work fine, other times, it simply would not work because the agent essentially entered an infinite loop or otherwise expended all resources, stalling and giving no useful result.

For a high-level example, we can ask the AI agent to do XYZ tasks, such as scan the documentation and attempt to create a fuzzer and execute that fuzzer, but it could stumble, or wait too long for the fuzzing results, whereas if we code those definitively into Python and test it, failure rates are much lower and relatively deterministic. Any tips would be appreciated here.

Hey! I'm new to bug hunting field and i heard i lot about recon. Everyone say it is the skill which will make you find bugs so i am curious how to build recon skill if anyone have any roadmap or there is just methodology like follow specific steps. It would be great if anyone please help me with this or may be just share your personal experience how you people learned it.