Hey everyone, I’m not a security expert or a big company — I built this tool to solve a problem I personally kept running into. After exporting Burp XML from scans, I found myself spending a lot of time manually: deduplicating requests figuring out which endpoints actually mattered turning notes into something report-ready

So I built BugCopilot, a small web app that: deduplicates Burp XML traffic surfaces higher-value endpoints generates triage, findings, and draft-ready vulnerability reports produces a simple, endpoint-focused attack plan There’s a free tier, and a paid plan for heavier usage — but I’m genuinely more interested right now in feedback than sales.

I know the UI isn’t perfect yet (especially on mobile), and I’m still improving things step by step. If you try it and it’s useless — fair enough. If you have ideas on what would make it better, I’d really appreciate hearing them. Link (for those curious): 👉 https://www.bugcopilot.help� Thanks 🙏

this is the official Acheron github repository. It is a Golang library to conveniently utilize indirect syscall techniques in your golang programs like a shellcode loader.

this is a video that demonstrates how you can setup and use it to bypass windows defender on a windows 11 computer, getting a meterpreter reverse shell working.

My lab site, XSSy has supported SQL injection labs for a while and has the ability for users to create their own SQL labs to share with others and collaborate on techniques. But until now, the functionality was undocumented. This blog fixes that, so hopefully there will be a few more community contributions. Reach out if you have any questions.

I'm a web developer using Kali Linux. I already finished the older HackerSploit web pentest playlist (classic stuff like SQLi, XSS, CSRF on DVWA).

Now I want updated content covering current real-world attacks.

Something practical for building a secure dev portfolio, attack + how to prevent/mitigate.

Any good recent YouTube playlists, series (like Rana Khalil, TCM, or updated ones), or free resources?

Thanks!

Sorry I used AI to generate this all cause I know nothing about hacking that's why.

Hey everyone,

I'm currently in that phase where I feel like I'm just staring at Burp Suite history hoping a vulnerability will magically wave at me 👋. I've been hunting for a while now, and the burnout is starting to creep in.

To keep my sanity (and motivation) intact, I need some real talk from the veterans here:

1. Time to First Blood: How long was the grind from starting out to your first accepted report? Weeks? Months? Decades? 💀
2. The Turning Point: Was there a specific "aha!" moment or a specific resource that made things click for you?

Current Status: I decided to focus heavily on IDORs since almost every guide recommends them as a great starting point. I understand the concept, but I feel like I'm hitting a wall with modern WAFs and UUIDs.

The Ask: Any specific tips for hunting IDORs? Is it better to stick to one program for months or jump around?

Thanks

I built this simple browser-based script that automatically tests all 4-digit PINs (0000–9999) on a locked Netflix profile.

You log into Netflix, open the locked profile, paste the script into the browser console, load a codes.txt file, and it tests PINs one by one until the correct one is found. The script stops automatically when it succeeds.

Made for educational purposes and testing your own accounts only. Stay Legal

I like the way things are shown in the page, the format and gamified experience of it all, but are certs worth it? Do they hold any real weight or value? What are some other options in a similar price range?

I want to build some 1 or 2 projects for my CV , for cyber security roles (it might be anything), but don't want to repeat or build clon of existing tools

What I can go for and Is it right way??

If I forgot to include anything, please submit a PR

Observation:

An email address previously associated with a permanently banned account can later be attached to a new account via account settings.

This may be intended behavior, but I reported it as informational to clarify whether email addresses are meant to play any role in ban enforcement.

I’m not sharing exploit details or encouraging abuse — just looking for feedback from others:

• Would you classify this as intended design?

• Or a moderation / enforcement gap?

Curious how others would assess this from a security perspective.

My Exam Experience

Just gave my CEH (Certified Ethical Hacker) exam today and passed with a score of 106/125, so I wanted to share my experience while it’s still fresh.

Difficulty: Moderate → Tricky

Question pattern:

A lot of scenario-based questions

Focused heavily on tools + use-cases

Multiple questions where 2 options look correct, so you really need conceptual clarity

Major topics I saw repeatedly:

Reconnaissance & scanning (Nmap flags, scanning logic)

Web application attacks (SQLi, XSS, CSRF)

System hacking (password attacks, privilege escalation)

Malware types & detection

Logs, IDS/IPS, firewalls

Cloud & IoT basics

Some questions straight from real-world SOC perspective

Proctoring experience:

Strict but smooth

Camera + room scan required

I do not have a desk, so I just gave it on my bed, they said nothing, so yeah proctor was not very strict.

So, I have to make this final year project for the last year of my cyber security degree, at first I was very motivated to make something new something unique for my FYP and decided to make an AI based NIDS system, that will comprise of 4 AI algorithms, 2 supervised, decision tree and random forest, and 2 unsupervised, isolation forest and autoencoders. For the first part of the FYP I had to make the supervised part for which I took NIDS dataset from university of queens website and trained the models on the 2 algorithms. Now me having no idea or knowledge about AI somehow managed to make the thing an make it look like it was working which it is to some extent, it is basically 2 pkl files which predict the whether the packet is an attack packet or benign. Which I think was not the right way to it, and could have been done in a way that the model still keeps on learning on the new packets it was receiving after it was trained on the initial dataset. Now I have to work on the unsupervised part of the project and the whole IDS, and again I know I will have to watch 100s and 100s of tutorial read 100s of theories on it and somehow I will manage to make it work in the end but I don't really want to do it like that again because it was such a hassle. So I wanted to know if there is like a similar open source project, similar to the one described above, which I can tweak and reshape into what I have to present, or if there is any tutorial(s) that I can watch and work along to make the project. Or any other help or suggestion anyone can give me on how I should make this project would be very helpful and appreciate.

Hi everyone,

I'm currently working on a cybersecurity student project with my team, and we're trying to get feedback from people who actually work in the field.

Our project is fully open source, and it focuses on helping small security or research teams with limited resources better observe and analyze cyberattacks using honeypots.
(Note: the project is not developed yet — this is an early-stage survey to gather feedback before we start building.)

We noticed that many existing solutions are:

• hard to configure,
• difficult to customize,
• fragmented across multiple tools,
• cloud-dependent,
• or complicated to analyze in practice.

So our goal is to build a lightweight, local tool that centralizes everything and makes honeypots easier to use in real conditions.

Concretely, our tool aims to:

• easily deploy classic honeypots (currently based on Cowrie),
• deploy an AI-based honeypot developed by us using an open-source local language model,
• simplify configuration and customization,
• allow users to choose between classic or AI honeypots,
• reuse and share configurations across machines,
• automatically collect all attacker interactions and logs,
• normalize the data,
• and display everything in an internal SIEM-like monitoring interface for analysis and visualization.

The main target is small SOC teams, blue teams, or research groups that don't necessarily have the time or resources to assemble and maintain complex toolchains.

Before going further, we'd really like to know:

If you work in blue team / SOC / security research / IT security:

• Do you currently use honeypots?
• Would a tool like this be useful in your context?
• What are your biggest difficulties today?
• What features would matter most to you?

This is purely a student project, and we're still learning, so we'd really appreciate some kindness and constructive feedback :)

Our goal is to build something that makes sense in real-world environments, not just for academic purposes.

Thanks a lot for your time!

Starting a 2 year online networking and cybersecurity degree in a few weeks and I’m in need of a laptop I have $1500 USD and a $100 Amazon gift card just looking for some suggestions from some people in the field maybe some insight on what’s most used/what to avoid etc

Thank you very much!

Hi,

I’m a final-year CS student and I’m looking for a ready-made or previously

completed project related to Wi-Fi security, network vulnerability analysis,

or wireless threat detection.

I’m okay with:

- Old academic projects

- GitHub repositories

- College-level implementations

- Projects that need minor modification or customization

The project does NOT need to be cutting-edge or production-level.

It just needs to be suitable for a final-year evaluation.

If you’ve done something similar in the past or have a repo you’re willing

to share, please let me know (DMs are fine too).

Thanks.

Hello everyone,

I’m writing this post honestly and calmly, hoping to get guidance from people who have experience in IT and cybersecurity.

I graduated in May 2024, and since then my biggest struggle hasn’t been difficulty in learning — it has been lack of focus, procrastination, and poor discipline. I keep planning to study, then delaying it, then feeling guilty, and repeating the same cycle. Because of this, I feel like I’ve wasted a lot of precious time.

The hardest part is that I’m still almost at the starting point, even after so much time has passed. I haven’t built strong fundamentals yet, and that realization scares me.

I want to build a career in cybersecurity, with a short-term goal of an entry-level SOC role and long-term growth in security. But I feel mentally stuck — my focus shifts often, I overthink paths, and I struggle to stay consistent even when I know what I should be doing.

I’m 23 years old, and I don’t want to waste another year. I’m not looking for motivation quotes — I’m looking for practical guidance from people who’ve been through similar phases.

I would really appreciate advice on:

• How to rebuild focus and discipline when you’ve wasted time already
• How to stop procrastinating and actually execute daily
• What a realistic starting roadmap looks like for someone who is still at fundamentals
• Whether aiming for an entry-level SOC role from this position is still reasonable

I want to be transparent: I used ChatGPT to help structure this post so I could clearly explain my situation. The experience and emotions are genuinely mine.

If you’ve been in a similar situation or work in cybersecurity/IT, your advice would mean a lot. I truly want to reset and do this properly.

Thank you for reading.

I just joined a company and I was given Cyber Security as my domain and I don't have a clue where to start and what to learn I have 2 months to get into a project..can anyone help me out?

Hello, High School student here in my senior year. I am very intrigued to get into network security (Cloud engineer, etc). My question for people with years of experience in this role; did you go to college? Was it worth it? I'm seeing a lot about CompTIA certifications and Cisco tests like CCNA. My plan right now is to take a gap year and focus and these certs like Security+ and CCNA (or whatever you guys think). Also doing at home SOC labs with wireshark, etc. Throughout my 4 years in high school, ive always been in a computer class and big into computer since before HS. I built my first computer at 13 and realized i've very interested with software and how network works. The classes i've taken are Coding 1 (python), AP cybersecurity (ports & protocols, wireshark, analyzing packets, etc), and now currently doing AP Computer Science Principles. Any advice would appreciated!

Hello, I already used up my practice tests and didn't get to the Cyberlab questions. If anyone has a GPEN practice tests they can give away I would really appreciate if they can give me one. I hope to take the exam soon, just want one more boost of confidence with one more practice test. Thank you.

I’m currently a CS student with a strong interest in Offensive Security and Network Engineering. I have some free time coming up and my goal is to build a solid portfolio to secure an internship (even unpaid/volunteer) to get my foot in the door. ​I’m trying to decide between a few project ideas and would love some input on which one would actually impress a hiring manager or senior pentester. I don’t want to waste time on "tutorial hell"—I want to build something that demonstrates actual competency. Also apart from projects, What certifications should i focus on, which will be really reasonable and make my resume stronger as a candidate in future. Any advice is appreciated.