​

Hi everyone!

I'm currently working with several clients who need technical and cybersecurity-related services. However, the workload is becoming more than I can handle on my own.

That's one of the main reasons I've decided to build a cybersecurity company and bring together a team of skilled people who want to grow with it.

What we're building

The company will focus on identifying and fixing software vulnerabilities using artificial intelligence, AI agents, automated code analysis, and human expertise.

Our main goal is to help businesses secure their applications, websites, APIs, and GitHub repositories.

We want to develop workflows where AI agents assist with analyzing code, identifying potential security issues, suggesting fixes, and supporting security assessments.

Every finding and proposed fix will be reviewed and validated by qualified team members.

Who I'm looking for

I'm interested in connecting with:

- Cybersecurity specialists and ethical hackers.

- Developers with experience in application security.

- People familiar with vulnerability research and secure code review.

- Developers experienced with AI agents, LLMs, and automation.

- Motivated developers willing to learn how to use AI for cybersecurity.

- People interested in building a long-term technical team.

You don't need to be an expert in everything. Practical skills, curiosity, reliability, and a willingness to learn are important.

How the business will work

I'll be responsible for formally establishing the company, finding and managing clients, negotiating contracts, and handling business development.

The technical team will focus on executing projects, identifying vulnerabilities, validating findings, and helping clients implement security fixes.

My goal is to secure paid client projects before assigning production work to collaborators.

Compensation, responsibilities, and payment milestones will be agreed upon before each engagement. I will receive an agreed business commission or margin for client acquisition and company management, while technical collaborators will be compensated for their work.

This is an early-stage venture, not a guaranteed salaried position. Although I already have client relationships and work opportunities, I cannot promise a specific volume of paid cybersecurity projects until contracts are confirmed.

Our vision

I want to build a cybersecurity company where AI helps a small but highly capable technical team work more efficiently, deliver quality security services, and eventually serve more businesses.

All security testing will require explicit authorization and a clearly defined scope.

Interested in joining?

Send me a DM with:

1. Your technical background.

2. Your cybersecurity or development experience.

3. Your experience or interest in AI agents.

4. Any GitHub projects, portfolios, or relevant work.

5. Your preferred collaboration arrangement.

I'm looking for people who want to build something serious, learn new technologies, and work on real client projects.

Let's connect!

Hello, I am interested in Cybersecurity, especially in Pentesting, I started learning in Tryhackme and Hackthebox platforms (Thm is my most used one) by practicing free rooms (I try to learn by doing btw), but I get stuck in easy rooms in tryhackme and I do not know what to do without reading a walkthrough, and honestly this makes me feel I am not in the right track in learning for this domain, If you can help me by suggesting ways to improve my skills in Pentesting and I work alone because I did not find other people interested in Pentesting like me . I would be thankful to receive your pieces of advice.

I'm 16 and just getting started with C. My long-term goal is to work in vulnerability research and exploit development, with reverse engineering as a major part of that path.

I'm trying to avoid the common mistake of jumping between tools, courses, and trendy topics without understanding the fundamentals.

For those of you who do security research professionally:

1. What would you learn, and in what order, during your first year?
2. How important are C, assembly, operating systems, computer architecture, Linux, networking, and Python? Which should I prioritise instead of trying to learn everything at once?
3. When does it make sense to start studying memory corruption, fuzzing, debugging, and vulnerability analysis?
4. Which labs, books, or practical projects actually teach you to think like a researcher rather than just follow tutorials?
5. How many hours of focused practice per week is a realistic target for a beginner?
6. What separates someone who can solve CTF challenges from someone who can independently discover and understand real vulnerabilities?

I'm not looking for exploit code to copy or a shortcut into the industry. I want to develop the ability to understand systems deeply and eventually find problems that other people have missed.

If you were starting again today, what would you focus on first, and what would you deliberately postpone?

i feel something might be missing 😕 🤔

Second round yesterday for a junior SOC analyst role. The job ad listed tenable, crowdstrike and axonius , and the interviewer asked what the third one is for if the first two already tell you what is vulnerable and what's protected.

I blanked, then said it was another scanner and could tell right away that was wrong. Looked it up after and from what I can tell it doesn't do the vuln scanning itself. It pulls in what tenable, crowdstrike, AD and the cloud accounts each see and works out which records are the same machine.

Makes sense on paper, but I still could not say why a company pays for that on top of the other two, and the third round is tuesday. My home lab has 6 devices so I've never had two lists that disagree...

Subnetting kept tripping me up when I was studying, and it comes up constantly in security work: scoping scans in CIDR notation, writing firewall rules, reading ACLs, figuring out how many hosts are in a /22.

Most calculators just give you the answer, so I built one that shows the steps behind it. Enter an IP and CIDR and you get the network ID, host range, and broadcast, plus a decimal "Magic Number" walkthrough so you can check your own math (no binary). There's also a tab with 20 graded practice problems.

I built it, it's free, no signup, no ads, and no third-party trackers. Link: activeitprep.com/subnet

If you find a wrong answer or an odd mask that breaks it, tell me. Which networking fundamentals gave you the most trouble while learning security? I'm considering adding VLSM and supernetting practice.

Hey everyone,

Whenever I do a box that involves getting WP admin credentials, manually logging into the dashboard, navigating to plugins, and clicking "Upload" to drop a PHP reverse shell always felt too slow.

I wanted to automate the process from the terminal, so I spent some time figuring out the exact curl syntax to do it. It’s a great way to understand how WordPress handles authentication and CSRF protection under the hood.

The core workflow comes down to 3 steps:

The Login: Sending a POST request to wp-login.php and saving the session cookie (-c cookie.txt).

Grabbing the Nonce: WordPress uses a nonce for security on plugin uploads. You have to GET the plugin-install.php page with your cookie and grep/awk out the _wpnonce value.

The Payload Upload: Finally, using curl -F to send the malicious zip file as multipart/form-data, passing both the cookie and the nonce.

Automating this really helped me understand HTTP requests better rather than just relying on the browser.

If you want to see the exact bash commands and cURL syntax I used, I wrote a full breakdown on my blog here: [https://medium.com/@0xShell/beyond-the-browser-automating-authenticated-wordpress-plugin-uploads-with-curl-e357cfb3ff3e].

Hope this helps speed up your workflow on your next box! Let me know if you guys have other ways you automate WP exploitation.

Not sure if this is the right place to post this, but I shared it on r/cybersecurity recently and got some great advice, so I thought I'd share it a little more widely.

This tool pulls a bunch of security information sources into one place (38 sources), and it doubles as an MCP server, so you can plug it into any of your AI agents. It's MIT licensed and written in Rust.

Paste in a CVE and it pulls from NVD, CISA KEV, EPSS, OSV, public exploit sources and others in parallel. You get a 0–100 risk score and a short "act now or later" answer, with the evidence listed so you can check it yourself. It also handles IPs, file hashes and dependency files. You can use it as a desktop app, a CLI, a REST API, or an MCP server for Claude Code, Cursor and similar tools. The AI part is optional and runs locally by default, so nothing leaves your machine unless you switch it to a hosted model. Information is only as current as the public data.

I've had this idea for a while and I'm still not sure exactly where I want to take it, so if you have any suggestions, I'd love to hear them. Feel free to contribute to the project. Thank you!

https://github.com/Fazmin/cve-intel

I'm planning to pivot into Cybersecurity over the next 12 months, specifically targeting the GRC side of things.

​I already have a background in IT support but I'm looking to pivot into a full-time GRC role within a year.

​My main goal is to spend this year learning as much high-value stuff as possible to get job-ready and land a entry-level/junior GRC or Analyst role.

​For those working in GRC or hiring for it:

​Frameworks: Which frameworks should I master first? (e.g., NIST CSF, ISO 27001, SOC 2) Should I just read them end-to-end, or is there a better way to learn how to apply them?

​Certs: Is there any entry-level cert actually worth getting for GRC (like CompTIA Security+), or should I just focus on learning controls, audit prep, and risk assessments?

​Projects: What kind of practical project or portfolio can a beginner build to prove they understand risk management and policies?

​Any advice, reality checks, or recommended resources would be hugely appreciated! Thanks in advance!

I'm a fresher stuck without proper guidance. Few weeks ago, I got assigned with a task to pentest a mobile app, I don't know anything Abt it, the setup, the methodology, etc., I don't have any senior to seek help in my org.

I spent weeks searching, watching YT tutorials.

But I couldn't understand anything. The setup itself is failing sometimes. Being an enthusiastic hands-on person and not understanding the way to pentest a mobile is a big nightmare.

I require quality guidance. Pls help me out

As someone who’s worked in cybersecurity for over eight years, across roles ranging from pentesting to vulnerability management, I’m curious: what’s motivating you to study cybersecurity or pursue a career in the industry as a beginner?

Hi all,

I’ve published a small Windows password-hashing library in Ada/SPARK: Win32_Hash.

What it does:

• PBKDF2-HMAC-SHA256 through the Windows CNG API (BCryptDeriveKeyPBKDF2), 1,000,000 iterations by default (650k–1M by type)
• Random salt, 32–256 bytes, from ProcessPrng with BCryptGenRandom as fallback; stored as Base64 (RFC 4648)
• Hash stored as 64 uppercase hex characters; separate verify procedure with constant-time comparison, fail-closed
• Every secret wiped with SecureZeroMemory plus a redundant Ada overwrite, on success and on every failure path

Verification:

• GNATprove --level=4, all provers: 186/186 checks proved, 0 unproved
• Re-verified on three GNATprove versions: Community 2021, 14.0.1, 16.0.1
• adacovex: GNATprove Platinum (186 VCs), DO-178C DAL-C achieved

Honest scope, as documented in the README: the bodies that call the Windows API directly are SPARK_Mode => Off (their contracts are checked at run time); everything around them is proved. Not externally audited — I don’t call it “secure” without that qualification. Windows only.

https://github.com/EliAvila10/Win32_Hash

Feedback welcome.

Hi everyone,

I am a Bachelor’s student specializing in Cybersecurity, and I need to complete a 3-month internship. I have already secured the internship location, and they are willing to provide me with a dedicated server, but we haven't decided on a project topic yet.

Do you have any project ideas I could work on? The project needs to be free/open-source, substantial enough to span over 3 months, and directly related to cybersecurity.

One of my professors suggested setting up OpenNebula (including template integration, automation, pay-per-use billing, etc.), but I'm worried about the lack of community support if I get stuck, especially since I'll be working on this project completely on my own.

Any suggestions or advice would be highly appreciated! Thanks!

Hey everyone,

I've been working in cybersecurity for the last 5 years, and over the past year I've been building a project called Vader-Pro-VDR, an AI-assisted Vulnerability Detection & Remediation platform.
So far, I've built:
A Go-based endpoint agent that collects system and software inventory information.

A backend API that receives and processes agent data.

AWS-hosted infrastructure for communication between endpoints and the backend.

A working proof of concept that can identify installed applications and their versions across endpoints.

My long-term vision is to build a platform that can:
Continuously identify vulnerable software and configurations.

Correlate findings with CVE intelligence.

Use AI agents to provide remediation recommendations.

Eventually automate certain remediation workflows in a controlled manner.

The challenge I'm facing isn't necessarily technical anymore. I've realised that a project of this scope is difficult to build alone.
I work remotely and don't have much exposure to the open-source community, so I'm looking for advice from people who have built or maintained open-source projects before.
Some questions I have:
How did you find your first contributors?

At what stage did you make your project public?

What communities have been most helpful for cybersecurity-focused open-source projects?

Are there common mistakes first-time maintainers should avoid?

What would make you interested in contributing to a project like this?

The repository is here:
https://github.com/Tridents10/Vader-Pro-VDR

I'm looking for honest feedback, technical criticism, and advice on how to take this from a personal project to a community-driven one.

Thanks in advance.

Hey everyone,

I've been working in cybersecurity for the last 5 years, and over the past year I've been building a project called Vader-Pro-VDR, an AI-assisted Vulnerability Detection & Remediation platform.
So far, I've built:
A Go-based endpoint agent that collects system and software inventory information.

A backend API that receives and processes agent data.

AWS-hosted infrastructure for communication between endpoints and the backend.

A working proof of concept that can identify installed applications and their versions across endpoints.

My long-term vision is to build a platform that can:
Continuously identify vulnerable software and configurations.

Correlate findings with CVE intelligence.

Use AI agents to provide remediation recommendations.

Eventually automate certain remediation workflows in a controlled manner.

The challenge I'm facing isn't necessarily technical anymore. I've realised that a project of this scope is difficult to build alone.
I work remotely and don't have much exposure to the open-source community, so I'm looking for advice from people who have built or maintained open-source projects before.
Some questions I have:
How did you find your first contributors?

At what stage did you make your project public?

What communities have been most helpful for cybersecurity-focused open-source projects?

Are there common mistakes first-time maintainers should avoid?

What would make you interested in contributing to a project like this?

The repository is here:
https://github.com/Tridents10/Vader-Pro-VDR

I'm looking for honest feedback, technical criticism, and advice on how to take this from a personal project to a community-driven one.

Thanks in advance.

Disclosure: I am the creator of OIDC Inspector and I added the FAPI 2.0 metadata signals based on the feedback on this subreddit.

I've added a FAPI 2.0 section. For each requirement of the FAPI 2.0 Security Profile that discovery metadata can say something about, it reports whether the server publishes a matching value.

Things I'd like opinions on:

1. Are any of the profile requirements I'm treating as observable from metadata actually not?
2. Which metadata fields would you want surfaced that I'm missing?
3. Is "differs" the right label when a server publishes something outside the profile (for example `client_secret_basic` alongside `private_key_jwt`)?

It's free, but it needs a free account to run scans. Link: https://contextiq.trango-compute.com/dashboard/oidc-inspector

Happy to answer questions.

I want to announce a new pentest learning platform: Knossos

I’ve been working on this lab for a bit - I’ve always wanted a better server platform for people to learn pentesting on, besides simply spinning up VMs, and I finally had the opportunity to build it.

Based on the lessons in my books, I built Knossos to have over 2 dozen servers, three networks (DMZ, Internal, Private), and 33 pentest challenges. It emulates an enterprise environment, and the best part is it’s all wrapped up in a single docker deployment. A couple commands, and you have an entire, complex network to learn hacking against.

Capture flags as you work through the network. Each flag is tied to a chapter within my book ”Professional Penetration Testing” where I teach how to perform the attack and why.

You can learn more about the free lab at https://pentest.tv/knossos

This is the lab I wish I had when I was trying to learn pentesting over two decades ago. For those that don’t know, I created one of the first exploitable virtual machines: De-ICE. I spoke on the De-ICE discs at DefCon 15, which later spawned the books - the most recent version of "Professional Penetration Testing" is the 3rd edition. This has been an incredible journey over the last couple decades, and I’m excited to bring you Knossos - the next generation of pentesting labs.

LMK if you give it a try and what you think. Thanks!

- Tom Wilhelm

Next week, we're bringing an FBI agent to our office in Utah for a candid conversation about cybersecurity, the threats we're facing, and what organizations need to know. No sales pitch, just a chance to hear an insider's perspective.

We're kicking off the morning with a networking breakfast, and we'd love to have you join us.

Come hang out in person, or tune in online. Either way, it should be a great conversation.

Free to attend. Hope to see you there!

https://zoom.us/webinar/register/5117921732126/WN_XIp2emSmS8ebHLoMGWXqzg

Title. I'm not gonna post pictures bc I dont want people thinking im marketing-- im not I just dont knoe if this is worth finishing. its just a basic CRUD skeleton I made for myself because I hate Spotify premium and when downloading music I hate organizing it in my phones files and losing functionality. Please lmk if this is something too overdone or if this is somewhat of a niche ​

Hi all,

I am just a beginner in cybersecurity and ethical hacking and I need an AI study buddy to guide me through basic concepts, CTFs, tool usage (Nmap, Wireshark, Metasploit, and so on), and network traffic at the level of packets.

Commercial chat assistants tend to block any security-related questions and refuse to answer how something works. For this reason, I have chosen the local approach.

My hardware specs:

GPU with 12GB VRAM

System RAM with 32GB DDR5

I can put the quantized 8B to 14B models fully in VRAM or load them partially, in case it is beneficial to sacrifice token processing speed for that.

What models or fine-tunes would you recommend me that know the technical stuff but do not have overly strict guardrails?

Hey everyone!

We're Exun Clan, the student-run tech club at DPS R.K. Puram, New Delhi, and we're back with the 16th edition of Sudocrypt, our flagship international CTF!

Sudocrypt is an international Cryptic Hunt x Capture The Flag (CTF) event where participants from around the world tackle a series of cybersecurity and cryptic challenges. Expect code-breaking, cryptography, and plenty of problem-solving as you work your way through the levels.

The competition is entirely online, so you can participate from anywhere in the world.

Dates: October 27–28, 2026

Prizes: With a prize pool of over $900 USD in previous editions, along with over $500 USD in goodies and prizes, Sudocrypt v16.0 promises an exciting challenge for cryptic enthusiasts and CTF players alike.

Event website: https://sudocrypt.com/

CTFtime listing: https://ctftime.org/event/3443/

You can also check out the other events at Exun 2026 here: https://exun.co/26/events

Hope to see you on the scoreboard!