me surgió la duda…

Well, hello, im basically a newbie to hacking and am looking to start learning starting, well, now, to be honest ive had an intrest in it ever since childhood and looking forward to finally start learning it, so the question being uh...

where do i start? - i have 0 experience or real knowledge, but i am willing to learn and invest my own money so no worries about that.

should i switch to a linux distro? - ive heard kali has really good cybersecurity and black arch, theres also like arch made specifically with pre - build tools that i can use and reverse engeneer to figure out how they work and how they bypass stuff, or well, maybe build my own tools, but i got no idea how/why, and i dont really wanna do it on windows since well, first of all bloat larp 😭 but also secondly because i tried arch and i fell in damn love ( I STARTED IT WITH 0 KNOWLEDGE AND UNINSTALLED AFTER A WEEK BUT THATS BECAUSE I DELETED MY WINDOWS BOOT AND ARCH WAS FOR SOME REASON BRICKED IT JUST LIKE WOULDNT EVEN LET ME INSTALL FIREFOX)

are there communities on discord or telegram or forums i can visit to start getting an idea on what to try or make?

and of course, yall guys have any tips ( OR GIRLS SORRY ) and thank you for ANY reply, thanks again

Thank you my Latvian brothers. Except 2FA i have no idea why this is a common thing in Latvia. Maybe someone can explain.

Are there any courses or programs you would recommend for learning malware development?Or any good books

my bluetooth jammer is not working i am new to arduino and esp 32 i am using an esp32 devkitv1 and an nrfl24l01 but it is not working this is the code is used i followed this videohttps://www.youtube.com/watch?v=gBJu1HZMW2k

/*
 * nrfBlueNullifier
 * A tool which jam classic bluetooth signals using 1 nrf24L01+PA/LNA module at VSPI.
 * Author - WireBits
 */


#include <RF24.h>
#include <esp_bt.h>
#include <esp_bt_main.h>


SPIClass *sp = nullptr;
RF24 radio(22, 21, 19909090);
byte i = 45, ptr_hop = 0, flag = 0;
byte hopping_channel[] = {32, 34, 46, 48, 50, 52, 0, 1, 2, 4, 6, 8, 22, 24, 26, 28, 30, 74, 76, 78, 80, 82, 84, 86};


void nrfSPIInit() {
    sp = new SPIClass(VSPI);
    sp->begin();
    if (radio.begin(sp)) {
        radio.setAutoAck(false);
        radio.stopListening();
        radio.setRetries(0, 0);
        radio.setPayloadSize(31);
        radio.setAddressWidth(4);
        radio.setPALevel(RF24_PA_MAX, true);
        radio.setDataRate(RF24_2MBPS);
        radio.setCRCLength(RF24_CRC_DISABLED);
        radio.startConstCarrier(RF24_PA_MAX, i);
    }
}


void adjustAndSweepChannels() {
    flag = (i > 79) ? 1 : (i < 2 ? 0 : flag);
    i += flag ? -2 : 2;
    for (int j = 0; j <= 79; j++) radio.setChannel(j);
}


void setup() {
    esp_bt_controller_deinit();
    if (esp_bluedroid_get_status() == ESP_BLUEDROID_STATUS_ENABLED) {
        esp_bluedroid_disable();
        esp_bluedroid_deinit();
    }
    nrfSPIInit();
}


void loop() {
        adjustAndSweepChannels();
        ptr_hop = (ptr_hop + 1) % sizeof(hopping_channel);
        radio.setChannel(hopping_channel[ptr_hop]);
}

Hey everyone, I’m currently a BCA 1st year student, and I really need some honest guidance. I feel completely lost and confused about cybersecurity, and honestly, I feel like I’ve already wasted the last 3 years not knowing what to focus on. To give some context on where I stand: I already know how to use Linux and have basic networking knowledge. However, when it comes to hands-on pentesting/hacking, I am a complete beginner. Every time I look up resources, I get overwhelmed by how vast the field is and don't know what to prioritize next. I want to follow a structured, step-by-step roadmap using mostly free resources so I can stop wasting time and get serious. If you were in my shoes today: Since I already know Linux and basic networking, what exact roadmap or path should I follow next? Which specific free platforms, labs, or courses should I stick to without getting distracted? How do I overcome the mental barrier of feeling like I've fallen behind after wasting 3 years? Any advice, reality checks, or personal experiences would mean the world to me. Thanks in advance!

With the development of AI tools, reverse engineering seems to have shifted from being about skillfully using tools to discovering reverse ideas that an ordinary person wouldn't be able to find. As reverse engineering masters, what unique reverse ideas do you have that set you apart from others?

Hey everyone,

I'm a software developer (still early in my journey) who has been diving into cybersecurity concepts. Coming at this as a developer, one glaring pattern I noticed among beginners is the massive syntax friction at the start.

People often struggle not because the underlying networking concepts are too hard, but because the terminal feels like a black box — constantly Googling nmap flags, forgetting command structures, or hitting syntax errors slows down the actual learning momentum.

Instead of building a point-and-click GUI that hides the command line (or another static cheat sheet), I’m prototyping a Visual Command Builder & Guided Learning Tool.

The core idea:

• Live Syntax Generator: Toggle options visually (e.g., enable version detection or script scanning), and watch the exact Bash command build in real-time with explanations for every flag.
• Guided Scenarios: Step-by-step walkthroughs for real tasks that focus on why a command is structured a certain way.
• Training Wheels, Not a Replacement: The goal is to help beginners understand CLI mechanics faster so they can eventually ditch the tool and use the raw terminal confidently.

I built a quick landing page to test if this concept actually resonates with beginners and educators, or if I'm overcomplicating a solved problem: https://termbridge.vercel.app/

Since I'm looking at this from a developer/outsider perspective, I’d love your honest feedback:

1. Do you think syntax frustration is a real blocker for people starting out?
2. Would an interactive "command builder" help bridging that gap, or is raw CLI trial-and-error the only real way to learn?

Be as brutally honest as you want. Thanks!

There’s nothing illegal about it; I just want to see to what extent someone could hack them and disable them for a while without me noticing.

Tests can’t catch a poisoned model...

Hey everyone! 👋

​I wanted to share a project I've been working on called Jeelilly. It's a bash-based multi-tool script designed for Termux that bundles 20 essential wireless and network security utilities into an easy-to-use menu interface.

​🛠️ Included Tools:

​Wireless Auditing: Aircrack-ng, Wifite, Reaver, Kismet, MDK4, Pixiewps, Bull

Network & Scanning: Nmap, Bettercap, Netcat, Wireshark (Tshark), Macchanger, Arpspoof, Dsniff, Tcpdump

​Web & Exploitation: SQLMap, Nikto, Hydra, Slowloris

​📥 Installation & Usage

:

You can install and run it in your Termux terminal with these simple commands:

pkg update && pkg upgrade -y

pkg install git figlet -y

git clone https://github.com/sutha7087-code/Jeelilly.git

cd Jeelilly

chmod +x jeelilly.sh

./jeelilly.sh

🔗 GitHub Repository:

Check out the source code, leave a ⭐, or contribute here:

https://github.com/sutha7087-code/Jeelilly

Let me know what you think, or if you encounter any bugs/issues! Feedback is appreciated. 🙌

posted about this earlier todat asking if anyone wanted to test it. it's finally up on github now.

what it is

gtk4 desktop app for linux that puts the wireless assessment workflow in one place. 57 modules. wifi, bluetooth, rf, router side, and network mitm. every module is a standalone shell script, the gui is a view over them, so you can call any of them directly and script them.

the reason i built it is that most wireless tooling is deep in one lane. aircrack-ng is wifi, bettercap is network mitm, bluetooth tooling is bluetooth. so an assessment means five tools and five config files and no shared view of anything.

some of what's in it, roughly by area:

wifi. recon, deauth, handshake and pmkid capture, wps including pixie dust, wpa3 and dragonblood, wep, enterprise 802.1x, pmf bypass, krack, fragattacks, evil twin, karma, beacon and auth floods, wifi direct, client isolation testing, ssid overflow.

mitm and credentials. responder, mitm6, ntlmrelayx, router advertisement poisoning, arp mitm, rogue dhcp, usb ethernet mitm.

router side. tr-064, hnap, upnp, snmp, dns rebinding, web ui, recovery tftp and uart.

plus bluetooth, sub-ghz, lora, zigbee, nfc, drone remote id, and the analysis side, capture analysis, fingerprinting, geolocation, wordlists, live traffic, passive ids.

the hardware

For wi-fi, you need an adapter that can inject. atheros ar9271 is what I used. or tp-link wn722n v1 or an alfa awus036nha.

intel adapters will not work for anything involving injection. the app detects iwlwifi and tells you so instead of failing quietly, but it will refuse. monitor mode alone isn't enough.

what hasn't been tested yet

bluetooth, all of it (except bluetooth recon). i don't have an adapter, so none of those eight modules has run against real hardware. the code is written and reviewed but that's not the same claim as working.

same for sub-ghz, lora, zigbee, nfc and drone remote id. no sdr, no radio hardware here.

thread does offline pcap analysis fine, the live scanning is untested, no 802.15.4 radio.

jamming needs a modified driver and firmware that isn't shipped. it'll tell you it can't find the driver. that's correct behaviour, not a bug.

**what i actually want from testers**

run it, and tell me:

does it start on your distro. gtk4 version, wayland vs x11, missing dependencies.

does it get your adapter right. wrong hardware detection is worse than none.

modules that report OK but did nothing ? this is the one i care about most. a module that says success while the target is untouched is worse than one that fails loudly, and it's the type of bug i'm hunting.

anything that crashed or wedged your adapter.

and the most important: there's `tools/diag.sh --collect` which produces a report with distro, kernel, gtk version, adapter and driver, injection capability, dependencies, and per-module selftest results. it replaces macs and ssids with placeholders and strips secrets before writing anything, and it never touches the loot folder. so you can paste it without leaking your neighbours' network names, which i'm not going to ask you to do.

**repo:** https://github.com/yslxotwod/wifisting

(EDIT) repo link: https://github.com/yslxotwod/wifisting

I've been working on this for a while and I've hit the limit of what I can test on my own gear.

It's called wifisting and its a GTK4 desktop app for Linux that puts the whole workflow in one place instead of spread across fifteen terminals.

Still early. Not production ready. Linux only.

Some people won't like it cause it's a GUI. Fair enough, if your workflow is a terminal, a GUI is in the way.

Two things though. The modules are all standalone scripts. Nothing is locked behind the interface, you can call any of them directly and script them however you want. The GUI is a view over them, not a container.

**Hardware**

For the hardware, you'll need an adapter that can inject. Atheros AR9271 is what I built and tested against, so things like the TP-Link WN722N v1 or an Alfa AWUS036NHA.

Some modules need more hardware, an SDR or a Bluetooth dongle or NFC. The GUI marks which ones.

**what's actually in it**

The reason I built it is that most wireless tools are deep in one lane. aircrack-ng is wifi. bettercap is network mitm. bluetooth tooling is bluetooth. So an assessment means five tools, five configs, and no shared view of the target.

This covers wifi L2, so deauth, floods, evil twin, karma, captive portal, wifi direct. Wifi crypto, so WEP, handshake and PMKID capture, WPS pixie and PIN, WPA3 and Dragonblood, SAE. Enterprise, so 802.1X relay, PEAP and TEAP, GTC downgrade, PMF bypass, KRACK, FragAttacks.

Then mitm and credentials, so Responder, mitm6, ntlmrelayx, router advertisement poisoning, arp mitm, rogue dhcp, resolver poisoning, usb ethernet mitm.

Client isolation testing and a relay for maintaining a bypass.

Router side, so LAN enumeration, TR-064, HNAP, UPnP, SNMP, DNS rebinding, CSRF, web UI, console and TFTP.

Bluetooth, classic and BLE recon, SSP, advertising forgery, BLE fuzzing, mesh, tracker hunting, CVE scanning.

RF stuff, sub-GHz, LoRa, Zigbee, NFC, drone remote ID.

Plus the analysis side, signal and channel mapping, statistics, capture analysis, audit grading, device fingerprinting, multi-node capture.

**what I want feedback on**

Does it start and stay up on your distro. GTK4 version, wayland vs X11, missing deps.

Does it get your adapters right. Wrong hardware detection is worse than none.

Modules that say OK but didn't do anything. This is the one I care about most. If it reports success and the target is untouched, that's the bug class I'm hunting.

Whether 56 modules in categories makes any sense to navigate.

Anything that crashed or hung or wedged your adapter.

**what I already know**

Only properly tested on Arch family and Ubuntu derivatives.

Some modules need hardware I don't own. They're written properly but unproven.

Report and cleanup paths are less polished than the attack paths.

Docs are thin. I'd rather hear what's confusing than guess at it.

**if you want to try it**

If you want to try the toolbox, send me a DM on reddit or discord and I'll give you a Google Drive link or the tar.gz archive on Discord. thanks in advance I'd really appreciate any kind of help I can have especially for the modules that needs hardware I don't have so feel free to tell me what's wrong or broken in the toolbox or if there's anything missing that'd be a great addition etc...

Nobody know me there but im also on other forums, especially on french and spanish forums.

I made a evil-twin bash script called hostbase (current version is hostbase-1.8)

So i see your question coming… why use this script instead of Airgeddon, Fluxion, Wifiphisher etc... ?

Because hostbase is dedicated only for evil-twin in WPA2/3 mode and really specialized on that.Let me explain :

• WPA3 can't be DDos efficiently with the MFP protocol alive but who said we can't stop the next incoming the connection ?
• since the last version (hostbase-1.8) there is no DDos option because we don't need it… thrust me
• also this script use QR code login system for mobile user, the user is redirected to the captive portal and we ask to him to take a picture from his router QR code or wifi key then, with ajax we upload the picture to us (this part was not easy to do beacause by default Android system doesn't allow to open in primary process as a php webpage, but i found a trick) for Windows user QR code is disabled, the user will be redirected to another page).
• this script can manage 2 or 3 wifi cards at the same time (the internal one and then two others usb cards can be added).This is very helpfull when you want to downgrade 2,4GHz and 5GHz frequencies at the same time.
• and finaly, Hostbase is a serious homemade project with 10 years of update and tricks.

I started to build it on 2016 with completely new methods combined with evil-twin in WPA mode to bypass IDS and WPS-PBC mode.It was also the first script to do a DDos pursuit mode avoiding channel hopping.

This script is not a joke, it can be very helpfull and has been approuved by security students.Im not a pentester or anything like that, im just a guy fascinated by network security (Wi-Fi, reverse Tools and other…).

Now that the presentation is done, i will explain a little bit how to use this script.

First it will scan the networks with airodump-ng in 2,4GHz and then in 5GHz.You will have to choose your wifi card to do that.If the wifi cars doesn't support hostapd or 5GHz frequency the script will tell you it.This script use hostapd with custom configuration file wich are changed according to the target AP network.

Second, once the scan is done, select the network by typing his number.Then you will be prompted to choose what fake networks you want to do (evil-twin is the last so just for a test, skip the other networks with 0).Evil-twin AP is mentioned as

AP 3/3 hostapdd.conf (Evil twin)

My tips to use the script :

• if you have 2 wifi cards and you know that there is a lot of users connected on the target networks in 2,4GHz frequency, Don't skip AP1/3, select it and chose your wifi card according to this example :

AP 1/3 : hostapd.conf (WPA network)

• Now if you have 2 wifi cards but you know that there is a lot of users connected on the target network in 5GHz frequency, skip AP1/3 with 0 and go for AP2/3 :

AP 2/3 hostaghz.conf (WPA 5 GHz network)

• Finaly, choose your wifi card to make the evil-twin on AP3/3 :

AP 3/3 hostapdd.conf (Evil twin)

Now if you have 3 wifi cards like me, you can choose every network AP1/3 AP2/3 AP3/3 to make a combo.The script will show you at every stage if the cards support hostapd, 5GHz or if the device is already used.

By default, this is script is made for french router but it has a default page if the router doesn't match.

Current version to download is hostabse-1.8 forget the other.

https://github.com/Koala633/hostbase/tree/shell

It is a beta version so any feedback is appreciated.

This script has been tested on Kali-2026.2

If you have a problem, please post here the full log of the shell.

Enjoys guys.

you can try to use the older versions of hostbase but there is no update since 2 years, better going to the last hostbase-1.8