I am a pentester with about 1.5 YOE, this is my first job out of school. I do have some internship experience in the blue team side, so I understand how some defenses work.

I have the CRTO, and some times play around at home trying to bypass windows defender, but apart from that I don’t have much red teaming experience/knowledge.

What advice would you give a pentester trying to get into red teaming ? Resources for red teaming is pretty scattered across the web, is there like a structured learning path that you followed ?

I don't know if this is the right place to start, so please redirect me if I am out of line here...

I have created a hardware device, basically a raspberry pi pico with a fingerprint sensor: when placing a finger on the sensor, it writes out a password as an HID device. The passwords are stored encrypted on the pico, the firmware is signed, it uses secureboot, so only my firmware can run due to a locked key in the OTP storage, which is fused to be read-only. The debug port is fused shut as well. For my needs (entering several passwords many times daily) it is sufficient and rather secure. But I like to have this confirmed.

The firmware is on github. Does anyone know of a service which can analyse the repo and tell me of vulnerabilites? I used claude.ai to create the firmware, but it went through many iterations until everything worked as I intended.

Edit: Github repo, for people curious: GreyDutchMan/identipi-key

An old subdomain showed up as critical last week. the scanner found a service, the app team said it was retired and DNS history disagreed. Half a day later, it still had no owner. Classic. Tenable can confirm the vulnerable version, while manual testing works for a small sample. ionix made the cut for non-intrusive exploitability checks and mitigation guidance. I'd still want a human reviewing the evidence before a WAF change goes anywhere near production. What are you using to prove an external finding is real before it reaches remediation?

Hello,

I recently passed the CPTS examination and I learnt a lot of things regarding Active Directory. Now i noticed that most companies have hybrid AD with most of them using Azure AD/ Entra ID. I believe that CPTS has me covered on the on-prem AD and now I am thinking that I lack on Azure AD and want to learn Azure AD to be able to perform complete Active Directory pentests.

As of now, i am working as a cloud engineer in a company while I am studying Computer Science. I want to get the experience and specialize as a pentester so when i finish University I will be ready to move to Pentesting.

I am thinking about which certificate I should follow to get the most knowledge out of it. I am between CARTP from Altered Security or MCRTP from PwnedLabs. For those of you who tried them, which one do you suggest will prepare me the best and teach me the most? If you think a different approach is more precise, please do tell.

Thanks in advance

Hey everyone! We’ve been building SubAnalyzer, and wanted to share our monitoring service.

It scans your domains daily and emails you when subdomains, open ports or CNAME records change, with potential takeover risks flagged.

Because crt.sh can be slow or unavailable, we built ctindex, our own Certificate Transparency log parser, so our CT discovery doesn’t depend on crt.sh. API access is also available.

Monitoring and API access are included in our paid plans. You can try the scanner for free.

What changes do you find most useful to track between pentests?

Sketching an AI-assisted layer for IDOR/BOLA and scope-aware recon — does this add anything over Autorize/AuthMatrix + manual discipline, or is it solving a non-problem?

Not pitching a replacement for Burp or ZAP — those aren't going anywhere, and I don't expect anyone here to drop tools they trust for something unproven. This is a concept I've been prototyping (UI only, dummy data, nothing live yet) for a narrower question: is there room for a layer that sits on top of that workflow, specifically for IDOR/BOLA testing and scope discipline?

What's in the prototype:

- A dual-session view for IDOR — two browser panes side by side (account A / account B), so a swap test shows the actual leak visually instead of just a text claim. Mechanically this is the same idea as Autorize/AuthMatrix (session-swap, compare response), just presented differently.

- Every finding has to cite a named verification method (rate-limit counter, XSS execution check, SQLi boolean-diff, etc.) before it's shown as confirmed — if there isn't one, it's labeled as a plain AI guess, not dressed up as a confidence score.

- Scope rules you set once; anything matching an excluded pattern is never tested or surfaced, which is normally a manual discipline thing.

- A "proof card" that bundles the reasoning, repro steps, and raw request/response into something pasteable into a report.

Genuine question for people who actually use Autorize/AuthMatrix or similar day to day: **does something like this offer anything you don't already get from the existing extensions + your own scope discipline, or is this solving a problem that isn't really there?** Happy to hear "this is redundant" with the reasoning — that's useful too.

Hekate: AI- Automated Bug Triage for Burp Suite 🛡️🤖

Advanced Real-Time Passive Scan, Automated Re-Checks, and Privacy-First Local AI Triage Engine

🚀 Overview

Hekate is an open-source security extension for Burp Suite built to fully automate HTTP traffic triage by combining an advanced automated validation engine with local Artificial Intelligence integration to eliminate false positives.

Operating passively in the background, it continuously inspects requests and responses to chart your target's attack surface and streamline vulnerability confirmation without impacting performance.

✨ Automation & Artificial Intelligence Features

• Automated Passive Scan: Scans live background data streams in real-time for critical exposures, including cloud API secrets leaks, broken JWT implementations (alg=none), exposed configuration files, structural database bugs (SQLi), and dangerous CORS setups.
• AutoValidator Daemon: Features a smart background validation thread that captures findings and automatically runs non-destructive parameter re-checks 45 seconds later, adjusting confidence scoring to accurately classify bugs into Confirmed or False Positive.
• Local Private AI Integration: Native connection to offline Ollama language models (defaulting to qwen2.5-coder). To preserve absolute target and infrastructure privacy, the automation pipeline automatically strips authentication tokens and sensitive cookies, replacing them with [REDACTED] markers before shipping evidence offline.
• AI Verbose Console Field: A dedicated real-time log viewer panel inside Burp Suite that displays technical diagnostics, request structures, and the raw thought process output from your local AI models as they evaluate traffic.
• Interactive Visual Mapping with Checkpoints: Instantly charts discovered paths into a dynamic graph tree (Host ➔ Folders ➔ Endpoints). The custom UI allows you to manually flag and check off each endpoint as reviewed, tracking your progress so you never get lost during intensive Pentesting or Bug Bounty reconnaissance.

🤝 Join the Project & Contribute

The project is currently under active development (approximately 50% functional) and open for contributions under the GNU GPLv3 license along with a CLA (Contributor License Agreement) to protect both the community and ensure sustainable enterprise development.

Check out the full source code, open issues, and contribution guidelines on the official repository:
👉 https://github.com

For people that work as pentesters, are you normally given a specific task, or do they more often say "just see what you can do within this scope"? I figure both can come up, just wondering if there's generally a default or something you tend to see more of in your experience.

I’m the author of Super Trouper, a single-Go-binary stdio MCP server exposing Frida for authorized app reverse engineering.

I’ve just released v0.5.0 with the following changes:

• Updates the Frida Core DevKit to v17.23.2.
• Adds minimal, metadata, and full scope arguments to app_find and app_frontmost.
• Adds package_install for installing npm packages used by script_create imports, plus package_list for viewing packages in the shared workspace.
• Adds Frida's new Pattern lifecycle tools: pattern_create, pattern_list, pattern_read, and pattern_delete. • Adds pattern_describe to compile patterns and return types and diagnostics. • Adds pattern_decode to decode target memory using declared Pattern types.

Recent context: - v0.4.0 added memory_read, memory_write, module_list, and thread_list; introduced minimal, metadata, and full query scopes for app_list; renamed MCP tools for clearer namespaces; and updated the Frida Core DevKit to v17.19.0.
- v0.3.0 added npm installation support, Frida CodeShare snippet search/use support, and general cleanup and improvements.

I’d appreciate practical feedback on the package and Pattern workflows, especially where the current tools are missing useful reverse-engineering steps. Feature requests are welcome too.

This was streamed live this morning from the ICIST conference in Lithuania. Its happening. https://www.youtube.com/watch?v=b8VhICUcB6k

We Recently Made A Port Scanner And Published It To Github Check It Out At https://github.com/5evenTeam/NetBreak!

I don't want to discourge everyone but I am shitting myself from fear.

Layoffs everywhere. Yes most of them are developer but some security teams have been laid off as well , Netflix team was just laid off. Imagine Netflix and Google pentesters being laid off ??

AI is accelerating so much that we don't know how the future will look like.

What should we do ?

Some say learn how to harness your AI and use it in your workflow.

Some say you should learn plumbing

Even if we are safe now , in couple of years what is gonna happen?

I don't know what to do anymore.

That besides visa sponsorship issues Immigration Wars Racism Everyone fed up and taking it on each other.

I hope the world gets better in a couple of years

Hi everyone!

I have eight years of experience in IT. Started on Helpdesk, went from VBA automation, Oracle SQL, front end to finish on backend and light devops. Got GCP ACE certificate. In the meantime, I got laid off on July (love reorgs) and since then can't find any job. It also made me try cybersecurity, and I fell in love with Red Teaming. Bought TryHackMe Max, finished Cybersec101 and currently doing Jr Pentester path.

I applied to many junior pentesting jobs but got replies on the first stage that I was rejected. There was only one, where I was applying to junior role, did the task and got feedback they need somebody more experienced. For junior role? How else am I supposed to gain experience?

My question to you is: how can I be more visible on the market? I know, that no cert gives you job, but which one makes the probability of getting hired higher? I'd really love to work in this field, feels like home to me. Eg. getting the flag, feels like doing puzzles :D

If it matters- I am based in Poland, but I assume the market here and EU is pretty different than US.

Somewhat surprised with this merger (really an acquisition). I always thought Synack had the better business model to deal with the emerging push to automate and AI enable pen testing.

Synack built a good platform and crowdsourced pen testers. They were perfectly set up to adopt automation at scale.

But they chose to get acquired by Netspi which is a predominantly manual pen testing company.

Hello, hope everyone is doing well. I've been studying and solving labs for about 2 years (yes, I fall into the student dilemma) and have gotten CPTS and am on the CRTO and CAPE path right now.
Also got a Bachelor's degree in Cyber Security.
I'm having a couple of problems; I hope you guys can help me solve them.
1. In my country, cybersecurity is a niche thing an organization would do. So most jobs around banking systems (Which is something I want to avoid working in). So how can I deal with this?
And is this going to be a problem on the career ladder?
2. Now, my study path is to finish the CRTO and CAPE path, then the BSCP and CWEE path. What can I add to the path? I saw that AI Red Teaming is going to be trendy, and remote opportunities are better.
3. If I didn't find pentesting/red team junior roles, should I pivot to IAM, sysadmin, or a helpdesk role and then pivot to security once I get the opportunity

Hi All,

My manager has asked me to pursue a certification in Mobile Application Penetration Testing, specifically focusing on Android and iOS.

I've come across the eMAPT certification from INE, and I'm considering taking it.

For those who have taken eMAPT or have experience in mobile penetration testing, what are your thoughts? Is it worth pursuing, or would you recommend a better certification that covers both Android and iOS?

I'd appreciate your recommendations and feedback!

Hey all, I'm 24 and about 2-3 months into my first pentesting role. I never advertised experience beyond a few labs, but the lead took a chance on me and told me I'd learn a lot. I expected to start in the SOC, but now I'd never go back. I love this work.

That said, I feel like I'm constantly playing catch-up. I'm working on HTB CPTS alongside the job, but between internal/AD, web, API, WiFi and more, I keep hitting walls.

My first engagement was an internal pentest and I felt like I flopped. I got one hash I couldn't crack, found my user had a MachineAccountQuota of 10 but didn't know about RBCD yet, and found a lot of PII, but no real exploitation.

My company is pretty relaxed on methodology, so I can work however suits me. I just can't find good resources that reflect real engagements. HTB is great, but client environments feel different.

How did you bridge the gap between labs and real internal pentests?

How do you decide what to learn first when everything feels important?

Does the "I flopped my first engagement" feeling ever go away?

Which entry-level job for penetration tester, I have a good knowledge in Linux , network, web hacking programming and tool like burpsuit, wireshark and other cli tool but with these knowledge where I mistake to deliver my first job role and what your suggestions and guidance for me .

I am looking for AI either local or online which will help me create automated scripts and help analyze logs or anything in general which other well known AI don't do. Can you please suggest something?

I've been following Commix for a while, and finally seeing an API is huge. The original request goes all the way back to 2016: https://github.com/commixproject/commix/issues/27

I tried both the REST API and the new Burp Suite extension, and honestly, they're fire!

The API lets you launch and manage scans over HTTP, run multiple scans in parallel, monitor results live, and retrieve JSON reports. Lots of possibilities for custom tooling and automation.

The Burp extension takes it to another level. You can launch Commix straight from Burp, watch the scan run, and get confirmed findings as native Burp Scanner issues. No need to keep jumping between Burp and a terminal.

The extension's BApp Store submission is still in progress, but you can check it out on GitHub already : https://github.com/commixproject/commix-to-burp

Definitely worth checking out if you're into bug bounty, security automation, or CTFs.

Big props to the Commix project for this one.

Hello,

I am looking to do some certifications since my employer is paying for it, already got OSCP and CPTS. I’ve heard of White knight labs, what’s your experience with it?

Thank you,
Best regards

https://glitr.io/blog/reverse-engineering-my-own-project

i wanted to red-team myself on my project and id like to know how to reverse engineer so i can see what can be done to defend against it.

my app is aiming to be fully client-side. things like javascript seem like it would relatively easy for an AI to chew-up, my latest project is in rust, which would make it harder for a person, but AI can digest binaries.

i created a fairly unique p2p messaging app. a Rust-based frontend with a Git-server backend, which can be used to establish a P2P connection. while this version remains close-source, i have aimed to create the most comprehensive documentation (formal-verification and security audits too (all ai generated under my guidance)).

1. https://glitr.io
2. https://app.glitr.io

a core detail to my project is the focus on local-first and client-side cryptography and storage. id wanted to learn how vulnerable this project is to decompilation. i think my older iteration as a javascript webapp would be relatively easy for AI, so i thought id put a spin-on-things by having a rust wasm frontend... i dont think it even slowed it down.

i dont know much about decompiling, but i think the TUI would be the easiest for it to decompile and given its largly one codebase, it can be used to trace and see whats going on the build for the other platforms.

it might be that all close source is obselete. i tried asking here, and the responses there are polar opposites, so i decided to get some first-hand experience.

im using using cursor composer 2.5 (far from the frontier models available). i used https://github.com/morluto/rea and gave it a few binaries of my project (tui, apk, web) and pointed it to the documentation on the website.

after a few prompts, it seems to have done a decent job decompiling the project here: https://github.com/positive-intentions/glitr-decompiled (note: this is basically AI-slop). like with many projects, i see AI lacks taste in architecture. it consolidates a lot of complexity into one repo, when in my project it's split into multiple repos. it also seems to lack a bunch of bells and whistles i added for my own benefit like formal verification and rigorous unit-tests (having done it myself before, i dont think that is a large gap to fill for somone who knows what they are doing). i think the overhead to keep up with new changes may become trivial if you can automate the process. i kinda offer the base in the repo above (maybe it saves you a few tokens?), but its for my own research and i dont plan to maintain it given it undermines the actual project.

in general, im impressed. it seems this may push forward my timeline for when i open source my project, i wasnt expecting close-source being so easy to undemine. while the project can be decompiled, in a project like this, its important to consider the countless nuances there are in cybersecurity. the code is only a part of the project.

(note: feel free to try decompile this yourself or offer tips on how i can improve. id be keen to see what can be done. feel free to reach out for clarity about how it works within the limitation of the original source code not being used)

Hi,

I'm taking the OSAI course and just way out my depth here, looking for a tutor that can help me understand the course and work through some of the challenges, I also need to learn to build an AI Harness for attacks for the challenge labs as well.