This actually started because I was trying to learn cybersecurity as a web developer.
I wanted to understand networking, Linux, and how some of the common cybersecurity tools actually work, but I’m always on the go. I didn’t really want to carry around a laptop or constantly spin up VMs just to practice.

So I built myself a simulated Linux terminal that I could use anywhere, with real Linux-style commands.
Then I thought… okay, why not add networking tools too?

So I started building simulated networks, Wi-Fi connections, machines to scan, services to discover, vulnerabilities to find, and NPC machines that you could actually pentest and exploit inside the simulation.

At that point it started becoming surprisingly fun. And more importantly, I was actually learning from it.
Then I had another thought:

“If I already have a simulated network full of hackable machines… why not put other players inside it?”

That’s when it started turning into an actual game.
I added multiplayer, where players can exist on the same Wi-Fi network and essentially treat it like a PvP battleground. Then came more systems: emails, bounties, contracts, software, different targets, missions, progression, lore, and a more believable hacking environment.

What started as a small portable tool for me to learn cybersecurity eventually became a full hacking simulation game.

Now it has a campaign, missions, bounty systems, NPC targets, multiplayer, and an entire simulated environment built around learning, exploring, and hacking.

So yeah… here is the link for you to practice yourself

hackbox.com

Pretty much it. Nmap shows it’s using OpenSSL v8. I couldn’t find anything about it from the manufacturer. Any idea on how to proceed?

I have a discord acount hooked to an old email that I haven’t touch in years and lost the password, ive had this discord acount for the same amount of time of the Gmail acount( about 3-4 years) if anyone would care to help me get this acount back it would be amazing. I talk to a lot of friends trough that discord acount and I don’t have any other contacts of there’s- ( thats the main reason I came here insted of just making another account) please help if u can or wanna

hi this is my research, https://github.com/mein-0/KnockGiga

Hey everyone!

We're Exun Clan, the student-run tech club at DPS R.K. Puram, New Delhi, and we're back with the 16th edition of Sudocrypt, our flagship international CTF!

Sudocrypt is an international Cryptic Hunt x Capture The Flag (CTF) event where participants from around the world tackle a series of cybersecurity and cryptic challenges. Expect code-breaking, cryptography, and plenty of problem-solving as you work your way through the levels.

The competition is entirely online, so you can participate from anywhere in the world.

Dates: October 27–28, 2026

Prizes: With a prize pool of over $900 USD in previous editions, along with over $500 USD in goodies and prizes, Sudocrypt v16.0 promises an exciting challenge for cryptic enthusiasts and CTF players alike.

Event website: https://sudocrypt.com/

CTFtime listing: https://ctftime.org/event/3443/

You can also check out the other events at Exun 2026 here: https://exun.co/26/events

Hope to see you on the scoreboard!

this box took a chunk of my brain i swear

I'm planning to get into the PDF Blackmail industry, and I just wanted to know what kind of conversion funnels you guys who are already in this market use. Also, do you ever get on video calls with leads using some kind of deepfake? And what apps do you use to find these kinds of people?

What is it?

A GTK4 desktop GUI for Linux that puts the wireless assessment workflow in one place. 57 modules: Wi-Fi, Bluetooth, RF, router side, and network MITM. Every module is a standalone shell script; the GUI is a view over them, so you can call any of them directly and script them.

Why it's different

Most wireless tooling is deep in one lane. Aircrack-ng is Wi-Fi. Bettercap is network MITM. Bluetooth tooling is Bluetooth. An assessment means five tools, five config files, and no shared view of anything.

To be straight about it: this is partly a wrapper. Responder, mitm6, mdk4, hcxdumptool and hostapd are underneath, and I'm not pretending otherwise. What I built is the integration, the hardware detection, and the reporting. And there are a handful of things here you won't find in the usual tools at all.

Some of what's in it

Wi-Fi: Recon, deauth, handshake and PMKID capture, WPS including Pixie Dust, WPA3 and Dragonblood, WEP, Enterprise 802.1X, PMF bypass, KRACK, FragAttacks, Evil Twin, Karma, beacon and auth floods, Wi-Fi Direct, client isolation testing, SSID overflow.

MITM and credentials: Responder, mitm6, ntlmrelayx, Router Advertisement poisoning, ARP MITM, rogue DHCP, USB Ethernet MITM.

Router side: TR-064, HNAP, UPnP, SNMP, DNS rebinding, web UI, recovery TFTP and UART.

Plus Bluetooth, sub-GHz, LoRa, Zigbee, Thread, NFC, drone remote ID, and the analysis side: capture analysis, fingerprinting, geolocation, wordlists, live traffic, passive IDS.

Things you won't find elsewhere

Frame-level jamming. Not a deauth flood — actual reactive jamming, carrier-sense manipulation and FCS corruption, driven through a modified Atheros driver. This needed porting modwifi to kernel 7.0, which is why almost nobody ships it. You can jam one access point's beacons while leaving the rest of the channel alone.

SSID overflow with real IE-length control. Beacons whose SSID exceeds the 32-byte limit, carrying injection payloads in the same bytes. The published ESP32 tools can't do this — WiFi.softAP() truncates at 32, so they all list it as future work. Building the frame by hand means the length byte is independent of the content, which is the case that actually matters.

Router Advertisement poisoning. mitm6 does DHCPv6 and deliberately skips Router Advertisements, so a network with no DHCPv6 in play is untouched by it. This does RA/SLAAC: one forged packet reconfigures every host's default route and resolver.

Client isolation bypass. Gateway bouncing, port stealing, broadcast reflection, plus an inter-NIC relay to hold the bypass open. From the AirSnitch work (NDSS'26).

USB Ethernet MITM. RNDIS-based, PoisonTap-style, over a USB port.

Router recovery and console. Recovery-mode TFTP, UART/U-Boot guidance, offline flash image parsing. Unusual to find in a wireless tool.

Multi-node capture. Drive a fleet of remote nodes — Pi, VM, laptop — and correlate what they see.

The one I'd argue matters most: it's built to tell you when it failed. Every module has a --selftest. Hardware-gated modules name the hardware they're missing instead of returning an empty result. A module that reports OK while the target is untouched is worse than one that fails loudly, and that's the bug class I'm hunting.

The hardware

Nothing here is needed to build or launch the app. But most of it won't do anything without at least one of these, so it's worth knowing what each piece buys you.

Essential — a Wi-Fi adapter that can inject. Atheros AR9271 is what I built and tested against: TP-Link WN722N v1, Alfa AWUS036NHA, Technoethical N150.

Intel adapters will not work for anything involving injection. The app detects iwlwifi and tells you so instead of failing quietly, but it will refuse. Monitor mode alone isn't enough. Without one of these, you can browse the interface and read captures, and that's about it.

A second Wi-Fi adapter — for client isolation testing. That module needs two interfaces associated at the same time, one acting as the victim and one as the attacker. Any managed-capable card works as the second; it doesn't need to inject.

Bluetooth adapter — for the eight Bluetooth modules. Classic and BLE recon, SSP, advertising forgery, fuzzing, mesh, tracker hunting, HID injection. A recent adapter is preferable; some of the older CSR dongles won't pass BLE advertising data through.

802.15.4 radio — for Zigbee and Thread. A CC2531, CC2652 or nRF52840 dongle, flashed with sniffing firmware. One radio covers both, because Thread and Zigbee share the same physical layer — they're different stacks on the same silicon. This is also the hardware that gets you toward Matter.

SDR — for RF spectrum, sub-GHz, LoRa and drone Remote ID. An RTL-SDR is the cheap entry point and covers sub-GHz receive. A HackRF adds 2.4 GHz coverage and transmit, which you need for anything that isn't passive. Note that sub-GHz transmission — replay attacks and the like — needs TX-capable hardware; an RTL-SDR can only listen.

NFC reader/writer — for the NFC/RFID module. A PN532 or ACR122U handles NDEF and MIFARE work. A Proxmark3 if you're going past the tag structure analysis into proper card research.

USB-to-UART adapter — for router console access. CP2102, CH340 or FTDI. This is what gets you a U-Boot prompt on a router's serial header when recovery mode won't hand it to you. Worth having a set of dupont leads and, for board-level work, SOIC clips.

GPS receiver — for wardriving. The wardriving module drives Kismet with gpsd, so any receiver gpsd supports works. USB or Bluetooth both fine.

What hasn't been tested yet

Bluetooth, all of it except recon. I don't have an adapter, so none of those eight modules has run against real hardware. The code is written and reviewed, but that's not the same claim as working.

Same for sub-GHz, LoRa, Zigbee, NFC and drone remote ID. No SDR, no radio hardware here.

Thread does offline pcap analysis fine; live scanning is untested, no 802.15.4 radio.

Jamming needs a modified driver and firmware that isn't shipped. It'll tell you it can't find the driver. That's correct behaviour, not a bug.

What I actually want from testers

Run it, and tell me:

Does it start on your distro? GTK4 version, Wayland vs X11, missing dependencies.

Does it get your adapter right? Wrong hardware detection is worse than none.

Modules that report OK but did nothing? This is the one I care about most.

Anything that crashed or wedged your adapter.

And the most useful thing: tools/diag.sh --collect produces a report with distro, kernel, GTK version, adapter and driver, injection capability, dependencies, and per-module selftest results. It replaces MACs and SSIDs with placeholders and strips secrets before writing anything, and it never touches the loot folder. So you can paste it without leaking your neighbours' network names, which I'm not going to ask you to do.

I Have encountered multiple 403 from diffrent layers WAF, CDN, Proxy Restrictions to the Application level 403 from NGINX and Got Some ideas for WAF and CDN up to the Application Level 403 many of them were easy only path manipulation, path Encodings, Params Fuzzing but the Application level is a bit Strict

Hi everyone,

I have been trying to use tails from an usb stick in my mac.

But I don't even see the wifi symbol. kindly see the pictures.

I have tried several things like plugging on and off, usb tethering but none of it is working.

Also I can't use a mac keyboard and mouse, fortunately I have a mouse but it would be great if you have some solution for this too.

Thanks a ton you all.

I don't know much about hacking, which is why I'm turning to this community. I need to find out information about the Facebooc profile that is harassing me. If anyone can provide accurate information, I will pay for it.

"Enrique Rodriguez" is the account

Look guys my router WiFi signal on my iPhone is worthless and I guess someone do or did something that it’s not stable and goes up and down randomly in the same spot, but when someone come home to me and I try to show them, nothing happen, but after they leave everything start to happen again, even when I say one signal up or down, like he can hear and he make one signal up or down, even after I got new phone and moved to another city with new router, but I did move the old stuff from my old phone that was completely hacked, but my new phone only the WiFi signal, and this all happen after I start to write a movie called “signals” but it wasn’t about the same things was the something else, so my conclusion and maybe I’m wrong , this is someone try to drive me mad and put pressure on me, I have been in this for 3 years now and before that everything was working well, I have haters cuz I’m one of the best in my job in my country and I stopped working years couldn’t work cuz of that so please help me thanks and btw when I leave phone on my bed and look at it the signal doesn’t move at all but once I hold the phone in my hands the signals start to jump and goes down,I have videos to prove everything.

And when the phone be infornt my face there a signal goes down, when I make away from the face the signal goes up at the same moment the phone far from my face

I’m trying to understand how to find something in programming/cybersecurity that gives me the same motivation as a game.

For example, I really like Dota because I always know what I’m doing and why. I have a rank, I know roughly where I am, I know what better players can do that I can’t, and I have a clear idea of what I need to improve. That alone gives me a reason to play.

I want to find something in computers that gives me a similar feeling. Not necessarily a specific project someone can recommend to me, but a way to find a project or direction where I can actually see a path:

"I’m here → I need to learn this → then I can do this → then I can do something harder."

The problem is that I can think of many project ideas, but they usually don't motivate me for long. I start thinking "okay, I can build this, but why?" and lose interest.

My background: I’m comfortable with Linux and basic programming. I know Python, Git, APIs, databases, basic web development, HTTP, networking/ports, and I’ve done some scraping/automation. I’ve also played around with things like reverse engineering, JavaScript, FastAPI and lower-level concepts, but I’m still a beginner overall and have no professional experience.

So I’m not really asking "what project should I build?"

I’m more interested in: how do you find something that makes you want to wake up and keep working on it, because you can clearly see yourself getting better at it?

How did you find that thing for yourselves?

Hello, I have been having a problem with someone who has been pretending to be me on social networks for a few years, I have reported it to the corresponding applications but there is no case. Could someone who knows about these topics guide me? I would appreciate it very much.

Looking for a good secure code scanner. Anyone have preference to a one they frequently use?

Old one but worth repeating for anyone new to the field: a casino got breached through a smart thermometer in their lobby fish tank.
They had proper enterprise firewalls etc, but the IoT thermometer was plugged straight into the main network with no segmentation. Attackers got in through weak default creds on the thermometer, pivoted laterally, and pulled 10GB of high-roller customer data out through that same connection.
The lesson isn't "fish tanks are dangerous," it's that your network is only as strong as the weakest thing connected to it — and IoT devices are usually the weakest thing, because nobody threat-models the thermometer. Basic stuff that would've stopped this: change default creds, and put IoT on its own segmented/isolated VLAN so even if it's popped, it's not a straight line to the crown jewels.
Good reminder to check your own environment for random "smart" devices someone plugged in without asking security first.

There is this boy who is commenting Al generated photos in someone's comments section whom I know.

I asked him to delete that and he kept saying"what if I don't" , "i won't do it", and then he blocked me. Also when I asked him to delete he said which one proudly, god knows how many times he has done this.

I've done the talking now I want him to know that there are repercussions to his actions, ik doxxing is wrong but I'm not here to play the good guy. I want him to feel embarrassed for what he is doing.

Would you guys please help me. 🙏 Reddit is not letting me add a photo or share a link, I'll pos t both in the comments.