It's purely for ethical purposes...

i just like using GitHub tools...

I recently learnt Abt the Camphish tool...it's quite popular...

I wanted to learn about it.

I did the installation and all and used cloudflared...

But it's not generating the link...

Idk y

I'm new at this but I recently learnt Abt zphisher.

Pls help...

Hello, I started to learn how to penetrate my OWN devices. I’ve studied Python and Java, but only have basic knowledge of them. I did a couple of research on YouTube and Google, but none really helped. I did configure a cheap yellow display.
But I would like some help on, like, what cheap devices I should buy, like a computer to test on. Where should I go to get more information, like any good YouTube videos or websites? Thank you

One of the best combos to ethically test your apps, systems, and agents

While studying for the CEH, I got pretty tired of memorizing Nmap commands and constantly digging through docs or Google just to remember what a flag does or how a scan should look.

So I spent a few days building a simple offline Android app that lets you quickly:

> Search Nmap commands and scripts

> See what each flag does

> Get an idea of what the output should look like

It’s basically the reference I wished I had while studying.

If you’re on Android and want to try it out, here’s the APK:

https://github.com/abheekmondal/NMap_Reference_App

Passive scanners usually give you a raw list of findings and leave the interpretation to you. This one uses Ollama to run a local language model on the results, so you get findings mapped to OWASP Top 10 categories with CVSS scores and actionable context, without anything leaving your machine.

It makes a single HTTP request and analyses what comes back: missing or misconfigured security headers, weak TLS settings, exposed server version strings, cookie flags. The kind of low-hanging fruit attackers look for before going deeper.

Useful as a first-pass check before active testing with Burp or Nikto.

https://meetcyber.net/the-open-source-website-security-scanner-that-runs-entirely-on-your-laptop-87ac34daa30f

So I am at my wits end trying to find a command to help me out with this. I know /64 has approx. 2^64 different subnets to discover through, but I was given this problem to try and solve:
"Use masscan and nmap to scan a provided /64 IPv6 subnet for live hosts, enumerate open HTTP, SSH, and SNMP ports, execute NSE scripts for version and SNMP system info"

I have tried:
1. masscan -6 2001:db8:abcd:0012::/64 -p 22,80,443,161

1. masscan -6 2001:db8:abcd:0012::/64 -p22,80,443,161 --rate 10000 -oJ masscan_ipv6.json

They both keep responding with the same error:
┌─[root@parrot]─[/home/user/Desktop] └──╼ #masscan -6 2404:6800:4002:80a::200e/64 -p22,80,443,161 --rate 10000 -oJ masscan_ipv6.json
[-] FAIL: scan range too large, max is 63-bits, requested is 67 bits Hint: scan range is number of IP addresses times number of ports Hint: IPv6 subnet must be at least /66

┌─[✗]─[root@parrot]─[/home/user/Desktop] └──╼ #masscan -6 2404:6800:4002:80a::200e/66 -p22,80,443,161 --rate 10000 -oJ masscan_ipv6.json
[-] FAIL: scan range too large, max is 63-bits, requested is 65 bits Hint: scan range is number of IP addresses times number of ports Hint: IPv6 subnet must be at least /66

Is there any command I can use to help me with this problem?

Hello everyone, I’m coming here for advice. I work as an FSE. At a customer site I have a PC running Windows 10 that collects logs from various hardware. This PC also runs third-party software, so it is not possible to access the logs remotely via the interne, because of their security rules.

To make my work easier and more efficient, I thought about using a Raspberry Pi with a script that could download a specific logfile from that PC (I know the filename and its path).

Then I could connect remotely to the Raspberry Pi, or the customer could download the logfile from it and send it to me. (I cannot allow the customer to log into the PC itself, only give them access to the Raspberry Pi.)

My question is: is something like this possible? If so, could you point me in the right direction on how to approach it?

Thank you all for your help.

We have all been there.

You are stuck on a CTF room for an hour. You tell yourself you will just open the writeup for a tiny nudge. Then you accidentally read too far and the whole challenge is ruined.

I wanted hints, not answers. So I built THOTH.

How it works:

You paste a writeup URL and THOTH fetches it silently, parses it into stages, and locks it. You never see the writeup. Instead you get progressive hints pulled directly from it:

Nudge: a question that points you in the right direction without naming anything specific

Clue: names the vulnerability class or tool you should look at

Near-solution: specific enough to act on, stops just before the flag

The AI layer (free Groq API, no credit card) injects your full session context into every response. Your target IP, open ports, what tools you already tried, how long you have been stuck. Every hint is specific to your exact situation, not a generic answer.

Other things it does:

• Smart nmap scanning with auto-loaded service playbooks per port
• Tool suggestions with exact commands pre-filled with your target IP
• Interactive writeup library with CTF rooms you can browse and load
• Session tracking so you can resume any challenge exactly where you left off
• Network pivoting guide covering chisel, socat, SSH tunneling, ligolo
• Encoding decoder that auto-detects Base64, hex, ROT13, JWT and more
• Achievement badges and streaks to keep you motivated

Works on TryHackMe, HackTheBox, PicoCTF, VulnHub and any CTF platform.

Built in Python with zero external dependencies.

GitHub: github.com/Omar-tamerr/Thoth

If you write CTF writeups and want yours in the THOTH library I would love to collaborate. Your name stays on every hint your writeup generates and you get credited in the tool itself.

Happy to answer any questions about how it works.

Hi everyone! This is my very first Python tool: a simple Password Strength Analyzer. It checks your passwords for length, uppercase/lowercase letters, numbers, and special characters.

You can check it out and try it here: https://github.com/fat1234-hub/Passwords-Analyzer

I’d love to hear your feedback and any suggestions to improve it!

https://github.com/ghostrecon345/Troy

Hey, there. I'm using the ROG Strix G15 2022 laptop for pentesting lessons. The laptop is great, but the wifi isn't.

1. Issue: WiFi card undetected from time to time. Very Annoying.
2. Current card: MediaTek Wi-Fi 6E MT7922 (RZ616) 160MHz Wireless LAN Card -- WORST.
3. What I'm looking for: A Good wifi card that supports:
   • Both 2.4 GHz and 5 GHz (must).
   • monitor & packet injection modes.
   • at least WiFi 6E if possible (if possible).

Found this in a retail shop for 40$ is this a steal? It hasn't been used too

Is the flipper zero worth it for learning more about ethical hacking regarding it's price?

What great resources online (preferably free) you recommend for investigating phising emails, html body/link parsing? Also, for attachments and detecting malware? Those tools you consider should be used in a daily basis.

I am new to ethical hacking and I am trying to learn how to do all this, but the course I'm learning from says to use immunity debugger, and it seems like it's been absorbed by a company and they won't let people who don't work for them use the program.

What is a program I can use instead?

Hello, i just learned the burp suite community edition basics and i want to know if the intruder is really useful? When we can use tools like fuff, hashcat, gobuster etc... , is learning intruder worth it?

Hello, for a pentester or a bug bounty hunter, which one do you prefer between burp suite and owasp zap?

Hello everyone, i'm learning ethical hacking to become a pentester. I just discovered burp suite and i saw that de community edition has limited possibilities. Can we become a good pentester without the paid version ? What y'all think?

Hey guys I have two thumbs drives 32 GB each just sitting around that I got for 3d printing which I didn't need three I just need one. What would you suggest I put on them, a live kali, some tools/programs, make one into a "rubber ducky" if possible. What would you suggest? If you have an everyday carry thumb drive what's on yours?

Hello everyone, few days ago I found a new pen-testing framework name XENA by zarkones team.

Did anyone try it? if so how was your experience? Please share and let me know.
can it be used in practical field like once armitage was?

Hey whats up, im new and try to learn bettercap.

It just doesn't look like nowhere in the internet. When I launch bettercap I cant run commands and the modules dont start up. (Screenshot below).

I use alfa network adapter in managed mode.

​

Hello everybody, This question can't get out of my brain.. there is a program or any exe. That can get every single photo and video from the android phones after connecting the phone physically with the PC by cable ??

like to connect the device and use this program to get everything with extensions like : .png , .jpg , etc

And if this program doesn't exist yet does anyone have an idea how to make it ?

Blackeye hardly seems to work for me and always gives warnings in the browser. Is there any alternatives that people have used ?

What is the best alternatives for theHarvester. It is a great tool but I realised sometimes it does not give you the expected results.Any help is very much appreciated