is there any way to view someone’s hidden spotify followers? sorry if this isnt the right community to ask

So I accidentally typed the wrong website, just a different letter, and landed on a sketchy website which I closed immediately.

As far as I understand that unless it downloaded something and explicitly ran it then it shouldn't be able to run any code on my machine.

However, is it possible that it will somehow infect my browser (I'm using Brave, also my OS is Fedora if it matters) so that when I open a different website it can still listen to what I'm doing and get credentials I might enter there?

Why proxies don't work on windows? I am getting err_connection_reset error in my chrome and firefox browsers. I took proxy from free proxy list, ip:port socks4/socks5 without password. Checked the proxies for validity with a proxy checker. Selected only valid proxies. Checked with several checkers. And on all these proxies connection reset error in the browser, what is it connected with?

Hi,

I've trained in IT and cybersecurity and currently work in IT at a school. I'm always fascinated by how things work and how they're implemented. In my spare time, I often explore how systems can be used in unintended ways—ethically, of course.

Lately, I've been looking into RATs and how they can capture screenshots or recordings of a victim's device without detection. I'm curious about how this happens without triggering antivirus or alerting the user. My goal isn't to create or spread a RAT but to understand the mechanics behind it—both how it works and how it might be detected.

Asking for a friend that doesn't have reddit

Is there a console-based hex viewer like xxd that works well on streams?

The problem with xxd and most (all?) the other hex viewers is that when they're used in hex + ascii mode, they need a full line of data (usually 16 bytes) before they can produce any output. So if you're dumping a stream and the stream pauses, you will never see the last data that was received unless it paused at exactly a 16-byte boundary.

What I'm looking for is an hex viewer (probably ncurses-based) that would update both the hex section and the ascii section of its output as soon a new byte is read, even if that doesn't result in a full line of output.

Does HackForums is cooperating with feds?

HackForums is probably the oldest "hacking" forum still active on the clear web.

Curiously, all others forums gets raided over the years. Also, some members were targeted through FBI operations over the last decade and some said on the web later that HF owner (Jesse) had cooperated with law enforcement by releasing infos/proofs on suspected users.

From what I can see, IMHO, Hackforums are definitely cooperating with the feds. Since 2007 they could have been taken down many times for various reasons but surprisingly still open.

This guy, Jesse is an asshole tbh, he was happy yesterday when Cracked and Nulled got taken down.

According to FBI press release available here; https://www.justice.gov/opa/pr/cracked-and-nulled-marketplaces-disrupted-international-cyber-operation

Nulled administrator is facing up to 30 years behind the bars.

How will the new UPI ID rule impact digital transactions starting February 1, 2025?

I'm dealing with a really toxic ex-boss (think manipulative, unethical, the works). His company's security is a joke – seriously, one could probably write a script to own their network in an afternoon. The temptation to use my 'skills' is strong, but I know it's a bad idea.

Anyone else ever been in a similar situation?

How do you resist the urge to unleash your inner unethical hacker when dealing with situations like this?

I am disgruntled lol but now I sort of see that many disgruntled employees, might in fact, be driven to lashing out.

I am looking for socks5 proxy that does not require authentication

My browser does not support socks5 proxy with authentication so make sure reccomend me one that will work without authentication

Might get access to it later through a summer program. Anyone have any experience with the platform? Would like to know what it is/any other info on it, doesn't seem to pop up on google a lot.

https://arstechnica.com/security/2025/01/backdoor-infecting-vpns-used-magic-packets-for-stealth-and-security/

FBI announced today the seizure of these following sites; nulled.io cracked.io sellix.io and starkrdp.io

There was an ongoing operation called Operation Talent.

Stay safe fellas.

Hey,

I imported a encrypted pdf from an ebook reader, output of `pdfinfo` says it's not a pdf file, probably it's encrypted by private key? is there a way to unlock it?

Hey there people, I am currently into this pentestring field.. I have learned some basics requiring to understand it. solved labs Portswigger, try hack me and gained some foundation knowledge specially in IDOR, XXE, SQLI, C, SSRF etc.. And yeah by learning this I Also able to find this vulnerabilities. but in random sites not actually in any bbp or vdp.. well here my question starts

unlike in labs or while you learning in somewhere in Portswigger labs those labs are too basic.. I hardly find to use them in real world scenarios.. am currently self learning all of this. any free sources you recommend for advancing those skills? Currently I am focusing on advance IDOR. Focusing on this particular vulnerability..

I don’t fucking understand if portswigger is teaching us all the same stuff wouldn’t that Mean these vulnerabilities are dead

I am relatively new to cyber secuerity, i just passed sec plus in July but ive been messing arond and learning for about a full year now. Forgive any ignorance I just love this and am eager to learn

In my home lab I wanted to try and create a reverse tcp payload using venom for an older android tablet i had (A8). I created several payload using both shikata ga nai (interesting tid bit in japanese this means "it cant be helped" or "to endure what you cant control"), base64, nothing and tried a few other encoders, the name of which escapes me at the moment.

I created a msf reverse handler and served it from a python simple http server on my local network. All ports and listener set up was correct. The tablet had google AV turned off for this exercise. I downloaded each payload to the device and when i attempted to install, only the non encoded payload would install, im assuming because of bad characters. The non encoded payload was installed and my multihandler confirmed this fact however the shell never spawned no matter how many times i tried to launch the app.

My question is, given the amount of devices that use ARM architecture why is there no specific arm encoder?

Am i lacking knowledge and is one of, for example, the XOR encoders used for this purpose?

What are your theories? Do you think the device has some sort of embedded securirty that stopped the shell spawning or was it most likely bad characters?

Is the solution what i think it is which is just to pull a list or ARM arc bad characters and manually exclude them from the encoder?

Looking to hear from some of the wizards I've seen in this sub.

Thank you

Like why create a payloads in pfp exe dll and other formats? And how do I decide what format to use?

I've taken the eJPT cert and currently working on the PNPT. The learning sources for both and THM do a thorough focus on how to do stuff, but they don't really go into the mindset on how to approach a problem and what to look for.

For instance, a good amount of the PNPT (especially the web portion) just says "okay do this and then do that". It just shows you how to do a very specific thing. I'm trying to work on my methodologies and how to approach something. But it's hard finding content like this.

Any suggestions or sources that explain stuff a bit more thoroughly?

Just curious.

I've been doing Try Hack Me modules for quite a while, and while I do think I'm still far from being professional, I do have enough of a grasp on the fundamentals to where I can figure things out (even if I don't exactly know how). I'm just curious, as someone who's being self-taught in this, when should I start job-hunting? I don't want to go in with no clue what I'm doing, but at the same time, I don't want to trap myself in the learning phase while having the ability to hack into the pentagon.

If I were in school, I would just wait until I graduate, but like I said earlier, I'm self-taught, so I have no idea when that would be. My initial guess is that I should be good when I'm able to do moderately difficult modules on my own, and potentially make a write up. However, I don't know if that's too far or too short of when I should.

For others who were self-taught, and got a career in cybersecurity, when did you start looking for jobs, and how did you know you had enough skills to be competent in your job?

Hello there, For my masters thesis I’m currently searching for leaked credentials to analyze. So if anyone could help I would be very grateful as so far turnout is very slim - .onion links are fine aswell but they should be accessible without payment - thanks in advance :)

Hello there, i'm founding our SMBs SOC and i'd like to do a small inside penetration test to show my colleagues where our systems are vulnerable.

The problem i face is that I have no clue on where to find active exploits, and it seems it's illegal to publish them (?), as I'm usually quite successful in finding virtually everything on the web.

I've also looked into Metasploit but their exploits are 15 years old? Am I overlooking something?

The CVEs that our internal systems might be vulnerable to don't have any proof of concepts online (that i can find) so naturally i tried finding similar ones: also no luck.

From the CVEs description only I can't build a PoC with my current experience.

Any advice or pointers?

Thank you in advance for any help!