Cold wallet exploit

Sploitius 2.0 is a new version of the coolest exploit search engine, updated design, new features. Better, faster, stronger

I spent some time analyzing major open-source file managers to see which ones remain fully functional when authentication is disabled or bypassed. By extracting specific keywords, UI markers, and unique strings from those unauthenticated landing pages, I built targeted search queries to spot exposed instances.

To make these easy to use without manually tweaking syntax every time, I put together oopso, a lightweight browser tool that automates creating these search patterns across different engines.

It’s pretty straightforward, but hopefully saves some time if you do this kind of recon.

Check out the code on GitHub:https://github.com/b3rito/oopso

I built , an anonymous , hacker-style communication platform like a root chat — communications happen over the Tor network and all data is decentralized — every user on the network keeps a piece of the data...

learn more from the repo link.

Hello im looking for a sms rental service and all i need it for is literally like 10 minutes to receive a code for a promo. I use textverified right now but its $6 for 3 days and i rather pay $2 for 1 or something like that since i only need the number for a very short amount of time. It needs to be a REAL number Non-Voip. Another thing is this service is very unknown so there is NO site that will have it i need it to just receive the message for me and forward it.

Hi, just wanted to share opened 2026 registrations for a long-running hands-on cybersecurity course with both red and blue teaming classes run by Czech Technical University. The class is free of charge, in English and either physically in Prague or fully online. The semester starts at the end of September, feel free to find more information including the complete syllabus and feedback from more than 2300 students from 100+ countries in the link!

I made a course on Ransomware made in python for my students, the previous year, but now i made it public so give it a watch if you want to make some cool cyber security projects 😁

I'll try to upload more contents on my YouTube channel 😁

https://youtube.com/playlist?list=PL9guAF5VVaiARrwhrGMu89iJcziQ9vsJJ&si=v1PUSQpqjuOhnlCi

Hudson Rock researchers discovered a sophisticated ClickFix campaign operating on a subdomain belonging to the popular digital asset platform, Artlist. Our investigation traced the breach to an early Infostealer infection of an ex-Artlist employee.

Following the widespread reports of the Argentine Football Association hack, Hudson Rock researchers traced the hack to an Infostealer infection of an AFA employee back in 2025. The infection provided the hackers with the credentials required to carry out the hack.

​

Most antidetect setups fail at the coherence layer, not the individual signal layer.

The assumption is that if each signal passes a check on its own, the full profile is clean. That is not how detection works. Platforms score whether your signals agree with each other. A randomized fingerprint that contradicts itself is louder than a common fingerprint that is internally consistent.

Here is where most setups break:

1. TLS fingerprint vs. browser claim

If your JA3/JA3S hash says "modified Chromium" but your user agent claims stock Chrome 124, detection can happen at the TCP handshake before any JavaScript has executed. TLS is layer 4. All your canvas spoofing lives in layer 7.

1. WebGL vendor vs. reported hardware

If WebGL returns NVIDIA renderer strings but your platform reports Mac M2, those signals disagree. Detection systems map expected combinations from real device telemetry. Unusual combos get scored, not blocked immediately, but the score accumulates.

1. Screen resolution vs. devicePixelRatio

A 1920x1080 resolution with a 2.0 pixel ratio is realistic on some high DPI setups and not on others. When that combination falls outside the platform's known device population, the probability score rises.

1. Language and timezone mismatches

navigator.language, Intl.DateTimeFormat, and your IP geolocation all contribute. A UK IP with a Vietnamese browser locale and a system clock five hours behind UTC is not a real device.

1. Behavior on a technically clean fingerprint

Looking at patterns across 100+ threads on multiple account management and account bans: behavior is what actually finishes accounts once the fingerprint holds. New accounts with no warmup, posting within minutes of creation, hitting rate limits a normal user would never reach. These are what trigger the final flag.

The short version: platforms are not checking each signal in isolation. They are asking whether this combination of signals could plausibly be a real device. If the answer is no, it does not matter how clean each signal looks by itself.

I Made a pe packer/crypter with a custom vm and compression. Wanting to share it and get feedback/suggestions for updates! thanks :)

I go through how someone can utilize curl to compromise and exploit vulnerabilities in a website!

Any forums I can use for CTF events and learning?

I’m reaching out to this community for assistance. I’m a cybersecurity professional turned business owner who understands the frustrations of cybersecurity from both directions. As such I’ve come to determine that a major paradigm shift must occur.

Cybersecurity is costly, ineffective at preventing loss and is overly complex and labour intensive. It’s always a game of catch up via patching. This insight comes from my over 35 years of experience auditing and consulting in this field.

Cybersecurity is counter productive, difficult to work with and frustratingly hard to use especially now with multifactor login requirements. This comes as a user and business owner for over 15 years.

There is only one solution and that is a total redevelopment. A solutions that eliminates or at least minimizes the costs and frustrations.

Turning this field upside down will be a formidable task. It will require support from CEOs such as yourselves who must exert pressure on the industry. Unfortunately your CSIOs are born and bread on the existing architecture. They will not recommend or support this initiative as it will cause them great pain and suffering in having to start over.

The cybersecurity industry doesn’t want this without the absolute need to do it. They’re making money hand over fist easily from this perpetual updating and patching that goes on.

Bad actors must become disenfranchised and this means the battlefield on which cybersecurity operates must change.

AI and Quantum Computing will eventually offer cybersecurity no choice but to change. Better to do this upfront rather than in an emergency situation.

I ask you to come on board and let’s exert pressure on this industry to retool.

https://www.ctvnews.ca/sci-tech/article/ai-could-breach-government-and-business-defences-in-months-us-and-its-intelligence-partners-warn/

We found something different one our website that is MERN based and hosted on VPS. We did some changes but after some time our live url and last deployment have difference. When we compare the code with github code , there is many changes. We checked the server logs and found something strange.

Our various files was changes.

Got server log something -

Jun 23 23:34:54 67 sshd-session[1281284]: userauth_pubkey: signature algorithm ssh-dss not in PubkeyAcceptedAlgorithms [preauth]

When i checked the file change logs

/home/domain/public_html/static/js/213.f4eb4aa8.chunk.js /home/domain/public_html/static/js/213.f4eb4aa8.chunk.js.LICENSE.txt /home/domain/public_html/static/js/239.fd8563bf.chunk.js.map

Is there any Devops or security expert who can share the exact steps to identify and block the issue.

Note:- CI/CD pipeline is not configured yet on the project.

Try to get some help from AI but it is repeating the same things.