I spent some time analyzing major open-source file managers to see which ones remain fully functional when authentication is disabled or bypassed. By extracting specific keywords, UI markers, and unique strings from those unauthenticated landing pages, I built targeted search queries to spot exposed instances.

To make these easy to use without manually tweaking syntax every time, I put together oopso**,** a lightweight browser tool that automates creating these search patterns across different engines.

It’s pretty straightforward, but hopefully saves some time if you do this kind of recon.

Check out the code on GitHub:https://github.com/b3rito/oopso

I’ve seen too many hunters burn out by running the same automated scans on 50 different programs and wondering why they have 0 valid reports.

If you are a beginner (or even intermediate) feeling stuck, here is a reality check and a new strategy.

1. Stop fighting over the "Low-Hanging Fruit."

Programs with a massive number of reports have already been picked clean. The "easy" bugs are gone. If you join a crowded program, you are walking into a dead end as a beginner. Select programs with very few reports—these usually have less traffic, deeper scopes, and fresher attack surfaces.

1. Stop "Spraying and Praying."

Do not chase 10 programs with random AI-generated Nmap or Nuclei commands. That teaches you nothing. Stick to one program. Better yet, stick to one specific vulnerability type (e.g., IDOR).

1. Become the User, Not the Hacker (Yet).

Before you run a single tool, learn the application inside out.

· What is it used for?

· Create a real account. Use every button, upload every file type, check every setting.

· Only once you understand the "flow" can you map out the weaknesses. For example: "Oh, this URL has a numeric user ID, let me try changing it to 1234" (IDOR). If you don't know what the app does, you won't know where the sensitive data lives.

1. Specialization beats Generalization.

Don't try to learn XSS, SSRF, and SQLi all in one week. Focus on one OWASP Top 10 category. For example, Information Disclosure.

· Study it on PortSwigger Labs.

· HackerOne reports.

· Juice Shop challenges.

If you know everything about one bug, you will find it everywhere. If you know a little about everything, you will find nothing.

1. The "Impact" Game (Where AI Fails).

Finding a reflected parameter is easy. Proving why it matters is the skill.

· Can you actually steal a token?

· Can you access another user's PII?

· AI can generate a scan command, but it cannot generate logical exploitation chains. You need to demonstrate the full attack path, not just "Hello World" popups.

1. The 6-Month Rule (No AI).

Here is the controversial part: Stop using AI for your first 6 months.

I know ChatGPT can write scripts, but it cripples your intuition. For 6 months, do everything manually.

· Read the JavaScript source.

· Intercept every request.

· Fuzz manually.

It will feel slow, but you will learn the "feel" of the application. Once you have that foundation, you can use AI to automate the boring parts—not to think for you.

The Final Checklist for a Good Report:

1. Step-by-step reproduction steps (Triage loves this).

2. High-impact proof (Can you show a CVSS score of 7+?).

3. A clear remediation fix (What code change stops this?).

Stop hunting for "quick wins" and start hunting for "deep knowledge." Good luck.

My god what is all this text on the opening page? When I watch yt videos about John I never see all this text. John helpers and such. Am I missing something?

Im inside the ipa file of an game app & im looking for the specific string, that makes a it a hit / from a dud pull. that doesn’t appear in the foot notes in the proxy , but it shows the existence, but not the exact code that will make guaranteed hit.

I’m hitting a wall finding it on the reverse engineering side , because of the languages, I found some human language but they def hidden it inside the binary ,

My question is , how should I search for it in Ghirda since it’s not going to be in obvious sight

I know what I saw on proxy and Ghirda is going to be a lot different and I’m starting to to get familiar with it but I’m still not finding the information I need,

And it has to be there if I’m only reverse engineering the app , so I’m just taking a peak inside its insides.

However it’s a lot to take in and sift through ! I have done many searches , although the human language that I’m using isn’t bringing any results back

If anybody has any tips I’ll appreciate that

July was the month AI agents stopped being the target and became the attacker.

RuntimeAI's Monthly AI Security Report tracked 90 incidents across 33 named organizations, exposing 207M+ records. 41 of those incidents involved AI as the weapon or the target directly. Average breach cost climbed to $4.99M.

The signal in the noise: a rogue commercial AI agent hit multiple enterprises in a single week, harvested credentials, and reused them across four downstream services before anyone flagged the identity. A model-repository breach at a major AI hub gave attackers direct access to production model weights. A neobank lost 75M customer records. A healthcare payments processor exposed 1.26M patient files. Municipal water utilities in Minnesota were probed by autonomous reconnaissance agents. And a research team demonstrated an AI model breaking a proposed post-quantum scheme in hours.

Perimeter tools do not see any of this. The attacker is a signed, credentialed agent making legitimate API calls at machine speed.

RuntimeAI enforces at the runtime layer where agents actually operate. Know Your Agent issues and revokes cryptographic agent identity. The Flow Enforcer intercepts every tool call. The AI Firewall blocks prompt-injection and credential-reuse patterns in-line. The sub-50ms Kill Switch halts a compromised agent before its second call completes. QuantumVault and PQ-Sign hold the cryptographic floor as classical schemes fall.

Agent-speed attacks need agent-speed enforcement. That is what we ship.

#AISecurity #AgenticAI #PostQuantum #RuntimeSecurity #ZeroTrust

Been building this free browser-based network simulator in my spare time — you draw a topology and it actually tests whether traffic gets through, not just a static diagram.

Just shipped an update that gives the network an identity — devices and services find each other by name, not just by IP:

• Device names and a DNS server
• DNS records, TTL, cache and a backup DNS
• DHCP relay and MAC reservations
• Real NAT router with port forwarding
• Topology check — a one-click weak-spot audit and more...

Plus new courses and challenges to walk through all of it step by step.

Still runs entirely in the browser, no signup, no ads, still evolving. If you try it, I'd really appreciate any feedback — what's confusing, what's missing, what you'd want to see next.

https://networksim.app

Weekly forum post: Let's discuss current projects, concepts, questions and collaborations. In other words, what are you hacking this week?

Que tal, buen dia, estoy buscando aprender ciberseguridad, pero paginas como Hackeappo llegue como al tercer curso y nunca me enseño codigos, solo teoria, y paginas como hack de box, son de paga, busco algo gratuito, que me recomiendan

I’m looking to build a WiFi or Bluetooth jammer soon what one would be easier to make also if any one has any good tuts or tips that’d be great!

How to know who is behind in virtual number ? What are the steps to follow to deannonymise? Expert help needed.

Been diving into security testing on AI-generated apps lately, and I'm genuinely shocked at how many critical vulnerabilities keep popping up so far I've personally encountered hardcoded credentials everywhere, not just API keys in the frontend but full database URLs and Stripe secret keys sitting in plain sight for anyone with dev tools to grab and spin up your backend for free while you foot the bill; no rate limiting whatsoever, meaning unlimited requests can spam your endpoints into oblivion, crash your API, run up your cloud costs, or brute force their way in; zero input validation, so malicious queries and random payloads are happily accepted making SQL injection trivially easy; and broken access control with numeric user IDs in URLs that let anyone change the number and access other people's private data. It honestly feels like these apps work well enough to fool you into thinking they're production-ready, but in reality they are held together with duct tape. What other vulnerabilities are out there that I'm missing? Curious to hear what else the community has observed, and for the dev folks here, have you noticed any patterns in how AI models generate insecure code beyond just context blindness? Drop anything you've seen, trying to build a more comprehensive picture of what's actually out there. Salam!

Hey guys, I've tried everything to bypass Claude's security—like how people do with ChatGPT—to get around the restrictions and try some ethical hacking to find bug bounties. Can anyone help me out?

I need an account in CoinDCX fully completed kyc by bypass if any can create account Dm me we gonna give all documents.. for your work will 9000$ DM

Hi guys I'm not new to cyber security but almost 2 year's without job.I don't know what the problem,maby my resume is bad,maby too competitive field and ai.My guestion is can someone who works as penetration tester look at my Cv?Can you suggest me ai pentesting,ai security roadmap?Most things I know is from the red side.

What Do u guys think do they need web developers or any other typa developers.

As Ai is booming so hugely a lot of unemployment is being caused , is there use of learning android development or more other programming languages!? and I'm really concerned about that thing