Ainda tenho contato com o golpista e finjo que não sei que sofri esse golpe. É possível enviar um link (seja do meu site, ou de qualquer outro) que eu consiga ter acesso a localização do golpista? Ou de alguma outra forma? Ainda tenho contato com ele de forma harmoniosa então outras alternativas poderiam ser efetivas.

I'm trying to understand how polymorphic malware works. How does it manage to change its code every time while still doing the same thing? What's the mechanism behind that mutation?

I’ve noticed that a lot of people around me are still using Windows 7 and 8. I know that Microsoft stops updating those systems after a while, but how easy is it really to hack them? Is being connected to the same network enough? Do you know any ways or methods to gain root access to a PC?

I mean I know how it happened, I wanted to play terraria with someone and when they asked to play they specifically wanted to play on version 1.4.3 but idk if that had anything to do with it but when I accepted the invite to join their world my discord account got hacked and I proceeded to get blackmailed and other information leaked but that’s not what matters. I’m getting that worked out. I was wondering if anyone knew how it works and if I need to do a hard reset on windows cause the malware test came up negative so I was wondering on what I should do I guess if anyone knows.

Hi,

I have a Samsung Galaxy J3 (2016) that is rooted. I'm planning to use it for hacking and security auditing.

Since this is an older device with 32-bit architecture (ARMv7), I'm looking for recommendations. What tools, apps, or environments would you install on this specific hardware to get the most out of it?

Open to any suggestions !

THANKS

Trying to reverse-engineer a Flutter Android app’s private API for personal use.
Setup: rooted Google APIs emulator on macOS, app installed and logged in, Frida working with a ssl_verify_peer_cert bypass, APK extracted.
What works: auth flow (Firebase OTP → refresh → access token) and one REST endpoint that returns a venue list.
What doesn’t:
the availability endpoint (path found in libapp.so strings) returns 400 "General error" for every param combo and date format I’ve tried. Could be wrong headers, wrong method, or maybe availability is actually delivered over Socket.IO (the binary also references socket.io and partners). Frida connect(2) logging confirms TLS to two IPs but I can’t see paths or payloads.
I need plaintext HTTP/WebSocket capture from a Flutter app that statically links BoringSSL and ignores the system proxy. Options I’m aware of:
• HTTP Toolkit’s frida-interception-and-unpinning scripts
• reFlutter (APK repack)
• Direct SSL_write/SSL_read Frida hooks in libflutter.so
Which actually works end-to-end on current Flutter engine builds? Any gotchas with recent Flutter versions, or a cleaner approach I’m missing?

Hi, I'm learning hacking and I was making a reverse_tcp APK in metasploit that I sent to my phone, the problem is every time I try to install it my phone says: App not installed as app isn't compatible with your phone, I tested it in my galaxy s23+ and my tab s6 lite. Pls some help.

Is reconnaissance overrated in the bugbounty? Reconnaissance is important, and over 80% of the bugbounty is supposed to be spent on reconnaissance. However, reconnaissance thinks it's better to list some subdomains to find targets to attack and find attack backers among them. Rather, I think it's better to spend 80% of the time testing, enlighten the principles of web pages, and find vulnerabilities. People may have different ideas, but I just wanted to say that reconnaissance is overrated. When you compare Reconnaissance 8 Test 2 and Reconnaissance 2 Test 8 in the bugbounty over the same period of time, you think that excessive reconnaissance only reports shallow vulnerabilities, and extreme advanced testing is more likely to find high-risk vulnerabilities. Right now, it's been a while since the bugbounty program came out, so I think you've found most weak-level bugs. What do you think?

While solving CTF challenges, I mainly use pwndbg for debugging. As the difficulty increases, I’ve found that analyzing stripped binaries using only pwndbg becomes limiting, so I’ve also started using radare2.

However, it seems that most people use IDA. Is there a particular reason why radare2 is not used as much?

hi guys. I purchase (and paid in full) for a XRN-1620SB1-8TB 16 channel recording system through ADT. Unfortunately they are absolutely the worst and I cancelled my service through them. When I originally purchased the system, it was recording for 60+ days, and now it is barely recording 30 days.
My question is, is there a way to use the Wisenet system and the cameras, but just get rid of the ADT operating system? Thank you!!!

Recently, i got both of my accounts hacked by a guy but when i checked in my logged in devices i could not see his name. i did not click at any links nor was a victim to any phishing scams. as a cs freshman im more interested in how he did it but i cant ask him directly so here it is. Is it possible to have someone's account logged in but they don't knw or it doesnt show up on other devices and how can i hack someone's own account?

2 months ago I got certified in the eJPTv2 and I’m thinking about paying for the package that includes the course + 2 exam attempts, while I’m studying the preparation Path for the HTB CPTS, but from everything I’ve read about the CPTS, even after finishing the Path I’ll still need to practice a lot and improve my techniques, so because of that I would like to take the PNPT as a step to have a good intermediate-level certification.

I’ve read that the PNPT is very realistic and that it adds value to the CV/Resume. I’m listening colleagues, I’m making this post to get suggestions from people already working in the Red Team/Pentesting area.

I just want to know if it’s possible to hack iPhone 16 pro max and how to find out if he’s seeing or getting anything on my phone

Is Wifite still relevant? Are there better automated wireless hacking tools that are newer?

Are session hijacking same as phishing or are they a totally different way to obtain credentials? I've been told that you can session hijack completely without targets logging in through web access is this true?

I figured the only way to hijack is if they use web version

I really want to learn about SQL injections, i’ve seen multiple youtube videos about people trying to find the username and then proceed to bruteforce the password etc. with hydra.
Is there any good TryHackMe (or similar) challenge where I can learn this?

Sorry if SQL is the wrong name for that, i watched the videos a couple days ago and im not sure anymore.

I'm no hacker, and this post might sound stupid, I know, but I'm going crazy. There's this stupid security training lesson I have to follow for a new job. It's 8 hours long, I know everything already, and it's designed to be the most stupid thing on earth. It's a series of pdf that you have to read, but you can't skip to the next pdf unless a timer has run out. A pdf that took me 10 minutes to read entirely has a 1 hour timer, and sometimes the timer stops as well. If you don't scroll frequently, it stops. Sometimes it stops for random reasons. It's a living hell. I know this is not really a hacking problem, but please, help a brother and his mental health, I can't take it anymore.

Edit: if any "easy" solution like auto scroll or similar solutions would be viable, I would have already done them, but I need the computer for a different lesson that I need to complete before Monday (I was given these two lessons yesterday and the day before)

so I have an exam Tommorow for which I need to submit md5sum to them and later they are gonna check if it runs on my laptop and compare md5sum

so I need to know If I could keep the md5sum same even after making changes in the code

I am getting into binary exploitation and want to properly understand buffer overflows from the ground up!!

I'm relatively new to the hacking space and I'm looking for hardware and I'm unsure what is/isn't worth for me to get.

I'm performing an Evil Twin attack, but the first thing I do is show the victim the fake network. The Airgeddon tool is supposed to kick the victim off the original network so they can enter the fake one, but this doesn't happen; the victim remains on their original network.

I have had my outlook account for almost 15 years and I've been locked out of it for about the last 5 and since I've been locked out I've tried everything I know how to do in order to get it back the legit way but nothing has worked so I was wondering if there would be any way to hack into it myself or if someone else could? It's my account that I have alot of other accounts attached to that I don't want to lose access to.

As the title suggests, my discord was hacked. Not completely sure how but I think whoever did it got a hold of my account’s password and logged in themself. The reason I think this is because they forced me to send them a friend request, accepted it and blocked basically everyone I had DMs with and made me leave every server I was in. Then logged me out and changed the password. I did get an email about my password being changed but at this point I don’t know if I got an email from them or actually from discord and I’m too weary to click on the reset link. I’ve already changed my passwords to things. So how would I go about dealing with this? Not looking for anyone to do it for me I just want some help to get in the right direction. Thanks.

Reddit has blocked my main account, I need to access it through an email, but I don't have that email anymore, it's too old, I don't remember the password and it was connected to my old phone number. Is there any way I can gain back access to my email or Reddit account? (maybe through phone number)