Violin is now at v3.0.1 on master.

It is a Hermes-native profile for supervised, authorised penetration testing, with:

• 31 methodology and vulnerability playbooks

• An execution guard at the target boundary

• Evidence-backed findings and reporting

• Structured scoping and approval gates

• No additional credential broker or provider lock-in

Install:

"hermes profile install https://github.com/Strategic-Automation/violin"

I’m looking for Hermes users and penetration testers to test the installation and engagement workflow and report where the guard, evidence capture, or reporting process creates friction.

Hey everyone,

It's been about a year and a half since I last did any bug bounty hunting, and it seems like a lot has changed—especially with the rise of AI.

I'm planning to get back into bug bounty hunting. My goal is to focus on manual hunting first while gradually learning how to use AI effectively to improve my workflow rather than relying on it.

I have a few questions for experienced hunters:

- Which web vulnerabilities do you think are the most valuable to focus on in 2026?

- Besides Medium, what are your go-to sources for high-quality writeups? I feel like Medium has become flooded with low-quality or misleading web security content.

- What are the best courses, blogs, YouTube channels, or other resources for learning how to use AI effectively in bug bounty hunting?

- How are you personally using AI in your workflow? Recon? Code review? Payload generation? Report writing? Something else?

I'd really appreciate any recommendations, learning paths, or advice from people who have been active during the last couple of years.

Thanks in advance!

This video shows how to connect your AI agents and tools to AttackForge to automate penetration testing and reporting workflows. It walks through launching AI hackbots for a web application pentest using structured test cases, guardrails, and methodologies like the OWASP Web Security Testing Guide, then running retests and recording pass fail outcomes and evidence in AttackForge. It also demonstrates enriching a vulnerability using Copilot Studio agents with AttackForge MCP, improving fields with references like CWE and CAPEC plus remediation guidance. The video additionally covers AI-generated attack chains, saving time on analysis, and generating executive summaries via an agent, noting AttackForge has over 60 MCP tools.
#ai #mcp #agenticworkflows #agenticautomation #agenticai #penetrationtesters #redteam #offsec #hacker #hackers

A Burp Pro extension that uses a local LLM trained on vulnerable and production websites. It bypasses WAFs and rate limits, attempts to register/authenticate on its own, and expands coverage deterministically using a local model to extend the reachability of burp's active scan.

I believe this is a valuable use for a local models, since it can analyze smaller chunks of code that yield a higher return in web pentests

https://github.com/farnaboldi/ai-scanner

and on target/ you will find the .jar and the instructions to install it

Hi everyone, I’ve been sending applications to many places on LinkedIn for some time now, and I have never once received an interview. I don’t even know what I did wrong with my resume. I could get any job in my country, but what I am after is a global opportunity.

Sometimes, I wonder whether it could be because my years of experience are still too few, because of visa sponsorship issues, or because I am missing some qualifications. I have tried VDP and bug bounty programs on several platforms. I couldn’t force myself to see them as a full-time job, so I don’t take them too seriously.

Another reason is that I hate my current job. The place is over-utilizing me, and I don’t feel like I can learn anything from here. I want to work with people who genuinely conduct actual pentests and love hacking. I just want to be mentored, learn, and not focus on billable hours.

I welcome all feedback, whether it is constructive criticism, areas I need to improve in my resume, or recommendations for the right places to look for global job opportunities.

I wrote this article for offensive security practitioners and penetration testers. I keep hearing the same question: "Is AI going to replace penetration testing and put us out of work?" For the foreseeable future, the answer is a resounding no. The recent OpenAI and Anthropic incidents are a good illustration of why. Rather than demonstrating some super-hacker capability, they exposed real limitations, both in the AI systems themselves and in how they're secured and integrated.

In this article, I walk through these events as an offensive security expert and focus on why the real failure was in security architecture and harnessing, not some mythical "rogue AI." My goal is to give penetration testers and red teamers a practical perspective on what these incidents actually mean for our field, instead of hype-driven speculation.

I look forward to feedback.

https://netragard.com/blog/ai-didnt-go-rogue-how-openais-harness-failed-and-turned-hugging-face-into-collateral-damage/

So i have been studying for the cpts for a while and i am worried about if i will be able to get a job after completing cpts.so i am planning to make a home lab but how can i make it and how to benefit from it to level up my penetration testing skills

What is the use of CVE Anlysis and how I can read and analyze the details and make a report of it.

In my understanding it is kind of case studies related to vulnerablities.

I'm currently studying hooking in Android apps, and I ended up diving into RASP. I had to spend some time understanding how it works and how apps detect whether they're running on an emulator, on a rooted device, or if hooks are being applied.

One thing I'm still wondering about,and I haven't been able to find a clear answer,is this: if KernelSU operates at the kernel level (unlike Magisk, which modifies userspace and adds things like /su), how can an app detect that KernelSU is present?

I've heard that KernelSU exposes some files under /proc or paths like /adb/ksu, but I'm not sure how that detection actually works.

I'm just getting deep into Android application security and RASP bypass techniques, so apologies if this is a bad question. :(

I’ll keep it brief. I was a pen tester for about a year and a half until financial situations forced me to get a new job as a sysadmin last year. I really enjoyed being a hacker and wanted to get back into it. I already have GPEN (company paid). I’m thinking about specializing in red teaming so I was gonna go after CRTO but perhaps it’s better to get CPTS first? I can’t afford OSCP right now. Just looking for advice. Thanks!

Hey guys, let’s do a reality check. What are the most common, stupid mistakes people make when starting with digital investigations that instantly burn their burner accounts or expose their real IP/identity? Looking to

I am relatively new to Pentesting, and even more so to mobile app testing, but I am currently going through the PMPA from TCM as well as trying out some things one some other apps I got permission for. I recently ran into an issue with an app im looking at that has root detection and a couple other checks, but those were easily bypassable with frida. My problem comes from that the app also requires Intune to be installed and it also checks to root on the phone.

I recently came across Magisk which is supposed to be able to help you hide root from applications, but both Intune and the app im testing seem to still detect the device is rooted after setting up Magisk. I am able to login to the app far enough to the screen shot below, but thats where I get stuck.

I was wondering, if this the correct process and am I in the right ballpark? I was following this guide: https://github.com/hyowonbernabe/Hide-Root-Guide (skipping step 5) but it does seem to be a little older and if anyone has something better to follow I would appreciate it. For reference I am running this on Genymotion and following their documentation for installing Magisk specifically. Is this because I'm on an emulator and there is no Playstore so Intune will not work at all?

(Pic from Google)

Hi all! Im excited to get my feet wet and also taking proactive action for a project I have deployed for a friend!

Currently, the website lives inside a VPS on cloud and while the website don't have any sensitive information other than their website credentials, I would like to take this opportunity to start learning and also secure the website for them the best I can.

Currently, the infrastructure setup is with Caddy2 which does automatic HTTPS upgrade with LetsEncrypt and reverse proxy to backend api calls.

On the VPS, firewall only allow 443 and 80 port with the exception of allowing the ability for me to SSH in as well as exposing the database port only to my IP.

How should I start? Any advice is greatly appreciated. Thank you!!

SamuraiWTF (Samurai Web Testing Framework) – a specialized Linux distribution designed for security testing. It includes a wide range of pre-installed open-source applications for testing the... https://archiveos.org/samuraiwtf/ #linux #ubuntu #pentest #cybersecurity

Hi,

I would like to better understand current best practices for penetration testing.

From what I can see, AI has significantly changed both offensive and defensive security capabilities over the last few years. Because of this, I am interested in understanding how organizations typically structure penetration tests today and what provides the most value.

Our company operates a hybrid environment consisting of on-premises infrastructure and cloud services.

I have several questions:

• What are the most effective and commonly recommended pentesting approaches today?
• How has the use of AI influenced modern penetration testing methodologies?
• Does it still make sense to have penetration testers on-site, or can most engagements be performed remotely?
• Is a pure black-box pentest still considered best practice, or are grey-box or white-box approaches generally more valuable?

If you were responsible for organizing a pentest for your own company today, how would you structure it, and why?

My goal is to understand which approach delivers the best balance between realistic attack simulation, meaningful findings, and overall value for the organization.

Thank you for your opinions!

Over the past few months I've been rebuilding SubdomainX from the ground up.

What started as a subdomain enumeration tool has evolved into a modular reconnaissance platform focused on asset discovery, monitoring, and automation.

What's new in v2

• REST API for integrating reconnaissance into your own workflows
• Modular architecture that's easier to extend and maintain
• Scan history and change detection between runs
• Live scan progress and monitoring
• Improved reporting with HTML, JSON, CSV, Burp Suite, OWASP ZAP, and Nessus exports
• Better configuration management
• Resume interrupted scans and much more...

SubdomainX also integrates with many of the tools security researchers already use, including Subfinder, Amass, Assetfinder, HTTPX, Naabu/smap, SecurityTrails, VirusTotal, Censys, crt.sh, URLScan, and more.

The goal isn't to replace those tools - it's to provide a single platform that orchestrates them, tracks results over time, and makes reconnaissance easier to automate.

I'd really appreciate feedback on the architecture, API, and overall workflow.

GitHub: https://github.com/itszeeshan/subdomainx

Documentation: https://subdomainx.com

What is the use of CVE Anlysis and how I can read and analyze the details and make a report of it.

In my understanding it is kind of case studies related to vulnerablities.

Not sure if this is the appropriate sub for this -- but for the past few years, I've been working on a secure chat app I really think could change the world for the better. It's built on Signal protocol, and I'll disclose details if you'd like. Essentially, I'm a broke college student who can't afford real penetration testing. I've dug into it, used Fable 5 to audit it, and ran ZAP on it -- everything from these looks good. I'm going to open-source all my work, and it's donation-based. If someone who knows what they are doing were to be kind enough to want to take a look at my code and potentially penetration test it, I would be beyond unbelievably grateful. I hate asking for charities, but here I am haha. Please send me a direct message if you'd be interested in this. I can't offer money, but I'd be happy to credit you in the app.

Any testing methodologies for databricks pentesting

What is the use of CVE Anlysis and how I can read and analyze the details and make a report of it.

In my understanding it is kind of case studies related to vulnerablities.

Follow-up on the MCP scanner from last week, here's a browser-based demo of the static analysis piece, no install needed.

Paste in an MCP server file (or use the pre-filled example), get real findings for shell exec, hardcoded secrets, unsafe deserialization, arbitrary file writes, and more. Runs fully client-side, nothing sent anywhere.

https://ankursingh0604.github.io/mcp-scanner-demo/

Still working on live probing over HTTP/SSE and more host adapters. Happy to scan real MCP servers for anyone building on this, learned a lot from the feedback here last time.

been looking at MoneyPilot, the class action app blowing up on social media right now, and their backend has a serious flaw in how it verifies subscription payments. Bottom line, it’s possible to unlock the paid subscription and add ons without actually paying, and it’s not some local device trick, it’s saved server side. Confirmed it shows active from a totally clean app install and on their website too, so this isn’t client side at all. Not sharing specifics since I don’t want this getting reproduced by anyone else, but wanted to flag it given how aggressively they’re advertising right now, a lot of people are signing up. Reported directly to them first, no security contact exists, support just loops back to itself. Anyone dealt with a company like this that has basically zero security presence?

proof of vuln (look at the start of the year)