r/netsec monthly discussion & tool thread

r/netsec monthly discussion & tool thread

https://www.reddit.com/r/netsec/comments/1olp81v/rnetsec_monthly_discussion_tool_thread/

Inside the Data on Insider Threats: What 1,000 Real Cases Reveal About Hidden Risk

https://www.darkreading.com/insider-threats/inside-the-data-on-insider-threats-what-1000-real-cases-reveal-about-hidden-risk

Social Engineering People’s Credit Card Details

https://www.schneier.com/blog/archives/2025/10/social-engineering-peoples-credit-card-details.html

US Stands Out in Refusal to Sign UN Cybercrime Treaty

https://www.darkreading.com/cybersecurity-operations/us-refuses-sign-un-cybercrime-treaty

Over 100 Chrome extensions break WhatsApp’s anti-spam rules

https://www.malwarebytes.com/blog/news/2025/10/over-100-chrome-extensions-break-whatsapps-anti-spam-rules

High-Severity Bug: AMD Zen 5 RDSEED Flaw Risks Randomness Integrity; Microcode Fix Coming

https://securityonline.info/high-severity-bug-amd-zen-5-rdseed-flaw-risks-randomness-integrity-microcode-fix-coming/

CVE-2025-11833 (CVSS 9.8): Critical Flaw Exposes 400,000 WordPress Sites to Unauthenticated Account Takeover

https://securityonline.info/cve-2025-11833-cvss-9-8-critical-flaw-exposes-400000-wordpress-sites-to-unauthenticated-account-takeover/

Critical WordPress Plugin Flaw (CVE-2025-8489, CVSS 9.8) Allows Unauthenticated Admin Takeover

https://securityonline.info/critical-wordpress-plugin-flaw-cve-2025-8489-cvss-9-8-allows-unauthenticated-admin-takeover/

CISA Warns of Active Exploitation in XWiki and VMware Vulnerabilities

https://securityonline.info/cisa-warns-of-active-exploitation-in-xwiki-and-vmware-vulnerabilities/

An 18-Year-Old Codebase Left Smart Buildings Wide Open

https://www.darkreading.com/vulnerabilities-threats/18-year-old-codebase-left-smart-buildings-wide-open

Pentesting Next.js Server Actions

https://www.reddit.com/r/netsec/comments/1of84hu/pentesting_nextjs_server_actions/

Modding And Distributing Mobile Apps with Frida

https://www.reddit.com/r/netsec/comments/1oe43pb/modding_and_distributing_mobile_apps_with_frida/

pyLDAPGui - Python based GUI for browsing LDAP

https://www.reddit.com/r/netsec/comments/1nh8qvn/pyldapgui_python_based_gui_for_browsing_ldap/

pyghidra-mcp: Headless Ghidra MCP Server for Project-Wide, Multi-Binary Analysis

https://www.reddit.com/r/netsec/comments/1muobce/pyghidramcp_headless_ghidra_mcp_server_for/

Snoop - OSINT Tool For Research Social Media Accounts By Username

http://www.kitploit.com/2025/04/snoop-osint-tool-for-research-social.html

Privescing a Laptop with BitLocker + PIN

https://www.reddit.com/r/netsec/comments/1oe6hrc/privescing_a_laptop_with_bitlocker_pin/

Yet Another Random Story. VBScript's Randomize Internals.

https://www.reddit.com/r/netsec/comments/1nq3i96/yet_another_random_story_vbscripts_randomize/

Fine-grained HTTP filtering for Claude Code

https://www.reddit.com/r/netsec/comments/1nff57n/finegrained_http_filtering_for_claude_code/

Practical guide for hunters: how leaked webhooks are abused and how to defend them

https://www.reddit.com/r/netsec/comments/1njbx3q/practical_guide_for_hunters_how_leaked_webhooks/

Mastering Digital Breadcrumbs to Stay Ahead of Evolving Threats

https://www.darkreading.com/vulnerabilities-threats/mastering-digital-breadcrumbs-stay-ahead-of-evolving-threats

Technical Writer II - Cyber - TS/SCI/FSP

Company: CrowdCyber

Location: Annapolis Junction, MD

CyberSecurity Engineer - TS/SCI

Company: CrowdCyber

Location: Annapolis Junction, MD

Windows Cyber Software Engineer - TS

Company: CrowdCyber

Location: Chantilly, VA

Information System Security Engineer 2 - TS/SCI/FSP

Company: CrowdCyber

Location: Annapolis Junction, MD

HPC Technical Expert - TS/SCI/FSP

Company: CrowdCyber

Location: Annapolis Junction, MD

Windows Reverse Engineer - Top Secret - Full Scope

Email Us to talk about our Candidates!

Linux Cyber Software Engineer - Top Secret - Full Scope

Email Us to talk about our Candidates!

Apple iOS Cyber Software Engineer - Top Secret SCI

Email Us to talk about our Candidates!

Mobile Android Cyber Software Engineer - Top Secret - Poly

Email Us to talk about our Candidates!

Windows Vulnerability Researcher - Top Secret - Full Scope Poly

Email Us to talk about our Candidates!

Apple’s Bug Bounty Program

https://www.schneier.com/blog/archives/2025/10/apples-bug-bounty-program.html

Zeroday Cloud hacking contest offers $4.5 million in bounties

https://www.bleepingcomputer.com/news/security/zeroday-cloud-hacking-contest-offers-45-million-in-bounties/

Google now pays $250,000 for KVM zero-day vulnerabilities

https://www.bleepingcomputer.com/news/security/google-now-pays-250-000-for-kvm-zero-day-vulnerabilities/

Bug Bounty: An Economic Disadvantage for Researchers?

https://www.digitaloperatives.com/2023/07/29/bug-bounty-an-economic-disadvantage-for-researchers/

Google Pixel Titan M with Persistence - Zero click Up to $1,000,000

https://bughunters.google.com/about/rules/6171833274204160/android-and-google-devices-security-reward-program-rules

The AI-Designed Bioweapon Arms Race

https://www.schneier.com/blog/archives/2025/10/the-ai-designed-bioweapon-arms-race.html

Security Analysis of a medical device: Methods and Findings

https://www.reddit.com/r/netsec/comments/1o29iec/security_analysis_of_a_medical_device_methods_and/

LLM Honeypot vs. Cryptojacking: Understanding the Enemy

https://www.reddit.com/r/netsec/comments/1o5m7cg/llm_honeypot_vs_cryptojacking_understanding_the/

Singularity: Deep Dive into a Modern Stealth Linux Kernel Rootkit – Kyntra Blog

https://www.reddit.com/r/netsec/comments/1o7bh9p/singularity_deep_dive_into_a_modern_stealth_linux/

Blind Enumeration of gRPC Services

https://www.reddit.com/r/netsec/comments/1o4eyuc/blind_enumeration_of_grpc_services/

Operation Triangulation: What You Get When Attack iPhones of Researchers

https://media.ccc.de/v/37c3-11859-operation_triangulation_what_you_get_when_attack_iphones_of_researchers

Our Polymorphic Reverse Shell Generator beat EVERY AV!

https://m.youtube.com/watch?v=9kAq-OO72Uk

How Hackers Hide From Memory Scanners

https://youtu.be/WYuhJzngfVc?si=KYvedCuIOsItE7sc

How Hackers Exploit Vulnerable Drivers

https://youtu.be/ELVdDwvELKY?feature=shared

DEF CON 31 - Weaponizing Plain Text ANSI Escape Sequences as a Forensic Nightmare - STÖK

https://m.youtube.com/watch?v=3T2Al3jdY38&feature=youtu.be

FX of Phenoelit - @41414141

https://twitter.com/41414141

vx-underground - @vx-underground

https://twitter.com/vx-underground

BTCillustrated - @BTCillustrated

https://www.twitter.com/btcillustrated

Halvar Flake - @halvarflake

https://twitter.com/halvarflake

Dave Aitel - @daveaitel

https://twitter.com/daveaitel

Will AI Strengthen or Undermine Democracy?

https://www.schneier.com/blog/archives/2025/10/will-ai-strengthen-or-undermine-democracy.html

Google says Search AI Mode will know everything about you

https://www.bleepingcomputer.com/news/google/google-says-search-ai-mode-will-know-everything-about-you/

The AI Fix #74: AGI, LLM brain rot, and how to scam an AI browser

https://grahamcluley.com/the-ai-fix-74/

Aembit Introduces Identity and Access Management for Agentic AI

https://securityonline.info/aembit-introduces-identity-and-access-management-for-agentic-ai/

NSFW ChatGPT? OpenAI plans “grown-up mode” for verified adults

https://www.malwarebytes.com/blog/news/2025/10/nsfw-chatgpt-openai-plans-grown-up-mode-for-verified-adults

Tired of Unpaid Toll Texts? Blame the 'Smishing Triad'

https://www.darkreading.com/threat-intelligence/unpaid-toll-texts-smishing-triad

UNC6384 Targets European Diplomatic Entities With Windows Exploit

https://www.darkreading.com/cyberattacks-data-breaches/unc6384-european-diplomat-windows

Penn hacker claims to have stolen 1.2 million donor records in data breach

https://www.bleepingcomputer.com/news/security/university-of-pennsylvania-hacker-claims-1.2-million-donor-data-breach/

China-linked hackers exploited Lanscope flaw as a zero-day in attacks

https://www.bleepingcomputer.com/news/security/china-linked-hackers-exploited-lanscope-flaw-as-a-zero-day-in-attacks/

Sandworm APT Attacks Belarus Military With LNK Exploit and OpenSSH Over Tor obfs4 Backdoor

https://securityonline.info/sandworm-apt-attacks-belarus-military-with-lnk-exploit-and-openssh-over-tor-obfs4-backdoor/

CoinTelegraph Hacked: Fake CTG Airdrop Scam Steals Crypto Via Malicious Pop-Ups

https://securityonline.info/cointelegraph-hacked-fake-ctg-airdrop-scam-steals-crypto-via-malicious-pop-ups/

Cencora’s $75 Million Ransom: A New High in Cyber Extortion

https://securityonline.info/cencoras-75-million-ransom-a-new-high-in-cyber-extortion/

FBI warns against using unlicensed crypto transfer services

https://www.bleepingcomputer.com/news/security/fbi-warns-against-using-unlicensed-crypto-transfer-services/

iOS v17.4 Beta 2 Nerfs (Some) Progressive Web Apps for EU Users

https://www.nobsbitcoin.com/ios-v17-4-beta2-undermines-progressive-web-apps-pwas-for-eu-users/

CoinCenter: Broad, Ambiguous, or Delegated: Constitutional Infirmities of the Bank Secrecy Act

https://www.coincenter.org/broad-ambiguous-or-delegated-constitutional-infirmities-of-the-bank-secrecy-act/

Flok License Plate Surveillance

https://www.schneier.com/blog/archives/2025/10/flok-license-plate-surveillance.html

Privacy Alert: Meta to Use User-AI Conversations to Target Ads Across Facebook and Instagram

https://securityonline.info/privacy-alert-meta-to-use-user-ai-conversations-to-target-ads-across-facebook-and-instagram/

LinkedIn will use your data to train its AI unless you opt out now

https://www.malwarebytes.com/blog/news/2025/09/linkedin-will-use-your-data-to-train-its-ai-unless-you-opt-out-now

TikTok is misusing kids’ data, says privacy watchdog

https://www.malwarebytes.com/blog/news/2025/09/tiktok-is-misusing-kids-data-says-privacy-watchdog

Police using drones to read your license plates, warns EFF

https://www.malwarebytes.com/blog/news/2025/09/police-using-drones-to-read-your-license-plates-warns-eff

Details About Chinese Surveillance and Propaganda Companies

https://www.schneier.com/blog/archives/2025/09/details-about-chinese-surveillance-and-propaganda-companies.html

The Great Firewall Leaks: A 600GB Trove of Secrets Exposed

https://securityonline.info/the-great-firewall-leaks-a-600gb-trove-of-secrets-exposed/

Tor needs 200 new WebTunnel bridges to fight censorship

https://www.bleepingcomputer.com/news/security/tor-needs-200-new-webtunnel-bridges-to-fight-censorship/

Meta plans retention 'hooks' for Threads as more than half of users leave app

https://www.reuters.com/business/media-telecom/meta-plans-retention-hooks-threads-more-than-half-users-leave-app-2023-07-28/?taid=64c3b01ee6cfe30001c4540f&utm_campaign=trueAnthem:+Trending+Content&utm

EFF: The U.K. Government Is Very Close To Eroding Encryption Worldwide

https://www.eff.org/deeplinks/2023/07/uk-government-very-close-eroding-encryption-worldwide

Aircrack Cheat Sheet

https://raw.githubusercontent.com/Ignitetechnologies/Mindmap/main/aircrack/Aircrack-ng%20%20UHD.png

How a Load Balancer Works

https://pbs.twimg.com/media/F5-ByLvXkAASw3j?format=jpg&name=4096x4096

Process Injection

https://4.bp.blogspot.com/-ixv5E0LMZCw/WWi5yRjL-_I/AAAAAAAAAnk/WO99S4Yrd8w6lfg6tITwUV02CGDFYAORACLcBGAs/s1600/Process%2BInjection%25281%2529.png

Argument Map on Restricting Encryption

https://www.argumentenfabriek.nl/wp-content/uploads/2021/11/EN-Argumentenkaart-inperking-encryptie.pdf

OSCP Enumeration Cheat Sheet

https://pbs.twimg.com/media/F2HWy_LWgAI5hT1?format=jpg&name=4096x4096

Google Chrome's new post-quantum cryptography may break TLS connections

https://www.bleepingcomputer.com/news/security/google-chromes-new-post-quantum-cryptography-may-break-tls-connections/

Companies, countries battle to develop quantum computers | 60 Minutes

https://youtu.be/K4ssT6Dzmnw

An Efficient Quantum Factoring Algorithm

https://arxiv.org/abs/2308.06572

You Can’t Rush Post-Quantum-Computing Cryptography Standards

https://www.schneier.com/blog/archives/2023/08/you-cant-rush-post-quantum-computing-standards.html?utm_source=dlvr.it&utm_medium=twitter

Supercomputer makes calculations in blink of an eye that take rivals 47 years

https://www.telegraph.co.uk/business/2023/07/02/google-quantum-computer-breakthrough-instant-calculations/

The Human Rights Foundation Announces 20 Btc Bounty Challenge For Bitcoin Development

https://bitcoinmagazine.com/business/human-rights-foundation-announces-20-btc-bounty-challenge-for-bitcoin-development

Open-Sourcing the Design Guide: 2 BTC to port the Bitcoin UI Kit from Figma to an open-source Penpot project.

https://hrfbounties.org/

Serverless Payjoin: 2 BTC to deploy a production-ready version 2 payjoin protocol which may send and receive Payjoin transactions without requiring a sender or recipient to operate a public server.

https://hrfbounties.org/

E2EE Group Chats: 2 BTC for the creation of end to end encrypted group chats powered by any popular Nostr client that does not leak metadata

https://hrfbounties.org/

Silent payments: 2 BTC for a mobile wallet which can send and receive Silent Payments in a private manner without requiring the user to run a full node

https://hrfbounties.org/

Signal’s Post-Quantum Cryptographic Implementation

https://www.schneier.com/blog/archives/2025/10/signals-post-quantum-cryptographic-implementation.html

Part Four of The Kryptos Sculpture

https://www.schneier.com/blog/archives/2025/10/part-four-of-the-kryptos-sculpture.html

Signal adds new cryptographic defense against quantum attacks

https://www.bleepingcomputer.com/news/security/signal-adds-new-cryptographic-defense-against-quantum-attacks/

Journeys in Hosting 1/x - Precomputed SSH Host Keys

https://www.reddit.com/r/netsec/comments/1no01xq/journeys_in_hosting_1x_precomputed_ssh_host_keys/

1965 Cryptanalysis Training Workbook Released by the NSA

https://www.schneier.com/blog/archives/2025/09/1965-cryptanalysis-training-workbook-released-by-the-nsa.html

The Cloud Edge Is the New Attack Surface

https://www.darkreading.com/cloud-security/cloud-edge-new-attack-surface

Hybrid Clouds Provide a Practical Approach to Post-Quantum Migration

https://www.darkreading.com/cybersecurity-operations/a-practical-approach-for-post-quantum-migration-with-hybrid-clouds

Cloud Threat Hunting and Defense Landscape

https://www.recordedfuture.com/research/cloud-threat-hunting-defense-landscape

US Senator Wyden Accuses Microsoft of ‘Cybersecurity Negligence’

https://www.securityweek.com/us-senator-wyden-accuses-microsoft-of-cybersecurity-negligence/

The 10 Humorous But Immutable Laws of Cloud Security

https://www.digitaloperatives.com/2023/07/18/the-10-humorous-but-immutable-laws-of-cloud-security/

vuls: Vuls is an agent-less vulnerability scanner for various platforms and applications. 6 recent commits. Latest release: v0.35.1.

https://github.com/future-architect/vuls

devguard: DevGuard secures software supply chains through attestation-based compliance and vulnerability management. 22 recent commits. Latest release: v0.17.5.

https://github.com/l3montree-dev/devguard

BBtool: BBtool is a user-friendly penetration testing tool for security researchers and ethical hackers. 1 recent commits.

https://github.com/Physiotherapist16/BBtool

Mobile-Security-Framework-MobSF: Mobile-Security-Framework-MobSF performs automated mobile app security testing and analysis for Android, iOS, and Windows devices. 1 recent commits. Latest release: v4.4.2.

https://github.com/MobSF/Mobile-Security-Framework-MobSF

CVE-2016-10708: This project exploits a vulnerability in OpenSSH versions prior to 7.4 through malicious SSH packets. 2 recent commits.

https://github.com/lggcs/CVE-2016-10708

Joas A Santos (@CyberSecurityUP): Joas A Santos is a cybersecurity expert with experience as a Red Team Lead and Information Security Researcher. 4064 followers. Known for ShadowPhish (209 stars). Expert in Red Team Operations.

https://github.com/CyberSecurityUP

sonyahack1 (@sonyahack1): SonyaHack1 is a cybersecurity developer specializing in penetration testing and red team operations with notable work on VulnHub and HackTheBox. 42 followers. Known for kids_2.0-Tasks (0 stars). Expert in Penetration Testing, Red Team Operations.

https://github.com/sonyahack1

Art of Hacking (@The-Art-of-Hacking): Omar Santos is a cybersecurity developer specializing in ethical hacking, penetration testing, and digital forensics with notable tools like h4cker and Weevely. 2983 followers. Known for h4cker (23348 stars). Expert in Exploit Development, Incident Response.

https://github.com/The-Art-of-Hacking

sickcodes (@sickcodes): Sickcodes is a cybersecurity developer with expertise in security research and open-source development of notable projects like no-sandbox and Docker-OSX. 2664 followers. Known for no-sandbox (186 stars). Expert in Exploit Development, Security Scanning.

https://github.com/sickcodes

kader m (@cyn00b): kader m is a cybersecurity developer specializing in API and framework vulnerability testing with notable open-source contributions. 61 followers. Known for Windows-Exploit-Suggester (1 stars). Expert in Exploit Development.

https://github.com/cyn00b