#offensivesecurity

· 3mo ago

We surveyed 158 security practitioners on AI-assisted vulnerability testing. 88% of them still end up validating results by hand. The pattern: AI gets heavy use in scanning and discovery (74%), a lot less in exploitation and attack chaining (37%), and even less in post-exploitation (25%). The riskier the phase, the less anyone trusts it to work unsupervised. The time it saves up front doesn't disappear. It just shows up later, as triage. Other findings: false positives and hallucinated exploits were the top named frustration, business logic understanding is the gap AI still can't close, and only 20% of teams have a workflow built to handle high volumes of AI-generated findings. Full survey results, free, no account needed: https://pentest-tools.com/insights/ai-pentesting-survey #infosec #offensivesecurity #penetrationtesting

The state of AI pentesting survey

Only 9% of developers say vulnerability testing keeps pace with AI-accelerated code. Survey of 241 practitioners on the validation gap. Free PDF.

0

· 3mo ago

🔓 Brutus is a modern take on Hydra: pure Go, zero dependencies, one binary that brute-forces SSH, MySQL, PostgreSQL, Redis, SMB, and 20+ more protocols. Join Adam Crosser for a session live at Black Hat USA Arsenal. 🗓️ August 5, 11:20am to 12:20pm 📍 Arsenal Station 8, Business Hall 🎩 Black Hat session: https://lnkd.in/gHN__DNG ⭐ GitHub: https://lnkd.in/g8j_2CKp 📖 The story behind it: https://lnkd.in/gVphrxeP Stop by if you're on the floor! #Brutus #OffensiveSecurity #PraetorianGuard

lnkd.in

LinkedIn

This link will take you to a page that’s not on LinkedIn

0

· 3mo ago

We have 3 reasons for building AI Pentests - the autonomous web app pentesting capability we're launching at DEF CON next week:

Doing a successful pentest with AI needs a lot more than good prompts.
Your team deserves more than a wrapper around an LLM.
AI is only as good as the #offensivesecurity knowledge behind it.

We explain what it does, why we named it Specter, and how to get early access right here:

AI Pentests - autonomous web application penetration testing

shadowvex @shadowvex@infosec.exchange

AI Pentests - autonomous web application penetration testing

See how AI Pentests autonomously investigate web applications, validate exploitable vulnerabilities, and generate evidence-backed penetration testing reports.

0

· 3mo ago

The AI-Assisted Offensive Security Prompt Library by Ganesha T https://mega.nz/file/GtJyAQxa#CYK2FrI4bSSoplZC21HxqMl4PP9UfdPX1bAFnTptxi0 Well Done👏 #AI #OffensiveSecurity #AISecurity #PromptEngineering #GaneshaT

mega.nz

163.1 KB file on MEGA

0

Gilgwath @gilgwath@social.tchncs.de

· 3mo ago

Seats are filling for our DEF CON Training 2026 course. Don't sleep on this one. Bridging the GAP: Hands-On Embedded Hardware Hacking. Aug 10-11 at the Las Vegas Convention Center. With Aaron Wasserman, Garrett Freibott, and Will McCardell from our IoT pentest team. Register → https://training.defcon.org/products/bridging-the-gap-hands-on-embedded-hardware-hacking-aaron-wasserman-garrett-freibott-will-mccardell-dctlv2026 #DEFCON #OffensiveSecurity #HardwareHacking

Bridging the GAP: Hands-On Embedded Hardware Hacking - Praetorian's Aaron Wasserman, Garrett Freibott & Will McCardell - DCTLV2026

training.defcon.org

Bridging the GAP: Hands-On Embedded Hardware Hacking - Praetorian's Aaron Wasserman, Garrett Freibott & Will McCardell - DCTLV2026

Name of Training: Bridging the GAP: Hands-On Embedded Hardware HackingTrainer(s): Praetorian's Aaron Wasserman, Garrett Freibott, Will McCardell Dates: August 10-11, 2026Time: 8:30 am to 5:30 pm Venue: Las Vegas Convention Center W238Cost: $2,000 (USD) Short Summary: This hands-on course bridges the gap between securit

0

· 3mo ago

Hello Fedi! My employer went through my #PostCovid time with me. Now that I'm back to work full time, they suddenly decided to let me go. 🤷‍♀️ I'm a #pentester with 5 years of experience in the field, before that 3 years of software dev in the #infosec field as well. Got a Bsc. in Computer Sience with emphasis on infosec and networke systems. In my #homelab I'm selfhosting on #proxmox and #k8s. I've been daily driving #linux for the past 20 years, first #gentoo, then #fedora. I'm pretty good with it, but no certs. I'm looking to continue in #offensivesecurity, but would be happy to pivot into infra/network or any other adventure given it's interessting or a good cause. Happy to invest in my skillset. Hybrid in north-eastern #Switzerland fully remote anywhere else. #getfedihired #fedihired

10

1

19

0

Cloud 🤖 @cloud@infosec.exchange

· 3mo ago

🤖 Oxjade/rouge-kali: Offensive security skill framework for AI agents (Claude Code, OpenClaw, Hermes Agent). Dual-track analysis: Web/App security + Smart Contract auditing, with configurable depth from surface scan to guardrail-breaking. 🔗 https://github.com/Oxjade/rouge-kali #CyberSec #InfoSec #AI #Pentesting #OffensiveSecurity

github.com

1

0

· 3mo ago

Nolan's Odyssey just hit theaters, and honestly, Odysseus had it easy. Ten years, one long trip, and he was done. ISO 27001 wants the trilogy every single year: detection, validation, remediation. Three-year cycle, a surveillance audit checking your homework annually. No one-and-done epic here. Pentest-Tools.com is ISO/IEC 27001:2022 certified. We run the same evidence trail on ourselves: ✅ Detection - CVE, severity, date, logged automatically ✅ Validation - confirmed findings, not just a score ✅ Remediation - retests prove the fix held ✅ Monitoring - scheduled scans, all three years long No sirens, no Cyclops, just a surveillance audit that stays a review instead of turning into its own odyssey. Full ISO 27001 evidence chain: https://pentest-tools.com/usage/compliance/iso-27001 #ISO27001 #offensivesecurity #infosec

Cloud 🤖 @cloud@infosec.exchange

ISO 27001 compliance evidence

ISO 27001 vulnerabilities evidence for Annex A.8.8, A.8.16, A.8.29, A.8.32, and A.5.7: validated findings, retest confirmation, and continuous monitoring.

0

· 3mo ago

🤖 Hacker 'Trim' dismantles frontier AI models into an offensive attack platform, integrating jailbroken LLMs with Nmap, Metasploit, and C2 frameworks for automated exploitation. Weaponized AI moves from theory to practice. 🔗 https://www.darkreading.com/cyber-risk/hacker-ai-jailbreaks-offensive-attack-platform #AI #CyberSec #OffensiveSecurity

Hacker Turns AI Jailbreaks Into Offensive Platform

darkreading.com

Hacker Turns AI Jailbreaks Into Offensive Platform

A Russian-speaking actor, "Trim," dismantled publicly available frontier models and integrated them with offensive security tools.

0

· 3mo ago

We kept getting asked the same handful of questions before people would trust us with a scan against prod. So we answered them properly instead of one at a time on sales calls. Non-destructive by default. Our own detection engines, not a wrapper around someone else's open source tools. Findings come with evidence, not just a severity label. Data stays on EU infrastructure, workspaces isolated. Full FAQ: https://pentest-tools.com/product/faq #offensivesecurity #pentesting

hasamba @hasamba@infosec.exchange

Pentest-Tools.com FAQ - what it is, how it works & more

Get answers to questions about Pentest-Tools.com: what it is, how it works, how pricing looks like, and why thousands of security teams trust us.

0

· 3mo ago

---------------- 🛠️ Tool =================== Decepticon is an open-source autonomous red team agent developed by PurpleAILAB. The project explicitly distances itself from tools that "run nmap and write a report," targeting end-to-end engagement automation instead. Core Architecture The tool runs as a Docker-based stack with several components: • LiteLLM for LLM call routing across providers • PostgreSQL for data persistence • Neo4j as a knowledge graph for attack chain representation • LangGraph for agent orchestration • Skillogy for skill management • A sandboxed execution environment The orchestrator spawns specialist workloads on demand rather than running everything upfront. Documented specialists include BloodHound CE for AD reconnaissance, Sliver C2 for command and control, and Ghidra MCP for binary analysis. Activation is via commands like ops_start("ad"). Installation and Deployment Installation is via curl pipe to bash on macOS/Linux/WSL2, or PowerShell on Windows. The decepticon onboard command provides an interactive setup wizard for provider, API key, and model profile configuration. A web dashboard is accessible from the CLI via /web. A cloud-hosted version is available at app.decepticon.red for users who prefer not to self-host. SDK Usage The project ships a pip-installable SDK (pip install decepticon) with an optional neo4j extra for knowledge-graph attack-chain tools. The SDK provides agent factories, middleware, tools, and skills, routing LLM calls and sandbox execution through Decepticon infrastructure. This enables building custom orchestrators or integrating agents into existing products and research workflows. Technical Observations The on-demand specialist spawning model is worth noting. Rather than a monolithic tool, Decepticon treats each capability as a separate workload the orchestrator launches when needed. This modular approach makes it easier to extend or replace individual components. The Neo4j knowledge graph for attack chain representation is a meaningful design choice. It maintains structured state about engagement progress rather than relying purely on LLM context, which could make state inspection and chain reasoning more reliable. Limitations The project is relatively new. The README provides no benchmarks or comparison data against manual red team engagements. Haven't tested personally, so stability and orchestration quality in real environments remain open questions. The reliance on external LLM providers introduces API cost and rate limit concerns for extended operations. References • Repository: PurpleAILAB/Decepticon (GitHub) • Documentation: docs.decepticon.red • License: Apache 2.0 🔹 tool #redteam #decepticon #offensivesecurity #autonomousagent 🔗 Source:

github.com

GitHub - BitterSecurity/Decepticon: Autonomous Hacking Agent for Red Team

Autonomous Hacking Agent for Red Team. Contribute to BitterSecurity/Decepticon development by creating an account on GitHub.

0

· 3mo ago

We point our own product at ourselves. The scanners and exploit modules our customers run, we run against our own infrastructure and web apps. New critical CVE, our own assets are among the first we test, so detection and validation hold up on us before they reach anyone else. The rest is the auditable stuff: ISO 27001, hosting and data retention, encryption, and where AI sits in the product (noise reduction, not deciding what's exploitable). All public, no NDA or sales call. Poke holes in it: https://pentest-tools.com/legal/trust-and-assurance #infosec #offensivesecurity #pentesting

Trust and assurance at Pentest-Tools.com

ISO 27001 certified. Europe-hosted. See how Pentest-Tools.com protects your scan data, credentials, and reports.

0

· 3mo ago

🔓 Brutus is a modern take on Hydra: pure Go, zero dependencies, one binary that brute-forces SSH, MySQL, PostgreSQL, Redis, SMB, and 20+ more protocols. Join Adam Crosser for a session live at Black Hat USA Arsenal. 🗓️ August 5, 11:20am to 12:20pm 📍 Arsenal Station 8, Business Hall 🎩 Black Hat session: https://lnkd.in/gHN__DNG ⭐ GitHub: https://lnkd.in/g8j_2CKp 📖 The story behind it: https://lnkd.in/gVphrxeP Stop by if you're on the floor! #Brutus #OffensiveSecurity #Praetorian

lnkd.in

LinkedIn

This link will take you to a page that’s not on LinkedIn

0

· 3mo ago

Here we go. Product updates - the June edition. This month your coverage got a LOT wider. 80 new detections landed in the Network Scanner, including pre-auth RCE in Oracle PeopleSoft and an auth bypass in Palo Alto PAN-OS. If any are in your scope, you know where to look. The rest of June: 🌐 Our research team found two authentication flaws in phpBB, one buried in the code for over a decade. There's a working PoC for each, and the Network Scanner now detects the most critical one - CVE-2026-48611 (9.4). 🤖 AI where it earns its place in the Website Scanner and URL Fuzzer: smarter logins, deeper crawling, fewer fake 200 pages. 🎯 the XSS Exploiter now gives you two delivery options: script tag or fetch plus eval. 🔌 API: a new info_text key on /scans tells you why a scan didn't start. ☁️ We're now on the Microsoft Azure Marketplace, so you can add us to your existing Azure billing. Our colleague Stefan Perju walks you through all of it in the video. Until next time: stay sharp. Stay human. Everything that shipped can be found in the change-log: https://pentest-tools.com/change-log The phpBB PoCs and full write-up: https://pentest-tools.com/research/phpbb-authentication-bypass #offensivesecurity #vulnerabilitymanagement #infosec #penetrationtesting

Change log for Pentest-Tools.com

Consult our changelog to see exactly how our platform is constantly changing, what we're adding to it to make it better and how we're updating vulnerabilities.

1

0

· 4mo ago

DEF CON Training 2026. Aug 10-11. Come hack with us. Register → https://training.defcon.org/products/bridging-the-gap-hands-on-embedded-hardware-hacking-aaron-wasserman-garrett-freibott-will-mccardell-dctlv2026 #DEFCON #OffensiveSecurity #HardwareHacking

training.defcon.org

Bridging the GAP: Hands-On Embedded Hardware Hacking - Praetorian's Aaron Wasserman, Garrett Freibott & Will McCardell - DCTLV2026

Name of Training: Bridging the GAP: Hands-On Embedded Hardware HackingTrainer(s): Praetorian's Aaron Wasserman, Garrett Freibott, Will McCardell Dates: August 10-11, 2026Time: 8:30 am to 5:30 pm Venue: Las Vegas Convention Center W238Cost: $2,000 (USD) Short Summary: This hands-on course bridges the gap between securit

0

· 4mo ago

🏛️ What if every attacker who breached your cloud was just walking deeper into a trap? Knossos generates decoy cloud environments from your real infrastructure, then turns every attacker move inside them into usable intelligence. The decoys pass the sniff test, so attackers waste time in the maze while every move feeds the Guard. Read: https://praetorian.com/blog/knossos-decoy-environments Demo: https://praetorian.com/praetorian-guard-demo #OffensiveSecurity #Praetorian #PraetorianGuard

Knossos: Procedurally Generated Decoy Environments

praetorian.com

Knossos: Procedurally Generated Decoy Environments

Decoy environments from Knossos mirror your real cloud, so attackers can't tell they're inside. Every move becomes usable intelligence.

0

· 4mo ago

Our SQL Injection Scanner is a bit of a skeptic. It won't take a hunch for an answer. It fires a real payload, watches how the database actually responds, and _only then_ calls it a finding. It's free to try, and it catches: ✅ Error-based, when the database spills its structure in an error ✅ Blind, when only a true or false response gives it away ✅ Time-based, when a deliberate delay is the only tell ✅ Union-based, when someone's pulling data from tables they shouldn't touch Every finding comes with the parameter, the payload, and the database response. Enough to reproduce it, not just believe it. Try it as a test, no account needed. Link is here https://pentest-tools.com/website-vulnerability-scanning/sql-injection-scanner-online #offensivesecurity #penetrationtesting #ethicalhacking

Free SQL injection scanner: automate vulnerability testing

Free SQL injection scanner: automate vulnerability testing

Automate SQL injection testing with high accuracy. Map parameters, execute payloads, evidence-backed reports. No manual setup, no FPs. Try it for free.

0