Elektrine
Log in Register

#pentesting

31 posts · Last used 4d

Back to Timeline
thecybersecguru @thecybersecguru@infosec.exchange · 4d ago
What Happened to HackerOne? HackerOne has changed significantly from the bug bounty platform many researchers knew in the late 2010s. Its current direction is increasingly centered around Hai, AI-assisted triage, vulnerability validation, agentic testing, continuous testing and CTEM. But the question isn't simply whether HackerOne uses AI. It's how researcher submissions, security intelligence and AI-driven workflows fit together, and what that means for the role and value of human vulnerability researchers. I dug into HackerOne's history, funding, Live Hacking Events, pricing shift, AI architecture, researcher-data controversy and current product strategy. https://thecybersecguru.com/analysis/what-happened-to-hackerone/ #HackerOne #BugBounty #InfoSec #CyberSecurity #AppSec #VulnerabilityResearch #AISecurity #CybersecurityResearch #EthicalHacking #Pentesting #AgenticAI #CTEM #SecurityResearch #BugBountyHunters #ApplicationSecurity
2
1
0
kallisti
Kallisti @kallisti@infosec.exchange · Jul 04, 2026
Replying to @kallisti@infosec.exchange
New blog post! I recently got to use both of the tools I published on Codeberg (Axmar and Tessera) during an engagement, and so I decided to make a brief writeup as a case study of what these tools can do. https://ti-kallisti.com/tales/schedule.html #infosec #pentesting #redteam #redteaming #Microsoft #ActiveDirectory #MSSQL
2
0
1
hackersidekick
Hacker Sidekick @hackersidekick@infosec.exchange · Jul 30, 2026
The Agentic Workbench for Cybersecurity has been rebuilt from the ground up. Our biggest update ever! Hacker Sidekick actually does the work in one window where the analysis lives next to the execution. What the rebuild unlocks: An agent that drives a real browser. Not screenshots of a browser, a real sandboxed Chromium it operates for you. It inspects the DOM, pulls full request and response bodies, reads storage and cookies including HttpOnly, walks login flows, and intercepts traffic proxy-style to hold, modify, or block requests. 77 tool integrations that pull your critical data into one place. Threat intel, SIEM, EDR, and ticketing, plus a built-in intel server with MITRE ATT&CK, NVD, VirusTotal, Shodan, Censys, and Exploit-DB out of the box with no key. Watch mode, a second set of eyes. Toggle it and a passive monitor observes your terminal and browser and surfaces brief advice: a missed step, forgotten cleanup, a scope concern. It only advises. It has no tools of its own and never acts. Because it is one integrated environment instead of a browser tab bolted onto a chat, all of this is faster, more powerful, and more connected. The agent plans and asks, security modes and approval gates keep it in bounds, and every command it runs is visible. Nothing happens off-screen. That is the integrated hacking environment. Full tour: https://hackersidekick.com/inside-hacker-sidekick-desktop-feature-tour.html?utm_source=linkedin&utm_medium=social&utm_campaign=desktop_feature_tour #cybersecurity #infosec #pentesting #hackersidekick #AI #dfir #redteam #threatintelligence
0
0
0
girishatindra
girishatindra :coolcat: @girishatindra@mastodon.social · Jul 26, 2026
Your router's admin password might be sitting in a random Reddit comment right now. I proved it. Captured a WPA2 handshake, cracked it, then found the real admin password buried in a years-old Reddit thread after every official default failed. Full attack chain from capture, cracking, OSINT, lateral movement to hardening the router against the CISA Project Upskill checklist. Medium: https://medium.com/radio-hackers/beyond-cracking-the-4-way-handshake-how-i-used-hcxdumptool-hashcat-and-osint-to-compromise-a-62a968cb0611 Hackernoon: https://hackernoon.com/beyond-cracking-the-handshake-a-technical-analysis-of-wpa2-weaknesses-and-router-exposure #CyberSecurity #WiFi #InfoSec #WPA2 #PenTesting
1
1
0
Cloud 🤖 @cloud@infosec.exchange · Jul 27, 2026
🤖 Oxjade/rouge-kali: Offensive security skill framework for AI agents (Claude Code, OpenClaw, Hermes Agent). Dual-track analysis: Web/App security + Smart Contract auditing, with configurable depth from surface scan to guardrail-breaking. 🔗 https://github.com/Oxjade/rouge-kali #CyberSec #InfoSec #AI #Pentesting #OffensiveSecurity
0
0
0
somananousbhidinjector @somananousbhidinjector@infosec.exchange · Jul 23, 2026
Meet SOMA — an ultra-small (12x13mm) ATmega32U4 USB-HID keystroke injection device designed for physical security assessments and hardware hacking. Protrudes only ~1.5mm from a USB port for a flush, covert footprint. Fully open-source schematics & firmware: https://github.com/nebojsa-sjekloca/soma First batch is now live on Tindie: https://www.tindie.com/products/42127/ #RedTeam #HardwareHacking #BadUSB #Infosec #OpenSource #Pentesting #Embedded
0
0
0
h_ackerman
Zanidd @h_ackerman@infosec.exchange · Jul 23, 2026
Sadly it looks like I habe to use ai soon. any tips on setting up an automated agentic pentester? I'm running containerized ollama and hermes with an rtx5060Ti passthrough and gemma4-12b. looking for skills, (uncensored) models, workflows, Plugins etc to run pentests. also set up parrot os security docket and gave the ai ssh access to it. #ai #agenticai #hermes #hermesagent #pentesting #penetrationtesting
0
1
0
pentesttools
Pentest-Tools.com @pentesttools@infosec.exchange · Jul 21, 2026
We kept getting asked the same handful of questions before people would trust us with a scan against prod. So we answered them properly instead of one at a time on sales calls. Non-destructive by default. Our own detection engines, not a wrapper around someone else's open source tools. Findings come with evidence, not just a severity label. Data stays on EU infrastructure, workspaces isolated. Full FAQ: https://pentest-tools.com/product/faq #offensivesecurity #pentesting
0
0
0
bugxhunter
0xBughunter @bugxhunter@infosec.exchange · Jul 20, 2026
🔴 ServiceNow’s sandbox escape RCE hole now exploited in the wild 📝 A sandbox security hole that could lead to remote code execution (RCE), pat... https://www.csoonline.com/article/4198993/servicenows-sandbox-escape-rce-hole-now-exploited-in-the-wild.html 📰 CSO Online #ZeroDay #Pentesting
0
0
0
rsgbengi
Rubén Santos García @rsgbengi@infosec.exchange · Jul 19, 2026
Browser exploitation isn't web bugs. It's memory corruption across three processes. This issue walks the full chain: V8 JIT type confusion for arbitrary read/write, WebAssembly RWX pages to run shellcode, WebGPU/Dawn as the softer GPU-process target, and the renderer→GPU→broker sandbox escape that ends in --no-sandbox. https://www.kayssel.com/newsletter/issue-59/ #InfoSec #CyberSecurity #Pentesting #BugBounty #BinaryExploitation #WebGPU
0
0
0
bugxhunter
0xBughunter @bugxhunter@infosec.exchange · Jul 18, 2026
🔍 Google fixing Android lock screen bug that lets Gemini send SMS with... 📝 Someone gets ho... https://www.theregister.com/security/2026/07/17/google-fixing-android-lock-screen-bug-that-lets-gemini-send-sms-without-a-pin/5273027 📰 www.theregister.com - Articles #CyberSecurity #Pentesting
0
0
0
kallisti
Kallisti @kallisti@infosec.exchange · Apr 30, 2026
New blog post! This time I talk about my new favorite evasive shellcode loader, Charon. I give a brief overview about what it does, how it works and which techniques it uses. Also a brief addendum for enjoyers of bloated Implants such as Sliver. https://ti-kallisti.com/general/ms/descending-into-hades.html #InfoSec #Malware #Shellcode #RedTeam #RedTeaming #Pentesting #Charon #Sliver #Merlin #Mythic
2
1
3
bugxhunter
0xBughunter @bugxhunter@infosec.exchange · Jul 15, 2026
🛡️ A Video Screen That Is Also a Camera 📝 Amazing : Researchers from ETH Zurich in Switzerland, however, managed to create a new type of pixel that can ... https://www.schneier.com/blog/archives/2026/07/a-video-screen-that-is-also-a-camera.html 📰 Schneier on Security #Malware #Pentesting
0
0
0
pentesttools
Pentest-Tools.com @pentesttools@infosec.exchange · Jul 14, 2026
We point our own product at ourselves. The scanners and exploit modules our customers run, we run against our own infrastructure and web apps. New critical CVE, our own assets are among the first we test, so detection and validation hold up on us before they reach anyone else. The rest is the auditable stuff: ISO 27001, hosting and data retention, encryption, and where AI sits in the product (noise reduction, not deciding what's exploitable). All public, no NDA or sales call. Poke holes in it: https://pentest-tools.com/legal/trust-and-assurance #infosec #offensivesecurity #pentesting
0
0
0
rsgbengi
Rubén Santos García @rsgbengi@infosec.exchange · Jul 04, 2026
Reentrancy forked Ethereum in 2016 ($60M DAO hack). It drained $52M from Curve in 2023 because Vyper 0.2.15-0.3.0 silently gave each @nonreentrant function its own independent lock. Cross-function reentrancy bypasses guards via shared state. Read-only reentrancy bypasses them via view function oracles. CEI is the foundation, guards are just backup. https://www.kayssel.com/newsletter/issue-57/ #InfoSec #CyberSecurity #Pentesting #BugBounty #OffSec #Web3 #Solidity
0
2
0