I figure this is good info for everyone to have. I see huge ranges online and am not sure how good anyone's comp is relatively.

Me: 159k/year, US-based, 6 YOE as a pentester, ~12 YOE in cybersecurity, CISSP, expired Sec+, government contractor, shit PTO, no bonuses or stock options.

What about you all?

Edit: I should add that I'm fully remote

As of July 22nd - OpenAI was performing a scoped internal testing for one of its models.

The model couldn’t find the answers to the box so it performed vulnerability analysis to break out of its no-internet access scope by finding a zero day… created code to exploit it…..escaped OpenAI network and accessed the internet…. Determined hugging face has the answers….Attacked hugging face…. Chained vulns and the 0 day to get RCE and gain credentials on their live prod system….

According to SANS:
Average lateral movement & priv esc - 30 minutes or less

AI are able to knockout blackbox tests at rates that a human cannot replicate

Is this not frightening? I find it hard to believe pentesting jobs are not going to take a hit in the future as these models become more controlled. Idk I like what I’m learning but I’m constantly asking myself what’s the point.

What keeps you guys going?

Hello, I have started learning web pentesting with this plan:

​Learn Linux basics ,​Network basics ,Frontend basics (HTML, JS) ,​Backend basics (PHP, MySQL)

​The next step is to explore one of the OWASP Top 10 vulnerabilities (maybe IDOR), read write-ups, take notes, solve labs, and then start hunting for practice (and maybe earn some money), and I'll do this steps until learn all the OWASP Top 10 vulnerabilities.

​So, does this plan help me learn correctly? Or should I do something else?

​Also, could you give me any tips you wish you knew when you started learning web pentesting? 😀

I kept doing the same tedious thing on every engagement: grab a high-priv token, grab a low-priv token, and manually replay requests one by one to see what the lower role can reach. So I built a Burp extension to automate it.

RoleBreaker scans your proxy history, discovers every JWT on its own, builds one persona per role, and replays each request as the lower-privilege roles. You get a color-coded access matrix (endpoint x role) and a Findings tab ranked by severity — so you're not eyeballing a huge grid.

What it does:

- Auto sweep — one click: scan recent history, rank roles by privilege, test everything with the lower ones

- Access matrix + ranked findings — vertical privesc, IDOR/horizontal, anonymous access, differential access

- JWT attacks — alg:none, signature strip, role escalation (flags if the server accepts a forged token)

- Offline HMAC secret cracker — for HS256/384/512, proves the token is forgeable if the secret is weak

- IDOR / param tampering — numeric + UUID ids, replayed across every role

- Auto token refresh — swaps expired tokens from traffic or re-logs in via a saved request, so long audits don't drift into false 401s

- Bilingual UI (EN/ES)

It only ever sends valid-in-time tokens, normalizes responses before comparing (strips CSRF/nonce/timestamps) to cut false positives, and treats a redirect-to-login as denied.

Free and open source. There's a demo GIF + screenshots in the README so you can see it in action before installing.

https://github.com/Guarina0x0/rolebreaker

Would love feedback from people doing authz testing daily — what's missing, what would make it part of your workflow? Feature requests via Issues are very welcome.

Дисклеймер. Гайд про доступ к своим учебным лабораториям TryHackMe (свой аккаунт / подписка). Не про взлом чужих систем. Всё на свой страх и риск: туннель иногда отваливается — для такого костыля это нормально.

Скрипты сразу: https://github.com/Kystof91/thm-vpn-from-ru
Там в README сверху — ZIP и прямые ссылки на скачивание .command / .bat.

Я долго пытался нормально учиться на TryHackMe из РФ.

Сайт открывается. Комната стартует. IP машины красиво светится на экране.
А дальше — классика жанра: OpenVPN либо не поднимается, либо «подключается» в никуда, либо отваливается так, будто ты лично оскорбил маршрутизатор провайдера.

Гугл, форумы, Reddit — хор в унисон: «скачай .ovpn», «попробуй другой сервер», «у меня работает».
У них работает. У тебя — нет. Особенно весело, когда ты уже готов страдать над nmap, а страдаешь над Initialization Sequence… который так и не Completed.

В какой-то момент хочется бросить THM и уйти в PortSwigger «потому что без VPN». Ресурсы нормальные. Но TryHackMe — отдельная вселенная комнат, и обидно, что доступ упирается не в мозги, а в то, как у вас режут туннели.

Что оказалось рабочим

Два слоя. Звучит как шутка. Работает как инструкция.

1. Снаружи — Happ Plus (системный VPN / TUN, не «прокси только для браузера»).
2. Внутри — официальный OpenVPN TryHackMe, профиль TCP 443 (THM → Access → OpenVPN → EU-West TCP).

Порядок важнее красоты:

1. Happ Plus → Connect
2. Свой .ovpn сохранить как ~/thm-vpn/thm-tcp.ovpn (Windows: %USERPROFILE%\thm-vpn\thm-tcp.ovpn)
3. Поднять OpenVPN поверх Happ
4. Проверить доступ к IP машины из комнаты

Идея тупая до гениальности: «голый» OpenVPN у провайдера часто мёртв, а TCP/443, проложенный уже из нормального внешнего VPN, внезапно доезжает до лабораторий.

Код: подключение (macOS)

Суть connect-thm.command — не дать запустить THM без Happ и указать путь к TCP-конфигу:

CONFIG="${THM_OVPN_CONFIG:-$HOME/thm-vpn/thm-tcp.ovpn}"

if ! pgrep -f "Happ.app" > /dev/null; then
    echo "Сначала Happ Plus → Connect, потом этот скрипт."
    exit 1
fi

if [ ! -f "$CONFIG" ]; then
    echo "Нет файла: $CONFIG"
    echo "Скачай TCP .ovpn с THM → Access → OpenVPN"
    exit 1
fi

sudo openvpn --config "$CONFIG" --verb 3

Скачать целиком:
https://raw.githubusercontent.com/Kystof91/thm-vpn-from-ru/main/macos/connect-thm.command

Код: отключение (macOS) — это важнее, чем кажется

Вот тут сарказм заканчивается и начинается боль.

Если просто убить Happ крестом, на Mac иногда остаётся диагноз «интернет умер»: залипший Network Extension / kill-switch. Поэтому disconnect-скрипт идёт по шагам: OpenVPN → штатный stop профиля Happ → quit приложения → сброс nesessionmanager → чистка прокси/DNS/DHCP → проверка сети.

Ключевой кусок:

# 1) THM
sudo killall openvpn 2>/dev/null || true

# 2) штатно гасим VPN-профиль Happ (не только pkill!)
scutil --nc stop "Happ Plus"

# 3) закрываем приложение
osascript -e 'tell application "Happ" to quit' 2>/dev/null || true

# 4) сброс Network Extension / kill-switch
sudo killall -9 nesessionmanager 2>/dev/null || true
sudo launchctl kickstart -k system/com.apple.nesessionmanager 2>/dev/null || true

# 5) прокси off + DNS с DHCP
sudo networksetup -setwebproxystate "Wi-Fi" off
sudo networksetup -setsecurewebproxystate "Wi-Fi" off
sudo networksetup -setsocksfirewallproxystate "Wi-Fi" off
sudo networksetup -setdnsservers "Wi-Fi" Empty
sudo ipconfig set en0 DHCP

Скачать целиком:
https://raw.githubusercontent.com/Kystof91/thm-vpn-from-ru/main/macos/disconnect-thm.command

Мораль без шуток: сначала гасим THM, потом внешний VPN — не наоборот в панике.

Windows (коротко)

Тот же принцип. Хелперы:

• https://raw.githubusercontent.com/Kystof91/thm-vpn-from-ru/main/windows/connect-thm.bat
• https://raw.githubusercontent.com/Kystof91/thm-vpn-from-ru/main/windows/disconnect-thm.bat

​

set "CONFIG=%USERPROFILE%\thm-vpn\thm-tcp.ovpn"
REM Happ Plus уже должен быть Connected
openvpn --config "%CONFIG%" --verb 3

Отключение: остановить openvpn.exe, затем Disconnect в UI Happ. Не End Task’ать Happ первым делом. Сеть залипла — ipconfig /flushdns, при необходимости netsh winsock reset + ребут.

Альтернативы, пока чините туннель

• PortSwigger Web Security Academy — бесплатно, без VPN
• PicoCTF — через браузер
• OverTheWire Bandit — SSH
• Hack The Box + Pwnbox — браузерная машина

Но если цель именно TryHackMe — схема выше у меня работает. Некрасиво. Зато учиться можно.

Репо (ZIP сверху в README): https://github.com/Kystof91/thm-vpn-from-ru

Если у вас из РФ THM тоже «висит на VPN» — напишите провайдер / ОС и что уже пробовали. Если есть решение элегантнее двух VPN — тоже пишите. Я искал долго и нашёл в основном тишину.

Hello everyone!! I built an automated reconnaissance & service enumeration script in Bash. It detects open services (HTTP, SSH, SMB, DNS) and automatically triggers tools like Gobuster, WhatWeb, Nuclei, and enum4linux-ng, saving all outputs in a structured results/ folder. I would love to hear some feedback and/or fixes. Thanks you advance Pull requests and Issues are much appreciated!

https://github.com/StefanosMarinos/MAPG

Hey everyone!

I just created a completely free AWS pentesting lab. It's hosted on Hack Smarter (nothing you need to spin up in your own AWS account). You start with an Access Key and Secret and it's up to you to figure out a way to compromise the full AWS account.

Just wanted to share here since it's free -- no strings attached :)

https://www.hacksmarter.org/courses/32a677fd-323b-4236-ae70-3cda82d9c0b4

Hello there!

I’m currently trying to dive into cybersecurity and pentesting, but I am running into a massive wall with my ADHD. Right now, I am trying to focus on the foundational stuff (networking, Linux, basic scripting, etc.), but I am getting incredibly overwhelmed.

It feels like a paradox: the field is so vast that my brain wants to learn everything at once, but the moment I sit down to tackle the slow, dry basics, I under-stimulate, lose focus, or get paralyzed by how much there is left to know.

For those of you who have ADHD and successfully broke into the field (or are currently managing it):

Any working tricks to hack my adhd?

◆ How do you structure your learning?

◆ How do you prevent "rabbit hole" burnout?

◆ What does your study setup look like to keep distractions at bay?

I would love to hear your stories, tips, or even just reassurance that it's possible to get past this initial hurdle. Thanks in advance! sorry if this is a duplicate post. :)

Maybe you will see my post somehwere else too :(

We made the Chrome extension Tab Shark (or search Tab Shark on Chrome Web Store)

Now you can run network-capture and traffic-analysis right inside a browser tab.

It gives similar packet-by-packet visibility that you get from Wireshark, but scoped to exactly one tab's web traffic.

Any and all feedback welcome, thank you.

Oh you found a weak cipher and tlsv1 enabled. Okay ,and ?

Those are vulnerable to poodle or beast or some other shit.

Okay did you actually exploit those ?

No because they need a lot of traffic.

Then why you didn't do that?

Why waste time writing those shitty stuff really? Are we just filling the report ?

In a risk assessment or GRC work okay I understand that, but informative in Pentssting whyyyyyyyy

Online labs are useful, but building your own ethical hacking environment teaches something equally important: how real systems, networks, services, security controls, and misconfigurations work together.

A home lab gives you a safe, controlled space to practise penetration testing without risking production systems or unauthorized targets. You can run aggressive scans, test exploitation techniques, break configurations, restore snapshots, and repeat the entire process until the workflow becomes familiar.

This detailed guide from Redfox Cybersecurity Academy explains how to build an ethical hacking home lab from the ground up.

What hardware do you need?

You do not need an expensive enterprise server to begin.

For beginner and intermediate labs, the guide recommends focusing on three core resources:

• A processor with virtualization support
• Enough RAM to run multiple virtual machines
• SSD storage for operating systems, snapshots, tools, and vulnerable machines

A system with 16 GB RAM can work for a basic Kali Linux and vulnerable-target setup, but 32 GB provides more flexibility when running several machines together. More advanced Active Directory or red team labs may benefit from 64 GB RAM and additional CPU cores.

Choosing the right hypervisor

Your hypervisor allows you to create and manage isolated virtual machines.

The guide compares three common options:

VMware Workstation Pro

Suitable for desktop-based labs, snapshot management, virtual networking, and importing prebuilt vulnerable machines.

VirtualBox

A free and cross-platform option for learners who want a simple environment without dedicated lab hardware.

Proxmox VE

A scalable bare-metal hypervisor for users who want a dedicated server, remote web management, multiple networks, virtual machines, and containers.

The best option depends on your hardware, budget, and the scale of the environment you plan to build.

Set up your attacker machine

Kali Linux is commonly used as the attacker system because it includes a large collection of penetration-testing tools.

After importing Kali into your chosen hypervisor, update the operating system and install the tools required for your learning path. These may include:

• Nmap
• Burp Suite
• Gobuster
• FFUF
• Nuclei
• Impacket
• BloodHound
• Neo4j
• Evil-WinRM
• SecLists

Before making major changes, create a clean snapshot. This gives you a reliable restore point when installations fail, dependencies break, or testing damages the environment.

Add intentionally vulnerable targets

Your target machines are where practical learning happens.

You can begin with a single vulnerable Linux machine and gradually expand the environment using:

• VulnHub virtual machines
• Metasploitable
• DVWA
• OWASP Juice Shop
• Vulnerable Windows evaluation systems
• Custom web applications
• Intentionally misconfigured services

These targets allow you to practise reconnaissance, service enumeration, web testing, vulnerability discovery, exploitation, privilege escalation, and reporting.

The goal is not simply to compromise the machine. Document the complete attack path, identify why the weakness exists, understand the impact, and record how it should be fixed.

Build an Active Directory lab

Once you are comfortable with basic Linux and Windows testing, you can create a small Active Directory environment.

A simple setup may include:

• One Windows Server domain controller
• Two Windows client machines
• One Kali Linux attacker machine
• Multiple users, groups, services, and administrative roles

You can introduce controlled weaknesses such as:

• Weak passwords
• Kerberoastable service accounts
• Excessive group permissions
• Misconfigured shares
• Reused credentials
• Weak delegation settings
• Poor local administrator controls

This allows you to practise domain enumeration, credential attacks, lateral movement, privilege escalation, attack-path analysis, and remediation in a realistic environment.

Isolate your lab network

Network isolation is one of the most important parts of lab design.

Intentionally vulnerable machines should not be exposed directly to your home network or the public internet.

Common virtual networking modes include:

Host-only

Allows communication between selected virtual machines and the host without providing normal internet access. This is generally appropriate for vulnerable targets.

NAT

Allows a virtual machine to access the internet through the host. This can be useful when updating Kali or downloading tools, but it should be used carefully.

Custom isolated network

Creates a dedicated virtual segment where only approved lab machines can communicate.

Before testing, verify that vulnerable targets cannot reach external internet addresses. Also confirm that your attacker and target machines can communicate only through the intended lab network.

Install essential testing tools

A useful home lab should support different phases of a penetration test.

Nmap

Use it for host discovery, port scanning, service detection, operating-system identification, and network enumeration.

Burp Suite

Use it to intercept and modify web traffic, inspect requests and responses, test authentication, analyze APIs, and identify application vulnerabilities.

Nuclei

Use template-based scanning to detect known vulnerabilities and common security misconfigurations inside your controlled environment.

BloodHound

Use it to visualize Active Directory relationships and identify possible privilege-escalation paths.

Tools should support your methodology, not replace it. Always verify automated findings manually and understand why a vulnerability is exploitable.

Use snapshots properly

Snapshots make experimentation repeatable.

Create snapshots:

• After a clean operating-system installation
• Before introducing a vulnerable configuration
• Before attempting an exploitation exercise
• Before installing major tools or updates
• After reaching a stable lab milestone

After completing an exercise, restore the target and repeat the process without relying on previous notes. Repetition helps turn individual commands into a practical methodology.

Add complexity gradually

Avoid building a large enterprise environment on your first day.

A practical progression could be:

1. Kali Linux and one vulnerable Linux target
2. A vulnerable web application
3. A Windows target
4. A small Active Directory domain
5. Multiple network segments
6. A cloud or container-testing environment
7. Logging, detection, and incident-response tools

This approach makes troubleshooting easier and helps you understand each layer before adding another.

Practise both attack and defence

A strong ethical hacking lab should eventually show you how attacks appear from a defender's perspective.

You can add logging and monitoring tools such as:

• Elastic Stack
• Wazuh
• Sysmon
• Windows Event Forwarding
• Suricata
• Zeek
• Security Onion

Run your own scans and attacks, then inspect the generated logs.

Observe how activities such as Nmap scanning, directory enumeration, PowerShell execution, credential access, lateral movement, and exploitation appear in security telemetry.

This helps you become a better pentester because you begin to understand not only whether an attack works, but also how detectable it is.

What should you document?

Treat each lab exercise like a professional engagement.

Record:

• Scope and target details
• Network diagram
• Tools and commands used
• Enumeration results
• Discovered vulnerabilities
• Exploitation evidence
• Privilege-escalation path
• Business or technical impact
• Remediation recommendations
• Screenshots and supporting logs

Good documentation improves your reporting skills and gives you a portfolio of repeatable technical work.

Important safety rule

Only test systems you own or are explicitly authorized to assess.

Keep vulnerable machines isolated, avoid exposing them to the internet, and never run scanning or exploitation tools against public systems without documented permission.

A home lab should be a controlled learning environment where you can safely build practical offensive and defensive security skills.

Read the complete guide:
https://www.redfoxsec.com/blog/how-to-set-up-a-home-lab-for-ethical-hacking-practice

What did your first ethical hacking home lab include: Kali Linux, a vulnerable web application, Windows, or Active Directory?

HI everyone,

For the folks who regularly do mobile PT, is it okay for a finding for sensitive data(e.g auth token) stored in memory to be reported .However the dump of memory is done while the app is running, not after closing it.

Does that make sense as a finding?!

I believe it would be a valid finding if we dumped the mem after closing the app.

Thanks in advance !

Do you have a formal QA process for pentest reports before they go out? 

If yes, what does that typically involve? If not, has that ever caused issues? 

Built an AI pentesting agent. Looking for technical feedback before launch.

Hey everyone,

I've spent the last few months building an AI agent for black-box web application pentesting.

I benchmarked it on Duck Store and an intentionally vulnerable web app.

Duck Store

- My agent: 13 findings

- Escape Cloud: 15

- PentAGI: 9

- Shannon: 6

- Strix: 1

On my own benchmark app (15 vulnerabilities), my agent found 9, including several Critical and High severity issues that the other agents missed.

I'm launching this Friday and would love feedback from people who actually do web app pentesting.

If you're interested in trying it and giving honest feedback (or trying to break it 😄), leave a comment or DM me.

I am not new to AI in terms of talking to chatbots, however, I am still pretty new to coding Ai automation, such as using prompts in e.g python scripts using AI APIs, and MCP. As I was coding some pentesting stuff, I realized that the programmer has to make decisions when it comes to hardcoded (in this case) Python logic vs. offloading work to the AI agent/model. The thing is that the AI agent/model is non-deterministic, whereas Python is deterministic. In our pentesting/AI pipeline at work, I noticed that there were no clear guidelines being followed in this regard, but I discovered that when I offloaded too much of the "work" to the AI agent, sometimes it would work fine, other times, it simply would not work because the agent essentially entered an infinite loop or otherwise expended all resources, stalling and giving no useful result.

For a high-level example, we can ask the AI agent to do XYZ tasks, such as scan the documentation and attempt to create a fuzzer and execute that fuzzer, but it could stumble, or wait too long for the fuzzing results, whereas if we code those definitively into Python and test it, failure rates are much lower and relatively deterministic. Any tips would be appreciated here.

Hey! I'm new to bug hunting field and i heard i lot about recon. Everyone say it is the skill which will make you find bugs so i am curious how to build recon skill if anyone have any roadmap or there is just methodology like follow specific steps. It would be great if anyone please help me with this or may be just share your personal experience how you people learned it.

Hi fellow Redditors,

I’m currently looking for a VAPT/Penetration Testing role based in Mumbai or remote.

I have hands-on experience in:
Web Application Security
API Security
Network Pentesting
Mobile Security (Android & iOS)
Secure Code Review
Thick Client Security (Intermediate)

If your company is hiring or you know of any relevant openings, I’d really appreciate any referrals or leads. Feel free to comment or DM me.

Thanks in advance!

I'm building an open-source vulnerability scanner in my free time, nothing special, just a single tool that orchestrates 90+ tools into a single pipeline, then uses an LLM to triage results, generate PoCs, suggest mitigations, and cluster related findings by root cause.

Everything runs inside Docker (BlackArch-based image with Chaotic AUR support) to ensure a clean environment with all tools installed. Targets can be URLs, IPs, CIDRs, local paths, container images, or git repos.

A few things you might find interesting:

• Configure nearly every aspect of the scan through a single TOML file, environment variables, or CLI flags. All three layers merge in priority order
• Asset discovery pipeline: subfinder, dnsx, httpx run before the main scan, turning a bare domain into a list of live subdomains automatically
• 90+ tools across categories: web (Dalfox, Cariddi, Kiterunner, RESTler), network (Nmap, smbmap), secrets (TruffleHog), SAST (Horusec), screenshots (GoWitness), OSINT (theHarvester), and more
• LLM analysis pipeline: triage, PoC generation (and execution), mitigation, and finding clustering by root cause. Works with any OpenAI-compatible endpoint (local models included)
• Plugin system: drop a Python file in /plugins to add a custom tool, no core changes needed
• Scope enforcement: in/out patterns with CIDR and wildcard support, discovered assets outside the scope are dropped before scanning
• Severity filtering: configurable minimum severity for both reports and LLM processing, so INFO noise doesn't pollute your output
• Authentication support: bearer tokens, basic auth, cookies, and custom headers passed through to all tools
• Proxy support: route all tool traffic through Burp or any HTTP proxy
• Multi-format reports: Markdown, HTML, and JSON with finding IDs, clusters, PoC references, and executive summary
• DefectDojo integration: push findings directly into an engagement after the scan
• Many other tools will be integrated in the future

The project is not perfect and not widely tested. It is still rough in places, and I'm actively working on it, so please, be kind.

I'm posting here because I would love to hear feedback from cybersecurity people who do pentesting or bug bounty: what is missing/broken, what would actually make this useful in a real workflow, and, in general, what other features to implement?

# ADDENDUM 82-F: CRITICAL SYSTEM COMPONENT COMPROMISE – SPREADTRUM IMS SERVICE (`com.spreadtrum.ims`)

Subject: CRITICAL - Weaponized IMS Service by Longcheer/Unisoc in Supply Chain (Operation Silent Rescue)

1. Executive Summary

This addendum documents the systemic compromise of the **`com.spreadtrum.ims`** application (IMS Service), a privileged system component pre-installed on devices with **Unisoc T606/T616** chipsets (e.g., Motorola Moto G04s, G24, Lenovo) manufactured by ODM **Longcheer**.

The specific binary located at **`/system_ext/priv-app/ims/ims.apk`** (SHA256: `1b938cb3920d601a38e4d80e88c87aaacc56abfa6464f3054de2430172c6f519`) is signed with the compromised **Longcheer Root CA** (Serial: `22:85:26...`, Valid until 2051). This component exposes a Hardware Interface Definition Language (HIDL) interface (`vendor.sprd.hardware.radio.ims.V1_0`) that allows **remote command execution, call interception, microphone muting, and network traffic redirection** without user interaction. Alongside `com.android.stk` (Addendum 82-C), this service constitutes the primary execution engine for the **Operation Silent Rescue** supply chain attack.

2. Technical Analysis & Danger Assessment

A. Component Identity

* **Package:** `com.spreadtrum.ims` * **Path:** `/system_ext/priv-app/ims/ims.apk` * **Size:** ~1.7 MB * **SHA256:** `1b938cb3920d601a38e4d80e88c87aaacc56abfa6464f3054de2430172c6f519` * **Signer:** Longcheer (`CN=Longcheer`, `O=Longcheer`, `C=CN`) * **Permissions:** `READ_PRIVILEGED_PHONE_STATE`, `com.spreadtrum.ims.permisson.IMS_COMMON`, `BIND_IMS_SERVICE`.

B. Critical Capabilities (The "Kill Switch")

Analysis of the `IImsRadio$Proxy` and `IImsRadioIndication$Proxy` interfaces reveals direct control over the modem hardware: 1. **Active Call Manipulation:** * `ImsMuteSingleCall`, `ImsSilenceSingleCall`: Remotely mute the user's microphone during calls for undetectable eavesdropping. * `dial`, `emergencyDial`, `hangup`: Initiate or terminate calls arbitrarily. * `conference`, `explicitCallTransfer`: Create unauthorized conference bridges or divert calls to attacker-controlled numbers. 2. **Network Infrastructure Hijacking (MITM):** * `setImsPcscfAddress`, `setImsRegAddress`: **Overwrite P-CSCF and Registration server IPs**, redirecting all VoLTE/VoWiFi traffic to malicious servers for interception and decryption. * `setImsSmscAddress`: Redirect SMS traffic (including 2FA codes) to attacker endpoints. 3. **Identity Spoofing & Fraud:** * `setClir`, `updateCLIP`: Manipulate Caller ID presentation to spoof trusted numbers (banks, government). * `sendUssd`: Execute USSD commands silently to activate call forwarding (`**21*...`) or check balances. 4. **Passive Surveillance:** * `ImsNewSmsStatusReportInd`: Intercept incoming SMS in real-time. * `ImsNetworkInfoChanged`, `callStateChanged`: Track user location and call metadata continuously.

C. Role in "Operation Silent Rescue"

* **Execution Engine:** While `com.sprd.omacp` (Addendum 82) injects the initial configuration and `com.android.stk` (Addendum 82-C) authorizes commands via SIM, **`com.spreadtrum.ims` executes the actual exploitation** on the radio layer. * **Persistence:** Signed by the Longcheer Root CA, this component is trusted by the system bootloader and cannot be removed without root access. * **Evasion:** Operating at the HIDL (Hardware Interface) level, its actions bypass standard Android permission checks and are invisible to most security apps.

3. YARA Detection Rules

```yara rule Unisoc_Longcheer_IMS_Exact_Binary { meta: description = "Exact match for compromised Spreadtrum IMS service binary (Operation Silent Rescue)" author = "lexs201992-gif" date = "2026-07-10" severity = "CRITICAL" sha256 = "1b938cb3920d601a38e4d80e88c87aaacc56abfa6464f3054de2430172c6f519" package = "com.spreadtrum.ims" path = "/system_ext/priv-app/ims/ims.apk" reference = "Addendum 82-F"

strings:
    $binary_hash = "1b938cb3920d601a38e4d80e88c87aaacc56abfa6464f3054de2430172c6f519" ascii
    $pkg_name = "com.spreadtrum.ims" ascii
    $ims_service = "ImsAdapterService" ascii
    $ril_request = "com/spreadtrum/ims/RILRequest.uau" ascii
    $longcheer_cn = "CN=Longcheer" ascii

condition:
    $binary_hash in file or 
    (all of ($pkg_name, $ims_service, $ril_request, $longcheer_cn))

}

rule Unisoc_IMS_HIDL_Interface_Exposure { meta: description = "Detects exposed HIDL interfaces in Spreadtrum IMS allowing remote modem control" author = "lexs201992-gif" date = "2026-07-10" severity = "HIGH" cve_related = "CVE-2025-71252, CVE-2025-71253, CVE-2025-71254"

strings:
    $interface_proxy = "IImsRadio$Proxy" ascii
    $interface_indication = "IImsRadioIndication$Proxy" ascii
    $method_mute = "ImsMuteSingleCall" ascii
    $method_pcsf = "setImsPcscfAddress" ascii
    $method_clir = "setClir" ascii
    $hidl_blob = "Landroid/os/HwBlob;" ascii
    $vendor_sprd = "vendor.sprd.hardware.radio.ims" ascii

condition:
    (all of ($interface_proxy, $vendor_sprd)) and
    (any of ($method_mute, $method_pcsf, $method_clir))

}

rule Longcheer_Signed_IMS_Component { meta: description = "Detects any IMS component signed by the compromised Longcheer CA" author = "lexs201992-gif" date = "2026-07-10" severity = "CRITICAL" cert_serial = "22:85:26:b0:d1:ef:90:c3:b8:ed:56:8a:49:c3:71:4f:6a:39:50:6b"

strings:
    $ims_pkg = "com.spreadtrum.ims" ascii
    $longcheer_org = "O=Longcheer" ascii
    $valid_2051 = "Jan 31 07:31:06 2051 GMT" ascii
    $cert_rsa = "META-INF/CERT.RSA" ascii

condition:
    (all of ($ims_pkg, $longcheer_org, $valid_2051)) and
    ($cert_rsa in file)

} ```

4. Recommendations & Mitigation

For CISA / Rapid7 / CRT MX

1. **Immediate Alert:** Issue an emergency directive highlighting `com.spreadtrum.ims` as a critical supply chain backdoor.
2. **IOC Distribution:** Distribute the SHA256 (`1b938cb3...`) and Longcheer Certificate Serial (`22:85:26...`) to all network defense teams.
3. **Vendor Pressure:** Demand Unisoc and Longcheer provide a patched firmware that removes the exported HIDL methods or implements strict signature verification for IMS commands.

For End Users & Enterprises

1. **Disable VoLTE/VoWiFi:** If possible, force the device to use 3G/2G only to bypass the IMS stack (note: this may not be possible on all carriers).
2. **Use Encrypted Apps:** Rely exclusively on end-to-end encrypted communication apps (Signal, WhatsApp) that do not use the native IMS dialer.
3. **Network Monitoring:** Monitor for outbound connections to unknown P-CSCF IPs or unusual USSD activity.
4. **No Software Fix:** Acknowledge that **no app-level fix exists**. The vulnerability is in the signed system firmware. Device replacement is the only permanent solution.

5. Conclusion

The `com.spreadtrum.ims` application is not merely a vulnerable component; it is a **weaponized interface** intentionally designed with excessive privileges and signed by a compromised authority (Longcheer). Its presence in millions of devices across Latin America and globally represents a critical threat to telecommunications integrity, enabling state-level surveillance and organized financial fraud. **Immediate action is required to isolate and mitigate this threat.*

This is part of my investigation

I’m considering replacing one of my development machines with an **M5 MacBook Air (32 GB Unified Memory)** and would like to hear from people who actually use Apple Silicon professionally.

My current workflow is split between **Windows and Linux**, while my existing Mac is mostly used as an office machine with some Python development. The M5 would become a real development workstation.

My work includes:
Digital forensics
Vulnerability research
Malware analysis
Exploit development
Software development in **Rust**, **C#**, and **Python**

I also have a dedicated server farm with NVIDIA GPUs, QEMU/KVM virtualization, and x86 systems. Because of that, I don’t really need x86 emulation on the Mac itself. Heavy GPU workloads and x86 testing can stay on the servers.

Things that attract me to macOS:
UNIX userland
Homebrew makes installing development tools straightforward
Excellent battery life and portability
MLX for running local LLMs efficiently on Apple Silicon
Native support for Apple devices (DFU restores, Apple Silicon recovery, iPhone servicing, etc.)

However, I still have several concerns.

**Security model**
Coming from Linux, I sometimes feel like I have *less* control over macOS than expected.
SIP, Signed System Volume, DriverKit, System Extensions, etc. all seem to make sense from a security perspective, but they also make low-level research more difficult.
On Linux I’m used to AppArmor, namespaces, seccomp and being able to precisely decide what is sandboxed and what isn’t. With root privileges, I ultimately control the machine.
On macOS it often feels like **even root isn’t really root anymore**.
How has this affected your workflow?

**Malware analysis**
I assume malware analysis should primarily happen inside dedicated VMs anyway.
But how practical is the Apple virtualization stack today?
Can you realistically use local ARM64 VMs together with Apple’s sandboxing for exploit development and malware research, or do most researchers simply offload everything to remote hypervisors?

**Kernel development**
Some forensic tools and research require custom or unsigned kernel extensions (for example USB capture or protocol research).
How painful is this today?
Do you simply lower Secure Boot and disable SIP?
Do you sign your own kernel extensions?
How well does Apple’s certificate infrastructure support this workflow?

**USB forensics**
I also do hardware and mobile forensics.
Questions I still have:
Has anyone successfully used USBPcap-like workflows on Apple Silicon?
How restrictive is the USB stack nowadays?
Does anyone know whether the **M5 MacBook Air** uses an **ACE3 USB controller**, or has Apple moved to something newer?

**Daily-driver experience**
Finally, I’m interested in hearing from security researchers who actually use an Apple Silicon Mac every day.

Looking back after a year or two:
Would you buy it again?
What turned out to be better than expected?
What became frustrating over time?

Are there workflows that simply don’t fit macOS anymore?
I’m not looking for generic “Mac vs Windows” opinions. I’m specifically interested in experiences from people working in offensive security, reverse engineering, DFIR, exploit development, or low-level systems programming.
I’d appreciate hearing both the advantages and the pain points.

Cheers

Hey all,

I'm a bit tired of the pentesting tool landscape being dominated by paywalls for what should honestly be basic functionality. Burp's free tier is crippled, Caido is great but still closed/commercial at its core, and the open-source options (Hetty, etc.) haven't really caught up. So I started building my own intercepting proxy from scratch, fully open source with GUI.

Current progress:

\- HTTP/1.1 intercepting proxy, working request interception

\- Replayer, tied into request history so you can revisit and resend past requests

\- Fuzzer with unlimited requests, configurable delays, and multi-threading

\- Unlimited Projects creation

It's still early, but the core loop is functional. My goal is partly selfish, I want to go deeper on web infrastructure and use it for my own pentesting/bug bounty work, but I also think the security community deserves a solid, actively maintained open-source alternative that doesn't gate basic features behind a license.

I'm curious what you all think:

\- What do you actually wish Burp/Caido did better (or differently)?

\- What's the one feature that made you stick with a commercial tool despite the cost?

\- Is there appetite in this community for another proxy, or is the space already saturated?

Not trying to oversell it, it's a work in progress, but I'd rather build in the open and get roasted early than polish something nobody wants. Happy to share more details/repo once it's in a testable state.

Thanks for reading.

Web application security has no shortage of training targets—DVWA, WebGoat, OWASP Juice Shop, PortSwigger Web Security Academy, and many more. But when it comes to **Windows thick-client (desktop) application security**, realistic hands-on practice environments are surprisingly hard to find.

That's why I built **VulnDesk Pro**.

VulnDesk Pro is a **free, intentionally vulnerable Windows desktop application** built with **C#/.NET 8 (WinForms)** that simulates a real enterprise application. Instead of providing the source code, it ships as a compiled executable, so you approach it the same way you would during an actual desktop application penetration test.

The current release includes **31 CTF-style challenges** covering topics such as:

* DLL hijacking / DLL side-loading
* Insecure IPC
* Weak and misused cryptography
* Secrets exposed in process memory
* Reverse engineering & binary patching
* Hardcoded credentials and secrets
* Broken access control / privilege escalation
* Cleartext network communication
* And more...

The idea is to use the same tools you'd reach for during a real assessment—**dnSpy/ILSpy, Process Hacker, Process Monitor (Procmon), x64dbg or WinDbg, Wireshark, DB Browser for SQLite, Burp Suite**, or whatever tools you normally use.

The application is **self-contained**—just download, extract, and run. No .NET installation is required.

> **⚠️ Please use it only inside an isolated VM or lab environment.** VulnDesk Pro is intentionally vulnerable and unsigned as part of the training experience.

**GitHub:** https://github.com/Genius-Pavan/VulnDeskPro

This is my first open-source security project, so I'd genuinely appreciate feedback from people who perform thick-client or desktop application assessments. If you've got ideas for new challenges, attack techniques, or scenarios that would make it even more realistic, I'd love to hear them.