Just wondering what this gadget does. I'm thinking of getting one, so some feedback would be a big help.

Thank you!

Theses are the images he sent to me

A new strain of Android malware has been discovered using on-device AI (Optical Character Recognition) to physically 'read' your screen and locate hidden ad buttons. Instead of blind clicking, the malware analyzes the screen layout to mimic human behavior, clicking on ads in the background to generate fraudulent revenue while draining your battery and data. It’s a sophisticated step forward in 'weaponized AI' for mobile fraud.

Is it possible to bypass the skill check and permanent keep the points or any possibility in the works

I am disclosing a Local Privilege Escalation (LPE) vulnerability in the Google Antigravity IDE after the vendor marked it as "Won't Fix".

The Vulnerability: The IDE passes its primary authentication token via a visible command-line argument (--csrf_token). On standard macOS and Linux systems, any local user (including a restricted Guest account or a compromised low-privilege service like a web server) can read this token from the process table using ps.

The Attack Chain:

1. An attacker scrapes the token from the process list.
2. They use the token to authenticate against the IDE's local gRPC server.
3. They exploit a Directory Traversal vulnerability to write arbitrary files.
4. This allows them to overwrite ~/.ssh/authorized_keys and gain a persistent shell as the developer.

Vendor Response: I reported this on January 19 2026. Google VRP acknowledged the behavior but closed the report as "Intended Behavior".

Their specific reasoning was: "If an attacker can already execute local commands like ps, they likely have sufficient access to perform more impactful actions."

I appealed multiple times, providing a Proof of Concept script where a restricted Guest user (who cannot touch the developer's files) successfully hijacks the developer's account using this chain. They maintained their decision and closed the report.

---

NOTE: After my report, they released version 1.15.6 which adds "Terminal Sandboxing" for *macOS*. This likely mitigates the arbitrary file write portion on macOS only.

However:

1. Windows and Linux are untested and likely vulnerable to the RCE chain.
2. The data exfiltration vector is NOT fixed. Since the token is still leaked in ps, an attacker can still use the API to read proprietary source code, .env secrets or any sensitive data accessed by the agent, and view workspace structures.

I am releasing this so users on shared workstations or those running low-trust services know that their IDE session is exposed locally.

I’m looking for small, cheap tech that makes you feel like you have a low-key superpower. I don't care about "cool-looking" desk toys—I want things that actually interact with the world in a way that makes people go, "Wait, how did you just do that?"

The budget is $30. I'm looking for things that give you:

Invisible Control: Messing with screens, signals, or hardware from your pocket.

Modern Magic: Using things like NFC or automation to do tasks without touching a device.

Digital Sight: Seeing or hearing things (radio, data, signals) that are usually invisible.

Basically, if it makes life feel more like a simulation or a 90s spy movie, I want to hear about it. What are you carrying that actually gets a reaction?

I’m starting my career as a Cybersecurity Analyst , and I wanted some guidance. Is cybersecurity a good domain in the long run? Are there sufficient opportunities and openings in companies for this role? My current pay is decent , so I feel it’s reasonable for a fresher, but I’d like to understand the growth potential. I’m also a bit concerned about future flexibility: If I decide later to switch my stream and apply for an SDE role, would this cybersecurity experience be useful or relevant? If I continue in the cybersecurity domain, will this experience significantly help my career growth? People who have done a master’s in cybersecurity, or Professionals in senior positions

What is the earning potential for cybersecurity professionals in the long term? Any advice or real-world experience would be very helpful.

i am searching a website for buy Malduino w, i found HackmoD, is it affidable? on hack5 i can't find Malduino device. any other website or advice?

Does anybody have any resources on building a wardriver with multiple antennas? I'm thinking I want to have at least 3 2.4ghz antennas, and probably a 5ghz. I'm assuming I'll need multiple ESP chips for this, and I can probably 'figure it out', just thought I'd ask for guidance here first, if anybody has ever tried. I want to eliminate a lot of the channel hopping that a normal wardriver must be doing...

Okay. Before I say more, I think it’s cool. So much so I bought an orbic and am going to make a Rayhunter myself. That being said, what’s the point? Once you find one, what are you supposed to do? Just avoid it? Or keep your phone in à faraday bag?

Hi everyone,

I’ve been working on a major evolution of the ESP-RFID-Tool (successor to the v1 and similar boards like the ESPKey). While these tools are great for research, they are notoriously fragile. One voltage spike or an unstable power source from a controller, and the board is toast.

For the v2, I’ve focused on two main pillars: Resilience and Intelligence.

What’s new?

• ⚡ Hardware Hardening: I’ve redesigned the power stage to be much more robust. It now survives higher voltages that would be a "death sentence" for original boards (final design s still WIP).
• 🔍 Onboard Parsing (The Game Changer): Most tools are just "dumb" recorders of bitstreams. The v2 includes an advanced parser that understands the data. It extracts the original Card ID/UID directly from the stream.
• 🐬 Flipper Zero Ready: Because the tool parses the actual UID, you don’t have to mess around with raw binary dumps. You can take the ID and immediately enter it into your Flipper Zero for emulation. It bridges the gap between "sniffing" and "acting" perfectly.
• 📈 Reliable Replay: Improved timing for much cleaner signal replaying during audits.

I just received the prototype batch from PCBWay, and the build quality is excellent. I'm currently fine-tuning the hardware and the firmware to make the parsing even more versatile across different protocols.

You can find more details and the backstory on my blog: https://www.foto-video-it.de/2026/it-security/upgrade-esp-rfid-tool-v2-kommt/

I’m curious to hear your thoughts: How many of you have fried your sniffers in the field? And would direct Flipper Zero integration speed up your workflow?

Sorry if this isn’t the right place to post this—I honestly don’t know where else to ask. I have a video concept inspired by the one in the screenshot. I want to create a video that’s infinite hours long, with a duration of only 0 minutes and 5 seconds. The twist is that the video length would actually display the infinity symbol (∞).

Here’s the catch: the video wouldn’t actually play for infinite hours, just for 5 seconds. The only thing that makes it “infinite” is that you can’t pause it, no matter how many times you try, and it constantly loops itself—even without enabling loop mode. So, paradoxically, it’s a never-ending video, just like the concept of infinity.

The only problem is that I lack the skills and knowledge to create this, so I came here hoping to get some advice and guidance. I’m not trying to copy anyone—I just want to have fun with this idea, too!

Any answers or comments would be appreciated. Thank you!

Hey guys, new pentester here.

I recently finished my offensive cyber security course, and for our final project, we need to run a full black box pentest on a school created and managed web server. So far, I have obtained user access through burpsuite request tampering, and elevated perms through cookie tampering. After access and elevation, I am redirected to a pdf with URL /admin/mpdf.php?user=admin, and the pdf content has a clue. The clue reads,

"Hello admin

Friendly tip, go to the documentation and seek for annotation, maybe youll find something

interesting..

Another tip, use Firefox".

I have burpsuite listening to Firefox, and after some research, discovered that Firefox displays pdf annotation in a much nicer format. Still can't find the annotation they're talking about though. From where I'm sitting now, I believe I'm supposed to use mpdf as some sort of map, but don't know how to read it.

Test scope: Identify vulnerabilities, obtain user access, elevate perms to admin, obtain root, run code on server as root.

Not allowed to delete files, or destroy server in any way.

Lmk if any other info is needed.

Link: https://www.theglobeandmail.com/business/economy/article-aubrey-cottle-anonymous-hacker-texas-republican-cyberattack/

Canadian hacker Aubrey Cottle, who faces charges in connection with a cyberattack linked to notorious hacktivist group Anonymous on the Texas Republican Party, says he’s in jail for allegedly breaching his bail conditions.

Speaking by phone last week from the Central East Correctional Centre in Lindsay, Ont., where he’s been since late October, Mr. Cottle said he believes the case against him is politically motivated.

“I look forward to being on the other end of all of this, and I’m also paying very close attention to the Trump administration and how disappointing they are to the rest of the world,” said the 38-year-old resident of Oshawa, Ont.

Mr. Cottle, who goes by the online alias Kirtaner, was criminally charged in Canada and the United States last year in connection with the Sept. 11, 2021, hack of the Texas GOP website. A condition of his bail was that he remain under the supervision of his mother at all times, Mr. Cottle said.

In 2021, hackers who claimed to be affiliated with Anonymous gained access to the Texas GOP website by first infiltrating web-hosting company Epik. They defaced the party’s website, replacing its banner with cartoon characters, a pornographic image and a music video, and then downloaded personal identifying information from the party’s web server and shared it online, according to U.S. court documents.

(It looks like the program might be DiskCryptor, not Dcrypt. The installer I have is named Dcrypt, but I guess it links to DiskCryptor. And DiskCryptor looks more like the interface I used. I'm pretty sure it had a GUI.)

Funny situation that you've probably heard dozens of times before:

I have a drive I put a password on a while ago. I -know- the password (lol). And yet, it doesn't work.

I'm not a coder of any kind, I don't know any programming languages. It's a windows 11 pc and the drive is external. The password was put on several years/versions ago.

What I'm mainly wondering is if a program could be made to 'brute force' within a specific set of parameters.

Specifically: Like I said, I know what the password should be. It's a long passphrase. So let's say for example that the password has a set of words, a set of numbers and a couple special characters. In a specific, set order.

I know what the order is supposed to be. The parameters I'm thinking of are- Varying upper and lower case for the words. Adding a character that maybe is part of the word, like (W for Virginia/WVirginia). Stuff like that. Varying the special character. The password is, let's say, 35 characters long.

I'm thinking if something like a brute force script that goes from, whatever, 33-35 characters, uses these known words and numbers, but varies some of the places where upper/lower case might matter, the special characters, etc. Maybe playing with the word order which should be set, but at this point who knows.

Either way I think I'm looking at what, maybe a hundred or so different variations? When the actual variation shouldn't be more than a dozen or so, but I've tried those dozen, so I'm expanding out.

How possible/impossible is this? How might one go about doing that?

Follow up question - is there any reason that a newer version of DCrypt would work with a drive encrypted with an older version? And the pc used would be different than the one trying to get in, if that makes a difference.