Which entry-level job for penetration tester, I have a good knowledge in Linux , network, web hacking programming and tool like burpsuit, wireshark and other cli tool but with these knowledge where I mistake to deliver my first job role and what your suggestions and guidance for me .

Hey all, I'm 24 and about 2-3 months into my first pentesting role. I never advertised experience beyond a few labs, but the lead took a chance on me and told me I'd learn a lot. I expected to start in the SOC, but now I'd never go back. I love this work.

That said, I feel like I'm constantly playing catch-up. I'm working on HTB CPTS alongside the job, but between internal/AD, web, API, WiFi and more, I keep hitting walls.

My first engagement was an internal pentest and I felt like I flopped. I got one hash I couldn't crack, found my user had a MachineAccountQuota of 10 but didn't know about RBCD yet, and found a lot of PII, but no real exploitation.

My company is pretty relaxed on methodology, so I can work however suits me. I just can't find good resources that reflect real engagements. HTB is great, but client environments feel different.

How did you bridge the gap between labs and real internal pentests?

How do you decide what to learn first when everything feels important?

Does the "I flopped my first engagement" feeling ever go away?

Hi All,

My manager has asked me to pursue a certification in Mobile Application Penetration Testing, specifically focusing on Android and iOS.

I've come across the eMAPT certification from INE, and I'm considering taking it.

For those who have taken eMAPT or have experience in mobile penetration testing, what are your thoughts? Is it worth pursuing, or would you recommend a better certification that covers both Android and iOS?

I'd appreciate your recommendations and feedback!

I've been following Commix for a while, and finally seeing an API is huge. The original request goes all the way back to 2016: https://github.com/commixproject/commix/issues/27

I tried both the REST API and the new Burp Suite extension, and honestly, they're fire!

The API lets you launch and manage scans over HTTP, run multiple scans in parallel, monitor results live, and retrieve JSON reports. Lots of possibilities for custom tooling and automation.

The Burp extension takes it to another level. You can launch Commix straight from Burp, watch the scan run, and get confirmed findings as native Burp Scanner issues. No need to keep jumping between Burp and a terminal.

The extension's BApp Store submission is still in progress, but you can check it out on GitHub already : https://github.com/commixproject/commix-to-burp

Definitely worth checking out if you're into bug bounty, security automation, or CTFs.

Big props to the Commix project for this one.

https://glitr.io/blog/reverse-engineering-my-own-project

i wanted to red-team myself on my project and id like to know how to reverse engineer so i can see what can be done to defend against it.

my app is aiming to be fully client-side. things like javascript seem like it would relatively easy for an AI to chew-up, my latest project is in rust, which would make it harder for a person, but AI can digest binaries.

i created a fairly unique p2p messaging app. a Rust-based frontend with a Git-server backend, which can be used to establish a P2P connection. while this version remains close-source, i have aimed to create the most comprehensive documentation (formal-verification and security audits too (all ai generated under my guidance)).

1. https://glitr.io
2. https://app.glitr.io

a core detail to my project is the focus on local-first and client-side cryptography and storage. id wanted to learn how vulnerable this project is to decompilation. i think my older iteration as a javascript webapp would be relatively easy for AI, so i thought id put a spin-on-things by having a rust wasm frontend... i dont think it even slowed it down.

i dont know much about decompiling, but i think the TUI would be the easiest for it to decompile and given its largly one codebase, it can be used to trace and see whats going on the build for the other platforms.

it might be that all close source is obselete. i tried asking here, and the responses there are polar opposites, so i decided to get some first-hand experience.

im using using cursor composer 2.5 (far from the frontier models available). i used https://github.com/morluto/rea and gave it a few binaries of my project (tui, apk, web) and pointed it to the documentation on the website.

after a few prompts, it seems to have done a decent job decompiling the project here: https://github.com/positive-intentions/glitr-decompiled (note: this is basically AI-slop). like with many projects, i see AI lacks taste in architecture. it consolidates a lot of complexity into one repo, when in my project it's split into multiple repos. it also seems to lack a bunch of bells and whistles i added for my own benefit like formal verification and rigorous unit-tests (having done it myself before, i dont think that is a large gap to fill for somone who knows what they are doing). i think the overhead to keep up with new changes may become trivial if you can automate the process. i kinda offer the base in the repo above (maybe it saves you a few tokens?), but its for my own research and i dont plan to maintain it given it undermines the actual project.

in general, im impressed. it seems this may push forward my timeline for when i open source my project, i wasnt expecting close-source being so easy to undemine. while the project can be decompiled, in a project like this, its important to consider the countless nuances there are in cybersecurity. the code is only a part of the project.

(note: feel free to try decompile this yourself or offer tips on how i can improve. id be keen to see what can be done. feel free to reach out for clarity about how it works within the limitation of the original source code not being used)

I am looking for AI either local or online which will help me create automated scripts and help analyze logs or anything in general which other well known AI don't do. Can you please suggest something?

Hello,

I am looking to do some certifications since my employer is paying for it, already got OSCP and CPTS. I’ve heard of White knight labs, what’s your experience with it?

Thank you,
Best regards

Hi,

I'm taking the OSAI course and just way out my depth here, looking for a tutor that can help me understand the course and work through some of the challenges, I also need to learn to build an AI Harness for attacks for the challenge labs as well.

been working on this for a few weeks. it's a wifi and bluetooth toolkit for the esp32, runs off a single button and a small oled. no pc needed once it's flashed — updates come over wifi from a browser.

whole thing is about $8. esp32 board + oled + a button. that's it.

what it does:

- scans wifi, sniffs probes, reveals hidden SSIDs, shows channel congestion

- WPA2 stuff — PMKID capture, EAPOL handshake capture (hashcat 22000 format), deauth, targeted deauth

- captive portals — karma, rogue ap, 2fa (email/pass then otp)

- BLE spam

- optional nrf24 module for a 2.4ghz RF sweep

- captures save to onboard flash so they survive reboots

controls are just the boot button. short press scrolls, long press selects. that's the whole UI.

repo here if anyone wants to look: https://github.com/eccue/ALIEN-ESP

im self taught and this is my first real project so go easy lol. built with AI as a coding tool but wired and tested everything by hand on my own board.

for authorized testing only obviously. dont be weird with it.

Would you consider the lack of client isolation on a guest WiFi network a valid finding during an internal network penetration test?

I'm curious how other pentesters approach this and what severity you would typically assign, assuming connected guests can communicate directly with each other.

I am a relatively new grad pentester, 23 with about 1.5 yoe. I pretty much run the whole process from scoping/kickoff to readouts. I make 75k.

If y’all are comfortable, could y’all drop your stats below.

YOE:
Title:
Salary:

Hey everyone! I've been working on OWASP Hunting, an open-source project for security researchers and penetration testers.

Feel free to explore the project, use it in authorized testing, and contribute!

🔗 OWASP: https://owasp.org/projects/hunting
💻 GitHub: https://github.com/OWASP/OWASP-Hunting

Feedback and contributions are welcome!

Hi there,

I recently got my first tech/cyber role out of college in threat intel/vulnerability management. It took me 18 months to get a role but it pays well ($83k) starting out. Honestly I’m very proud of myself because I’m essentially self-taught, and was able to get through a pretty rigorous interview that went super in-depth on web-app vulnerabilities.

My main goal is to get into pentesting. So far I’ve been doing web security labs through PortSwigger, completed the CPTS path on HTB (taking the exam in December), and publish writeups on my solved boxes on Medium. I also go to local security meetups, though I haven’t turned that into any direct industry connections yet.

After CPTS I’m planning to go for CRTO/OSCP, and eventually GWAPT since web app testing is a smaller part of my current role and my employer covers the cost of GIAC certs.

I’m planning to stay in my current role for another year or two to build up more experience and finish CPTS/OSCP before I start applying — want a stronger resume and more runway before I make the jump. Does that timeline make sense, or should I be applying sooner/in parallel?

Any other advice is welcome. Thanks!

Hey everyone,

I've been working on a project called PenX, an open-source security reconnaissance toolkit for Windows 10/11.

It's based on the original METATRON project, which was designed for Linux. I wanted something similar that runs natively on Windows, without having to set up Kali, WSL, or a separate Linux VM just to use a few reconnaissance tools.

So I've been porting and expanding it.

PenX basically brings several security tools together in one terminal interface:

• Nmap – Port scanning and service discovery
• WhatWeb – Web technology fingerprinting
• Nikto – Web server vulnerability scanning
• WHOIS & DNS – Domain reconnaissance
• HTTP Headers – Basic security header analysis
• Local AI – Analyze scan results using your own LLM
• PDF/HTML Reports – Export findings
• Scan History – Store and review previous results locally

The part I find most interesting is the local AI integration.

You can connect PenX to Ollama or LM Studio and use whatever compatible model you have running locally. The model can analyze reconnaissance results, suggest potential security issues, and recommend fixes.

No OpenAI subscription or paid API is required.

I've also added SQLite support, so there's no need to configure MariaDB just to get started.

For Windows, there's an installer that handles the Python environment and helps set up the external scanning tools. You can also build a Windows executable using PyInstaller.

It's still an ongoing project, and there are definitely things that need improving, especially around compatibility, reliability, and the AI analysis workflow.

I'm not trying to replace Nmap, Burp Suite, or other established tools. The goal is simply to make reconnaissance and initial security assessments more convenient, especially for people running Windows.

GitHub: https://github.com/SLP-DEV1/PenX

Everything is open source under the MIT license, with credit to the original METATRON developer.

I'd be interested to hear what you think. What features would actually make something like this useful in your workflow?

Bug reports, suggestions, and contributions are welcome.

If you like the project, feel free to leave a star on GitHub. It helps a lot!

For authorized security testing and educational use only.

I just completed Red Team Fundamentals room on TryHackMe! Learn about the basics of a red engagement, the main components and stakeholders involved, and how red teaming differs from other cyber security engagements. https://tryhackme.com/room/redteamfundamentals

Recentemente, descobri ferramentas de busca como o DeskData e o Portal Neonara, mas percebi que seus custos são um pouco elevados.

Gostaria de saber se existem alternativas gratuitas ou de código aberto que ofereçam funcionalidades semelhantes. Se alguém conhecer alguma ferramenta desse tipo, agradeço pelas indicações e por compartilhar suas experiências!

I've been working on it for quite some time now, it's a desktop toolkit for web application and API pentesting where I tried to put most of what I normally use during an assessment in one place.

It's basically a traditional HTTP/HTTPS and WebSocket proxy but I've added quite a few things like request replay, automation workflows, endpoint discovery and findings linked to the captured traffic. I also integrated an MCP server so tools like Claude code and Codex can directly interact with the captured traffic and perform some testing.

I added an interactive demo directly on the homepage so you can actually try the interface without having to download or install anything.

https://ogmabox.com/

I'm the developer so obviously I'm biased but I'd really appreciate some feedback from people who use Burp Suite or Caido regularly especially what you think is missing or could be improved

This is going to be an odd question but recently I’ve been tasked with doing some voice-based social engineering. I have my scenario and all my infra ready to go, but my nerves are getting the best of me before making the calls effectively paralyzing me. What are your tips/tricks for getting more comfortable there and overcoming that?

I'm rn starting cisco's course of intro to cybersecurity nd will also be starting a networking course.I've also done some thm and htb but like i forgot many things I learnt from it,so should I make notes for the things I study??Anything apart than this?Genuine help needed

I built a free agent protocol inspector tool that can provide IGA style review packets for security teams looking to review Agent access. It looks into MCP, A2A, ARD & poppy.json to provide a comprehensive picture.

Here is the link: https://contextiq.trango-compute.com/dashboard/agent-protocol-inspector

Hey everyone!

I'm Daniel, the developer behind NetCatTest and CatSuite, an Android application I've been building for web application security testing.

One question I've been exploring throughout development is:

How much of a real web pentesting workflow can be performed directly from an Android device?

I'm not talking about running a basic vulnerability scanner or checking whether a website is online. I'm talking about actually interacting with HTTP traffic, manipulating requests, testing parameters, analyzing APIs, and documenting findings.

That's what led me to develop CatSuite.

The application currently includes:

• HTTP/HTTPS interception: Capture, inspect, and modify requests and responses.
• Repeater: Manually modify and replay HTTP requests.
• Intruder: Test payload positions, parameters, and custom wordlists.
• Endpoint discovery: Enumerate directories, files, and API endpoints.
• HTTP fuzzing: Test different inputs and analyze application responses.
• Built-in browser: Inspect DOM elements, cookies, storage, and network traffic.
• JWT and SSL/TLS analysis: Inspect authentication tokens and certificates.
• JavaScript extensions: Extend functionality with custom scripts.
• Evidence export: Export HTTP traffic and testing results.

One workflow I particularly wanted to support was:

Browse → Intercept → Modify → Replay → Fuzz → Analyze

All from an Android device.

Of course, I'm not suggesting that a smartphone should replace Burp Suite, Caido, or a full desktop pentesting environment.

But I do think there's an interesting use case for portable security testing, especially when you need to quickly inspect an API, reproduce a request, validate a finding, or investigate unexpected application behavior.

CatSuite is currently available for free on Google Play.

Project: https://netcattest.com/catsuite

Google Play: https://play.google.com/store/apps/details?id=br.com.netcattest.catsuite.app

I'm particularly interested in feedback from people who perform professional web application pentests.

Would you actually use a mobile pentesting toolkit during an engagement? If so, which capabilities would make it useful enough to become part of your workflow?

I'm continuing to develop the application independently, and technical criticism is just as valuable to me as positive feedback.

Thanks for reading!

CatSuite is intended for authorized security assessments, personal labs, and educational environments.

Just wanted to ask the more experienced web app pentesters here for some advice.

I've studied web app pentesting through courses like CWES and others, so I'm familiar with different vulnerabilities and exploitation techniques, but I know studying them and actually testing real-world applications are two different things.

I have a few questions:

1. What are the most important things to keep in mind when doing a web app pentest? What are some things you wish you knew when you were starting out? Any common mistakes beginners tend to make?
2. How do you guys actually approach a web app pentest? Do you start by manually exploring the application and checking requests in Burp, or do you use automated tools early on? Just curious about your usual workflow.
3. When do you actually use Burp's active scan? Do you run it after manually testing everything, or do you use it throughout the engagement? I know it can help find vulnerabilities, but I'm curious how much you guys rely on it.
4. Is it safe to run active scans against production applications? This is something I'm a bit unsure about. Since active scans send payloads to test for vulnerabilities, couldn't they potentially modify or delete data or even affect the application? Do you guys run them on production, or do you usually avoid them unless specifically approved by the client?
5. What about Burp's passive scanning and audit features? Are there any features or settings you avoid using on production environments? I'm still trying to understand which tools are safe to use during normal testing and which ones require more caution.
6. What separates a good web app pentester from someone who just knows how to find common vulnerabilities? Is it mostly experience, understanding business logic, testing access controls, or something else entirely?

Would appreciate any advice from people who've been doing this for a while! Just want to get a better idea of how things work in actual engagements instead of relying too much on what I've learned from courses. Thanks!

My company has never performed or had a PenTest done, in our preparation to become NIST compliant I’m looking for some guidance/advice. We want to do a technical PenTest keeping it in house for not just financial reasons but for my experience. The company is completely fine with me doing the PenTest but I’m not confident on where to start or how I should approach it. Any help pointing me to free tool kits or not insanely expensive ones and some guidance on the plan would be greatly appreciated

Built an open-source Contextual Threat Modeler (CTM) for security findings

Hey everyone! 👋

I've been working on Contextual Threat Modeler (CTM), an open-source cybersecurity project that helps turn vulnerability scan findings into more context-aware risk assessments.

🔍 What CTM focuses on:

\- Ingesting security findings from scanner reports

\- Context-aware risk scoring based on exposure, asset criticality, and other factors

\- STRIDE and MITRE ATT&CK mapping

\- Attack-path analysis to help prioritize risks

\- Analyst-oriented CLI output

The goal is to go beyond severity labels and help security analysts understand which findings deserve attention first.

I'm continuing to improve the project and would appreciate feedback from the community, especially on the risk-scoring logic, architecture, and features that would make it more useful in real-world security workflows.

Thanks for checking it out!