Hey all, I'm 24 and about 2-3 months into my first pentesting role. I never advertised experience beyond a few labs, but the lead took a chance on me and told me I'd learn a lot. I expected to start in the SOC, but now I'd never go back. I love this work.

That said, I feel like I'm constantly playing catch-up. I'm working on HTB CPTS alongside the job, but between internal/AD, web, API, WiFi and more, I keep hitting walls.

My first engagement was an internal pentest and I felt like I flopped. I got one hash I couldn't crack, found my user had a MachineAccountQuota of 10 but didn't know about RBCD yet, and found a lot of PII, but no real exploitation.

My company is pretty relaxed on methodology, so I can work however suits me. I just can't find good resources that reflect real engagements. HTB is great, but client environments feel different.

How did you bridge the gap between labs and real internal pentests?

How do you decide what to learn first when everything feels important?

Does the "I flopped my first engagement" feeling ever go away?

I am looking for AI either local or online which will help me create automated scripts and help analyze logs or anything in general which other well known AI don't do. Can you please suggest something?

Which entry-level job for penetration tester, I have a good knowledge in Linux , network, web hacking programming and tool like burpsuit, wireshark and other cli tool but with these knowledge where I mistake to deliver my first job role and what your suggestions and guidance for me .

Hi All,

My manager has asked me to pursue a certification in Mobile Application Penetration Testing, specifically focusing on Android and iOS.

I've come across the eMAPT certification from INE, and I'm considering taking it.

For those who have taken eMAPT or have experience in mobile penetration testing, what are your thoughts? Is it worth pursuing, or would you recommend a better certification that covers both Android and iOS?

I'd appreciate your recommendations and feedback!

Hello,

I am looking to do some certifications since my employer is paying for it, already got OSCP and CPTS. I’ve heard of White knight labs, what’s your experience with it?

Thank you,
Best regards

been working on this for a few weeks. it's a wifi and bluetooth toolkit for the esp32, runs off a single button and a small oled. no pc needed once it's flashed — updates come over wifi from a browser.

whole thing is about $8. esp32 board + oled + a button. that's it.

what it does:

- scans wifi, sniffs probes, reveals hidden SSIDs, shows channel congestion

- WPA2 stuff — PMKID capture, EAPOL handshake capture (hashcat 22000 format), deauth, targeted deauth

- captive portals — karma, rogue ap, 2fa (email/pass then otp)

- BLE spam

- optional nrf24 module for a 2.4ghz RF sweep

- captures save to onboard flash so they survive reboots

controls are just the boot button. short press scrolls, long press selects. that's the whole UI.

repo here if anyone wants to look: https://github.com/eccue/ALIEN-ESP

im self taught and this is my first real project so go easy lol. built with AI as a coding tool but wired and tested everything by hand on my own board.

for authorized testing only obviously. dont be weird with it.

I've been following Commix for a while, and finally seeing an API is huge. The original request goes all the way back to 2016: https://github.com/commixproject/commix/issues/27

I tried both the REST API and the new Burp Suite extension, and honestly, they're fire!

The API lets you launch and manage scans over HTTP, run multiple scans in parallel, monitor results live, and retrieve JSON reports. Lots of possibilities for custom tooling and automation.

The Burp extension takes it to another level. You can launch Commix straight from Burp, watch the scan run, and get confirmed findings as native Burp Scanner issues. No need to keep jumping between Burp and a terminal.

The extension's BApp Store submission is still in progress, but you can check it out on GitHub already : https://github.com/commixproject/commix-to-burp

Definitely worth checking out if you're into bug bounty, security automation, or CTFs.

Big props to the Commix project for this one.

https://glitr.io/blog/reverse-engineering-my-own-project

i wanted to red-team myself on my project and id like to know how to reverse engineer so i can see what can be done to defend against it.

my app is aiming to be fully client-side. things like javascript seem like it would relatively easy for an AI to chew-up, my latest project is in rust, which would make it harder for a person, but AI can digest binaries.

i created a fairly unique p2p messaging app. a Rust-based frontend with a Git-server backend, which can be used to establish a P2P connection. while this version remains close-source, i have aimed to create the most comprehensive documentation (formal-verification and security audits too (all ai generated under my guidance)).

1. https://glitr.io
2. https://app.glitr.io

a core detail to my project is the focus on local-first and client-side cryptography and storage. id wanted to learn how vulnerable this project is to decompilation. i think my older iteration as a javascript webapp would be relatively easy for AI, so i thought id put a spin-on-things by having a rust wasm frontend... i dont think it even slowed it down.

i dont know much about decompiling, but i think the TUI would be the easiest for it to decompile and given its largly one codebase, it can be used to trace and see whats going on the build for the other platforms.

it might be that all close source is obselete. i tried asking here, and the responses there are polar opposites, so i decided to get some first-hand experience.

im using using cursor composer 2.5 (far from the frontier models available). i used https://github.com/morluto/rea and gave it a few binaries of my project (tui, apk, web) and pointed it to the documentation on the website.

after a few prompts, it seems to have done a decent job decompiling the project here: https://github.com/positive-intentions/glitr-decompiled (note: this is basically AI-slop). like with many projects, i see AI lacks taste in architecture. it consolidates a lot of complexity into one repo, when in my project it's split into multiple repos. it also seems to lack a bunch of bells and whistles i added for my own benefit like formal verification and rigorous unit-tests (having done it myself before, i dont think that is a large gap to fill for somone who knows what they are doing). i think the overhead to keep up with new changes may become trivial if you can automate the process. i kinda offer the base in the repo above (maybe it saves you a few tokens?), but its for my own research and i dont plan to maintain it given it undermines the actual project.

in general, im impressed. it seems this may push forward my timeline for when i open source my project, i wasnt expecting close-source being so easy to undemine. while the project can be decompiled, in a project like this, its important to consider the countless nuances there are in cybersecurity. the code is only a part of the project.

(note: feel free to try decompile this yourself or offer tips on how i can improve. id be keen to see what can be done. feel free to reach out for clarity about how it works within the limitation of the original source code not being used)