I'm starting to learn Broken Access Control and need help finding the best rooms and labs on TryHackMe, Hack The Box, PortSwigger Web Security Academy, and other platforms to practise it. I'd also appreciate any additional tips, techniques, and learning resources that have helped others understand and identify these vulnerabilities effectively.

Title sums it up. I know this person is continuing to post about me when l've asked them to stop. Private account.
Anyone willing to follow them for me and send me the screenshot evidence? Preferably a punk rock / motorcycle/ mechanist type feed. Thank you in advance.

I was hacked a month ago and i did changed all the password and 2fa, even resetted the PC window

Now yesterday u got an email about account been locked and i need to verify it, i did and went to sleep. During sleep i got the password reset but now i cant log in.

It shows this and these aren't my emails.

Cant acces ur email isnt working, coz it said like you'll be able to login via that email but when i did it made a bew account.

And the new email req eas rejected in a email saying verification is bad.

What should i do?

Basically my PC was compromised in fake cloudflare redirect when i was working on deploying a test website for the first time. After the project successfully deployed from Vercel, i clicked on the domain, and was instantly rerouted to the fake cloudflare, and immediately got forced to do the CTRL+V on CMD and enter. I said forced, because i couldnt change tabs, i could not get out of the browser full screen, nothing work, so i complied thinking it was cloudflare forcing a security check for the first time you are visitting a new domain.

It was only after a few hours after the site is working properly i started to think about this incident and immediately get ChatGPT assistance to track down what exactly happened few hours ago.

From then on, it was 8 hours of diagnostic (I did unplug the ethernet cable when i realized it) to find out the exact time it happened, the command and logs of what exactly got executed.

After figuring out the whole situation, I had GPT to create a technical write up of the event of what exactly happened and why window failed to scan and detect the malware despite running offline scan as well.

So i contacted microsoft support to inform them and hoping they could make use of the report to fix the vulnerability in the system. But the technical guy asked if I would connect to the network and allowed him to fix the issue. I hestiated, but during the 8 hours, i also changed all my passwords and removed access to all the passkeys, gave him the access and been watching him for a while now.

I showed him where the malwares are, he removed all %TEMPT% files & folders of where the second malware sits. Proceed to install Revo cleaner, remove Python and its related files and registetry and uninstall a few more software on my PC with my permission. (I dont really know why but i assume he's reducing the amount of services/processes)

I pointed out that window defender scan and offline scan initially failed to detect these malware and he assured me that he had removed the files and its registry - "The goal is to ensure the device is as safe and secure as possible by removing suspicious components, reducing potential persistence mechanisms, and confirming there are no obvious signs of the previously identified threat remaining on the system."

Now he's running sfc /scannow then DISM /Online /Cleanup-Image /Restore Health

(Honestly, im still going to remove this (C:) SSD and have it formatted and turn into an external drive, and use a brand new SSD as a replacement C drive. Just want yall thoughts on this

I found a USB drive in a very isolated spot at my school. It has a heart-shaped keychain, and I have no idea who it belongs to.

I haven't plugged it in because I'm concerned it could be a USB Killer, which might physically damage a computer through electrical discharge, or a malicious USB device designed to act as a keyboard and run commands when connected.

Is there a way to determine what kind of device it is and inspect its contents without exposing my laptop or other devices to those risks? I'm curious about what's on it, but I don't want to risk damaging my computer or compromising its security.

I posted the URL and some people replied call med an idiot. I didn't know at the time but researched it and apparently people who copy pasted that URL can get full access to my account? I changed my password just in case but I'm wondering if someone could have used that to compromise my account and if changing the password would have made any difference?

It was a link to a Youtube video.

Thankyou.

Hello everybody!
Recently i've been looking into Meta and i wanted to change my location entirely from it but it seems like it's not as easy.

(*I have NordVPN and I have an iPhone.*)

I changed my location to USA using NordVPN (I live in Europe).
I then reinstalled Instagram, logged in, but it was the exact same country and city as where I currently was.

So when I realized that the VPN didn't work I did some research about this and Meta can supposedly bypass VPN's and many other things.
Im using a second phone, so I don't even have a SIM Card on this phone.
My location services are also off entirely.

I did find out tho that using a VPN browser extension on my PC works.
I also have Nord downloaded on my PC as a program and it still doesn't work as good, but if you use a VPN Browser Extension instead then it works perfectly fine and it changes the location entirely.

Problem with that tho is that you can't really use Instagram on your browser since unfortunately you are limited to lots of things and you can't properly use it but im pretty sure there are ways of hiding your location from IG and other apps on your iPhone.
If you know any ways of fully changing your iphones location please let me know!

Hello. I have a Microsoft account that I’ve had for years, this Microsoft account was at first a gmail account than I made a Microsoft version of it, the handle, completely the same. I recently realize that my Microsoft account was hacked and the Microsoft email was now invalid. I do not know how to fix this and I’m worried. I keep all my information on the Gmail, not the Microsoft account and the passwords are completely different with the Gmail having double security. Is my Gmail doomed or is it just Microsoft that’s screwed? Is there a way to get my account back?

I prefer assistance to just be in the comments just to be wary of scammers.

Few weeks ago my sim got blocked, and I came to know it was because of cyber cell, some of you may know the whole story, as I've posted it earlier...

After sometime my bank account too got blocked and I got to know the reason was that someone sent me the money, that "the person" had the illegal money so I got stuck in the chain.... I got my account unblocked

Now I want to know the actual reason behind the blockage of my sim, where can I know about it ?

I don't want to go to police station or cyber cell

is there any good courses or online resources

I was hacked recently, found my discord and instagram account sending the Mr Beast scam, my main reddit account s*xting other people and telling them to add their telegram (my main reddit is suspended now).

I have changed my gmail, discord, instagram and reddit passwords as those are the ones that were saved on my laptop Chrome.

I’ve also ran a FRST scan and the Lummastealer had been removed.

My laptop battery also just broke right after (a bit too coincidental but yes) so now I can barely use it for 3 minutes whilst charging before it shut downs. So now i can’t really reset/wipe my laptop.

What now? I’m very anxious because I also have my parents banking details on it, my school/education passwords etc.

Would doing a complete factory reset seeing how my battery doesn’t work anymore and the laptop can’t be used, be effective at stopping the program keep accessing my details?

Hello,

So, I downloaded the steam game "Turnout" directly from steam and since recently there have been cases of malware in steam games I decided to use VirusTotal with the executable, wich gave me this flag:

HackTool.AmsiETWPatch .cn
(VirusTotal link: https://www.virustotal.com/gui/file/a5b2d7bfd44a7c83802223bccf43ed901d5d4865a0bea1845c0b591690d9ad65)

I think that it's just a false positive, but I want to have at least a second opinion from someone more knowleadgeble than me.

Thanks in advance!

Sorry if this is a dumb question -

I recently switched all my Gmail 2 step verification from my phone number to an authenticator app because I’m scared of sim swaps lol

But I still have a prompt to add a “recovery phone” number - is that just as much a bad idea as having my number as my 2fa?
Thanks

​

Hi

(I'm minor and Indian)

So like last December, I sent b00b pics to this guy online on snap. Now I can't recall if my face was in the pic or not. He neither saved them in chat nor did he screenshot them. A few days later I saw that his account was no longer active.

\----present-----

I recently added him again and asked him if still remembers me and has my pics. I sent him my face pic and then deleted it quickly, He said he does remember me but doesn't possess those pics.

Later he unadded me. After sometime I added him again and I have been asking him again and again, and he keeps on saying he doesn't even remember my face, and he doesn't have my pics.

I added another account of his. Asked him again, he said no, and got scared.

Idk I'm so scared. What if he had them saved on second device and leaks them or something? What if my face is actually visible in it?

(I'm minor and Indian) I also have screenshots of our recent chats

Ciao a tutti, a partire dal 4 ottobre ho subito attacchi hacker ripetuti in seguito. Avevo provato a scaricare Boodborne per PC e credo che i file di gioco contenessero un trojan. Mi sono entrati ovunque e diffuso foto di MrBeast in tutti i modi possibili. Recuperato sempre tutto, tranne account Linkedin ad oggi bloccato.
Pc formattato oggi alle 14.00 dopo che al mattino mi sono arrivate mail minatorie e di minaccia. Mail non inviatemi, mail scritte da DENTRO al mio account outlook, messe in bozza e poi spostate nella posta in arrivo, contrassegnate e flaggate: così le avrei viste di sicuro.
Non riesco ad uscirne. non so come liberarmi di queste mail. Io le cancello e loro puntalmente ritornano. Le vedo proprio apparire.
Ricevo chiamate, messaggi di transazioni non esistenti e anche i miei genitori hanno iniziato a ricevere telefonate del genere.
Sto andando nel panico.
come posso liberarmi di tutto questo?
Allego un estratto della mail.
penserei di ignorare tutto, ma l'attacco hacker era reale e mi ha costretto a runnare antivirus e formattare. Ci combatto da piu di una settimana.

I was using my iphone 17 pro max and the keyboard sound when typing keeps going on and off with a static sound coming out the microphone, i haven’t dropped or damaged my phone.

i have been hacked before and go accesss piracy websites all for movies too. i don’t know if i should reset my phone

When I was younger, I dated a creepy older guy for about 2 years. Back then, he had a Wi-Fi network named after a pun that is pretty common in my country for wifi networks.

In the two apartments I lived in after we broke up, that exact Wi-Fi name kept showing up under “my networks”. I never thought much of it at the time, assuming other people were just using the same pun.

A few months ago, I moved into a third place, and I just noticed the same network name popping up again. For the first time, I decided to click on it to see if it would prompt me for a password. Not only did it connect automatically without asking for one, but when I checked the password, it was the exact same password he used back then.

What makes this kinda creepy is that over the past 7/8 years, he has repeatedly tried to contact me. At first, I rejected him multiple times, and eventually, I just ignored him completely, assuming it was harmless. Now, seeing this network follow me across three different homes, I am starting to question things

I am still assuming that there is a logical explanation for this but I would love to find out what it is.

This was from a website to log into Asus but the redirect link and email I use to get there was weird. And so that session was an unrecognized device.

Did something bad happened? it's been three days since the incident.

Edit: I should have said that this was a login via Google account

Today morning I've been scammed....just stopped shy of paying money...this one guy reached out and said my account was sending messages like this and told me to contact customer support on Tumblr...foolishly I did And even told my tumblr password to guy who to to change it to his one.

to a guy on Discord...thankfully I didn't tell him gmail password... so my account is somewhat safe but I realised it was a scam when he asked for money...now my account is gone and name is probably changed too...I reported it to tumblr idk if i will ever get my account back....

Did anything like ths happen to you guys? I cannot believe I was so foolish ...I usually am very wary otherwise 💔💔💔💔

What about you guys?

Hey guys,

Looking for some advice.

I started getting a captcha when I opened google chrome incognito tab, saying it wanted me to prove that I was a human and due to getting a lot of traffic from my IP address.

On a whim, I did a full scan and windows defender picked up on this:

Trojan:JS/EtherHiding,CX!ams

The affected items all (3) had similar pathing:

User\AppData\Local\Google\Chrome\UserData\Default\ServiceWorker\ScriptCache

Been really stressed as I’m not sure what it actually means, but the threat was removed and I’ve wiped my chrome’s cookies and data from all time, and also changed all passwords from another device.

Has anyone had a similar issue or have any advice?

Any further actions I should take like fully resetting my laptop?

TIA

Hey there people.

If anyone can help me I'd really appreciate it.

Got this email this morning.

So I tried changing the passkey but it wouldn't let me.

Is this a common thing that happens.

Should I be concerned?

Hi everyone,
I’m looking for advice from people with experience in cybersecurity, iOS security, or WhatsApp account compromises. My husband has experienced some very unusual activity on his WhatsApp account, and we’re trying to understand how it happened and how to prevent it from happening again.
What happened
Last month, his WhatsApp profile picture was changed without his permission to a picture of an Asian woman. Around the same time, his WhatsApp account was blocked for several days, and we started receiving calls from international phone numbers.
More recently, during the night, four WhatsApp groups appeared on his account without him creating or joining them intentionally. He was listed as the administrator, and numerous unfamiliar international numbers were added to the groups, especially numbers from Brazil and Nigeria.
We have found Reddit posts from other users describing what appears to be a very similar pattern, including an unfamiliar Asian woman’s profile picture, suspicious group creation, and reports involving an iPhone 11. This makes us wonder whether others are experiencing the same issue, although we understand that similar symptoms do not necessarily mean the same cause.
What we have done so far
● Changed the phone number associated with WhatsApp.
● Enabled WhatsApp two-step verification and set a PIN.
● Checked WhatsApp’s Linked Devices section; no unfamiliar devices appeared.
● Reviewed the Apple Account and its device list and security settings.
● Started the Apple Account recovery process.
● Began updating the iPhone’s iOS version.
● Contacted WhatsApp support, but we have not received a response.

Hi everyone,
I’m looking for advice from anyone with experience in cybersecurity, iOS security, or WhatsApp account compromise. This happened to my husband, and we’re trying to understand how it was possible and how to prevent it from happening again.
What happened:
During the early hours of the morning, four WhatsApp groups appeared on my husband’s account without his knowledge or permission. His account was listed as the group administrator, and numerous unfamiliar international phone numbers were added, mainly from countries such as Brazil and Nigeria.
We also found reports from other Reddit users describing a very similar situation, including an AI-generated-looking Asian woman’s profile picture, unauthorized group creation, and suspicious activity despite having no unfamiliar devices listed in WhatsApp. Some reports specifically mention the iPhone 11.
What we’ve done so far:
● Changed the phone number associated with WhatsApp.
● Enabled WhatsApp two-step verification and set a PIN.
● Checked WhatsApp’s Linked Devices section. No unfamiliar linked devices were found.
● Reviewed the Apple Account and started its account recovery process.
● Checked the Apple Account’s device list and security settings.
● Started updating the iPhone’s iOS version because several Reddit users suggested that older iOS versions might be involved.
We also contacted WhatsApp support but haven’t received a response.
What we’re trying to understand:
1. How can someone create WhatsApp groups, become or act as an administrator, change a profile picture, or potentially send mass messages without the account owner’s permission when no unfamiliar linked devices are visible?
2. Could this be related to a WhatsApp vulnerability, an iOS vulnerability, SIM swapping, stolen session credentials, or another type of account compromise?
3. Has anyone experienced this exact pattern, especially on an iPhone 11, and found a technically verified solution?
4. Does updating iOS actually address a known vulnerability associated with this behavior, or is that just speculation based on Reddit reports?
5. If the activity returns after updating iOS and securing both accounts, what logs, diagnostic information, or evidence should we collect to help identify the entry point?
We’re not assuming that the iPhone 11 itself is responsible, and we understand that similar symptoms don’t necessarily mean the same underlying cause. We would especially appreciate advice from people who have investigated WhatsApp account takeovers or mobile security incidents professionally.
Thank you for any technical insight or recommendations. We’re trying to resolve this properly rather than repeatedly changing numbers and passwords without understanding the root cause.

I broke it off with my ex when I found out that he was a predator. I did not want anything to do with him just a thought of him around me or talking to me made me sick to my stomach because he could not get me back in August 2018, he hired a professional hacker to hack me also I found out before he left he took pictures of my driver license my Social Security number also my car registration ever since then no matter how many or what kind of phone I got he would have them hacked I have changed my emails so many times I have had so many different tablets and laptops $$$$I also moved so many times $$$$ but he still would find me a while back he got into my phone and erase the SIM cards he did this twice and he would take guys pictures and phone numbers out of my phone he thought were trying to talk to me and then delete them from my phone……. This has to stop I need help. I just want this guy to leave me alone. I do not want him and I don’t want him in my life.

I made a stupid mistake and joined a private Discord server that someone sent me. The server looked legitimate, with over 12,000 members. When I tried to join a voice chat, someone told me I had to verify my account first. I clicked the verification link and received an email with a verification code, but I stupidly didn't check that it was actually a code to access my Microsoft account. I entered that code to verify my account, and they obviously took it.

Within two minutes, they had logged into my Microsoft account, changed my password, and replaced my recovery email address.

The thing is, I barely used that Microsoft account. It had no banking information or anything important saved on it, and my PC is linked to a different Microsoft account that I still own and can access. I also checked all my Gmail accounts, and there were no suspicious login attempts or signs that anyone had tried to access them. They probably don't even know the email addresses or passwords for those accounts.

So my question is can I just continue using my pc and phone like before cause I don't really care about that Microsoft account or I should take some security steps?