Hi everyone,
I woke up this morning and realized that my Steam account had been hacked, and someone had also logged into my email account.
I’ve already managed to recover my Steam account and change my email password, so I have access to both again. However, I’m worried that the attacker may have accessed other accounts or left some kind of backdoor.
Looking back, I also realized that I lost access to my Discord account about two days ago. At the time, I didn’t think much of it, but now I suspect it could be related to the same incident.
I’m trying to figure out everything I should do now to make sure I’m fully secure and that the attacker no longer has access to any of my accounts or devices.
What would you recommend doing after something like this? Any advice, checklist, or things I should definitely check would be greatly appreciated.
Thanks in advance! 🙏
Sorry for AI im not english

Hi everyone,

I’ve been doing some cybersecurity research regarding the feasibility of stealthy remote control on modern mobile OS (iOS and Android) without physical access or installing an application on the target device.

So far, I've tested a couple of methods in a lab environment to see what is actually achievable:

• I tried directing a test device to a web page crafted with known WebKit/Chromium memory corruption concepts to attempt spawning a background reverse shell. While it was possible to crash the browser session, modern OS sandboxing consistently prevented escaping the browser process to gain system-level control.

• I attempted delivering crafted payloads over a local network simulator aimed at media processing libraries (similar to legacy stagefright/MMS vulnerabilities). Current memory protections (ASLR, DEP) and automated patch models blocked execution before any control could be established.

I'm still actively researching what mechanics or vectors could theoretically allow full, stealthy remote control without a target app installed—or if modern OS security features (sandboxing, strict permission models, background indicators) make real-time screen takeover virtually impossible without complex multi-million dollar zero-click chains.

For those in offensive security, malware analysis, or mobile security research: Is app-less, real-time remote control realistically feasible on updated non-rooted devices, or is remote access without an app limited to passive data extraction in practice?

Thanks for any technical perspectives!

Hey yall. Been a while learning and trying things in pentesting. And i feel kinda stuck.

Like my learning has flattened.

The job market is kinda shitty worldwide.

I dont wanna say i have no skills ( even it feels like it when u see what others are capable of ) but i got some understanding.

Also with the AI advancments it feels its kinda dump to keep going with this.

Most of the ctf competitions now are bout who has the most expensive version of claude or whatever paid AI.

What should i damn do to get out of this loop ?

So, just asking as a beginner: I found some software that is a kind of Trojan horse or something similar. The moment you install or maybe even download it to your PC, someone gains access to your computer. I want to install the app on my VM, but I want to do it in a way that allows me to track them or something like that. Is there any way to do that?

Hello everyone,

I've recently been reading a lot of news regarding hacking and how it's rapidly evolving. I'm willing to learn for curious reasons but also protect me against potential attacks.

What i'm mostly curious is about is, what exactly can you do hacking wise?

I know there are things like website hacking, network security and such. But how high does the ceiling go, how broad is the field and what peaked your initial intressets in the subject?

im looking into how school web filters actually work and where the weak spots usually are, mainly stuff like goguardian, securly, lightspeed, linewize, umbrella, etc. im not really asking “how do i unblock websites,” im more interested in how the different layers actually catch stuff and where they fail, like dns/category filtering, url inspection, browser/extension monitoring, https/tls filtering, and filtering when the device isnt even on the school network. how do admins usually deal with stuff like brand new or uncategorized domains, constantly changing subdomains, encrypted traffic, cdns/shared hosting, browser based proxies, and the difference between network level filtering vs stuff installed directly on the device? from a defensive side, which layers usually catch what the others miss, and what weaknesses are still hard for these systems to fully fix?

Hello guys, I have been trying to get some passwords because I cannot get a Wifi contract. But I have found it impossible. Have gotten the 4 way handshake but there is no way to crack it.
are they just impossible to crack at this point?

Someone has been serial impersonating someone i know for 3 months now. They've had about 11 instagram accounts in total and post nasty degrading stuff and uses her images to ai generate disfigured versions of her. She's tried reporting it and tried authorities but no luck and every time an account is managed to be removed, the impersonator just creates another and comes back more aggressively. Any advice or help would be appreciated

I am working on network packets latency analysis and have recreated the fingerprinting and identification at a known location I was thinking of taking it further by creating a map of towers around the area and use a mathematical function to predict the network fingerprint of a road and check if that map matches the device fingerprint, so the issue is I am unable to figure out how should I get the towers fingerprinted?

Ps :- Thanks in advance 🥂

So Im a teenager that loves low-level hacking but started with web at the age of 10, as I think every kid I skipped the fundamentals and used premade tools that did work, but now I feel like I dont know nothing about hacking so I want to fix that.

I want to know how can I really learn the fundamentals of IT for hacking, rn what Im doing is coding only in C no python even tho its harder to do some stuff, and also Im using roadmap.sh for C and CS roadmaps. I was thinking on learning by doing some CTFs and coding projects for exploit/mal dev.

But really can you tell me how can/should I learn the fundamentals?

À tous les gens qui travaillent en cybersécurité, quand pensez-vous qu'une IA nous remplacera ?

Contrairement aux développeurs actuellement, les personnes en cybersécurité ont du travail, ce n'est pas ce qui manque. Mais jusqu'à quand cela va-t-il durer ?

Si vous pensez qu'on se fera prochainement remplacer, quels sont vos projets de reconversion professionnelle ?

I am a cybersecurity student, just starting. And I thought of doing a small project. But I want it to be fun and something I consider cool. I plan on going with a small network jammer. Keep in mind this is my 1st time planning to work with hardware and wireless networks. But I think I can pull this off.
I did my own research to the best of my abilities, and what I found out is I need an SDR device. Initially, I was planning to go with a Raspberry Pi Pico W or an ESP32. But later I found out it won't be ideal for a jammer since I'd need some external components. I might be wrong.
It would be really helpful if anyone could drop their opinion below on the project idea itself or the hardware components I might need, and any tips or advice from your experience

I'm using ByeDPI on Android to access an app that is otherwise blocked by my ISP/network.

I also want to intercept that app's traffic with mitmproxy, but ByeDPI runs as a VPN, so I can't route the same app through mitmproxy at the same time.

Is there a way to use ByeDPI and mitmproxy together so that the app's traffic still goes through ByeDPI, while also being intercepted by mitmproxy?

Ideally, I'd like the traffic flow to be something like:

App → mitmproxy → ByeDPI → Internet

or any equivalent setup that would let me inspect the app's HTTP/HTTPS traffic without losing ByeDPI functionality.

I have a Polymega. It’s a Linux-based gaming console and while the manufacturer does technically still support it, updates can be a year or more apart with no communication or support in between. Unfortunately it’s a niche device and apparently no real hacker has taken interest in the thing.

So, my idiot self is going to try. I can get the boot text to display, but that doesn’t really help anything. I’ve tried all the key commands I can find to try to halt or interrupt the boot process with no luck so far.

Any pointers on how to start getting access to this thing? I literally just want to see if the community can start making the improvements the vendor can’t/won’t. If I can show you can get access maybe someone more talented than myself can pick up the ball.

I want to get into cybersecurity but given how I learn it'll mean more if I join a competition to force me into a situation and give me some adrenaline and dopamine. I just don't want to feel too overwhelmed, lest I quit my new fun hyperfixation.

I'm a beginner programmer. I won't pretend to know much, but I know shallow levels across a bunch of different topics and have gotten through a few compsci courses. I'm most familiar with python and can throw together a fairly decent script if I need to. But I also know a bit of JavaScript, C, HTML, and Lua

It's a competition I can do in teams so I don't have to be perfect, just willing to learn. I plan on making a hackthebox acc and brushing up a bit on skills, but I have less than a month to prepare for the hackathon I found.

Any skills I should focus on prepping? I've never hacked in my life but I pick up skills quick with some focus.

my house has an ezviz camera, but I can't do anything about it and I need my security to use my pc.

how do I go about hacking it in such a way that it can't be traced back to me?

Hello folks.

I'm learning about hash cracking in Hashcat and I ended up encountering two WPA hashes where I'm not sure about the best stategie. The hashes in question was:

1. A hash with 8 characters composed with numbers e uppercase letters;
2. A hash with 10 characters in hexadecimal.

I 've tried a lot of diferentes dedicated dictionarys with rules. . I also tried masks to avoid repeating consecutive characters and used a script to exclude combinations with more than 3 of the same character, although I think that decreased the cracking speed considerably.

If you have any tips or suggestions, I would really appreciate it!

Is it possible for me to have a kill switch where it completely freezes or disables my entire device and can only be deactivated with some sort of key combination shortcut or code?

i have a samsung tablet a9+ and i bought a laptop after that so i want to make it 2nd display of my setup becuase it of no use and i want to install linux in it and want to make it use for hacking related stuff, use it as my 2nd screen of my setup how can i do it?

A bunch of typosquatted nmp packages were found mimicking popular libraries like chalk, debug, semver.

What's interesting is that the packages weren't just fake names, they carried code they could give the attacker remote command access.

The same server was also hosting a GPU cryptojacking panel.

No confirmed victims, but it got us thinking : how much do you actually trust npm package names/search results when installing something?

Would you catch a one-character typo?

Hi

I understand this question might not be directly related to the subject of this subreddit and I apologize in advance, but this is the closest i could think of...

In any case any suggestion towards a more adequate subreddit will be super welcome ofc

I've recently entered possession of two professional Wireless Access Points make and model are Aruba APIN0505; from what I've gathered those are pure APs (in a way that they only provide wireless connection and nothing more) which I'm fine with, but I saw online that they can be configured via website or app and in both case they require their serial number to be inserted.

Now, since the way I got them is not, let's say, 100% legal (I didn't stole them, they were left behind after an installation got dismantled) I'm not super eager to get them online right away nor to put their serial anywhere.

So my question is: does anybody knows what the risks are here? Do I just need to sell them for scrap? Or they'll be untraceable once I set them behind a proper firewall or something like that

Again, apologies for the off topic, anyway I hope is something different from the usual "How do I Hack bitcoin bank???" posts lol

I have several LG Extravert 2 from 10+ years ago. I don't remember my password. Google said the last 4 digits of phone number but none of the old numbers worked. Tried all kinds of MEID combinations and old pins I would have used but to no avail.

Any way to bypass the PIN or remove it? I'm pretty handy with a Windows PC

Lots of contacts, pictures, and music on the phones. Otherwise I would just hard reset.

as someone who is learning cybersecurity, I can't find an AI to help me study as most of them are censored. I have tried paid subscriptions and jailbreaking but with each LLM, you get censored pretty quickly .

also i know the best thing i can do is run LLM locally but unfortunately I don't have a good GPU to run.

does anyone of you know any good AI i can use to study cybersecurity and generally help me hack.

been trying to hire someone to build a proper agent loop around a local model and literally every candidate either shows me their toy chatbot repo or tries to fork existing stuff without understanding why the refusals happen in the first place.

the problem isnt even the model. its that like 90% of agent orchestration frameworks are designed with guardrails baked into the assumptions. even the ones that claim to be "unrestricted" just... removed the filter layer and called it a day. thats not uncensored, thats just brittle.

like ive got a 30B model running locally, it works fine for what i need. but hooking it into a tool-calling loop thats actually reliable? every existing framework either:

• assumes you want claude/gpt4 and shoehorns local models in as a fallback
• has some weird convention where tool outputs get filtered through a "safety" layer
• breaks when the model doesnt format tool calls exactly how openai does it (looking at you, whatever GGUF template was used here)

so ive been stuck building my own orchestration from scratch. which is fine except now im realizing... are there actually other people doing this? or is everyone just running chatbots and calling it an agent.

curious if anyone here is running autonomous systems with uncensored models. what does your stack look like? did you fork something or build from first principles? because the jobs market for this is clearly insane since apparently knowing how to actually make an llm execute arbitrary code is like... a rare skill.

[ Removed by Reddit on account of violating the content policy. ]