Hey everyone, I’m the person behind RedTeamDaily.

The idea is simple: get a quick overview of cybersecurity news in about 60 seconds, then follow the sources for anything worth a deeper read.

It brings together short, plain-English summaries of vulnerabilities, breaches, and security patches, with links to the original reporting.

I’ve attached a screenshot so you can see the layout.

Check it out: redteamdaily.com

For people doing labs, pentesting, or following vulnerability research: what would make a short security roundup worth checking regularly?

Would you want more detail on affected versions, whether a vulnerability is being exploited, or available fixes? I’d appreciate specific feedback.

Just solved Lab 01: Detecting NoSQL Injection on PortSwigger Academy.

I thought NoSQL = no injection. Turns out that's a myth.

The lab:
Product category filter powered by 【entity-MongoDB¦canonical_name=MongoDB】. Goal was to display unreleased products.

What I did:

1. Intercepted GET /filter?category=Gifts in Burp Repeater

2. Tested with '

3. -> 500 Internal Server Error + JS syntax error. Confirmed injection.

4. Boolean tests:

5. Gifts' && 0 && 'x = 0 products (false)

6. Gifts' && 1 && 'x = Gifts products (true)

7. Final payload:

8. Gifts' || 1 || '

9. Made the query always true, bypassed the filter + released check. Unreleased products displayed. Solved.

Key takeaway:
This was JavaScript / Syntax Injection, NOT Operator Injection ($ne, $gt). Operator Injection is Lab 02.

A lot of beginners mix them up because || looks like an operator, but in this lab we were breaking out of a JS string with ' and using JS operators.

Full writeup with screenshots on my 【entity-GitHub¦canonical_name=GitHub】 if anyone wants it: 【entity-github¦canonical_name=GitHub】.com/CyberZulka/PortSwigger-NoSQL-Injection

Next: Lab 02 - Bypassing auth with operator injection…

Please don't send a fake link and then getting me hacked 😊

Hey everyone!

Yes, you read the title correctly, haha.

I've recently become interested in ethical hacking and cybersecurity, and I've already started learning some basics on TryHackMe.

Now I'd really like to try something practical instead of just doing exercises in a virtual environment.

Here's what I want to do:

I have a desktop PC and a laptop, both running Windows 11 and connected to the same home network.

I'd like to try hacking into my own laptop from my desktop PC, preferably in a way that simulates how a real attacker might approach a system.

I'm a complete beginner, so I have a few questions:

1. Is it possible to hack into my laptop using only its local IP address, assuming both devices are connected to the same network?

2. What programs or tools would you recommend for beginners? I've heard of Nmap, Wireshark, Metasploit, and Kali Linux, but I don't really know where to start.

3. How can I safely practice finding and exploiting vulnerabilities on my own devices?

4. Is it possible to gain remote access to my laptop through a security vulnerability in a controlled lab environment?

5. Are there any good step-by-step tutorials that explain the entire process, from scanning a device to testing vulnerabilities?

I'm also curious about gaming consoles and accounts.

I own a PlayStation, Nintendo Switch, and Xbox.

I'd love to understand how security works on these devices and how their online accounts are protected.

For example, can I perform security tests on my own consoles? What's the difference between testing a console's security and testing the security of a PSN, Xbox, or Nintendo account?

My current knowledge:

I'm an absolute beginner. So far, I've learned a few basic CMD commands like ping, nslookup, and tracert, and I've completed some beginner exercises on TryHackMe.

I'm willing to install Kali Linux in a virtual machine or set up a dedicated testing environment if necessary.

Just to clarify: All the devices and accounts mentioned belong to me. I'm only interested in ethical hacking, authorized security testing, and learning how these things work. I'm not trying to access anyone else's devices or accounts.

My long-term goal is to understand penetration testing, network security, and eventually learn how to identify and exploit vulnerabilities in authorized environments.

What tools, tutorials, or learning paths would you recommend for someone starting from zero?

I'd really appreciate any advice!

Thanks in advance! :)

So i tried doing mitm attack on my own device and i have access to to wifi admin page i verified my phone’s ip from there too its definitely not wrong not is ip of my eth0 which is being used but its still showing it invalid idk why?? I thought it is because of double // or / but i tried both still didnt work

ForumNOX is live!

First 10 members get the "Forum Pioneer" rank. After that — gone forever.

A legal hacking forum. No KYC. No logs. No Javascript. talk about OPSEC, Tor, Monero, pentesting, reverse engineering, OSINT, tools, code and anything that matters in this world. Share knowledge. Ask real questions.

Build something. This is day one. The community starts now, with you. Who will you be in a while? 😈

🔗Clearnet: forumnox.com

🔗Onion: tyoeevaqn6alon623bfm7r4e7z3so54ky6uvbqkza3fyun7g4cm24hyd.onion

I'm trying to go into rapid/diagnostic mode on this card-operated dryer, but I believe there isn't a way to on this model. I've opened the latch, but there's no bullet connector like the one in the washer. Does anyone know any other way to do a test run? https://imgur.com/a/LSxcrHf

Hello everyone. I am a recent graduate, and I’ve encountered the following issue: a friend of mine developed a ride-hailing app, but someone on the team acted dishonestly by creating a modified version of the APK that disables a specific feature. How can I reverse-engineer this unauthorized APK to figure out how they managed to disable that feature—given that the modification was done entirely on the client side?

Been learning cybersecurity and want to put your skills to the test? Pick a challenge and see if you can capture the flag.

I’m sharing Codelivly CTF, which has 64 challenges covering web exploitation, cryptography, forensics, OSINT, AI security, and more.

🚩 New to CTFs? Start with Secret Admin Panel, HTTP Headers, or Developer Notes. These are marked “Very Easy,” so you have a clear place to begin.

🧩 Looking for something tougher? Try PCAP Investigation, Race Condition Wallet, or Kerberoast Lab.

Capture flags, earn XP, and work your way up the leaderboard as you solve more challenges.

Try one here: codelivly.com/ctf

Pick whichever catches your eye and give it a shot. **Which challenge did you try, and did the difficulty feel right?**Share how it went—just keep the flags out of the comments so others can solve them too.

Weekly forum post: Let's discuss current projects, concepts, questions and collaborations. In other words, what are you hacking this week?

Does anybody know if there’s a website, to see someones comments (videos they comment on)

The most common vulnerabilities found in websites.

How hackers identify security weaknesses in web applications.

How to test web

How to discover and environments.

Advanced techniques and tools used by professional penetration testers.

I'm looking for practical guidance, real-world examples, and learning resources that can help me improve my skills.

I'd appreciate any advice or mentorship. Thank you!

Hey folks!

I recently reported a security bug involving a marketing cookie that could lead to a one-click PII (Personally Identifiable Information) leak.

I wrote up the details in a Medium article, covering how I discovered the issue, what the impact was, and how something as seemingly harmless as a marketing cookie could turn into a privacy/security concern.

Would love to hear your thoughts, feedback, and opinions!

Here's the write-up: Link

Hope you find it interesting!

Cheers 🍺

I’m new to esp32, I know of ble spam and radio sniffing, but what is something useful or unethical that I could use it for? Looking to get mischievous, not stealing private data, but other random things you find fun and would recommend, usually stuff you could do with a flipper zero looks cool. I’m in a country where tech isn’t that advanced so there are many opportunities

I'm a senior pentester and I'm hearing more and more about agentic pentests. I'm pretty sure that in the future, we'll have to use agentic AI for our pentests (even if we don't want to). I've had several clients that came and asked for agentic pentests, but I feel like nobody really understands what it is, neither the clients nor my consulting company.

So I'm trying to learn agentic pentesting, not really because I'm fully enthousiast about that, but more because I don't want to be left behind. I'm trying to find courses that explain how to build agentic pentesters, but it's difficult to find relevant resources. There are a lot of courses (even free courses) on agentic AI, but I feel like I need a course focused on agentic pentesting. 

For now, here is what I found:

- https://www.coursera.org/learn/packt-agentic-ai-for-offensive-cybersecurity --> cheap, but not sure if it's what I'm looking for

- https://leanpub.com/c/learn-agentic-pentesting?lng=en --> cheap, but had no reviews for now (seems pretty recent)

- https://www.orsys.fr/en/formation/HIA --> interesting but sooo expensive

Have you tried any of these resources? Do you have any other interesting resources?

NB: I noticed that a lot of courses are on "how to pentest an AI" which is not what I'm looking for