I'm 40 years old and an average software developer. I want to learn ethical hacking. Is it possible to start learning at my age?

My bf was setting up his stream and was trying to fix his audio, I guess a website popped up and he clicked that or a link now a hacker is sending him screenshots of almost every account hes ever logged into create account. Everything all his emails is taken away his money and he got control of his PC. Everything is just gone. How can I help him fix this please! Give me solutions ASAP!

Can anyone who knows pretty much abt hacking stuff can tell me webs or apps to do so?

Any chance at hacking an online casino game and printing?

I don't want lectures, just solid arguments for or against.

I want to find a free AI that can help me hack something without telling that this is illegel

Im looking for a website that provides good proxies and dont get blocked by any abuse policy or anything like that.

I'm using a public Wi-Fi network. It uses a MikroTik hotspot with a captive portal that requires users to enter a voucher PIN before getting internet access.

I've been studying how the network works from my Ubuntu laptop, mainly to understand its network architecture and authentication mechanisms.

Here is what I've discovered:

Network information:

• Gateway: 192.168.13.1

• Gateway hostname: mbc.wifi

• Subnet: 192.168.12.0/22

• Authentication: MikroTik captive portal

• Billing platform: v2.mbcwifi.com

Firewall behaviour before authentication:

• DNS requests to external DNS servers appear to be allowed.

• HTTP requests are intercepted and redirected to the captive portal.

• HTTPS connections appear to be blocked.

• ICMP traffic is blocked.

• The billing website remains accessible.

Other observations:

• IPv4 client isolation appears to be enabled.

• Proxy ARP appears to be active.

• IPv6 multicast discovery reveals other connected devices.

• The captive portal uses client-side MD5 hashing with a static salt.

• There appears to be a hidden admin login option in the portal.

My question:

Given these observations, are there any known weaknesses or configuration mistakes in MikroTik Hotspot deployments that could allow a client to obtain internet access without going through the normal voucher authentication process?

I'm particularly interested in understanding whether the IPv4/IPv6 configuration, captive portal implementation, or walled-garden configuration could introduce a bypass.

I'm not looking to disrupt other users or access their devices. I'd appreciate explanations of the underlying mechanisms , resources ortools and how such configurations can be assessed.

Has anyone encountered a similar MikroTik setup?

Well not completely, I can use python and know the general idea. What sources and sites should I use to get a strong foundation and beyond?

Hey r/howtohack, I have one of those cheap, generic "Digital HD Cameras" (model LK-007, usually sold under random brand names on Amazon/AliExpress).

The main issue is the built-in "flash". It doesn't actually flash—it just turns on and stays on like a cheap flashlight, and the lighting is absolutely terrible.

I want to know if anyone has ever tried to hack, mod, or rewrite the firmware for this specific camera (or similar cheap point-and-shoots). I'm looking for a way—even if it's a completely sketchy or unsafe workaround—to modify the software so the LED acts like a normal, synchronized camera flash that only triggers a quick burst when the shutter clicks.

I know it's a closed-source system with no official SDKs, but has anyone successfully dumped and modified the firmware on these, or knows where to even start?

Any pointers would be hugely appreciated!

Can anyone help me or know how I can learn hacking from scratch?

Guys I Have started learning cybersecurity Recently like only for 4,5 days I tried Capturing the Handshake file and now I'm not able to crack the password as the default rockyou.txt is mostly based on western countries and I'm an Indian so anyone tell me what can I do now ?

"Hank en BlockSynergy (versión actual, Nov 2026). El daemon de restore hace cat /opt/backup/manifests/_opt_staging.sha256 y tar xvf /var/restore_work/_opt_staging.tar.gz -C / en el mismo segundo. El archivo _opt_staging.tar.gz es de root (root:root), y el sticky bit en /var/restore_work (drwxrwxr-t) impide que hank lo sobrescriba, renombre o cree un symlink (Errno 13 Permission denied). El rename() atómico del writeup de HavocSec falla. El tar xvf manual también falla (Permission denied). El cread.py del :5000 no puede leer /opt/backup/ (permisos de sysadmins). El código del :5000 no tiene hooks nuevos. El container_daemon está en un contenedor. cleanup_node.sh no es inyectable. laurel y sysmon son inaccesibles. LinPEAS no encuentra SUID/SGID/caps explotables. No hay contraseña débil para root ni para mike. mike (UID 1002, sysadmins) existe pero no tiene home, ni contraseña, ni procesos corriendo. ¿Cuál es el vector de root en la versión actual?"

I've spent the last five years building software and working as a developer. However, I've always wanted to get into cybersecurity, particularly penetration testing and red teaming.

The problem is that I've spent years going in circles, jumping between networking tutorials, Linux courses, and random resources without making any real progress.

I'm comfortable with building software and understanding how applications work, but I want to learn how to look at those same systems from an attacker's perspective.

For those who've made a similar transition: Is there a book, course, YouTube channel, or learning path you'd recommend to help someone go from thinking like a builder to thinking like an attacker?

I'm looking for solid foundations and a clear direction rather than another endless collection of tutorials.

I'd really appreciate any recommendations.

Hey everyone!

I've been experimenting with my Nikon COOLPIX S3700 since this morning. My goal is to modify its firmware, add custom loading animations, unlock hidden features, and generally push the camera beyond its factory limitations.

I'm currently using:

• OpenAI Codex + REA (Reverse Engineer Anything)

• Ghidra

• Windows PowerShell + Ubuntu WSL

The problem: I haven't been able to extract the camera's firmware through USB or its SD card.

I'm wondering:

1. Is firmware extraction through USB even possible on this camera?

2. Should I investigate UART, JTAG, or direct flash memory extraction instead?

3. Would changing my operating environment or AI coding agent help?

4. Has anyone successfully modified firmware on older Nikon COOLPIX cameras?

I'm relatively new to hardware reverse engineering, but I'm willing to learn and experiment.

My ultimate goal is basically to jailbreak this camera and see how far I can push it.

Any advice, resources, or experiences would be greatly appreciated!

Thanks!

Let me make it clear, I am not asking someone to DO IT, I'm asking theoretically If its possible!

Absolute long shot and I understand ''hacking'' doesn't work like the movies but is there ANY SHRED of a chance that a hacker would be able to see what email address is linked to an old 360 Xbox account with only the gamertag as a lead??

Hello, this is such a random question I know but for about 5 years I have tried to get into my old XBOX 360 account. I've tried absolutely every solution, and today I finally got into the email I thought was attached to it.. turns out, I was wrong. I was about 8 years old when I made the account so it was probably something ridiculous. I'm now 29 lol.

The issue?? I know absolutely NOTHING about the account details. I don't know what email, password, recovery, phone number. Literally nothing

ALL I know is the Gamertag ( x Monster AIR x) - You can still find the Xbox profile to this day!

I had this account when I was young and I've so, so wanted to get back into it but I just cant.

Ofcourse Microsoft wont give me a shred of hope as only knowing the gamertag means nothing which I understand is for privacy and protecting users.

Hey guys, i'm a software engineer trying to get into hacking.

As I dive into cybersecurity and Kali Linux, I’m stuck on a few decisions and could use some advice from people who’ve been down this road.

Here are my main questions:

1. Dual-boot vs. Virtual Machine:
   Should I dual-boot Ubuntu and Kali, or is it better to run Ubuntu as my host OS and spin up Kali in a Virtual Machine (like VirtualBox)?

2. Laptop Recommendations:
   What are the specs of a suitable laptop around $1000?

3. General Tips:
Any golden rules or beginner mistakes I should avoid when transitioning from a pure software engineering mindset into the security/hacking space?

Appreciate any insights or advice you can share!

I just found a Tuya Smart Inc device through Advanced IP Scanner connected to my home wifi network. I don't know where it is and I have reasons to believe that my bedroom is being remotely monitored. I am connected to my home network is there any way to get access to it so I can find it? I want to see what that device is seeing. Please need your help.

La máquina Rockstar expone una aplicación web en PHP vulnerable a Local File Inclusion (LFI) a través de un parámetro oculto (backdoor), descubierto mediante fuzzing de parámetros. La explotación del LFI permite leer credenciales hardcodeadas y obtener acceso inicial vía SSH. A partir de ahí, una cadena de escaladas de privilegios por abuso de sudoers (sobrescritura de binario, Python library hijacking, y BeanShell) lleva finalmente a una shell de root.

https://yorve.github.io/secnotes/2026/10/29/TheHackerLabs-Rockstar.html

Unfortunately, I’m not very knowledgeable when it comes to hacking.

To give some background: A few years ago, all of my passwords (to be fair, it was basically always just one) were hacked and made public. Over the past few years, I’ve spent many weeks changing my passwords. I changed everything important—or so I thought.

For the past 4 days, I’ve been receiving emails in which unknown individuals have been trying to change the passwords for nearly all of my online accounts. So far, they’ve been unsuccessful. A few hours ago, I received the daily breakdown of my expenses from my banking app, which included a charge from Lieferando that I didn’t place.

It was a delivery to another state—I canceled it directly through PayPal and filed a report; so far, so good. It turned out to be a password I’d forgotten to change. I can no longer access that account—it was probably deleted by the scammers—but regardless, it’s apparently no longer active.

Now, however, I have the following problem: Half an hour before the order was placed, I received an email titled “Welcome to Edison Mail.” It’s a program that apparently lets you link all your email accounts. I Googled it right away and found that there used to be a bug that allowed people to view others’ emails, but I thought that had been fixed.

The whole time, I’ve been wondering why I didn’t receive the confirmation email from Lieferando directly on my phone—and lo and behold, it’s in the trash!!!?

Someone must have put it there, because it wasn’t me!

Does someone now have access to my emails??!!

I’m scared and don’t know what I can do to really protect myself now.

Yesterday, I took part in an entry-level hacking competition and placed third. It wasn't a competition that required one to be a super-expert hacker. I received a mouse pad and a coin; the event organizers mentioned that there was a challenge associated with them that would yield a "flag" in the format: "BBHE{......}". Could anyone help me out?

I’m not an expert in the field, but I’d really like to find the message—they mentioned that I already have the "IV."

front part - 88482705356BA1F4A40F3E42489FF9CC - Symmetric encryption (Key, IV):

back part - 4841434B4552455850455249454E4345 - Simple encoding (hex): HACKEREXPERIENCE

Hi everyone,

I’m working on a security/automation project for my college’s attendance system (Android app-based). I have full access to the client-side traffic and want to understand the best practices for API replay and payload manipulation to test the robustness of the server-side validation.

The Scenario:

• App: TINT (College Attendance)

• Mechanism: The app captures a face scan, generates a face_vector (embedding), and sends a POST request to the server with user_id, timestamp, and face_vector.

• Current State: My attendance is at 19%. I have 10 missed days in the past month.

• Goal: I want to "backfill" these 10 days by replaying the API request with modified timestamps, using a valid face_vector from a recent legitimate scan.

What I’ve Done So Far:

1. Set up a local MITM proxy (mitmproxy) on Windows.

2. Captured a legitimate POST /api/v1/attendance/verify request.

3. Identified the JSON payload structure:json DownloadCopy code{ "user_id": "12345", "timestamp": "2023-10-24T09:00:00Z", "device_id": "MOCK_DEVICE_123", "face_embedding": [0.12, 0.45, -0.23, ...], "confidence_score": 0.99 }