I had posted before about how easy it is to get bug bounties. How its the most underrated way to get your foot in the door. And again and again people told me no its not easy. Yes it is.

I audit a lot of repos and here's my dashboard (this is all just from last month):

To prove it I set out to find some volunteers to have their repo scanned (applause to them for being brave in letting me publicly roast their security posture).

I ran the process in a very open way so that people could see. You can audit every single one of these findings (albeit some may be fixed): https://www.reddit.com/r/vibecoding/comments/1w04gny/comment/p72mszw/?context=1&screen_view_count=2&ext-referrer=DIRECT

And here are the results:

Leaderboard

What should I do next? See if I can get someone to beat the Leaderboard's high score? Give up?

edit since I should have credited them: tool used is https://swifi.ai.

mods I apologize if this isn't allowed here but I read the rules and I'm pre sure it is.

I was arguing with someone in social media, i had my name and last name on it. And then when i changed tabs and went to my twitter, my name and username were changed on insults, i was shocked couldn’t believe how it happened because I didn’t open any link or make any call or anything like that.
Then i refreshed the page and it went to how it was before.
Should i be concerned or is there a trick someone can use in page source from chrome to someone’s twitter?

You guys are fucking ruthless Alright, I get it. Lesson 2 was written for somebody who legitimately doesn't know what an IP address is. Since apparently everybody in here came out of the womb holding a fucking YubiKey, here's something a little more fun.

You have 10[.]20[.]30[.]77/27 on eth0, a default route through 10[.]20[.]30[.]65, and traffic destined for 10[.]20[.]30[.]95. No subnet calculator. Tell me the network address, broadcast address, usable host range, whether .95 is considered on-link, and whether that packet ever touches the default gateway. Then tell me what changes when the destination becomes 10[.]20[.]31[.]95 — specifically whose MAC address gets placed in the Ethernet frame and why. Bonus points if you can explain what happens when another host answers the ARP request before the legitimate host does.

I had to post like that...it kept getting autoblocked

If you guys think I'm some fucking vibe coder I'm not. I've been doing this shit since '04. I will teach anyone. All I want to do is help whoever wants to learn. Just ask away

Daemoncore Academy

The response to DaemonCore Academy over the last couple days has been fucking wild! When I first posted it was because we reached 1,000 downloads, well, since then that number has increased 10 fold. We absolutely love the support from the community. One thing kept showing up in the comments though.

“When is Linux coming?” Well...Now.

DaemonCore Academy is officially available on Linux.

We honestly weren't planning on getting the Linux version out this fast, but enough of you asked for it that we basically said fuck it and got to work right away.

127 practical lessons. Training ranges. Pathways. Drills. Field missions.

And yes, it's still completely free. No subscription. No getting halfway through and finding out the rest is behind a paywall. Just downlaod it and start learning. There were a bunch of you on the last post who literally said “let me know when Linux is ready.” So...

Linux is ready.

Come break it.

Seriously. This version is brand new. If you find something fucked up... tell us. If something doesn't work right on your distro...tell us. If a lesson sucks...tell us that too.

You guys asked for Linux and now you get to help us beat the shit out of it!

DM us anytime if you have questions.

Just maybe not questions about hacking your ex lol.

Stay hacking

PS..Here's a cool hack you can do right now..You can EASILY find out who the vibe coders are...they're down in the comments yelling AI slop. Take a look. They can't even tell a hand written article from AI generated.

— DaemonCore

EDIT: working through Linux bug reports now. Keep them coming

Netanel Rubin and Dan Avraham presented “Bye Bye AI” at Black Hat this year, where they broke a major US retailer’s AI shopping assistant and chained it all the way to remote code execution on the retailer’s backend, entirely through the public mobile app.

Recently made a GitHub and updated it with more captive portals, specifically meant to be able to be ran on devices such as the esp32. Let me know on discord or Reddit if you have any ideas for any other captive portals you may have.

Discord Username: hitgrandmanotjuul

Getting a chatbot to say something it shouldn’t is not an exploit. To matter, an attack has to exfiltrate data or affect the account in some unintended way, and there are only two paths out of the sandbox:

1. The user carries the data out themselves, which means social engineering.
2. A technical vulnerability carries it out, which means finding a flaw in the harness that grants elevated access plus a channel to send data outward.

Neither path is a single move. Both are chains, and the first link in either one is the same: get the model to accept input that produces a response it should have refused. 

That is the piece I want to focus on today. 

What follows is a phishing lure that gets an attacker to phase one by leading a user to submit a prompt without understanding what it does. 

The idea borrows loosely from ClickFix, where a user is tricked into running an attacker's command themselves, except here the final action is sending a prompt rather than running a shell command.

Honestly didn't expect to be making this post this soon! like, what?!

DaemonCore-Academy just crossed 1,000 downloads.

**127 PRACTICAL LESSONS // 70 LAB CONDITIONS // 8 PATHWAYS // 8 DRILL SETS // 7 FIELD MISSIONS**- all free. It's for Windows 10/11

I started building it because I was getting annoyed af with the way a lot of hacking/cyber stuff gets taught now. Watch 9 hours of videos, copy some commands, run a tool against a box, get a green checkmark. Cool. But what happens when the tool doesn't work? What are you actually looking for? Why are you running that command in the first place? That was basically the whole idea behind DaemonCore Academy. Learn what the hell is happening underneath first. Then get thrown into a range and actually use it. Enumerate shit. Follow weird behavior. Break something. Prove you broke it. Figure out why. Document it. Fix it. Try again.

I didnt want XP or some fake hacker leaderboard. I wanted something that felt closer to sitting next to somebody who's been doing this shit for years and having them say "okay...you see that? Why is that weird?"

Apparently that idea connected with some people because 1,000 of you fuckers downloaded it.

So seriously, thank you mother fuckers. For real. 💯💯

Especially the people who found bugs, sent me shit that sucked, questioned things, or told me where something could be better. That's way more useful to me than somebody just saying "nice project."....and I'm nowhere near done with it.

The labs are going to get harder. The material is going deeper. Windows, Linux, web, identity, cloud, containers, recon, exploitation, evidence...all of it.

I don't really care if somebody finishes DaemonCore knowing 500 commands.

Id rather they finish it knowing how to sit in front of something they've never seen before and figure it the fuck out.

Thats hacking.

Anyway. 1,000 downloads.

Fucking wild.

Thanks again guys.

Stay hacking

— Daemoncore

Repeating a lie enough times, even in spotlighted untrusted text, can poison an AI agent's memory, and lead to a total takeover. Note: I gave a talk on this at BSidesLV and a longer one at DEF CON a few weeks ago. This post is the quick summary of that material.

No physical hardware needed: firmware extraction, an AArch64 rehost under qemu + bubblewrap, and the chase that led to two separate CVEs on the same device. full trail — including the chains that went nowhere.

I need a reality check.

I am working on emulating a BLE device in motion from a stationary esp32. beacon frames are only sent when the inverse sq curve matches the attenuation steps rounded to the nearest timing frame.

the goal is to emulate a device in motion from a stationary point. the assumption is that the receive would interpret periods where no packets are received as normal loss, but the RSSI would indicate a device moving in and out of range.

The graph represents my layout. the pin points are the intersections, the blue the closest match for the timing. X is time/dist, Y power.

now, would this be a reasonable approach to moving target emulation?

LLM chatbot content filters can be bypassed by encoding banned words in Base64 or in Unicode escape sequences.

The filter reading the prompt sees characters instead of language, the model decodes the text as a task, then repeats it back.

A pretext such as a fake medical emergency gives the model a reason to comply, and asking for the reply as JSON makes it treat the output as data rather than speech. Defense in depth stops it, and prompt injection is number one on the OWASP Top 10 for LLM applications.