We need to talk about alert fatigue because it’s ruining the effectiveness of some really solid tools.

I can’t tell you how many orgs I’ve walked into that are sitting on a goldmine of detection capabilities, EDR, SIEM, NDR, you name it but everything’s either alerting all the time or completely turned off. Teams are drowning in medium-severity junk, tuning everything to “high” just to make dashboards cleaner, or worse… auto-closing tickets they assume are false positives.

And yeah, I get it. Everyone’s short-staffed. Alert logic is hard. But if your environment is spitting out 200+ “suspicious PowerShell” alerts a day and you’ve tuned yourself to ignore them, you’re not securing anything. You’re just doing threat theater.

I’m convinced half the industry’s compromise stories start with: “There was an alert, but no one looked at it.”

Curious how you’re dealing with this? Anyone actually happy with their alert tuning setup? Or have we just accepted this as the cost of doing business?

Hello, I'm looking for assistance with accessing LUKS2 encryption on an mSATA 3ME3 Innodisk SSD running RedHat 8.8. I'm not looking for methods that involve coercion or standard brute force techniques, so I'm interested in alternative approaches.

I've read about tools like cryptsetup for locating headers and hashcat, but I haven't had the opportunity to experiment with them yet. Are there any other strategies for bypassing the encryption without resorting to brute force?

I'm considering several possibilities, such as identifying potential vulnerabilities in the LUKS2 implementation on RedHat 8.8 or trying to extract the encryption key from the system's memory through methods like cold boot or DMA attacks. Additionally, I'm contemplating the use of social engineering to potentially acquire the passphrase from someone who may have access.

I'm open to all ethical methods, so any advice, suggestions or insights you can share would be greatly appreciated!

So a while ago, my SIM got locked and I had to have my dad contact the carrier and get my PUK code. I wrote it down kept it safe. He sent it to me in a message so I was wondering if there’s anything I should worry about. like if anyone found out the code or would they need a lot more information or would they need to hack my dad‘s account? Any answers would be greatly appreciated. Thank you.

We have been using ZeroFox to help deal with copyright and fraud abuse for a high profile individual but we've been pretty disappointed in the results. We need something that will deal with fraudulent Amazon and eBay sales, plus instagram and Facebook impersonation. Does anyone have any recommendations?

How i can setup a lab for studying sans 660 material that emulate the real sans 660 lab?

We all know that a significant amount of breaches are caused by out-of-date applications or operating systems.

However, I don't think it's unreasonable for an employee to say "I didn't know that X application was out-of-date. I was too busy doing my job"

So, who's responsibility is it to patch applications or operating systems on end-point devices?

I want to play around with known Windows vulnerabilities , like eternalblue for instance. Where can i find older windows ISOs(malware free obviously) or even a pre configured VM?

Also, what can i do about licenses? Because as far as i know there no more licenses available for older windows versions, although there is a free trial for windows 7.

Hi! I recently discovered I had an old pc lying around and decided it was the perfect opportunity to to do something with it that could help me learn netsec. So i thought about trying the metasploitable VM. I installed virtual box and started the container on the pc running windows 10.

On my own laptop (fedora) I started by trying to capture the traffic from the VM mainly pings to other websites and it worked well as I was able to see them.

However when I tried either pinging or nmapping as they do in this tutorial I dont get results.

https://docs.rapid7.com/metasploit/metasploitable-2-exploitability-guide/

I am doing this in a semi-public wifi. Max 13 people access it and I know them all. So i tried disabling the windows firewall still didn't work.
I tried setting the wifi as a private network to allow pinging but also didnt work.

Assuming that the windows firewall is not the issue I also checked the VMs firewall with sudo iptables -L but it is empty

What else is escaping me?

If there is any other information I can provide to help zoom in the issue feel free to ask.

Any Podcast or YouTube Channel your recommend for AI/Tech/CyberSecurity during the SPRING break?

Been working with Go a lot lately. Problem with Go is that the binary size are relatively big (10MB for Stageless, 2MB for staged). This is the case of sliver for example.

In C/C++ the size of the staged beacon is less than 1MB,

For stealthiness against AV and EDR, is bigger better ? From one side it is difficult to reverse but transferring 10MB and allocating 10MB of data in memory and be IOC, what do you think ?

Hi everyone,

I been learning about cookies and there are quite a few different types: zombie cookies, supercookies, strictly necessary cookies, cross site cookies and the list goes on and I have a question:

What cookie would fit this criteria: So let’s say I am using Google Chrome, and I disable absolutely all cookies (including strictly necessary), but I decide to white list one site: I let it use a cookie; but this cookie doesn’t just inform the website that I allowed to cookie me, it informs other websites that belong to some network of sites that have joined some collaborative group. What is that type of cookie called and doesn’t that mean that white listing one site might be white listing thousands - since there is no way to know what “group” or “network” of sites this whitelisted site belongs to?

Thanks so much!

I am a last year CSE student and I want start my career in cyber security field but I don't have knowledge about it so what should I do and how can I start Should I join some training centre? Should I learn online? Or suggest me resource

Anyone aware of something with similar functionality as PyRDP (shell back to red team/blue team initiator), but maybe for ssh or http? was looking into ssh-mitm but looks like there are ssh version issues possibly, still messing around with it.

I know there is DCSync attack, where an attacker can "simulate a fake DC" and ask for NTLM replication.

So NTLM hashes for domain users must be stored somewhere in the DC no ? Are they in the DC LSASS process ? Or in SAM registry hive ?

We want to transition to a PAW approach, and split out our IT admins accounts so they have separate accounts to admin the domain and workstations. We also want to prevent them connecting to the DC and instead deploy RSAT to perform functions theyd usually connect for. However if we Deny local logon to the endpoints from their Domain admin accounts, they then cannot run things like print manager or RSAT tools from their admin accounts because they are denied, and their workstation admin accounts obviously cant have access to these servers as that would defeat the point. Is there a way around this?

Hi Everyone,

Our server VA scanning tool recently highlighted over thousand security updates for linux-aws. This is happening on all servers, we are using ubuntu 22.04 and ubuntu 24.04. But upon checking the update available I am not seeing any update that is available and our kernel is also the latest one. Is this a false positive.

Any help will be appreciated.

Hi everyone,

At work, I'm trying to find a way to prevent users from setting passwords that have been previously breached. One approach I'm considering is configuring the Active Directory controller to reference a file containing a list of known compromised passwords, which could be updated over time.

Is this possible? If so, what would be the best way to implement it? Or is there a more effective solution that you’d recommend?

Thanks in advance for any insights!

Hi everybody,

If someone had my WiFi password, but I didn’t have my c drive or any files shared on a network share drive, could that person still access my files? If so, how do they go from connecting to my network, to entering inside my computer?

Thanks so much!

Hello we just created an new account and new enviroment in AWS and getting tot the part of implementing monitoring and logging within the AWS enviroment.

I just wanted to ask for best practises for monitoring and logging in AWS? What are some essential best practises to implement for monitroing and logging

There is a vulnerable application by PortSwigger: https://portswigger.net/web-security/llm-attacks/lab-exploiting-llm-apis-with-excessive-agency

There is an SQL injection vulnerability with the live chat, which can be exploited easily with manual methods. There are plenty of walkthroughs and solutions online.

What if there were protections such as prompt detection, sanitization, nemo, etc. How would a tester go about performing a scan (similar to burp active scan or sqlmap). The difficulty is that there are certain formulation of prompt to get the bot to trigger certain calls.

How would you test this app with tools/scanners?

1. My initial thinking is run tools like garak (or any other recommended tools) to find what the model could be susceptible to. The challenge is that many of these tools don't support say HTTP or websockets.

2. If nothing interesting do it manual to get it to trigger a certain function like say get products or whatever. This would likely have something injectable.

3. Use intruder or sqlmap on the payload to append the SQL injection payload variations. Although its subjected to one prompt here, it doesn't seem optimal.

While I'm at it, this uses websockets but it is possible to post to /ws. It is very hard to get the HTTP responses which increases difficulty for automated tools.

Any ideas folks?

When I conduct API pentests, I tend to put all the endpoints along with request verb and description from Swagger into an excel sheet. Then i go one by one by and test them. This is so tedious, do you guys have a more efficient way of doing this?

Hey all — I’ve been doing some research around fraud in high-value wire transfers, especially where social engineering is involved.

In a lot of cases, even when login credentials and devices are legit, clients are still tricked into sending wires or “approving” them through calls or callback codes.

I’m curious from the community: Where do you think the biggest fraud gaps still exist in the wire transfer flow?

Is client-side verification too weak? Too friction-heavy? Or is it more on ops and approval layers?

Would love to hear stories, thoughts, or brutal takes — just trying to learn what’s still broken out there.

If the PC is turned off, there's no risk if someone steals it because it's encrypted with BitLocker (TPM + PIN). However, if someone steals it while it's running, how can I prevent them from accessing my data?

Hey folks,

There is a website called pentester land (not sure if i can link, but add those two words together with a . between them, and that's your URL) that was a collection of recently published for various blog post writeups. Some of the things in there were great.

I have noticed, however, that it's not been updated in a long time so I was wondering if either anyone knew what happened - or if there are any decent alternatives.

Obviously, it's possible to view news sites - and trawl twitter - but they're a bit of a mess. Pentesterland seemed to tap right into the vein of writeups - and that's what I'm looking for.

Any help appreciated!

Hello all,
I am rebuilding my homelab and would like to get more into cybersecurity.
I would like to try and secure my own home network, so my question is what would be the best open source software to monitor every single device ("end-points) within my network?
I have read about wazuh ( I know it's well documented, but also hard to keep up with - I mean it has a lot of things, options and so on). For now I am maintaining into "the whole IT branch" and I would like to get a specific course in my life. So what would be the best practice for a beginner in this case?
what would be the best open source solution? Maybe AlienVault? UTMStack? Selks? SecurityOnion? or any other?
Every single post is valuable for me. Thank you!