I built SSHintel as a lightweight SSH honeypot, and I'm looking for some feedback from people with more cybersecurity experience than me.

The basic idea is to let an attacker interact with a simulated Linux environment and capture what they do as structured security telemetry.

The demo shows an SSH session interacting with the fake environment while the dashboard tracks the activity.

Right now, it records things like:

• Authentication attempts
• Commands entered into the fake shell
• Session information
• Working directories
• Connection/disconnection events
• Attack timelines

One thing I specifically wanted to get right was isolation. Commands aren't actually executed on the host. SSHintel uses a fake, per-session filesystem and simulated command handlers to make the environment look somewhat realistic while keeping the interaction contained.

The telemetry is stored in JSONL + SQLite and can then be investigated through the dashboard.

I've recently gone back and reworked the project quite a bit, but I'm sure there are things I've overlooked.

I'd especially appreciate feedback on:

• Is the security/isolation model reasonable?
• What telemetry would actually be useful to a security analyst?
• What features would make this more useful as a honeypot?
• Are there any obvious weaknesses in the current architecture?

GitHub: https://github.com/SonitBahl/SSHintel

Demo: https://youtu.be/2bIwXTT2FtM

I'm mainly posting this to get feedback and ideas for where to take it next!!

I am writing to share a project I have been developing called HackDevilla (https://hackdevilla.nl).

What it is HackDevilla is an interactive cybersecurity platform centered around a unified simulation: compromising a virtual villa. Rather than presenting users with isolated, random challenges, the platform requires you to navigate and exploit a cohesive, realistic network environment.

How it works Users are presented with the target "Villa" and must apply practical enumeration and exploitation techniques to gain access to its systems. For example, an engagement might begin with bypassing external security measures—such as smart gates or IoT cameras—which then allows the user to pivot into the internal home network. Each vulnerability you patch or exploit grants deeper access to the infrastructure, testing different security concepts in a logical sequence.

The idea behind it Many practice platforms currently operate as a series of abstract puzzles. The primary goal with HackDevilla was to create an experience that closely mirrors a real-world red team engagement against a modern, heavily networked property. I wanted to bridge the gap between traditional Capture The Flag (CTF) events and practical penetration testing by providing a more contextual learning experience.

Upcoming updates Development is actively ongoing. The current roadmap includes:

• Expanded exploitation vectors: We are developing new modules focused on [insert specific technologies, e.g., HVAC systems, Bluetooth LE, or advanced IoT exploitation].
• Competitive features: Implementing a leaderboard and a multiplayer mode for concurrent testing.
• Dynamic defenses: Introducing a higher difficulty tier where automated defensive mechanisms actively respond to your intrusion attempts.

The platform is accessible athttps://hackdevilla.nl. I welcome any feedback, technical critiques, or suggestions regarding what systems or vulnerabilities you would find most valuable to test.

Thank you for your time.

Hey, I’m a beginner interested in cybersecurity. I have some basic programming/IT knowledge. What should I learn first, and what resources would you recommend?

Hey guys,

Whenever I'm doing boxes on Hack The Box or TryHackMe, I always end up with a mess of tabs—one for notes, one for Notion, a couple for revshell generators, and random terminal cheatsheets.

To keep things in one place, I started building ZeroBox. It’s basically a local, offline dashboard to track your boxes (Recon ➔ Foothold ➔ Root), take quick markdown notes, and generate reverse shells where you just punch in your IP once and it fills out all the commands automatically.

You can try it here:

https://xXDNDXx.github.io/ctf-tracker/

Code is on GitHub:

https://github.com/xXDNDXx/ctf-tracker

Just to be clear: it’s totally free, open source, no account or login needed, and everything saves locally in your browser. (Also no spoilers/flags for active boxes, just retired/public info).

It’s still very much a work in progress and I’m pushing updates and adding new stuff pretty much every day.

I'd really appreciate it if anyone grinding labs could click around and tell me what sucks, what’s broken, or what features you'd actually want to see added next.

Thanks!

Hi everyone,

My team and I are final-year Information Technology students looking for an industry-based Final Year Project (FYP) opportunity.

We are interested in working on a real-world problem in areas such as Cybersecurity, AI-based applications, Web Development, Database Systems, or Software Solutions. Our goal is to gain practical industry experience while building something that can provide value to an organization.

If you are a founder, startup owner, developer, researcher, or work with an organization that has a problem statement, project idea, or challenge that could be explored as an FYP, we would love to connect.

We're not looking for someone to do the work for us—we're looking for an opportunity to collaborate, learn, and build a meaningful solution under industry guidance.

Feel free to comment or send me a DM if you think there might be a good fit.

Thank you!

Hello everyone

I am 3rd year cybersec student. looking for ideas for an android app that actually solves a real security problem.

something pentesters, students, researchers or security people would actually use. wanna make it solid for my resume cuz still looking for an internship. and maybe turn it into a paid/sub thing later if it hits.

what cybersec app would you actually download and use daily?

Thanks :)

Hey r/bugbounty,

I’m starting a daily log of my learning progress to stay accountable and hopefully share some good vibes with other beginners. To give a little context, my day job is in AI architecture, so I already have a solid baseline in Linux, cloud, and networking. However, I’m getting into bug bounty purely for the thrill of the puzzle and the technical challenge, rather than chasing cash payouts.

Today’s focus is my very first module: Server-Side Vulnerabilities.

Here is what I'm currently working through:

• The Concept: Learning how attackers manipulate backend infrastructure. Instead of attacking the user's browser, it's about tricking the server into executing unauthorized commands or revealing hidden directories.
• The Sandbox: I’m using the PortSwigger Web Security Academy. I'm starting with their "Apprentice" track, which is meant to provide new learners with an overview of real-world vulnerabilities and how they are exploited.
• The Current Challenge: The module kicks off by teaching the basics of file path traversal. I’m actively trying to break the lab and solve this challenge right now!

Since I am aiming to focus on manual web exploitation and deep business logic flaws rather than just firing automated scanners, I'd love to hear from the veterans here.

Hi all!

I just built the pre-MVP version of a tool that tests the practical knowledge of anyone from infotech industry. A small "knowledge-checker" application that tests the depth of your IT skills, and hopefully help you learn something new. I will be honest - I vibe-coded it with Claude with couple of hour's back and forth, and I am certainly not trying to sell anything here — just trying to figure out if it's worth building out further.

There's only one category of test here for now, with 30 AWS Cloud Security scenarios across three difficulty levels. The questions are a mix of click-to-diagnose, multiple choice, and a couple of drag-and-drop ordering exercises. I intend to add more subjects and more scenarios and questions if I see any traction and positive interest.

Here's the public URL: [https://claude.ai/public/artifacts/93de0031-8ff4-4070-85c2-7edd7b07da76\](https://claude.ai/public/artifacts/93de0031-8ff4-4070-85c2-7edd7b07da76)

**It's a free demo** — **runs completely client side** (runs within the browser) for now, and **does not need any sign-ups and certainly no payment is necessary**.

If you work in IT, I would genuinely appreciate a few minutes of your time and honest feedback:

* Is this a type of app you would be interested to use for practising your learning and getting ready for say, certifications?
* If you are team lead - do you see value in your team using it for keeping their skills sharp?
* Does the format feel more useful than typical quiz apps? Is the difficulty calibrated right?
* What features would you like to see in the next iteration - if you think it's something worth building further?

Any other feedback?

Thanks for your time!

Hey everyone,

I’ve been diving into local network security and packet manipulation. I really liked the original evillimiter tool (which uses ARP spoofing and tc/iptables to throttle bandwidth), so I decided to fork it and try to improve it as a learning project.

The original tool loses track of target devices when modern phones (iOS/Android) use MAC Randomization. I’m trying to implement a way to re-identify and maintain the throttle on target devices even when their MAC rotates.

I'm currently looking into using Scapy for DHCP Fingerprinting (Option 55) or mDNS hostname extraction to track them, rather than relying on RSSI, which seems too noisy for a simple CLI tool.

I'm still learning the ropes of low-level networking, so I’ve been using AI as a pair programmer to help me figure out the Scapy logic and Python structuring.

My fork is here: https://github.com/DavidsonRafaelK/evillimiter

I'd love some input from the community:

1. Is DHCP Fingerprinting via Scapy a viable path for tracking dynamic MACs in a local LAN?
2. Are there better/lighter alternatives to track devices without relying heavily on ML?
3. Any general feedback on the approach?

Thanks!

Hey everyone,

I'm a JHU cybersecurity researcher going through the National Science Foundation I-Corps program — basically trying to figure out if what I'm building actually solves a real problem or if I'm living in an academic bubble.

I'm working on an next-gen security validation tool. I tested it against a FortiGate and a Cloudflare Pro WAF and got some interesting results — the approach found gaps that static tools completely missed on the same target.

But here's the thing — I don't actually know if security teams care about this in practice. So I'm looking for people who deal with WAFs, IPS, firewalls, or BAS tools day to day and would be willing to answer a few questions. Not selling anything, not promoting, genuinely just trying to learn.

Specifically I'm curious about:

1.How do you actually verify your defensive rules work after you deploy them? Or do you just trust them?

1. If you use a BAS tool (Pentera, SafeBreach, Cymulate, etc.) — do you trust its results? Has it ever said "all clear" and then something still got through?

2. When you write a new WAF/IPS rule, do you have a way to test it against attack variants you haven't seen yet?

Happy to do a 15-min call or even just chat in this thread. And I'll share what I'm learning from other conversations — some of the patterns are pretty interesting.

For context I've published at papers and have a patent in process, so this isn't a class project. But I also don't have any customers yet, which is why I need to talk to actual practitioners.

Appreciate any help. Thanks.

I have been trying to understand network scanning below the Nmap-output level, so I ran a few controlled experiments inside my own host-only lab.

Kali was the scanner (192.168.95.135) and a MISP VM was the target (192.168.95.131).

I captured the traffic in Wireshark and compared:

• ARP resolution before local communication
• ICMP request/reply
• Nmap ARP-based host discovery
• an open TCP port
• the same port after stopping the service
• the same port with firewall filtering
• SYN scanning
• service/version detection

The clearest part for me was seeing the three TCP behaviors directly:

OPEN: SYN → SYN/ACK → RST

CLOSED: SYN → RST/ACK

FILTERED: SYN → no response → retry

I wrote up the full experiment with the Nmap output and packet captures here:

https://chronosandcode.com/what-actually-happens-when-you-scan-a-network-arp-icmp-tcp-syn-nmap-and-packet-analysis-explained/

Everything was done against systems in my own isolated lab.

I will be interested to hear what packet-level experiments helped other people understand Nmap better.

I'm enthusiastic about research and recently got in touch with a student writing his own paper. Now my topic is dynamic datasets for cybersecurity intrusion detection in UAV networks in dense environments. As someone new to these terms, help me out, seniors: where should I start, and how should I start writing it ? What should be my design process? How to collect resources and materials, etc?

I know some basics in programming like i know how to read a script and i know some networking but not advanced and some linux , do you recommend to start cybersecurity at HTB ? do you think it time to get in or still i have to learn in advanced ?

Hey everyone,

Background: I've spent the last 3 years in information security.

I'm currently working through Practical Malware Analysis, and my plan is to document what I learn — the concepts, lab walkthroughs, and techniques — as short-form videos and longer breakdowns, partly to lock in my own understanding and partly because I know a lot of people study this book and might find the bite-sized version useful.

Before I get too far into it, I'd genuinely appreciate advice from people who've either gone through PMA themselves or have made educational malware analysis content publicly:

- **Which chapters/labs actually translate well into short-form (60-90s) content**, vs. which ones are only useful as full-length walkthroughs? I'm guessing static analysis basics (PE headers, strings, imports) work fine short, but dynamic analysis / unpacking probably needs more room to breathe.

- **Responsible disclosure / OPSEC around samples** — what's the norm for showing malware behavior publicly? Sandboxed screenshots only, no live samples shared, anything else I should be careful about?

- **Sequencing** — is it better to go strictly in book order, or restructure around themes (static analysis → dynamic analysis → unpacking → anti-analysis techniques) for a content series?

- **Tooling** — beyond what's in the book (IDA, OllyDbg, etc.), is there anything more current worth introducing early to keep the content relevant?

Idk if I’m asking In the right place

Im a Cybersecurity student and I can’t really pick the project I’m working on in university

but it’s ( AI-based phishing email detection system with ML and NPL )

And I think it’s the most basic project and I do wanna improve it somehow to add something new or fill a gap or improve systems already existing but idk how and I could use some help .

For the past 8 months, in my spare time, I’ve been working on a personal project with the goal of studying the old SMB1 down to its lowest levels. During this time, I’ve dissected the protocol using Wireshark, waded through Microsoft’s documentation (help!), and reverse-engineered the authentication phase. I also used AI as a tool for debugging and to help wrap my head around some of the more complex mechanisms, though the overall structure, architecture, and code were entirely designed and written by me.

So, I decided to build a lightweight server designed to 'trick' SMB clients into authenticating against it (similar to what the famous tool Responder does). I chose to hand-craft virtually the entire SMB1 stack, or at least enough of it to capture hashes. To achieve this, I wrote all the necessary network parsers from scratch: SMB1, ASN.1, SPNEGO, and NTLM, followed by the server itself.

It was both challenging and incredibly rewarding to dive so deep into a protocol famous for its complexity. I learned a huge amount along the way.

In the end, I think it turned out to be a cool little project, so I decided to share it. It’s certainly not meant to replace well-established tools, but if anyone wants to try it out or contribute in any way, I’d be thrilled! 🙂

https://github.com/lcky00/impostor

So i recently registered with NIOS or senior secondary, and I just wanted to confirm a few more things from students who've been there before, although I did contact them for every detail and they assured me that it is a safe and very prominent platform. Anyways it's their job I just wanted to confirm from students whether it is a safe option or not, also how did y'all pay, any classes attended? And was your examination centre at your study centre only ? What about practicals and all?

Hi everyone, I’m an undergraduate planning my FYP around a Network Intrusion Detection System (NIDS) that uses a Graph Neural Network (GNN) to detect network intrusions and potentially trigger preventive responses. My current plan is to use GraphSAGE as the main model, initially train it on CIC-IDS2017, and potentially use additional datasets for evaluation. The eventual goal is to have a prototype that can monitor network traffic, classify traffic as benign/malicious (and possibly identify the attack type), and generate alerts.

The part I’m most unsure about is how to represent the network as a graph. I’m considering things like IPs/hosts as nodes and network flows as edges, with features such as protocol, ports, packet/byte counts, flow duration, packet lengths, TCP flags, inter-arrival times, and connection statistics. I’m not sure which of these features are actually useful, whether IP addresses/ports should be included, or whether there is a better graph representation for NIDS. I’d really appreciate advice from anyone who has worked with GNNs or network security.

I also have very little practical experience developing ML models, so I’m trying to make sure I’m not choosing an unnecessarily complicated approach. Would GraphSAGE be a reasonable architecture for this problem, or would you recommend GCN/GAT/temporal GNNs or something else? Should I build traditional ML baselines such as Random Forest/XGBoost and compare them against the GNN? Also, is CIC-IDS2017 still a reasonable dataset to start with, or should I combine it with another dataset?

Finally, what would you add to this project to make it a strong but realistic FYP? I’m considering detection, visualization/alerts, and potentially automated prevention such as temporarily blocking suspicious traffic, but I don’t want to turn it into an impossible project. Any advice on graph construction, features, datasets, evaluation metrics, real-time detection, or common mistakes would be extremely useful. I’m especially interested in hearing from people who have actually built NIDS/GNN/ML projects.

I would really appreciate the responses

I am a 3rd year cyber student and I want to apply for internships and improve my skills.

I am planning for the SOC analyst role and further on.

Can anyone suggest the list of skills and tools needed to increase my chances of internship?

Also if possible can anyone mention projects to improve my skills which would have a good impact on my resume?

Hi everyone! I'm currently working on a school project and I'm collecting responses for a short anonymous survey. If you have a few minutes to participate, I'd really appreciate your help! Your responses will only be used for my school project. Thank you so much to anyone who takes the time to respond! (https://docs.google.com/forms/d/e/1FAIpQLSeX47QxdGyRa7Y9nXZcYetiEwULV7SX5zjMxATPApwF6VuslA/viewform?usp=header)

Hey everyone,

​I'm the President of a newly established, officially recognized university cybersecurity student organization. My executive board and I want to launch a practical, real-world project this year that leaves a lasting legacy for future student cohorts and our campus community.

​Rather than just running internal CTFs or technical labs, we want to build/implement something that directly impacts the daily lives of everyday students, faculty, or non-tech majors on campus.

​A few ideas we've tossed around:

​An open-source, campus-wide Phishing/Scam Alert Bot for messaging platforms.

​A physical USB Sanitization Kiosk (Raspberry Pi/Linux-based) set up near campus printing areas.

​A basic WiFi & Personal Device Security Audit guide/tool for students.

​For those who have run or participated in university cyber clubs, what kind of practical, high-utility projects worked best for your campus? What are the biggest traps to avoid when deploying something for general student use?

​Appreciate any insights or project suggestions!

Hey r/netsecstudents

I wanted to run a quick, fun security experiment on code generated entirely by AI agents. I’ve deployed the platform live and want to see if the authentication and access controls hold up against real testers.

• Target URL:https://rizq.estate
• Goal: Bypass authentication or escalate privileges to access the restricted admin panel/dashboard.
• Reward: $5 for the first person to send valid proof of access.

Proof of Concept (PoC): Send a DM with:

1. A screenshot inside the restricted admin panel.
2. A short explanation of the exploit (IDOR, Auth bypass, Broken Access Control, logic flaw, etc.).

Rules of Engagement:

• Allowed: Application-level vulnerability testing (auth logic, access controls, injection, API endpoints).
• Not allowed: DoS/DDoS, brute-force spamming, attacking third-party hosting infrastructure, or destructive payloads (do not delete or corrupt existing listings).
• Optional: Add X-Bug-Bounty: reddit-[your_username] to request headers to identify ethical testing in the logs.

Let’s see if AI-generated architecture holds up or fails. Happy hunting!