📚 Learning97

Web Security Academy is PortSwigger's free online web security training. It is known to combine learning material with hands-on labs across web vulnerability classes such as SQL injection, XSS, SSRF, authentication flaws and request smuggling, and to be built around Burp Suite. The page had no extractable text, so this description comes from the URL and general knowledge of the site.

portswigger.netcourseAdded 30 Oct 2026

The Web Security Academy is PortSwigger's free online training center for web application security. It combines written topic explanations, videos and interactive labs, with content from PortSwigger's research team and Dafydd Stuttard, author of The Web Application Hacker's Handbook. Labs can be solved with Burp Suite Community Edition, progress is tracked per account, and first solvers of new labs appear in a Hall of Fame.

portswigger.netcourseAdded 30 Oct 2026

Explainer on "shell" vulnerabilities, the -Shell naming for RCE flaws that began with Log4Shell (CVE-2021-44228). It compares memory-corruption bugs (PHP2Shell, CVE-2026-109618 and CVE-2026-109619; Node2Shell, CVE-2026-111497, in the Brotli decoder) with design-flaw bugs (Log4Shell, React2Shell, CVE-2025-55182). It covers shared traits, exposure through inherited components, and Brotli patch status across runtimes and distributions.

aikido.devarticleAdded 30 Oct 2026, published 29 Oct 2026

Windows Prefetch forensics tutorial from Hackers Arise. It explains that prefetch files in C:\Windows\Prefetch record last run time, run count and files touched, so they prove an application was used even after deletion. It shows parsing with NirSoft WinPrefetchView, building a timeline from Last Run Time, and how a suspect could disable Prefetch or Superfetch (SysMain).

hackers-arise.comarticlePublished and added 29 Oct 2026

A practical reverse-engineering map by hakimieiqbal on X that picks tools by target: native binaries, .NET, Electron, iOS, firmware, WebAssembly and network protocols. It introduces REA (morluto/rea), which connects coding agents to RE tools, and lists MCP bridges for IDA Pro, Ghidra and radare2. It adds an evidence-first workflow and free courses such as pwn.college and OpenSecurityTraining2.

x.comthreadAdded 29 Oct 2026, published 28 Oct 2026

Part 3 of the AWS Security Blog series on cybersecurity careers profiles three AWS staff: Brandon Caldwell (application security, empathy and communication), Kurt Heath (self-taught pen tester, cautious AI use) and Seth Jeacopello (code review, managing attention). It gives practical advice: practice on vulnerable machines and read the logs, build CTF and GitHub portfolios, and write clearly. It lists TryHackMe, Hack The Box, the OWASP Top 10, OWASP Cheat Sheet Series, Darknet Diaries and AWS Skill Builder.

aws.amazon.comarticlePublished and added 27 Oct 2026

The ViktorUJ/cks course is an open-source, community-maintained preparation course for the CKS (Certified Kubernetes Security Specialist) exam. It has 33 chapters grouped by CKS domain: cluster setup, hardening, system hardening, microservice vulnerabilities, supply chain, and runtime security. It also has 15 labs with automatic checks (labs 101-114), mock exams and Killer.sh guidance. Core labs target Kubernetes v1.36.

github.comcourseAdded 27 Oct 2026

AdaptixC2 listener configuration guide, second in a Hackers-Arise series. It walks through the fields for BeaconDNS, Beacon HTTP, Beacon SMB, Beacon TCP and Gopher TCP listeners, including DNS burst mode, HTTP URIs, User-Agents and redirector callback addresses, SMB named pipes, TCP prepend data, and mTLS. It also explains external versus internal listeners for lateral movement.

hackers-arise.comarticlePublished and added 26 Oct 2026

Code security for new coders is a Datadog Security Labs primer for vibe coders on first-party versus third-party code, hardcoded secrets and software supply chain risk (vulnerable and malicious dependencies). It lists security questions to put to a coding agent before and after code is written. It also defines SCA, SAST, IAST, DAST, IaC scanning and secret scanning, and cites the PHP2Shell vulnerabilities.

securitylabs.datadoghq.comarticleAdded 29 Oct 2026, published 26 Oct 2026

UTS #39 (Unicode Security Mechanisms) is the Unicode Consortium's technical standard for detecting identifier spoofing. It defines the General, IDN and Email security profiles for identifiers, confusable detection through skeleton and bidiSkeleton mappings, and mixed-script detection with resolved script sets and Restriction Levels. It also covers limited contexts for ZWJ/ZWNJ and the confusables and identifier data files. The fetched text is truncated, so later sections are not covered.

unicode.orgpaperAdded 26 Oct 2026, published 25 Oct 2026

GitHub Bug Bounty spotlight interview with @r31n, a researcher known for GitHub Enterprise Server findings. They describe a source-and-sink approach to mapping trust boundaries, chaining minor bugs (open redirect plus allowlisted SSRF that follows redirects), and confirming a finding only with a working PoC. They also cover using AI for code navigation and PoC scripts, and treating model output as untrusted input.

github.blogarticlePublished and added 22 Oct 2026

Live-Forensicator is a cross-platform (Windows, Linux, macOS) live response toolkit built around Forensicator.ps1. The Hackers Arise walkthrough runs it on Windows with case details, then reads the HTML report: event log summary (Event IDs 4624, 4798, 4799, 4688) and a risk rating. It also shows optional AI analysis through Ollama with a Mistral model, configured in config.json, and warns that the tool triggers AV and that AI slows runs.

hackers-arise.comarticlePublished and added 20 Oct 2026

SecurityKid Labs is a practice platform for vulnerability code review built on real GitHub security advisories, de-identified and scrubbed. Users get a scope and a diff, pin the vulnerable line, name the root cause, and defend claims against an AI mentor. They then see the advisory patch and can earn verified badges and public writeups. The page gives no case list or pricing.

labs.securitykid.comtoolAdded 20 Oct 2026

Hands-on walkthrough of Maigret, an open-source Python tool that checks a username against 3,000+ sites (top 500 by default) and builds a profile dossier by parsing public profile pages and recursively searching newly found usernames. Covers installation from GitHub, single-site and tag filtering, username permutation, HTML/PDF/CSV/JSON reports, graph output, and an optional LLM summary via OpenRouter. Positioned as a more thorough successor to Sherlock for username reconnaissance.

hackers-arise.comarticlePublished and added 16 Oct 2026

Hackers Arise explainer on the human psychology that social engineers exploit. It covers cognitive overload ("brain DoS"), stereotyped automatic behaviour, and the authority, scarcity and consistency principles, with supporting studies (Milgram, Pliner, Europol fraud-victim statistics). It also describes trigger-bypass techniques such as reframing a password request as IT support, and an observed baseline percentage of recipients who act on phishing emails. It closes with organisational and personal defences.

hackers-arise.comarticlePublished and added 15 Oct 2026

Hackers-Arise tutorial on NVIDIA NemoClaw, an open-source wrapper that runs OpenClaw agents inside OpenShell sandboxes with kernel-level isolation and declarative YAML network/file policies. It covers OpenClaw's security problems (543 tracked CVEs, 40,000+ exposed instances bound to 0.0.0.0 without auth), caveats such as zero-day RCE and sandbox escapes, and install and TUI testing steps on Kali. It also cites a Cisco AI Defense plus OpenShell case study that blocked simulated exfiltration through a third-party skill.

hackers-arise.comarticlePublished and added 14 Oct 2026

Token Security's "Agentic Universe" is a free learning hub for security and identity teams securing AI agents. It sits between shallow video-only overviews and long certifications, with short concept videos, technical deep dives written by practitioners, checklists to run against your own environment, and free tools. The fetched page is a landing blurb that doesn't list the modules or the specific tools, so the depth of the content is unconfirmed.

token.securitycourseAdded 14 Oct 2026

Part 2 of the AWS Security Blog's cybersecurity careers series. It profiles three people in less-publicized security roles: Jason Lane, who works backward from a vulnerability research goal and now measures risk across about a million Amazon applications. Jason Goodman moved from customer service through insider threat, adversarial detection and application security. Harshvardhan Chunawala advises startups and has worked on lunar rover operations and satellite incident response. It closes with pointers to the NICE Workforce Framework, CyberSeek, AWS Skill Builder and CISA resources for exploring roles.

aws.amazon.comarticlePublished and added 13 Oct 2026

The Security-Engineering Convergence (Edition 1.1) by Peter J. Hillier is a free, CC BY 4.0 technical book on Systems Security Engineering (SSE) as the security specialty within systems engineering. It runs from mission needs and loss scenarios through requirements, secure architecture, cyber resilience, verification and validation, acquisition, assurance cases, operations and retirement. Later chapters cover supply-chain assurance, legacy and cloud-dependent systems, systems-of-systems, and AI and autonomy. It ships as PDF, EPUB and a companion ZIP of worksheets, worked cases and standards crosswalks. It argues that meeting compliance controls is not the same as engineering evidence for mission outcomes.

pjhillier.github.iootherAdded 13 Oct 2026

Omar Santos's companion repo for his Pearson/O'Reilly trainings and books, organised in eight parts. They cover LangChain prompts, chains and RAG (Chroma), and agents (LangGraph, CrewAI, DeepAgents). They also cover FastMCP security servers (nmap, CISA KEV, Shodan) and attack-surface-management and SOC agent examples. Later parts have security guides to six agentic frameworks (OpenClaw, Hermes, Agent Zero, OpenHands, Paperclip, Buzz) with hardening notes and 2026 CVE mapping, agent cost/tokenomics scripts including denial-of-wallet budget guards, and a vendor-neutral spec for a human-gated multi-agent security-assessment harness (scope manifest, approval gates, kill switch). Useful as a hands-on path into AI-agent security tooling, with warnings that some examples act on real systems.

github.comrepoAdded 13 Oct 2026

Omar Santos walks through his eight-part AI-agents-for-cybersecurity repository: LLM building blocks (LangChain, RAG), then security agents with LangGraph, CrewAI, DeepAgents and MCP servers (nmap, CISA KEV, Shodan), a hardening guide for six agentic frameworks, token-cost control for agents, and a spec for a supervisor-led, human-gated security-assessment harness. It covers concrete design lessons such as least-privilege subagents, staged response actions, single-use approvals bound to exact actions, kill switches, and mapping controls to the OWASP Top 10 for Agentic Applications. Also notes Project CodeGuard rules shipped for AI coding assistants.

becomingahacker.orgarticleAdded 13 Oct 2026

Omar Santos walks through his AI-agents-for-cybersecurity GitHub repo, which has eight parts. Parts 1–4 cover LLM basics (LangChain, prompting, LCEL, RAG). Parts 5–8 cover building security agents with LangGraph, CrewAI, DeepAgents and MCP servers (nmap, CISA KEV, Shodan), and a hardening baseline for six ready-made agentic frameworks. They also cover token-cost control (caching, routing, budget guards, cost per accepted outcome) and a supervisor-led, human-gated security-assessment harness spec with single-use approvals, a kill switch and an append-only audit log. The post also covers Project CodeGuard rules for AI coding assistants. It is a practical learning path and a reference for governing and securing agents.

linkedin.comarticleAdded 13 Oct 2026

Explainer on Static Application Security Testing. It covers how SAST builds an AST and runs taint analysis from sources to sinks, which flaw classes it catches (SQLi, XSS, hardcoded secrets, weak crypto) and which it misses (IDOR and other access-control bugs). It compares SAST with DAST and SCA, cites false-positive and false-negative figures (91% false positives in a 2025 study of about 3,000 repositories; 47–80% of vulnerabilities missed), and argues for reachability analysis and reasoning-based AI SAST. It ends with evaluation criteria and a rollout plan; the vendor's own benchmark claims are preliminary.

endorlabs.comarticlePublished and added 12 Oct 2026

Vendor-authored guide that defines a software supply chain as developers, code, dependencies, AI models, containers and CI/CD pipelines. It walks through program components: OSS governance, SAST vs reachability-based SCA, AI model security, SBOM/VEX (NTIA minimum elements, SPDX vs CycloneDX), secrets scanning, CI/CD hardening, and signing/attestation with Cosign/Sigstore. It cites figures such as 95% of vulnerabilities sitting in transitive dependencies and only 1% of SBOMs being fully NTIA-conformant. Each section closes with an Endor Labs product pitch, so treat the framing as vendor-flavoured. The fetched text was truncated, so the final attestation/provenance section was not seen.

endorlabs.comarticlePublished and added 12 Oct 2026

A LinkedIn-hosted PDF guide to Claude Code hooks, subagents, MCP tools and custom slash commands. It covers the hook configuration in .claude/settings.json, the event payloads (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart), and exit code 2 as the way to block an action. It includes worked examples of safety hooks: a regex-based PreToolUse script that blocks rm -rf, curl piped to a shell, chmod 777 and privileged Docker containers. Other examples are audit logging, TDD enforcement and session context loading. Useful as a practical reference for putting deterministic guardrails around an AI coding agent, though the regex blocklists are easy to bypass.

media.licdn.comcourseAdded 9 Oct 2026

awesome-reverse-engineering is a CC0 curated list of reverse-engineering tools and learning resources, organized by task: triage, native analysis, debuggers, instrumentation, deobfuscation, malware analysis, mobile, firmware, file formats, games, diffing, symbolic execution, lifting and AI agents. Each entry notes licensing, maintenance status and prerequisites. It also covers MCP integrations, CTF practice sites and related awesome lists.

github.comrepoAdded 27 Oct 2026, published 9 Oct 2026

GitHub Bug Bounty spotlight interview with VIP researcher @vaib25vicky, who specializes in authorization and access control findings. They describe a feature-first methodology (deeply explore a feature until something odd surfaces, rather than hunting by bug class), discuss using AI as a productivity aid that still requires manual verification before submission, and note that most high-impact AI-feature bugs reduce to classic authorization issues and weak guardrails. The post also covers GitHub's restructured VIP bounty program (up to $30k+ payouts, invite criteria based on resolved severity counts).

github.blogarticlePublished and added 8 Oct 2026

Tutorial on setting up Kubernetes Agent Sandbox (kubernetes-sigs/agent-sandbox) with gVisor on an AWS EKS cluster. It runs a troubleshooting AI agent backend inside a sandbox using SandboxTemplate, SandboxWarmpool and SandboxClaim, and runs untrusted Python through the k8s-agent-sandbox SDK and Sandbox Router. Probes show blocked /etc/shadow reads, setuid and service account token access, plus host process isolation. It also covers scheduled deletion and suspend/resume with persistent volumes.

devopscube.comwriteupAdded 21 Oct 2026, published 7 Oct 2026

First part of a Hackers-Arise series teaching CUDA (NVIDIA Compute Unified Device Architecture): installing the CUDA toolkit and nvcc compiler on Kali or Debian-based Linux, writing a basic CUDA C++ kernel, and compiling and running a simple parallel vector-addition program. It explains GPU threading concepts (kernels, thread blocks, grids) and frames CUDA as foundational to AI workloads and to future security applications like password cracking, real-time threat detection and post-quantum cryptography, though those applications are only listed, not demonstrated, here.

hackers-arise.comwriteupAdded 7 Oct 2026, published 6 Oct 2026

A Hackers-Arise tutorial explaining how Web Application Firewalls detect attacks (signature-based, anomaly scoring, behavioral analysis) and how to fingerprint which WAF a target uses via HTTP headers, curl probing, or the WAFW00F tool. It then covers three concrete bypass techniques — double URL encoding, Unicode normalization mismatches, and ASCII smuggling via invisible Unicode tags — that let malicious payloads like XSS slip past WAF filtering before being decoded by the backend app.

hackers-arise.comarticleAdded 7 Oct 2026, published 5 Oct 2026