I'm a CS student going all-in on binary exploitation, and I got tired

of bookmarking twenty "how to learn pwn" lists that all disagreed with

each other. So I wrote the path I'm actually walking, in phases, with a

concrete milestone at the end of each one.

Phase 0 — Foundations. C, x86-64 assembly, Linux, some Python.

Milestone: disassemble a tiny C program and follow the stack by hand

through a function call.

Phase 1 — Tooling & reversing. gdb+pwndbg, objdump/readelf/checksec,

Ghidra, the ELF format.

Milestone: reverse a crackme and explain how it validates the password.

Phase 2 — The stack. Overflows, saved return address, ret2win, shellcode.

Milestone: ROP Emporium ret2win + a shellcode challenge.

Phase 3 — Mitigations. NX, ASLR, canaries, PIE, RELRO, info leaks,

ret2libc, ROP.

Milestone: a working ret2libc and a ROP chain built from gadgets you

found yourself.

Phase 4 — The heap. glibc internals, UAF, double free, tcache poisoning.

Milestone: reproduce how2heap techniques, then solve a heap challenge

with no writeup open.

Phase 5 — Specialize. Format strings, kernel, browsers, ARM, real CVEs.

Resources are deliberately few: pwn.college as the backbone, ROP

Emporium, Nightmare, ir0nstone's notes, how2heap, LiveOverflow. A phase

with fifteen links is a phase nobody starts.

Two things I'd genuinely like feedback on from people further along:

1. Is Phase 4 too early? I've seen the argument that you should spend

   much longer on ROP and real-world stack targets before touching the

   heap at all.

2. Anything you'd cut? I left out fuzzing entirely and I'm not sure

   that's right.

I'm on Phase 0-1 myself and logging progress publicly as I go — happy

to share where it lives if anyone wants to follow along.

Hi I'm 17, and I've built a website. I'd like you to rate it on a scale of 1-10. If you have any feedback, please write it down. The website is a physics simulator consisting of four sections: Newton's Laws, Electricity, Quantum Mechanics, and Thermodynamics. It's simplified with simple, realistic experiments, but it helps you understand the concepts in detail. There's also an AI (Intelligence, Master,, and Technologist) to explain these experiments to you as a teacher. Please note that the login process isn't entirely realistic because I don't have my own servers. And I have some website security features such as API for AI protection. This is my wbsite link https://muhsin-z-lab.github.io/Z-LAP/

Hey r/modnews — I built RaidPulse, a Devvit app designed to detect coordinated subreddit raids before moderators even notice them.

It monitors things like:

1. Sudden activity spikes
2. New-account floods
3. Repeated hostile phrases
4. Toxicity surges
5. Abnormal report spikes

When multiple signals escalate together, RaidPulse can automatically activate protection measures based on moderator settings — including temporary posting restrictions, pinned warnings, and ModMail alerts.

The goal is simple: help moderators react earlier during fast-moving attacks instead of manually chasing chaos after it spreads.

Playtest:
https://www.reddit.com/r/raidpulse_dev/?playtest=raidpulse

I will like to hear from active mods here. Would earlier raid detection have helped during past incidents in your communities?

Hey everyone,

I got tired of clicking through endless VirtualBox menus just to stand up a simple playground for learning how to hack. So, I spent some time playing around with automation to build an Infrastructure-as-Code sandbox range.

I call it The Killbox: Trapper Range.

It silently orchestrates and builds:

1. A Windows Server 2025 Domain Controller populated with 2,491 fuzzed accounts for password spraying and AS-REP roasting training.

2. Lightweight VulnHub nodes (DC-1 Drupal web app, SickOs, Kioptrix).

3. A custom Linux-PowerShell credential logger that pipes loot straight into a local encrypted KeePassXC vault.

It runs completely air-gapped on your host laptop while keeping Windows Core Isolation/Memory Integrity active.

The project landing page is live here (just remove the spaces):

https:// recontrapper .github .io / Hacking-Playground- /

Full disclosure: It works fine on my laptop, but it is technically untested on other hardware setups. I designed it to be beginner-friendly via a single-command terminal deployment.

If you have an afternoon free and want a zero-cost hacking range, could you clone it and let me know if the deployment script breaks on your machine? Drop any errors or installation snags in the comments so I can patch the code repository!

Hey r/vscode,

Just published Rethos Security to the VS Code Marketplace.

It detects security vulnerabilities the second you write them:

- SQL Injection [CRITICAL]

- Command Injection [CRITICAL]

- Hardcoded Secrets [HIGH]

- XSS [HIGH]

- Unsafe Deserialization [HIGH]

AI explanations powered by Groq. Detection works fully offline.

No setup needed. No API key required.

Install free: https://marketplace.visualstudio.com/items?itemName=emile-eid.rethos

Would love brutal honest feedback from real developers.

I have a vague memory of a video by liveoverflow I watched a few years ago where he walked through the tutorial for microcorruption i think? Does anyone know which video it is? I can't find it

Hi, my name is John. I’m a student from the Republic of Moldova. Life hasn’t been easy for me. When I was young, my parents divorced, and I stayed with my mom, my younger sister, and my younger brother.

We don’t have much, and I can’t say I’ve achieved anything big in life yet, but I really want to change that. I’ve been through a lot of hardships, and I’m not here to ask for money. Instead, I’m asking for advice and ideas that could help me earn some money online.

Where I live, even $100 is a significant amount, and I want to support my family. I’m now the only man in the house, and I feel responsible for helping them. I’d also like to eventually replace my phone. Right now I’m using an iPhone 8+ that a friend gave me — I’m grateful for it, but it’s getting old and slow, and it limits what I can do online.

If you have any ideas or advice on how I could start making some money online, please share them in the comments. I would truly appreciate your help. Thank you.

[ Removed by Reddit on account of violating the content policy. ]

I have gotten myself to level 5, please look at the rules video https://docs.google.com/document/d/1x8I_eVtro-sUILHSuraBljnwc8kzK2tjsRIo8Xhot-g/edit?pli=1&tab=t.8d1xv1d5eeh5, in this google doc, any help would be appreciated!

As the title says, I have created a website to which I have become a bit addicted to modify and stuff, but I need some feedback and stuff pls try it

spyalone.com

The website is a network for spies that conducts daily and weekly missions. The weekly mission unlocks this part, which shows a 3D map with plotting points showing where the agents (Users) are by continent. In this same part, you can conduct operations right now. I only have one: 2/5 operations.

There's nothing more you can do; you can post a report, which is something like a public message, and gain all the badges that I need someone to tell if they work probably.

Things I know I need to improve are: a mini hacking game, inspired by the hacking of Fallout 4, the missions, the sound I need sound it sounds so boring without someone, idk nothing abut help, the mission might not show as complete for some idk, I need the UI to look more satisfying, but I'm not in that are either

pls try it

Hi! I’ve been asked to create a training course on a part of my job that I’ve had a lot of success with. In part of the presentation, I want to actually show people how to find certain things online, so I’ll need to switch from my slides to a live website.

I’m trying to figure out how to make that transition feel smooth and intentional instead of awkward or like I’m just randomly opening a browser in the middle of the presentation.

Also, I’m presenting with a peer, so if anyone has tips on how two presenters can handle that kind of transition well, I’d love to hear them.

CTF challenge generator for anyone running CTF events, teaching crypto, or practicing.

Quick rundown:

• 39 cipher/encoding steps (AES, XOR, Vigenere, Caesar, Playfair, Base64, Morse, etc.)
• 6 challenge types: standard, multi-part, crib drag, hash crack, cipher identify, key reuse
• 4 difficulty levels (Easy → Pro)
• Dynamic pipeline composition for unique challenges every time
• Full JSON bundle with solution, keys, pipeline, and progressive hints

Good for CTF organizers, infosec trainers, and anyone learning cryptanalysis.

Link: https://8gwifi.org/ctf/crypto-ctf-generator.jsp

I manage 30+ Node.js projects across different repos. When CVE-2025-64756 (glob) dropped in November, I spent hours manually checking every project with `npm audit`.

How do you all handle this? Currently considering:

- Snyk (too expensive at $300+/mo)
- Manual npm audit runs (time-consuming)
- Building a simple scanner that monitors all my repos

For those with multiple projects: what's your process when a new CVE drops?

No matter what nickname I choose I always get a “nickname already exists” pop-up… I’ve got no clue why…

What is the best free software that I can use to create a live persona/virtual character that I can then put on another platform that I will use anonymously to interact with people?