https://preview.redd.it/0aualkit5xuh1.png?width=1366&format=png&auto=webp&s=0cec02b43a49b9e03dbe0f959b187d49c24c0919

I've been working on this for a while and I've hit the limit of what I can test on my own gear.

It's called wifisting and its a GTK4 desktop app for Linux that puts the whole workflow in one place instead of spread across fifteen terminals.

Still early. Not production ready. Linux only.

Some people won't like it cause it's a GUI. Fair enough, if your workflow is a terminal, a GUI is in the way.

Two things though. The modules are all standalone scripts. Nothing is locked behind the interface, you can call any of them directly and script them however you want. The GUI is a view over them, not a container.

Hardware

For the hardware, you'll need an adapter that can inject. Atheros AR9271 is what I built and tested against, so things like the TP-Link WN722N v1 or an Alfa AWUS036NHA.

Some modules need more hardware, an SDR or a Bluetooth dongle or NFC. The GUI marks which ones.

what's actually in it

The reason I built it is that most wireless tools are deep in one lane. aircrack-ng is wifi. bettercap is network mitm. bluetooth tooling is bluetooth. So an assessment means five tools, five configs, and no shared view of the target.

This covers wifi L2, so deauth, floods, evil twin, karma, captive portal, wifi direct. Wifi crypto, so WEP, handshake and PMKID capture, WPS pixie and PIN, WPA3 and Dragonblood, SAE. Enterprise, so 802.1X relay, PEAP and TEAP, GTC downgrade, PMF bypass, KRACK, FragAttacks.

Then mitm and credentials, so Responder, mitm6, ntlmrelayx, router advertisement poisoning, arp mitm, rogue dhcp, resolver poisoning, usb ethernet mitm.

Client isolation testing and a relay for maintaining a bypass.

Router side, so LAN enumeration, TR-064, HNAP, UPnP, SNMP, DNS rebinding, CSRF, web UI, console and TFTP.

Bluetooth, classic and BLE recon, SSP, advertising forgery, BLE fuzzing, mesh, tracker hunting, CVE scanning.

RF stuff, sub-GHz, LoRa, Zigbee, NFC, drone remote ID.

Plus the analysis side, signal and channel mapping, statistics, capture analysis, audit grading, device fingerprinting, multi-node capture.

what I want feedback on

Does it start and stay up on your distro. GTK4 version, wayland vs X11, missing deps.

Does it get your adapters right. Wrong hardware detection is worse than none.

Modules that say OK but didn't do anything. This is the one I care about most. If it reports success and the target is untouched, that's the bug class I'm hunting.

Whether 56 modules in categories makes any sense to navigate.

Anything that crashed or hung or wedged your adapter.

what I already know

Only properly tested on Arch family and Ubuntu derivatives.

Some modules need hardware I don't own. They're written properly but unproven.

Report and cleanup paths are less polished than the attack paths.

Docs are thin. I'd rather hear what's confusing than guess at it.

if you want to try it

If you want to try the toolbox, send me a DM on reddit or discord and I'll give you a Google Drive link or the tar.gz archive on Discord. thanks in advance I'd really appreciate any kind of help I can have especially for the modules that needs hardware I don't have so feel free to tell me what's wrong or broken in the toolbox or if there's anything missing that'd be a great addition etc...

VigilOSS - https://github.com/VigilOSS/Vigil

I built this tool because I was interested in Bug Bounties, wanted to learn how far AI could go at finding bugs, and was very interested in whether it could remove the mundane parts I remember from preparing for my OSCP.

Over time it went from a pile of prompts to a structured harness for long-running engagements. It's the result of hundreds of hours of running it on real targets, watching where it went wrong, and refining.

An operator agent coordinates specialist agents, and most every tool runs through one shared Kali container. Scope, attack surface, coverage, commands, credentials, evidence and findings live in a backend that survives restarts and compaction, so the agent doesn't redo work or forget why it ruled something out. It works with Claude Code and Codex. One engagement can mix source review and live web testing, and a bug found in code and then confirmed live stays as one finding.

I've used it on authorized HackerOne programs for findings that paid out more than $12,000 (Scanning large amounts of source maps, finding potential bugs, and having the web engagement test and verify). It has been most useful on large codebases, where tracking what has and hasn't been reviewed is harder than finding any single bug.

Hi experienced and junior pentesters

I would like to get a job as a pentester. Currently living in London, really interested in bug bounty and Pentesting I don't know what to do to get a job, I know about vulnerability types, recons burp suite, I reported some bugs but they were out of scope or N/A, no paid bugs yet. What exam do I need (except OSCP it is too expensive). Is there anything I can do daily? I am not coming from coding background,I have 3 years IT support experience, I know not enough but I have compTIA A+, MS900, SC900 certs. Any comments, any help much much appreciated. Thanks a lot in advanced.

My schedule is tight, so I can realistically spend about 30 minutes a day learning cybersecurity. I know that is not much, but I am curious how far consistent effort like that can take someone over several years.

I am mainly interested in how systems, networks, and computers work under the hood, especially how they can be broken, exploited, and analyzed from an attacker’s perspective. My interests are broadly in offensive security and skills related to pentesting and red teaming.

I am not currently learning this to get a cybersecurity job. I am interested in the subject itself and in developing a deeper understanding of computers, operating systems, and networks.

With 30 minutes a day, what level of knowledge and skill could realistically be reached over 3 to 5 years? Assuming someone stays consistent, how far could they get, and what kind of foundation could they build?

How do you handle this? You have a repeat client over multiple years. In the first few years, you're finding the same issues and the client is not fixing them. It turns out to be a lot, to the point of taking up all your available time to find and document them.

Now you get to the next year, same kind of test. During the initial meeting, would you ask the client:
Did you remediate these issues we found previously? If yes, great. We can validate that. But if the answer is no, and the answer is no to most or all of them, ask whether they want them tested again.

The reasoning here can go either direction. The client says yes to wanting them tested again, but then you're repeating your work and telling them what they already know and might have little to no time to find new issues. Or the client says no to testing the same issues, you document that in the report and then search out new issues.

My thinking is to have good documentation of the issues the client did not want retested and they acknowledged that those issues exist. This way if the client is compromised via one of those paths, they don't come back with the report and say "You didn't test this!" Well they can, but that's the importance of the documentation of the client's decision.

I maintain Chrome UX Report Dumps, a collection of monthly Chrome UX Report website lists grouped by rank and published as compressed downloads. It’s meant to make the data easier to use without exporting it from BigQuery.

The latest update adds the August 2026 dataset: 18,294,881 entries across 10 files, totaling 94.7 MiB compressed. The repository now contains 1,064,254,496 entries across 67 monthly datasets, totaling 5.32 GiB compressed. Those are counts across monthly dumps, not a count of unique websites.

If you use website lists for research or security work, I’d welcome feedback. What would make these dumps more useful, and what features or formats would you like to see?

Hey everyone. I’m currently on a Red Team engagement where we need to test a client’s MFA implementation (specifically their rate-limiting and fraud detection on the SMS gateway).

I need to trigger about 50-100 verification attempts from "clean" unique numbers to see at what point their WAF or carrier-level filtering kicks in. Using my own team's SIMs is a huge OpSec fail and obviously doesn't scale. Most 'disposable' number sites I've tried are already in the client's WAF blacklist. How do you guys source high-quality mobile lines for testing MFA logic without being blocked instantly?

Over the years, I have been asked to conduct physical pentests for large companies. They almost always ask for credentials. Usually I use my or my employee's backgrounds as "credentials", though I am curious if there are any certifications someone could earn in physical penetration testing.

Do you guys use any AI automated pentesting platforms at your work? Do firms actually buy or use these over regular security audits???