Hi everyone! I’m comfortable with Linux Essentials and Network+, and I’ve completed about 50% of the Junior Penetration Tester path on TryHackMe. But the further I go, the more difficult and unfamiliar the commands become.

For example, in the Hydra section, there were some options used to find the flags that weren’t explained in the text at all. Now I’m not sure what I should do or what I should study to become comfortable with these tools.

Should I take a course like CEH? What would you recommend? What did you guys do when you were starting out?

Hi there, I’ve been trying to start a pen testing career/course and I need deciding what’s the best option out there for an online course of pen testing. Last year I bough the INE one during Black Friday sale but to be honest it felt pretty boring not a lot hands on and kinda lost the feeling of it. It felt pretty dry and boring to be honest.

Thanks in advance!

I'm working on a pentest agent not just for CTFs, but designed to actually run against real client targets

While researching, I found that both Anthropic and OpenAI have cyber-related safeguards integrated into their standard APIs that block cybersecurity prompts

My Questions are :

1. Is anyone building pentest agents hitting the same problem?

2. Do any of the Chinese models have these restrictions?

Would appreciate any real-world experience!

Violin is now at v3.0.1 on master.

It is a Hermes-native profile for supervised, authorised penetration testing, with:

• 31 methodology and vulnerability playbooks

• An execution guard at the target boundary

• Evidence-backed findings and reporting

• Structured scoping and approval gates

• No additional credential broker or provider lock-in

Install:

"hermes profile install https://github.com/Strategic-Automation/violin"

I’m looking for Hermes users and penetration testers to test the installation and engagement workflow and report where the guard, evidence capture, or reporting process creates friction.

Hey r/Pntesting ,

I'm a pentester who got tired of spending more time writing reports

than actually hacking. So I built PentReport.

Here's what it actually does:

- Add your findings with CVSS scores and evidence screenshots

- AI generates full write-ups (description, business impact,

remediation) — clean prose, no markdown garbage

- Export professional PDF and DOCX in one click

- Deliver to clients via a secure portal instead of emailing PDFs

- Findings library so you never write the same SQLi finding twice

It's live at pentreport.com and completely free during beta.

A few things I want to be upfront about:

- No scanner import yet (Burp/Nessus) — that's on the roadmap

- Your data is never used to train AI models, ever

- SOC 2 compliant infrastructure, AES-256 at rest, TLS in transit

- Full data deletion — delete your account, everything gets wiped

- You can read exactly what sub-processors we use on the site

Doing a small closed beta — DM me if you want an invite code.

Looking for pentesters who write real reports and will tell me

what's broken.

pentreport.com

Hi , i am currently studying for the cpts and i am wondering if i could get a job after i pass the cpts exam, so could you tell how did you get your first pentesting role and if you actually had a prior job experience in any it role .and i heard from people that it is “impossible “ to get a job as a junior pentester so you need to get an it job first like IT help desk and then climb your way to a penetration testing role , is this right?
Note: i am 17 years old and i live out of the us and i have some experience in bug bounty.

Im an engineering (3rd year)college student, I started ethical hacking with a very outdated course on udemy(zaid sabihs old course) but realized that it's not enough and took up the ciscos netacad course on ethical hacking(90% completed rn). Tried some THM (very less) then switched to HTB, did the basics but realized any focused path is actually paid and stopped. Now I'm confused on what to further do cuz I feel like I know stuff but not to apply them. I want to save money on certifications in the future instead of spending them on THM or HTBs dedicated paths. Any advice on what I should further do or what i could do would be much appreciated.

So a bit of context, I am a cybersecurity senior analyst
I am interested in LLMs for that field especially with MCPs to connect them to the tools or for writing scripts

I started this field by doing assembly language reading for hacking games when I was a teenager then that became malware analysis then I started to analyze traffic and logs at work for a living
Before work I competed in cybersecurity competitions known as capture the flag to solve only one category of the challenges and that is malware analysis

Now here is the scene in LLM x Cybersecurity

Entry-level CTF challenges (I used to solve around 2017-2018, got first job in 2019) were solved and saturated by LLMs a long time ago (See intercode CTF benchmark)

Then High level CTFs (NYU CTF Bench, CSAW challenges, and CyBench) these were solved a while ago

Today we have
CyberGym (vulnerability description (CVE report not real details) plus code base find vulnerability
That was solved

Then ExploitGym (the one recent OpenAI model escaped and hacked hugging face to find solution, the 2 vulnerabilities themselves are trivial (JWT spoofing with no server side checks for Jfrog sandbox and JS + Python template in open source data viewer of Hugging face)
Still impressive for a fully autonomous model

ExploitGym gives vulnerability details + exploit technique/details and codebase (I wonder how/why OpenAI model escaped it in the first place those details should manage it this is why I feel it is staged but whatever right)

ExploitBench
More realistic threat vector
1-day not 0-day (0-day is a novel vulnerability no one else knows about it hence the name, 1-day is a known vulnerability patched, if in an open source project you can compare patches before and after and know it but not as valuable as 0-day since people will/should update their software, 0-days can and are used against high profile targets like in some 3rd world countries used for surveillance (and possibly non-3rd world countries ?!) but you usually can’t use a 1-day for that but still)

So ExploitBench is 1-days in V8 engine (used in chrome, electron vs code almost everything!!)

Gives the model a patch diff and codebase base that is it

Models are going wild on ExploitBench and ExploitGym but haven’t gotten there yet at the moment and only recent frontier models improved massively instead of near zero across the board

This is a massive risk indicator
Imagine models capable of exploiting any and every piece of software written by less capable people or other weaker LLMs (complex vulnerabilities!)

Not only that but global elite CTFs like DEF CON

You have an OpenSage harness (and ADK like Google adk or Anthropic adk, however this OpenSage ADK asks the model to design its own agent/s!, with whatever tools or sandbox environments it finds fitting for the Subagent to do the assigned subtask effectively, it can even design its own MCPs!, models don’t fully utilize that yet but some do and improved form like 39% to \~60% just by using that harness (same model!) )

Now my own benchmarks are simple

Some malware samples that I learned during my career and consider personal milestones

And one SIEM analysis challenge (logs that contains an attack plus normal behavior)

I tests on lots of models (Qwen3.6, heavily trimmed down Minimax 2.5 …etc, on my Strix halo and compared with opus at the time (the best opus at the time was 4.5!, it was better solved major stuff but didn’t implement the code required to decompose the malware and analyze its second stage)

Now enter Qwen 3.8 27b
3.
What was SOTA like 6 months ago or around beginning of this year
Now we have better local models at the same task

Qwen 3.8 devoured the malware that Opus couldn’t

I had some time analyzing and remembering its custom implementation (it has custom RC4 decryption routine, that is tricky with string manipulation!
And Strix halo isn’t the fastest LLM machine

By the time I remembered that malware and how it works

Qwen had already extracted and disassembled the decrypted payload!

I am stunned

This is super dangerous

I imagine how a single person / threat actor can now do what a state-sponsored intelligence service shacking team was required to do 1 year ago

These teams usually have

Usual network scanning or mapping especially of their targets
This can be easily done by even weaker models or no models at all

Initial access operations (phishing campaigns until some clicks or attempting to profile people like receptionist or sales people or HR, essentially any first line of communication at an organization or a company, to later make a targeted phishing against them)

This could be also better done with the aid of deep fakes and other stuff

Advanced and resourced teams would have zero-day or 1-day research teams
Especially against software used on the targets site from team 1

This third step can be fully automated with models now
This is the hardest step

Defenders can use LLMs but it is much harder to integrate new tools than offensive teams

At this level the world will change
Tbh I always thought cybersecurity was harder to automate with LLMs than software engineering or IT
But with this, this is super unbelievable

And not only a cloud model or an expensive to run locally model
A local model! Can you believe it
No traces no API calls no nothing

Empowered with the right environment setup and tools and it can do what teams of attackers or malware analysts were needed to do

Btw for malware analysis I give it Ghidra and a sandbox with python (it can use pefile or capstone or whatever it needs and it does use them!)

And also recently I added a Vbox with Vbox MCP and a debugger inside that box with another MCP for the LLM to control both (snapshot restore functionality and debugger functionality)

These tasks were hard and not every security analyst was a malware analyst
Even malware analysis positions are very rare and technical and don’t pay well because not much needed (I used to starts at assembly in assembly debuggers for nights at times!)

This is going above and beyond

Anyone had similar moments in cybersecurity or anything else ?

For searching thing, use pro version? Save project, use pro version? I had used old version, auto update when auto uptade closed on settings? Is this normal or should i consider finding opensource alternatives

I’m a senior in college, and in my second semester I have to take cooperative training. Currently, I have the CCNA, I can program, I know Linux, and I have a couple of other technical skills I learned in college. But I’m still not a penetration tester, which is what I really want to be.

I’m worried that companies will start thinking I’m more interested in networking or defensive security. Even my projects have mainly been network security related. Don’t get me wrong I love networking but I don’t see it being my full time job, It’s more of a hobby that I really enjoy.

Any advice on what I should be doing right now?
What tools/skills should I start learning right now?

I’m starting to study for the CPTS from HTB. Is that a good move or is there something else I should be doing right now?

What does a real professional web application penetration testing stack look like in 2026?

I’m not looking for a huge list of pentesting tools. I’m interested in the actual workflow used by professional web pentesters during an engagement.
For example:
recon → fingerprinting → crawling → content discovery → attack surface mapping → automated vulnerability scanning → manual testing → vulnerability-specific tools → validation / PoC
Which tools do you actually use at each stage?
I’m especially interested in:
Nmap
Whatweb
Wpscan
Searchsploit
Sqli
Burp Suite
httpx
Nmap / Naabu
WhatWeb
Katana
ffuf / Feroxbuster
Nuclei
Arjun
sqlmap
WPScan
Dalfox
Metasploit
Which of these tools are redundant in 2026?
For example, is there still a reason to use Gobuster, Dirsearch, Nikto, Hakrawler or GoSpider if you’re already using ffuf, Katana, Nuclei and Burp Suite?
What parts of web pentesting do you automate and what parts do you still always test manually?
I’d also like to see an example of the actual order in which you run the tools during a web application pentest, rather than just a list of tools.

Hi I’m reaching out here as a last resort. I’m a Junior Penetration Tester and I need to learn mobile pentesting from scratch. I have learnt some concepts of mobile security while I was in college but I’m entirely blank about it now. I checked out MASTG but the content there seems vast and I’m overwhelmed to start, because I have chronic anxiety issues. I have a lot of loans and EMIs going on to the extend that i cant spend money on courses either.

I know I may be fucked, but If someone could help me with a path to follow everyday so that I can learn this I’d be really grateful.

I'm a beginner pentester and have only pentested web apps so far.

I’ve been asked to do a grey box pentest of a chrome extension that scans forms and fills answers from an organization’s knowledge base. I have the extension files, a staging environment and test accounts, but idk where do I start. Is It similar to how u would pentest a web app? mapping endpoints and experimenting with requests in burp?

What specific vulnerabilities should I test for in a chrome extension? I can only think of Idor/Bola tests. Is there a reliable methodology or checklist available online because I couldn't find any. I did look into the OWASP extension cheat sheet but I haven’t found a port swigger style lab series or a clear pentesting methodology that I can follow for this.

I keep trying to memorise it but I fucking can't

There is just a lot of steps . ServerKeyExchange , CertificateVerify, and a lot of other shit. I am in the middle of interviews and some people like to ask about these fundamentals. I just fucking can't. Been trying for 2 fucking days man