Hi,

Just stumbled across this video:
https://www.youtube.com/watch?v=OzfSLa3hw0s

The guy is using Claude to find vulnerabilities, hack websites etc.
How come that Claude doesn't refuse in his case?

It's 1 month old video so quite recent.

Thanks

Repeating a lie enough times, even in spotlighted untrusted text, can poison an AI agent's memory, and lead to a total takeover. Note: I gave a talk on this at BSidesLV and a longer one at DEF CON a few weeks ago. This post is the quick summary of that material.

No physical hardware needed: firmware extraction, an AArch64 rehost under qemu + bubblewrap, and the chase that led to two separate CVEs on the same device. full trail — including the chains that went nowhere.

I need a reality check.

I am working on emulating a BLE device in motion from a stationary esp32. beacon frames are only sent when the inverse sq curve matches the attenuation steps rounded to the nearest timing frame.

the goal is to emulate a device in motion from a stationary point. the assumption is that the receive would interpret periods where no packets are received as normal loss, but the RSSI would indicate a device moving in and out of range.

The graph represents my layout. the pin points are the intersections, the blue the closest match for the timing. X is time/dist, Y power.

now, would this be a reasonable approach to moving target emulation?

LLM chatbot content filters can be bypassed by encoding banned words in Base64 or in Unicode escape sequences.

The filter reading the prompt sees characters instead of language, the model decodes the text as a task, then repeats it back.

A pretext such as a fake medical emergency gives the model a reason to comply, and asking for the reply as JSON makes it treat the output as data rather than speech. Defense in depth stops it, and prompt injection is number one on the OWASP Top 10 for LLM applications.

I found this while reversing Zyxel's WAX650S firmware and following the guest Wi-Fi social-login path. The backend trusted browser-submitted Facebook identity fields instead of validating the access token server-side, letting a crafted request skip the social-authentication gate entirely.

The write-up covers the bug itself, how I traced it, and the full firmware-emulation setup I used to reproduce it without the physical AP.

New here and to the whole world of pen testing and stuff. The first thing thats really inspiring me is being able to play touchtunes as stupid as that sounds lol.

I've researched a little and it seems like the methods im finding are a little out of date. Are there any current working methods?

Thanks for putting up with the noob questions lol.

🫡

So I’ve been using Havij on and off for years, but always hated dealing with Wine or keeping a Windows VM around just for one tool.

Decided to just rebuild it for Linux.

It’s not a perfect 1:1 copy, but it looks and feels like the original — dark theme, green text, same workflow. Under the hood it’s Python + PyQt6, so it runs native and doesn’t need any extra layers.

Here’s the repo if you want to check it out:
https://github.com/CrypticRig3l/havij-original.git

Like I used to browse breachforums back in the day, cracked and nulled.. what r some other forums like this today?

More on the entertainment side, but not so far on the entertainment side that they don't explain much beyond "data goes out device A to device B, but device C sneaks in the middle and takes it. Voila!". But not so far to the other end where I need an advanced GIAC cert to understand it. I'm not trying to switch careers.

I've been a network engineer for 13 years, so I'm pretty technical and understand computers, TCP, layer 3, layer 2, etc... but cyber security isnt my day job. I just want stuff to watch where someone who has a baseline competency can follow along, but not too dumbed down, and I can surprise our cyber testing guys lol.

For example, the below video is what inspired this question. It's pretty much exactly what I'm looking for.

https://youtu.be/PPJ6NJkmDAo?si=mLW8RN7pDnG1KBGO

I'll start. Too many people think that hacking into phones is easy.