<!-- SC_OFF -->I hope you’re doing well. I’m writing an article on the essential programming and scripting foundations every pentester should master in 2025, and I’d love to learn from your real-world experiences: • Which languages or libraries have you found most valuable for automation or exploit development? • What beginner-to-intermediate projects gave you the biggest confidence boost when working with code? • Are there any resources—courses, tutorials, GitHub repos—that truly transformed your workflow? • What common pitfalls would you warn newcomers to avoid when they start coding for security tasks? I appreciate any insights, examples, or recommendations you can share. Thank you so much for your help! <!-- SC_ON --> submitted by /u/Anezaneo (https://www.reddit.com/user/Anezaneo)
[link] (https://infosecwriteups.com/part-3-how-to-become-a-pentester-in-2025-programming-scripting-foundations-for-pentester-c57334e7a8fe) [comments] (https://www.reddit.com/r/Pentesting/comments/1kxcaf9/which_programming_or_scripting_skill_was_a/)

Osintgram tool
https://www.reddit.com/r/Pentesting/comments/1kxdq5t/osintgram_tool/

<!-- SC_OFF -->hey everyone. I'm running into a ModuleNotFoundError when trying to use a tool that relies on requests and urllib3. Here's the error I'm getting: I've already tried: Installing an older version of urllib3 (even v1.26.x) Reinstalling requests, urllib3, and six Setting up a fresh virtual environment The issue seems to stem from urllib3 relying on six, but that module path doesn’t exist anymore in recent versions. Still getting the same error. https://preview.redd.it/fxi4k7t73i3f1.png?width=1215&format=png&auto=webp&s=85e382cb55c588fb373b7da4b54f2c94b368de20 <!-- SC_ON --> submitted by /u/ZucchiniAgitated21 (https://www.reddit.com/user/ZucchiniAgitated21)
[link] (https://www.reddit.com/r/Pentesting/comments/1kxdq5t/osintgram_tool/) [comments] (https://www.reddit.com/r/Pentesting/comments/1kxdq5t/osintgram_tool/)

Regex for searching creds
https://www.reddit.com/r/Pentesting/comments/1kxei99/regex_for_searching_creds/

<!-- SC_OFF -->what regular expressions do you use when searching for passwords on domain shares? <!-- SC_ON --> submitted by /u/grime_vietnam (https://www.reddit.com/user/grime_vietnam)
[link] (https://www.reddit.com/r/Pentesting/comments/1kxei99/regex_for_searching_creds/) [comments] (https://www.reddit.com/r/Pentesting/comments/1kxei99/regex_for_searching_creds/)

I made a thing!
https://www.reddit.com/r/Pentesting/comments/1kxgaes/i_made_a_thing/

<!-- SC_OFF -->Good morning all you awesome pentesters! I just wanted to show you all a tool i developed for physical pentesting. It's a small usb device that lets you inject keyboard key strokes from your phone or from afar via a C2 web server. https://www.kickstarter.com/projects/pidgn/pidgn?ref=user_menu <!-- SC_ON --> submitted by /u/Clean-Drop9629 (https://www.reddit.com/user/Clean-Drop9629)
[link] (https://www.reddit.com/r/Pentesting/comments/1kxgaes/i_made_a_thing/) [comments] (https://www.reddit.com/r/Pentesting/comments/1kxgaes/i_made_a_thing/)

How a Simple Payment Exploit Could Take Down a Prop Firm — And No One Cared

One month ago, I was looking for bugs in a prop firm platform (I’ve been trading for 3 years and have worked with many of them). This…Continue reading on Medium »
Read more...

How I discovered Reflected XSS in GoldAcademy.

First of all, as usual, we need to make some infogatheringContinue reading on Medium »
Read more...

Spidering in Security

Spidering, in the context of cybersecurity, is the process of automatically crawling a website to collect information about its structure…Continue reading on Medium »
Read more...

How Web Cache Poisoning via Unkeyed Query Strings Can Lead to Reflected XSS

Write-up Web Cache Poisoning via an Unkeyed Query String.Continue reading on OSINT Team »
Read more...

Uncovering Hidden Signup Pages for Bug Bounty Hunting

While we hunting a bug in a web pentesting,we can able to see only login button.Continue reading on Medium »
Read more...

Game of Active Directory: Penetration Testing an Active Directory Environment (Video)
https://www.reddit.com/r/Pentesting/comments/1kxib0s/game_of_active_directory_penetration_testing_an/

<!-- SC_OFF -->https://www.youtube.com/watch?v=J4l-BMG9gTQ Our SVP of Cybersecurity, Jesse Roberts, put together a short breakdown of Active Directory pentesting. Sharing here in case it’s helpful! <!-- SC_ON --> submitted by /u/CompassITCompliance (https://www.reddit.com/user/CompassITCompliance)
[link] (https://www.reddit.com/r/Pentesting/comments/1kxib0s/game_of_active_directory_penetration_testing_an/) [comments] (https://www.reddit.com/r/Pentesting/comments/1kxib0s/game_of_active_directory_penetration_testing_an/)

Ethical Hacking Assignment - getting root from an IP/Site
https://www.reddit.com/r/Pentesting/comments/1kxknz5/ethical_hacking_assignment_getting_root_from_an/

<!-- SC_OFF -->Hi, I am a 4th semester of computer sciences right now and I'm working on my final project, which is getting root access of a site/ip using kali linux, we've attempted to use gobuster and metasploit, however, both methods are considered brute forcing and it simply isn't effective based on our deadline which is in a few days. The system we're trying to take root over uses linux so eternalbblue wouldn't work as well. Any tips on what method we should use. The goal here is to use kali to get the root access of server3.pentest.id (http://server3.pentest.id/) (this is a fake site that my lecturer gave us}. Also we found the vulnerable ports that are open already, there are 2 to be exact. So i guess we need to utilize those open ports. <!-- SC_ON --> submitted by /u/Seraphims-Monody (https://www.reddit.com/user/Seraphims-Monody)
[link] (https://www.reddit.com/r/Pentesting/comments/1kxknz5/ethical_hacking_assignment_getting_root_from_an/) [comments] (https://www.reddit.com/r/Pentesting/comments/1kxknz5/ethical_hacking_assignment_getting_root_from_an/)

Cracking JWTs: A Bug Bounty Hunting Guide [Part 1]

JWT Authentication Bypass via Unverified and Flawed Signature VerificationContinue reading on InfoSec Write-ups »
Read more...

How I Bypassed a Famous Regional Newspaper’s Subscription Plan By Http Response Manipulation

My article is open to everyone; non-member readers can click this link to read the full text.Continue reading on OSINT Team »
Read more...

Windows Defender E5 auto remediation problem
https://www.reddit.com/r/Pentesting/comments/1kxj48o/windows_defender_e5_auto_remediation_problem/

<!-- SC_OFF -->During a pentest, the windows test account was found by Defender and later disabled. It seems it also added the account to 2 windows user policy settings - "Deny access to this computer from the network" and "Deny logon through Remote Desktop Services" on each item that was accessed. I don't see any group policy that has this setting added and the local policy has it but is greyed out and I am unable to remove it. Any ideas? Just need to remove it so we can continue testing or if real-world, get the user back to normal access again. <!-- SC_ON --> submitted by /u/Successful_Way_3663 (https://www.reddit.com/user/Successful_Way_3663)
[link] (https://www.reddit.com/r/Pentesting/comments/1kxj48o/windows_defender_e5_auto_remediation_problem/) [comments] (https://www.reddit.com/r/Pentesting/comments/1kxj48o/windows_defender_e5_auto_remediation_problem/)

Mastering PHP Wrappers: Concepts, Use Cases, and Security Risks

By ZoningxtrContinue reading on Medium »
Read more...

How a Simple Payment Exploit Could Take Down a Prop Firm — And No One Cared
https://medium.com/@nimashahbazi524/how-a-simple-payment-exploit-could-take-down-a-prop-firm-and-no-one-cared-026509b54002?source=rss------bug_bounty-5

One month ago, I was looking for bugs in a prop firm platform (I’ve been trading for 3 years and have worked with many of them).
 This…Continue reading on Medium » (https://medium.com/@nimashahbazi524/how-a-simple-payment-exploit-could-take-down-a-prop-firm-and-no-one-cared-026509b54002?source=rss------bug_bounty-5)

How I discovered Reflected XSS in GoldAcademy.
https://medium.com/@secourses8/how-i-discovered-reflected-xss-in-goldacademy-257b69a14be8?source=rss------bug_bounty-5

First of all, as usual, we need to make some infogatheringContinue reading on Medium » (https://medium.com/@secourses8/how-i-discovered-reflected-xss-in-goldacademy-257b69a14be8?source=rss------bug_bounty-5)

Spidering in Security
https://medium.com/@natarajanck2/spidering-in-security-104900f56836?source=rss------bug_bounty-5

Spidering, in the context of cybersecurity, is the process of automatically crawling a website to collect information about its structure…Continue reading on Medium » (https://medium.com/@natarajanck2/spidering-in-security-104900f56836?source=rss------bug_bounty-5)