Sliver is my favourite C2. Change my mind
https://www.reddit.com/r/redteamsec/comments/1n4udsr/sliver_is_my_favourite_c2_change_my_mind/

<!-- SC_OFF -->Change my mind: Rock-Solid Sessions Once a beacon lands, it stays put. I’ve left shells for months and if a connection fails a few times it'll reconnect based on the retry configuration you set up. Customization kinda easy: Cross-platform: Native clients for Windows, macOS, and Linux mean no awkward juggling. CLI based: Tab-complete everything, vps friendly, linux -tism friendly. I mean you can probably design a UI for this but why. Partial “task automation” baked-in: Now available for sessions i think but with a bit of custom thingy can work for beacons as well for sure (haven't tried yet, it's in my backlog) Nice to have features: Nonce+TOTP encryption by default: No extra flags, no forgotten certs—traffic’s wrapped the moment the beacon calls back. Custom HTTP requests: Being able to customize strings and extensions in the http requests is nice MTLS beacons: Bit less incognito stuff but still nice in some environments. Donut launcher built-in: Fire raw shellcode/assembly on the fly. God tier for executing tools through the beacon ETW patch & AMSI bypass: Haven’t stress-tested them yet, but early smoke tests look promising. Evasion: I rc4 encrypt the compiled beacons, and pack them inside a custom loader so, no much to say here. Around 90% bypass rate against the EDR in real exercises and testing. (Not a very crazy loader neither, made it just to work) Some more gimmicks i really haven't used much like canaries and watchtower or wireguard sessions and stuff. True that Linux beacons and sessions are kinda trash. Mainly focused on Windows targets but do someone have any C2 that truly dethrones Sliver? Or do you agree.. <!-- SC_ON --> submitted by /u/wh1t3k4t (https://www.reddit.com/user/wh1t3k4t)
[link] (https://github.com/BishopFox/sliver) [comments] (https://www.reddit.com/r/redteamsec/comments/1n4udsr/sliver_is_my_favourite_c2_change_my_mind/)

Adaptix c2 framework extender tab not showing.
https://www.reddit.com/r/redteamsec/comments/1n5dz6w/adaptix_c2_framework_extender_tab_not_showing/

<!-- SC_OFF -->Hi im new to using Adaptix C2, but I can’t seem to load up extension kit because the extender tab isn’t showing but instead AxScript. Can someone help? I’d appreciate it. Since I can’t upload a photo. The tabs shown are Projects > AxScript > Settings <!-- SC_ON --> submitted by /u/Maleficent-Can3175 (https://www.reddit.com/user/Maleficent-Can3175)
[link] (https://adaptix-framework.gitbook.io/adaptix-framework) [comments] (https://www.reddit.com/r/redteamsec/comments/1n5dz6w/adaptix_c2_framework_extender_tab_not_showing/)

Puzzle to Pwnage: Decoding Hidden Endpoints for Maximum Exploitation

Hey there!😁Continue reading on InfoSec Write-ups »
Read more...

How I Bypassed VPN Detection, Broke Client-Side Crypto and Found Multiple IDORS

A security test on a popular local mobile wallet Flutter-based Android App…Continue reading on Medium »
Read more...

HTB-LAB Local File Inclusion (LFI)

IntroductionContinue reading on Medium »
Read more...

BackDoor 1: Walkthrough of NET-SQUARE Hacking Warm-Up Mobile Application Challenge

Recently got an opportunity to participate in a CTF (Capture-The-Flag) event which was organized by NET-SQUARE. They had their different…Continue reading on InfoSec Write-ups »
Read more...

How I Exploited a JWT Misconfiguration for Account Takeover and Admin Access in 5 Minutes

Hey there, back again with another post! 😄 In this post I’ll be sharing an interesting finding from an internal web pentest where I…Continue reading on InfoSec Write-ups »
Read more...

Anatomy of Email Security Vulnerabilities: How Spoofing, Protocol Weaknesses, and Misconfigurations…
https://medium.com/@mohamednfe78/anatomy-of-email-security-vulnerabilities-how-spoofing-protocol-weaknesses-and-misconfigurations-e3264c712479?source=rss------bug_bounty-5

Introduction
In 2025, email remains the beating heart of enterprise collaboration, but it is also the most weaponized channel for…Continue reading on Medium » (https://medium.com/@mohamednfe78/anatomy-of-email-security-vulnerabilities-how-spoofing-protocol-weaknesses-and-misconfigurations-e3264c712479?source=rss------bug_bounty-5)

I Broke Rate Limits to Hijack Accounts — Without Getting Blocked

During a bug bounty hunt, a single flaw was discovered that allowed me to reset any user’s password, without a single click from the…Continue reading on Medium »
Read more...

Ultimate Bug Bounty Guide 2025: Top 100 Essential Tools + 100 Proven Techniques for Ethical Hackers

Stop learning cybersecurity the wrong way. While most aspiring ethical hackers waste months jumping between random tutorials and outdated…Continue reading on Medium »
Read more...

Critical Unauthorized Data Disclosure via HTTP Method Manipulation: A Lesson in API Security in…

Assalam o alaikum for muslim brothers, sisters and hello for non muslims. i hope all of you are doing well and learning new things day by…Continue reading on Medium »
Read more...

Understanding the OWASP Top 10: The Simplest Guide for Web Security

The OWASP Top 10 is a globally recognized list of the most critical web application security risks, published by the Open Web Application…Continue reading on Medium »
Read more...

Recon to Responsible Disclosure

My First Accepted Bug!Continue reading on Medium »
Read more...

Cloudflare Tunnel — Origin Exposure Weaponized

🔎 IntroductionContinue reading on Medium »
Read more...

The Little CV + CSRF That Broke an Account

السَّلاَمُ عَلَيْكُمْ وَرَحْمَةُ اللهِ وَبَرَكَاتُهُ. اللَّهُمَّ صَلِّ عَلَى مُحَمَّدٍ وَعَلَى آلِ مُحَمَّدٍ، كَمَا صَلَّيْتَ عَلَى…Continue reading on Medium »
Read more...

Linux File Permissions Exploits Every Hacker Should Know

Understanding Linux file permissions is critical for both system administrators and penetration testers. When misconfigured, file…Continue reading on Medium »
Read more...

HOW i found the CVE-2025–4388?

Hi, everyone,Continue reading on Medium »
Read more...

The Psychology of a Hacker’s Click — Why Bug Bounty is More Mindset Than Tools

🧠 IntroductionContinue reading on Medium »
Read more...

The Ghost Vulnerabilities — How “Fixed Bugs” Come Back From the Dead

👻 IntroductionContinue reading on Medium »
Read more...