Writing other people's finding in a report
https://www.reddit.com/r/Pentesting/comments/1vkesx8/writing_other_peoples_finding_in_a_report/

<!-- SC_OFF -->L <!-- SC_ON --> submitted by /u/ProcedureFar4995 (https://www.reddit.com/user/ProcedureFar4995)
[link] (https://www.reddit.com/r/Pentesting/comments/1vkesx8/writing_other_peoples_finding_in_a_report/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vkesx8/writing_other_peoples_finding_in_a_report/)

Need VAPT or Cybersecurity Support Before Your Next Product Launch or Enterprise Onboarding?
https://www.reddit.com/r/Pentesting/comments/1vkj1ar/need_vapt_or_cybersecurity_support_before_your/

<!-- SC_OFF -->Building or launching a product? Or has an enterprise customer suddenly asked: “Can you share your latest VAPT report?” Cenvox Global Solutions is a Chennai-based cybersecurity company supporting startups, SaaS companies, product teams, and growing businesses with security assessments and ongoing security services. Our team works across: 🔹 Web Application VAPT & Penetration Testing
🔹 API Security Testing
🔹 Mobile Application Penetration Testing
🔹 LLM / AI Application Security & Penetration Testing
🔹 Secure Source Code Review
🔹 MDR & SOC Security Monitoring These services can be useful when you’re preparing for a product launch, enterprise onboarding, customer-requested security assessment, retest, or ongoing security monitoring. Our approach is simple: Understand the product. Identify the real risks. Test what matters. Help the team fix it. You can review more about our services and background here:
www.cenvox.com If anyone here has an upcoming cybersecurity requirement, happy to connect and understand the scope. Feel free to DM me. <!-- SC_ON --> submitted by /u/rockzers (https://www.reddit.com/user/rockzers)
[link] (https://www.reddit.com/r/Pentesting/comments/1vkj1ar/need_vapt_or_cybersecurity_support_before_your/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vkj1ar/need_vapt_or_cybersecurity_support_before_your/)

BSCP I need tips
https://www.reddit.com/r/Pentesting/comments/1vkj9kk/bscp_i_need_tips/

<!-- SC_OFF -->I have soon the BSCP exam, I would like to know any tips that would help me pass it first try.
Everything is accepted! <!-- SC_ON --> submitted by /u/kirafoxoxx (https://www.reddit.com/user/kirafoxoxx)
[link] (https://www.reddit.com/r/Pentesting/comments/1vkj9kk/bscp_i_need_tips/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vkj9kk/bscp_i_need_tips/)

Can I progress in my career if I don't understand the TLS handshakes ?
https://www.reddit.com/r/Pentesting/comments/1vkp15q/can_i_progress_in_my_career_if_i_dont_understand/

<!-- SC_OFF -->I keep trying to memorise it but I fucking can't There is just a lot of steps . ServerKeyExchange , CertificateVerify, and a lot of other shit. I am in the middle of interviews and some people like to ask about these fundamentals. I just fucking can't. Been trying for 2 fucking days man <!-- SC_ON --> submitted by /u/ProcedureFar4995 (https://www.reddit.com/user/ProcedureFar4995)
[link] (https://www.reddit.com/r/Pentesting/comments/1vkp15q/can_i_progress_in_my_career_if_i_dont_understand/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vkp15q/can_i_progress_in_my_career_if_i_dont_understand/)

Web App Pentesting in the AI Era
https://www.reddit.com/r/Pentesting/comments/1vkp93l/web_app_pentesting_in_the_ai_era/

<!-- SC_OFF -->Hi everyone, our latest post explores the practical considerations of AI-assisted source code analysis, evaluating the pros and cons of frontier and locally-hosted models while using a variety of harness orchestration designs. https://blog.includesecurity.com/2026/08/web-app-pentesting-in-the-ai-era/ <!-- SC_ON --> submitted by /u/IncludeSec (https://www.reddit.com/user/IncludeSec)
[link] (https://www.reddit.com/r/Pentesting/comments/1vkp93l/web_app_pentesting_in_the_ai_era/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vkp93l/web_app_pentesting_in_the_ai_era/)

XSS2Shell: Pre-Auth XSS in WordPress Login (CVE-2026-64638) Walkthrough
https://www.reddit.com/r/Pentesting/comments/1vksgpf/xss2shell_preauth_xss_in_wordpress_login/

<!-- SC_OFF -->I spent some time this weekend reproducing the recently disclosed XSS2Shell: WordPress login-page reflected XSS (CVE-2026-64638). If you didn’t get a chance to read about it, here is the summary:
Crazy simple XSS where the root cause is two sanitizers that disagree about what counts as an HTML tag: test gets stripped, while < b>test< /b> passes through the first sanitizer and is normalized into a valid element by the second. That gives you an HTML injection, but you can’t turn it into XSS because the second sanitizer has an allowlist and only allows specific HTML tags and attributes. The rest of the chain uses JavaScript already loaded on the login page, DOM clobbering, and a JSONP response to reach script execution in the login page. It’s a creative chain, although much simpler than the WP2Shell chain from two weeks ago. IMO the “2Shell” part from the title is a bit of a stretch. The original write-up continues after triggering the XSS to show how you can get a RCE (basically by targeting an admin account to open your XSS which uploads a shell as a plugin). I agree this can be abused at scale given how widely used WP is, but it’s a phishing-shaped precondition rather than “send one request, get a shell” as we’ve seen in WP2Shell. It’s a cool bug anyway. I turned my reproduction into a guided lab for anyone who wants to work through the chain rather than only read the write-up. Link: https://learn.uphack.io/lab/xss2shell-wordpress-login-xss/ Feedback on the lab or the technical explanation is very welcome. <!-- SC_ON --> submitted by /u/No_Zookeepergame7552 (https://www.reddit.com/user/No_Zookeepergame7552)
[link] (https://www.reddit.com/r/Pentesting/comments/1vksgpf/xss2shell_preauth_xss_in_wordpress_login/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vksgpf/xss2shell_preauth_xss_in_wordpress_login/)

Set up a free daily security audit for your server in under 5 minutes.
https://www.reddit.com/r/Pentesting/comments/1vl02tf/set_up_a_free_daily_security_audit_for_your/

<!-- SC_OFF -->Unsanctioned port exposures and unexpected configuration drift are two of the easiest ways for vulnerabilities to slip into production. Here’s how to automate daily security scans using three powerful open-source tools: 🔹 Naabu — Lightning-fast port scanning 🔹 Nmap — Deep service and version identification 🔹 Nuclei — Fast, template-based vulnerability detection ⚡ Bonus: The code examples include a diff feature so you only get alerted when something on your server actually changes (say goodbye to alert fatigue!). Reports take ~30 seconds to run. Full guide and ready-to-use code examples here 👇 https://qsa.sh/news/cron-monitor-exposure-changes <!-- SC_ON --> submitted by /u/tuxxin (https://www.reddit.com/user/tuxxin)
[link] (https://www.reddit.com/r/Pentesting/comments/1vl02tf/set_up_a_free_daily_security_audit_for_your/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vl02tf/set_up_a_free_daily_security_audit_for_your/)

Need help!
https://www.reddit.com/r/Pentesting/comments/1vli0uj/need_help/

<!-- SC_OFF -->Hi I’m reaching out here as a last resort. I’m a Junior Penetration Tester and I need to learn mobile pentesting from scratch. I have learnt some concepts of mobile security while I was in college but I’m entirely blank about it now. I checked out MASTG but the content there seems vast and I’m overwhelmed to start, because I have chronic anxiety issues. I have a lot of loans and EMIs going on to the extend that i cant spend money on courses either. I know I may be fucked, but If someone could help me with a path to follow everyday so that I can learn this I’d be really grateful. <!-- SC_ON --> submitted by /u/Character_Morning564 (https://www.reddit.com/user/Character_Morning564)
[link] (https://www.reddit.com/r/Pentesting/comments/1vli0uj/need_help/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vli0uj/need_help/)

GitHub action to find security vulnerabilities in NextJS, ExpressJS
https://www.reddit.com/r/Pentesting/comments/1vlr5fe/github_action_to_find_security_vulnerabilities_in/

<!-- SC_OFF -->New GitHub action to find security vulnerabilities in NextJS, ExpressJS https://github.com/marketplace/actions/secure-build-scanner <!-- SC_ON --> submitted by /u/Curious-about-future (https://www.reddit.com/user/Curious-about-future)
[link] (https://www.reddit.com/r/Pentesting/comments/1vlr5fe/github_action_to_find_security_vulnerabilities_in/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vlr5fe/github_action_to_find_security_vulnerabilities_in/)

How long would it take me to pass the PNPT
https://www.reddit.com/r/Pentesting/comments/1vlrzr4/how_long_would_it_take_me_to_pass_the_pnpt/

<!-- SC_OFF -->I have decent practical experience in pen testing I've completed the CRTA from cwl and also the capt from hackviser. <!-- SC_ON --> submitted by /u/Gullible_Use4337 (https://www.reddit.com/user/Gullible_Use4337)
[link] (https://www.reddit.com/r/Pentesting/comments/1vlrzr4/how_long_would_it_take_me_to_pass_the_pnpt/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vlrzr4/how_long_would_it_take_me_to_pass_the_pnpt/)

How do I pentest a chrome extension
https://www.reddit.com/r/Pentesting/comments/1vlvojb/how_do_i_pentest_a_chrome_extension/

<!-- SC_OFF -->I'm a beginner pentester and have only pentested web apps so far. I’ve been asked to do a grey box pentest of a chrome extension that scans forms and fills answers from an organization’s knowledge base. I have the extension files, a staging environment and test accounts, but idk where do I start. Is It similar to how u would pentest a web app? mapping endpoints and experimenting with requests in burp? What specific vulnerabilities should I test for in a chrome extension? I can only think of Idor/Bola tests. Is there a reliable methodology or checklist available online because I couldn't find any. I did look into the OWASP extension cheat sheet but I haven’t found a port swigger style lab series or a clear pentesting methodology that I can follow for this. <!-- SC_ON --> submitted by /u/No-Persimmon-174 (https://www.reddit.com/user/No-Persimmon-174)
[link] (https://www.reddit.com/r/Pentesting/comments/1vlvojb/how_do_i_pentest_a_chrome_extension/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vlvojb/how_do_i_pentest_a_chrome_extension/)

Found this project on GitHub and I'm curious what you guys think
https://www.reddit.com/r/Pentesting/comments/1vlyec3/found_this_project_on_github_and_im_curious_what/

<!-- SC_OFF -->I came across this GitHub project claiming to have a “quantum evasion engine” that can bypass EDR/Defender detection by combining polymorphic mutation, GF(2⁸), chaos-based mutation, indirect syscalls, ETW patching, etc. I went through the code and some parts are definitely interesting, especially the ETW/driver/token stuff. But I'm also not fully convinced by some of the claims in the README especially the whole “bypasses every detection / zero detections” part. So I'm curious from people who actually work with EDR internals: Is something like this realistically capable of bypassing modern EDRs, or is the project mixing some legitimate techniques with a lot of marketing? Would love to hear what I'm missing or what you'd look at first to validate the claims. Not trying to shit on the project genuinely curious because some of the techniques are pretty interesting. Link (https://github.com/JarDaNi686/SilentGate) <!-- SC_ON --> submitted by /u/topiwebde (https://www.reddit.com/user/topiwebde)
[link] (https://www.reddit.com/r/Pentesting/comments/1vlyec3/found_this_project_on_github_and_im_curious_what/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vlyec3/found_this_project_on_github_and_im_curious_what/)

What does a real professional web application penetration testing stack look like in 2026?
https://www.reddit.com/r/Pentesting/comments/1vn6tvn/what_does_a_real_professional_web_application/

<!-- SC_OFF -->What does a real professional web application penetration testing stack look like in 2026? I’m not looking for a huge list of pentesting tools. I’m interested in the actual workflow used by professional web pentesters during an engagement.
For example:
recon → fingerprinting → crawling → content discovery → attack surface mapping → automated vulnerability scanning → manual testing → vulnerability-specific tools → validation / PoC
Which tools do you actually use at each stage?
I’m especially interested in:
Nmap
Whatweb
Wpscan
Searchsploit
Sqli
Burp Suite
httpx
Nmap / Naabu
WhatWeb
Katana
ffuf / Feroxbuster
Nuclei
Arjun
sqlmap
WPScan
Dalfox
Metasploit
Which of these tools are redundant in 2026?
For example, is there still a reason to use Gobuster, Dirsearch, Nikto, Hakrawler or GoSpider if you’re already using ffuf, Katana, Nuclei and Burp Suite?
What parts of web pentesting do you automate and what parts do you still always test manually?
I’d also like to see an example of the actual order in which you run the tools during a web application pentest, rather than just a list of tools. <!-- SC_ON --> submitted by /u/No-Argument-956 (https://www.reddit.com/user/No-Argument-956)
[link] (https://www.reddit.com/r/Pentesting/comments/1vn6tvn/what_does_a_real_professional_web_application/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vn6tvn/what_does_a_real_professional_web_application/)

Any bug bounty hunter use AI to help to find vulnerabilities in bug bounty programs, I didn’t mean that AI do every thing for bug bounty hunter , I mean give tips such as go to this , write this ,, etc ?
https://www.reddit.com/r/Pentesting/comments/1vnavwx/any_bug_bounty_hunter_use_ai_to_help_to_find/

submitted by /u/FewBookkeeper3322 (https://www.reddit.com/user/FewBookkeeper3322)
[link] (https://www.reddit.com/r/Pentesting/comments/1vnavwx/any_bug_bounty_hunter_use_ai_to_help_to_find/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vnavwx/any_bug_bounty_hunter_use_ai_to_help_to_find/)

LAB - Damn Vulnerable NGINX Proxy (DVNP)
https://www.reddit.com/r/Pentesting/comments/1vnu9aw/lab_damn_vulnerable_nginx_proxy_dvnp/

<!-- SC_OFF -->Hello all, If you do bug bounty hunting or pentests you surely came across many hosts served from an NGINX server, in this lab (published to OWASP) I combined over 20 misconfigurations found in real world bug disclosures and both classic and novel security research, with an extensive blog where I explained everything you need to level up your NGINX hunting game. Feel free to check it out, give it a star on Github if you like it, and suggest any ideas you want me to add/fix... https://vwad.owasp.org/app/damn-vulnerable-nginx-proxy-dvnp/ Happy hunting! <!-- SC_ON --> submitted by /u/OilOverall4190 (https://www.reddit.com/user/OilOverall4190)
[link] (https://vwad.owasp.org/app/damn-vulnerable-nginx-proxy-dvnp/) [comments] (https://www.reddit.com/r/Pentesting/comments/1vnu9aw/lab_damn_vulnerable_nginx_proxy_dvnp/)

How to Find Your First Bug Bounty Vulnerability in 2026 (The Beginner Method That Actually Pays)

Everyone's searching CVE-2026-50522, Here's the step-by-step IDOR method beginners actually use to find paid bugs, by b0dj0x.Continue reading on Medium »
Read more...

️⚡ Ash Keeps Searching the Tall Grass, While Python Prepares for the Next Gym Battle

Ash had learned something important about Pokémon battles.Continue reading on Medium »
Read more...

How Expired Domains Become Weapons for Scams and Malware

Alternative title: The Hidden Cybercrime Economy Behind Expired DomainsContinue reading on Medium »
Read more...

I Changed ₹500 to ₹1 — How I Found a Payment Logic Bug in a QR Code

The QR Code Looked Normal. The Payment Logic Wasn’t.Continue reading on Medium »
Read more...

Shadow AI: The Breach Nobody Approved, Signed Off On, or Even Saw Coming
https://medium.com/@t3nv1/shadow-ai-the-breach-nobody-approved-signed-off-on-or-even-saw-coming-e97737fe30eb?source=rss------bug_bounty-5