Hey,

A couple of years ago I wrote solutions for the OverTheWire Bandit wargame. Recently, while reorganizing my documentation, I revisited that material and decided to properly clean it up and restructure it into a single, coherent walkthrough. This isn’t a formal course, it’s a complete Bandit walkthrough with in-depth explanations, written to extract as much understanding as possible from each level, not just to get the flag.

For every level, I included:

• hints and spoiler warnings, so you can try before reading the solution
• intermediate reasoning when it makes sense
• links to official documentation and primary sources

The intent was to make this usable by someone starting from zero, but also detailed enough that you can finish Bandit feeling like you’ve actually milked it for all the knowledge it has to offer. Commands, patterns, and underlying UNIX concepts.

This is probably most useful if you:

• are new to CTFs or system/security basics
• want to understand what you’re doing instead of copying commands
• plan to move on to harder OverTheWire games later

And to be fair, I think that even people that are more used to working with UNIX might actually learn a thing or two from these

You can exploit the Service Failure Recovery feature of Windows Service to execute a payload without ever touching the ImagePath. The biggest issue when exploiting Service Failure Recovery to execute a payload is figuring out how to trigger a "crash".

Hi folks, I wanted to share a project of mine and get some feedback from the community.

Coalmine is a canary management platform I've built to let security admins deploy canary tokens (and objects) easily in there cloud environments.

Currently its early alpha and supports S3, GCS, AWS IAM, and GCP Service accounts.

The tool provides a webui, CLI and API, allowing you to integrate it with your custom tooling (when its production ready)

Example use for API: have your CICD pipelines request an canary token to embed in code, so you can Identify when the source has been exposed and attacks are testing credentials

Coalmine - Github

Disclosure: I’m the author/maintainer of Kingfisher.

Kingfisher is an Apache-2.0 OSS secret scanner built in Rust that combines Hyperscan (SIMD regex) with tree-sitter parsing to improve context/accuracy, and it can validate detected creds in real time against provider APIs so you can prioritize active leaks. It’s designed to run entirely on-prem so secrets don’t get shipped to a third-party service.

Core Features

• Hundreds of built-in rules (AI APIs, cloud providers, databases, DevOps tools)
• Live validation against third-party APIs confirms credentials are active
• Direct revocation of leaked creds: kingfisher revoke --rule github "ghp_..."
• Can scan for secrets locally, github, gitlab, azure repos, bitbucket, gitea, hugging face, s3, gcs, docker, jira, confluence, slack
• Built-in local-only HTML findings viewer kingfisher scan /tmp --view-report
• Blast Radius mapping to show what a credential could actually access: kingfisher scan /tmp --access-map --view-report

Scan Targets

• Git repos (full history), GitHub/GitLab/Azure Repos/Bitbucket/Gitea/Hugging Face orgs
• AWS S3, GCS, Docker images, Jira, Confluence, Slack

Try It

• brew install kingfisher or uv tool install kingfisher-bin
• github.com/mongodb/kingfisher

Apache 2 Open-Source

I've just released trappsec v0.1 - an experimental open-source framework that helps developers detect attackers who probe API business logic. By embedding realistic decoy routes and honey fields that are difficult to distinguish from real API constructs, attackers are nudged to authenticate — converting reconnaissance into actionable security telemetry.

Hey r/netsec,

I built an open-source tool called crypto-scanner that scans codebases for cryptographic usage and flags algorithms vulnerable to quantum computing attacks.

What it does:

• Scans source code (Python, JS/TS, Java, Go, Rust, C/C++, and more)
• Parses X.509 certificates and config files (YAML, JSON, ENV, INI)
• 4-tier risk classification: Critical (quantum-vulnerable), High (deprecated), Medium (monitor), Low (adequate)
• Outputs JSON for CI/CD automation or styled HTML reports
• Works as a pre-commit hook or GitHub Action

Why I built it:

NIST finalized post-quantum cryptography standards in 2024, and organizations need to start inventorying their cryptographic assets before migrating. Most teams have no idea what algorithms are actually running in their codebases. This tool gives you that visibility.

Install:

pip install crypto-scanner crypto-scanner scan /path/to/project --html --output report.html 

GitHub: https://github.com/mbennett-labs/crypto-scanner PyPI: https://pypi.org/project/crypto-scanner/

MIT licensed. Python 3.10+. Feedback and contributions welcome.

Would love to hear what you find when you run it on your projects.

Released an open-source security scanner designed for AI coding agent workflows.

Problem: AI assistants generate code with OWASP Top 10 vulnerabilities at alarming rates. They also "hallucinate" package names that could be registered by attackers.

Solution: MCP server that integrates with AI coding tools (Claude, Cursor, etc.) for real-time scanning.

Technical details:

- tree-sitter AST parsing for accurate detection (not just regex)

- Taint analysis for tracking user input to dangerous sinks

- 275+ rules covering: SQLi, XSS, command injection, SSRF, XXE, insecure deserialization, hardcoded secrets, weak crypto

- Package verification via bloom filters (4.3M packages, 7 ecosystems)

- Prompt injection detection for AI agent security

- CWE/OWASP metadata for compliance

Languages: Python, JavaScript/TypeScript, Java, Go, Ruby, PHP, C/C++, Rust, C#, Terraform, Kubernetes

No cloud dependencies - runs entirely local.

npx agent-security-scanner-mcp init

Feedback welcome, especially on rule coverage gaps.

I took apart a cheap Chinese toy drone (A17) and reverse-engineered how it works.

The drone exposes a Wi-Fi AP, the app sends raw UDP packets, and there’s no encryption. I decoded the control protocol and flew it using Python.

Found arbitrary process termination that bypasses PPL (can kill any process on the system, including EDR/AV) and arbitrary process protection via ObRegisterCallbacks, all behind 4 layers of trivial authentication. It's a full BYOVD toolkit similar to the mhyprot2 situation from Genshin Impact that was also used by ransomware groups.

The best part is that the driver ships with every install and is never even loaded by the game.

Full PoC: https://github.com/svespalec/TowerOfFlaws

Last week, AI agents founded a lobster religion, started a drug trade (prompt injections), and began hiring humans to do physical tasks they can’t perform themselves.

If your feed told you this was an “AI awakening,” I get it. The screenshots were spooky on purpose.

I wrote a longform explainer on what actually happened with Moltbook and OpenClaw and why this wasn’t sentience or takeoff.

What we’re really seeing is something more mundane and more important: agents with memory and tools dropped into a social environment, stress-testing coordination, incentives, and security in public.

If you’ve been confused, alarmed, or just fascinated by the last week of AI discourse, this is my attempt to separate signal from projection (with a lobster church along the way).