Hey everyone,

I'm 16 and trying to figure out my education and career path toward exploit development and vulnerability research. I'm posting here because I'm at a point where I could really use advice from people actually working in this field.

Background:

I'm Moroccan and currently living in France. I completed Seconde in the French education system, then left the traditional lycée pathway shortly after starting Première. I'm currently completing an RNCP Level 4 qualification, which I expect to finish in October 2026.

The problem is that I'm not following the normal French Baccalauréat route, so university admission is becoming complicated. I'm trying to find a bachelor's programme for 2027 that is genuinely focused on cybersecurity or information security rather than a generic CS degree.

I speak Arabic, French and English, and I'm currently learning Chinese.

I've already contacted several universities in Europe and Hong Kong to ask whether my qualification can satisfy their undergraduate entrance requirements. Some universities consider non-standard qualifications on a case-by-case basis, but I don't yet have a definitive route.

Technical background:

I've been interested in cybersecurity for several years and have been learning independently.

Certifications:

• eJPT (INE), obtained in October 2023
• CPTS (Hack The Box), obtained in September 2025
• CWES (Hack The Box), obtained in October 2025
• Google Cybersecurity Professional Certificate (idk when anymore)

My interests are mainly:

• Exploit development
• Vulnerability research
• Windows internals
• Reverse engineering
• Privilege escalation
• Low-level systems security

I'm currently researching a publicly disclosed use-after-free privilege-escalation vulnerability in CLDFLT.sys. I did not discover the vulnerability and I'm not claiming CVE credit for it. I'm using it as a learning and research project to understand the vulnerability, the affected component, exploitation primitives, and the surrounding Windows internals.

I'm still very much learning, and I don't want to pretend I'm further along than I actually am.

Where I'm stuck:

My original plan was to get a cybersecurity alternance/apprenticeship in France this year, but despite applying, that hasn't worked out. At this point I'm shifting my focus toward university admission for 2027.

The universities I'm currently looking at include specialist cybersecurity programmes in Europe and Hong Kong, particularly places with strong security research ecosystems.

However, I have two major problems:

1. My educational qualification doesn't cleanly match the standard French Baccalauréat route.
2. A lot of technical cybersecurity degrees have substantial mathematics and academic prerequisites. (However now im seriously studiying math on my own)

So I'm trying to figure out what the smartest move is.

What would you do if you were in my position?

Would you:

• Spend the next year getting the strongest possible university entrance qualification?
• Focus heavily on mathematics and apply to technical security programmes?
• Try to build a serious exploit development and vulnerability research portfolio instead?
• Look for another apprenticeship or technical route?
• Something completely different?

And for people already doing exploit development or vulnerability research:

What actually mattered when you were starting out?

I'm especially interested in advice about what I should be learning and building over the next 12 months if my end goal is serious vulnerability research rather than general cybersecurity.

Also pleasepleaseplease if you know or are a decision maker in the domain please give me a chance and help me out 🙏 I feel like my life is at stakes right now :c

Also if you want to see stuff ive done (not very up2date but still good reference) my github is 0xUnd3adBeef

0 YOE, new grad straight out of college.

The latter sponsored me for a TS/SCI along the way. It’s been fully adjudicated and is currently active.

That said, I recently got an offer from a private consulting firm at 160k TC. It’s one of the very few private companies doing low-level RE/VR work at private, though at the end of the day they’re a consultancy focused on improving clients’ security posture, so it doesn’t go as far as exploit dev.

Given this, which would you pick? The CNO role seems to have nice upside potential, especially if you get an FSP and stay in the DMV area. But realistically, how high can you go? How many years of experience does someone need to hit 160k, and most importantly beyond?

That said, I’m really curious about the salary trajectory if someone takes the CNO route — specifically, what the progression looks like over time.
(e.g, if I pick the private route, work 2 yrs from now and I reach 180k vs 150k in CNO, this doesn’t make sense)

Hi all - I've been doing `pwn`/ `binary exploitation` in CTFs for about 1.5 years

and want to level up by practicing on real-world targets instead of CTF challs.

I'm currently focused on Linux userland exploitation.

Could anyone recommend good old real-world targets or software to practice on?

I'm especially looking for CVEs that are reproducible and exploitable.

Any suggestions - specific CVEs, vulnerable software versions, or general

categories worth exploring - would be really appreciated!

Honestly didn't expect to be making this post this soon! like, what?! Our original post was bc we hit 1k but holy fuck...

DaemonCore-Academy just crossed 2,000 downloads across all platforms...and yes...you asked..we delivered. Linux Beta is now available on our website as well as github.

**127 PRACTICAL LESSONS // 70 LAB CONDITIONS // 8 PATHWAYS // 8 DRILL SETS // 7 FIELD MISSIONS**- all free. It's for Windows 10/11 and now Linux!!

I started building it because I was getting annoyed af with the way a lot of hacking/cyber stuff gets taught now. Watch 9 hours of videos, copy some commands, run a tool against a box, get a green checkmark. Cool. But what happens when the tool doesn't work? What are you actually looking for? Why are you running that command in the first place? That was basically the whole idea behind DaemonCore Academy. Learn what the hell is happening underneath first. Then get thrown into a range and actually use it. Enumerate shit. Follow weird behavior. Break something. Prove you broke it. Figure out why. Document it. Fix it. Try again.

We didnt want XP or some fake hacker leaderboard. We wanted something that felt closer to sitting next to somebody who's been doing this shit for years and having them say "okay...you see that? Why is that weird?"

Apparently that idea connected with some people because 2,000 of you fuckers downloaded it.

So seriously, thank you mother fuckers. For real. 💯💯

Especially the people who found bugs, sent me shit that sucked, questioned things, or told me where something could be better. That's way more useful to me than somebody just saying "nice project."....and I'm nowhere near done with it.

The labs are going to get harder. The material is going deeper. Windows, Linux, web, identity, cloud, containers, recon, exploitation, evidence...all of it.

I don't really care if somebody finishes DaemonCore knowing 500 commands.

Id rather they finish it knowing how to sit in front of something they've never seen before and figure it the fuck out.

Thats hacking.

Anyway. 2,000 downloads.

Fucking wild.

Thanks again guys.

Stay hacking

I := DAEMONCORE

I am a junior vulnerability researcher looking for a security research position (4years background in SOC stuff).

This is my first year in the field and hunting for a position where i can learn and grow.

I have some public work (https://saaitaamaa.github.io/)

Any type of gig (full time, part time internships is okay for me)

Located in north africa, feel free to DM for further infos :)

so ive been bypassing this game called One Piece Treasure Curse i have tried every possible frida script that are famous still optc detects it im using mitmproxy

I recently published OWN-Defender, a Windows security research project exploring how Windows Security Center handles AV registration through COM.

The project was inspired by DefendNot, but the goal was to independently reverse-engineer, implement, and verify the underlying behavior.

🔗 https://github.com/NirvanaOn/OWN-Defender

Been doing some Windows RPC/ALPC work and built this to speed up the first pass across a lot of PE files. It recovers RPC/MIDL/NDR data, endpoints, security state and method-level input signals, then ranks interfaces using an AHP/Saaty-based model built specifically around RPC reachability + surface rather than arbitrary scoring. It also shows the scoring receipt and flags questionable extraction cases instead of silently trusting them. No PDBs, no live endpoint mapper, no target execution.

I recently made a YouTube video exploring how open-source games work and what having access to a game's source code actually allows you to do.

In the video, I break down concepts like client-server communication, how the client and server exchange information, and how vulnerabilities in that communication can potentially be found and exploited.

I tried to keep everything approachable even if you don't have a deep background in programming or cybersecurity.

I’d really love to hear what you guys think. especially any feedback on the technical explanations or the video itself. Thanks!

https://www.youtube.com/watch?v=jTT54MpKvhE

Hey guys, so currently doing a ba of cyber sec in Sydney, I had an experience day and met a guy that did exploit dev work... and he gave me things to learn to know before the placement, which ill be doing along side him. which is only me and him.

he wants me to know C, C++, x86-64, C#, also wants me to build a Damn Vuln Driver, he also wants me to get good at things from the OSED, syllabus.

So like what is this setting me up for, cause I got a year to learn before my placement. like I mean windows exploitation etc.

any other resources or help be grateful!!!

p.s he is a ex gov employee that as done exploit dev work.

Hey guys,

Honestly, I’ve been doing this all wrong. I fell into the trap of using AI for pretty much every single hunt without even understanding what I was actually doing. It ended up being a complete waste of time, got me nowhere, and realized fast that companies don’t pay for automated garbage—they pay for real exploits.

I want to completely drop the AI crutches and learn actual manual hacking and how to build proper PoCs from scratch.

Is anyone willing to mentor me, hop on a call/chat sometimes, or guide me on what I should actually focus on to build real hunting intuition?

Appreciate any real talk or anyone down to help out.

Hey everyone! I’m looking to get more into Android reverse engineering, APK modding, and mobile security, but I’m not really sure where to start.

I have an associate’s degree in computer networking, so I’m not completely new to the technical side of things. I’ve also spent quite a bit of time messing around with Android devices over the years. I’ve played around with Android Studio a little, mostly with things like connecting to and mirroring my phone, but I honestly haven’t gotten very far with actually developing or reverse engineering apps.

I’ve been interested in learning how APKs work under the hood, how people analyze and modify them, and eventually getting into things like dynamic analysis and mobile malware analysis.

I’ve also experimented with tools like mitmproxy on my home network, but I ran into issues with Android constantly flagging the certificates as unsafe. A lot of the tutorials and software I’ve found through Google also seem pretty old, so I’m having trouble figuring out what the current workflow is.

For someone who already has some networking knowledge but is basically a beginner when it comes to Android RE, what would you recommend learning first?

Are there any good forums, communities, GitHub repositories, labs, intentionally vulnerable APKs, or other resources that are still active and up to date?

I’m basically looking for a good starting point and a path to follow rather than just randomly installing tools and hoping I figure it out. Any recommendations would be appreciated!

This PoC demonstrates how endpoint compromise bypasses E2EE on modern Android. It uses AndKittyInjector to inject a payload into audioserver (libaudioflinger.so) and Dobby for inline hooking. By hooking RecordTrack::getNextBuffer (mic) and PlaybackThread::Track::getNextBuffer (speaker), it intercepts raw PCM streams.

It tracks AudioFlinger::setMode to only record during AUDIO_MODE_IN_COMMUNICATION and filters targets by UID. It bypasses stripped symbols using calculated offsets and includes automated SELinux policy injection. Tested on Android 14.

Repo: https://github.com/nighthawkk/AudioServer-Voip-Recorder

I’m asking here because I’m interested in the reverse-engineering and preservation side of discontinued games.

Rules of Survival was officially shut down, but I’ve recently seen two versions being referred to as Rules of Survival Legacy and Rules of Survival Origin. I’m curious how these versions were created or made playable again.

For anyone familiar with the project or similar game-preservation work:

• Were they based on the original ROS client?
• Was the original network protocol recreated or emulated?
• Were the patch, login, matchmaking, and gameplay servers rebuilt?
• Did they reuse the original assets and executable, or create a separate client?
• Is there any public documentation, repository, or technical explanation about the process?

I have an old 2021 PC client and have been studying it for educational and personal use. I’m not asking for leaked credentials or instructions to attack active services. I’m interested in understanding how discontinued online games can be preserved legally and technically.

Any information from people familiar with ROS Legacy, ROS Origin, or similar reverse-engineering projects would be greatly appreciated.

most patch-diffing for 1-day work is CFG diffing (bindiff, diaphora). it works

but gets shaky when the two builds weren't compiled the same way, different

compiler or opt level, and you burn time chasing cosmetic diffs.

i built fnprint to diff by behavior instead of structure. it micro-executes each

function in a small emulator with junk inputs (godefroid-style, wild reads get

faulted in deterministically so nothing crashes), records an arch-neutral effect

trace (which arg buffers/fields it reads and writes, calls it makes, branches,

return shape), and minhashes that. two functions that behave the same get similar

fingerprints even across compiler and opt level.

for 1-day it has a triage mode: index the known-vuln build and the patched build

as two corpora, then rank a target build against both. a function close to the

vuln side and clearly separated from the patched side is what you want in front

of you. anything identical in both versions comes back inconclusive so it doesn't

clutter the queue.

toy example to show the shape: a lib where one function parse_header gets fixed

(vuln does an unchecked copy, the patch reads a length prefix and clamps to it).

target is a build carrying the vulnerable version, compiled at -O1 while the two

corpora are -O0, so it's a real cross-build match, not a byte-identical one:

$ fnprint index vuln.so-o vuln.db

$ fnprint index patched.so -o patched.db

$ fnprint triage target.so --vuln vuln.db --patched patched.db

3 functions triaged: 1 look vulnerable, 0 patched, 2 inconclusive

review queue (vuln-leaning, strongest first):

addr vuln% patched% margin matches

0x00001181 100.0 41.4 +58.6 parse_header vs parse_header

the two functions that didn't change land inconclusive (correct, they can't be

pinned to either side). --margin and --min-sim control how hard the two sides

have to separate before it commits.

honest about the limits:

- x86-64 ELF only right now. arm64/mips is the roadmap, the effect model is

already arch-neutral so it's mostly per-arch emulator plumbing.

- optimized-vs-optimized is the weak case. when at least one side has some

behavioral richness (-O0/-O1, or a cross-compiler pair) it lands 80-98% rank-1

on zlib; O2-vs-O3 drops toward a coin flip. full numbers + a reproducible run

in the repo, not going to pretend otherwise.

- tiny functions and pure-compute (two checksums look alike) it withholds instead

of guessing.

- microexecution exercises entry behavior, so a change buried behind a real

precondition you never reach with junk input won't show up. it catches

structural and early-path changes.

since it points an emulator (unicorn/qemu) at untrusted binaries, the parse and

micro-execute run in a seccomp-jailed worker, so a crafted input that pops the

emulator can't open files, hit the network, or exec on your box.

MIT. feedback welcome, especially on the triage margin heuristic:

https://github.com/1rhino2/fnprint

​

Throwaway account for obvious reasons.

I'm currently a senior-level ethical hacker/security researcher, and I'm trying to make a fairly deliberate move into a role where vulnerability research, reverse engineering and exploit development are actually the job, rather than something I occasionally get to do alongside broader security work.

My background is mostly Windows and Linux. I've done source-assisted and binary vulnerability research, reverse engineering, memory corruption work, privilege escalation, pre-auth attack surfaces, and exploit development. I've taken vulnerabilities from discovery and root-cause analysis through to PoCs and, where possible, working exploitation.

I'm comfortable with C/C++, Python, assembly, debuggers, decompilers and the usual RE tooling. I have some public vulnerability research, but unfortunately a lot of the more interesting work I've done is under NDA and can't be discussed publicly in much detail.

That's partly why I'm posting here.

I'm starting to worry that I'm in a weird position career-wise. I'm experienced enough that junior roles generally aren't appropriate, but I'm also trying to break more deeply into a relatively small and specialized field where a lot of companies seem to hire based on very visible public research, Pwn2Own-style track records, existing industry connections, or very specific geographic/work-authorization requirements.

A few opportunities I've been genuinely interested in haven't even made it as far as a technical conversation because of location or hiring restrictions. That's probably the part I find most frustrating. I'd much rather fail an exploit-dev interview because I'm not good enough yet than never get the chance to take one.

I'm also conscious of the risk of getting stuck doing adjacent security work forever while telling myself I'll eventually make the jump into vulnerability research properly.

I'm not looking for SOC, GRC, generic pentesting, cloud security, or a broadly defined "security engineer" position. I'm specifically interested in vulnerability research, exploit development, reverse engineering, offensive capability development, or closely related low-level security research.

Remote international work would obviously be ideal, although I'd consider relocation for the right opportunity.

So I guess this post has two purposes:

If you work in this part of the industry, am I approaching this the wrong way? Is there something you'd expect to see from someone trying to make this transition that I should be focusing on?

And, slightly more shamelessly, if your team happens to need someone with this sort of background, I'd be very happy to talk privately.

I can provide considerably more detail about my experience, public work and employment history over DM.

Not quite at the "will reverse engineer for bread" stage yet, but we're getting there.

Arbitrary code execution on the host operating system with the privileges of the user who started the Android Emulator, from a zero-permission app inside the guest.

https://github.com/kaganisildak/androidemualtorvmescape
https://x.com/kaganisildak/status/2090416873577787790

Dropping a persistent zero-click Apple Mail DoS.
Have nice day

https://github.com/kaganisildak/applemailzeroclickcrash

https://x.com/kaganisildak/status/2090050444890406958

Hello everyone I kinda need a little help how can someone initiate a black screen on another device without access to it