I bought my first 3D printer expecting to make toys, gadgets, and the occasional product prototype. Instead, one of my most useful prints is simply a plastic clamp whose whole job is to get chewed up by my CNC bit. Plastic clamps save my bits when a cut goes wrong, but buying injection-molded ones over and over got old fast. Now I print them for pennies a dozen at a time.
Having the right power tools helps you work faster and more efficiently, so you can meet your deadlines. They aren't cheap, but price won't be a limiting factor when you get 41% off the DeWalt 20-Volt Max 6-Tool Cordless Combo Kit and save $370.
If your favorite green tool is broken or no longer works the way it should, don't toss it out and drop a bunch of cash on a replacement. A cheap spare part might be all you need, and you don't have to scroll through eBay to find it. Did you know Ryobi has a website where you can buy spare parts and accessories?
HostDeal helps agencies run unlimited websites with domains, backups, SSL, email, storage, and dev tools.
The post Get HostDeal for $119.97 and Give Every New Website Somewhere to Go appeared first on TechRepublic.
DeWalt makes hundreds of power tools, but you don't need to spend a ton of cash to get quality gear. While you probably already own several basics, if you're a new homeowner or simply on a budget, certain tools are must-buys. Here are a few affordable DeWalt tools worth buying.
Welcome back, aspiring cyberwarriors!
Recently a new project was released by Praetorian. Praetorian is open-sourcing the offensive tools their red team actually uses on engagements. They call it 12 Caesars and their team is planning to release one tool a week for twelve weeks. Every tool is written in Go and ships as a single binary with zero external dependencies.
Each tool is assigned a Caesar name and a blog post, where you can learn more about these tools.
We’ll look at four of these tools, including the basic ones, to make this article suitable for everyone. Before we proceed, it’s important to remind you that you can only test systems you own or have explicit written authorization to test. We will use our lab for it.
Our first tool is Titus. Titus finds credentials, API keys, and tokens in source code, files, git history, container images, and more. The tool has 487 detection rules covering AWS, GCP, Azure, GitHub, Slack, databases and hundreds of other services. Similar to TruffleHog, it can validate credentials as it finds them by calling the provider APIs.
It’s also available as a Burp Suite extension and a Chrome extension.
Loginkali > curl -sL -o titus https://github.com/praetorian-inc/titus/releases/latest/download/titus-linux-amd64
kali > chmod 777 titus
kali > ./titus --helpLet’s start by pointing it at test keys released by Truffle Security.
It found all the keys in the repo. Companies often publish their secrets by accident. Some live in the repositories for years, so it’s good to do regular checks to prevent unnecessary leakage.
Nerva is a fingerprinter supporting 170 protocols across TCP, UDP, and SCTP, plus dozens of HTTP technology fingerprinters. You can feed it with open ports from naabu, nmap or other tools and it’ll tell you what’s actually running with its version.
kali > curl -sL -o nerva.tar.gz https://github.com/praetorian-inc/nerva/releases/download/v1.70.3/nerva_1.70.3_linux_amd64.tar.gz
kali > tar --no-same-owner -xzf nerva.tar.gz
kali > chmod 777 nerva
kali > ./nerva --helpNow let’s use our Ubuntu to show a basic test.
kali > ./nerva -t 192.168.131.9:22,11434It will be way more useful when you work with big lists of corporate assets during a pentest.
Brutus is a modern Hydra alternative. It supports more than 40 protocols including SSH, RDP, MySQL, PostgreSQL and a lot more. Brutus was built to work with Nerva or naabu output.
kali > curl -sL -o brutus.tar.gz https://github.com/praetorian-inc/brutus/releases/latest/download/brutus-linux-amd64.tar.gz
kali > tar --no-same-owner -xzf brutus.tar.gz
kali > chmod 777 brutus
kali > ./brutus --help Each command has its own help menu to make it easy to work with.
kali > ./brutus creds --helpNow once again lets use our Ubuntu to spay passwords.
kali > ./brutus creds --target 127.0.0.1:22 --protocol ssh “admin:admin”It was easy. As mentioned before, this tool chains with Nerva, and that’s how it becomes useful to test the entire infrastructure against common password and detection.
With AI services proliferating inside corporate environments, we want to know what LLM infrastructure is running on our hosts. Julius will fingerprint more than 60 AI services including Ollama, vLLM, LiteLLM, LocalAI, Hugging Face TGI, AWS Bedrock and AnythingLLM. It can also list available models from endpoints.
kali > curl -sL -o julius.tar.gz https://github.com/praetorian-inc/julius/releases/download/v1.5.1/julius_1.5.1_linux_amd64.tar.gz
kali > tar --no-same-owner -xzf julius.tar.gz
kali > ./julius --helpYou can list all the AI services Julious can fingerprint:
kali > ./julius listWe will take a look at our machine.
kali > ./julius probe http://192.168.131.7:11434Ollama sits on port 11434, and it’s important not to leave it exposed publicly, because everyone can use your models without authentication.
There are more tools available in this project. Most of them are meant to be chained together and work well this way. The company says its team is actively using these same tools during their engagements. While you won’t need everything at once, experiment with those tools and see what fits you best.
If you like red teaming, we have our Red Team Operator training, where we cover more tools and techniques to help you emulate real APT work, so you can give a company a realistic stress test and help make it secure.
The post Pentesting: Twelve Caesars – Community Tools for Offensive Security first appeared on Hackers Arise.
Accessories are a big part of owning tools and using them regularly. I've been a big fan of Ryobi tools for a very long time. They're not only decent, budget-friendly tools, but they often do the job just as well as some higher-end ones. I'm mostly a hobbyist and maintainer of things, though, so I'm not necessarily using them for professional reasons. Either way, I found several accessories that make my Ryobi tools better. Here are a few cheap accessories that completely transformed my Ryobi tools and the way I use them.
Power tools are a modern marvel that anyone who has tried working with human-powered drilling or sanding will tell you we too easily take for granted. But while these tools are compact and powerful, they aren't that smart for the most part.
CapCut is bringing video editing to ChatGPT, letting users create and refine videos with prompts. Here's how it works and who could benefit.
The post ChatGPT Is Getting CapCut Video Editing. Here’s How It Works appeared first on TechRepublic.
CapCut is bringing video editing to ChatGPT, letting users create and refine videos with prompts. Here's how it works and who could benefit.
The post ChatGPT Is Getting CapCut Video Editing. Here’s How It Works appeared first on TechRepublic.
Being prepared is a common survival tactic, but I can’t count how many times I needed something for a car breakdown or road emergency and didn’t have it. Beyond the basics, like an air inflator, a screwdriver set, a road emergency kit, jack stands, and paper towels, there are essential tools you should always keep on hand in case you need to repair your vehicle or someone else's. Here are six Harbor Freight mechanic tools I always keep in my car’s trunk so that I am ready when something goes wrong.
When you need a power tool and head to the hardware store, you'll see options from Ryobi, DeWALT, RIGID, Makita, Milwaukee, and more displayed in a rainbow of colors. Once you choose a brand, you'll start stocking up on battery packs, chargers, and endless tools. Here's what you need to know about one of the most recognizable names, Milwaukee, and whether they're worth buying.
Whether you're a DIY homeowner or a professional, you know that buying a cordless power tool means getting trapped in a single brand's battery ecosystem. If you buy any other brand, you'll need a new set of batteries and chargers. However, the complete opposite is true with the Bosch Power for All system, which lets you use a single battery with 10 brands across more than 150 tools.
IndusPDF processes files locally on your device and includes editing, OCR, signing, and conversion for life.
The post Own a Full PDF Editor for Less Than One Month of Acrobat appeared first on TechRepublic.
IndusPDF processes files locally on your device and includes editing, OCR, signing, and conversion for life.
The post Own a Full PDF Editor for Less Than One Month of Acrobat appeared first on TechRepublic.
The cold, harsh winter months are quickly approaching, and snow is on the way, which means it's time to get out or upgrade your winter tools. There's no need to manually shovel snow from the driveway when it's freezing, especially when cordless options exist. With that in mind, here are a few cordless winter tools you should buy before winter.
Welcome back, aspiring cyberwarriors!
We’re continuing our series on Artificial Intelligence in Cybersecurity with another tool called Shannon. Shannon is a white-box AI pentester. It was created to test the security of your project by pointing it at the source code and the test stand. That means it needs both the running application and the source code. First, Shannon does an in-depth analysis of the code in the repository, then looks for attacks against that same project you’re hosting locally. This white-box approach is certainly more effective, as models don’t have to guess possible vulnerabilities, since guessing varies greatly depending on the model you use. Vulnerabilities can only make their way to the report if they have a working PoC. As always, only test systems you own or have explicit written authorization to test.
Now let’s take a closer look at Shannon and test our Juice Shop with it.
Juice Shop is just a Docker container, so we will install Docker and npm first.
kali > sudo apt update
kali > sudo apt install -y docker.io nodejs npm
kali > sudo systemctl enable docker --now
kali > sudo usermod -aG docker $USER
kali > newgrp dockerThen comes the Juice Shop.
kali > docker pull bkimminich/juice-shop
kali > docker run -d --name juice-shop --restart unless-stopped -p 3000:3000 bkimminich/juice-shopIt’s up and running. Now we need to copy the repository to our disk.
kali > git clone --depth 1 https://github.com/juice-shop/juice-shop.gitOnce we have it all set, we can get Shannon. Unlike Pentestcode and other tools, Shannon runs differently. By default, it expects your AI API keys in the env. In the next sections we’ll show how to run Shannon with OpenRouter and Ollama.
Shannon wants to see your API key in the env. You will also need a models.json file somewhere on your disk. Copy the following command to create it.
cat > ~/models.json << 'EOF'
{
"providers": {
"openrouter": {
"apiKey": "YOUR_API_KEY",
"models": [
{
"id": "nvidia/nemotron-3.5-lightning:free",
"name": "NVIDIA Nemotron 3.5 Lightning (free)",
"reasoning": true,
"input": ["text"],
"thinkingLevelMap": {
"off": null,
"minimal": null,
"low": "low",
"medium": null,
"high": "high",
"xhigh": null,
"max": "max"
},
"contextWindow": 262144,
"maxTokens": 65536,
"cost": {
"input": 0,
"output": 0,
"cacheRead": 0,
"cacheWrite": 0
},
"compat": {
"supportsDeveloperRole": false,
"thinkingFormat": "openrouter"
}
}
],
"api": "openai-completions",
"baseUrl": "https://openrouter.ai/api/v1"
}
}
}
EOFThen pass the keys and validate the setup.
kali > export SHANNON_AI_API_KEY="sk-or-v1-YOUR_KEY"
kali > export SHANNON_AI_MODEL="openrouter:nvidia/nemotron-3.5-lightning:free"
kali > npx @keygraph/shannon@latest start -u http://172.17.0.1:3000 -r /home/kali/juice-shop --validate-modelIf you see it’s validated, then you can run a full security analysis.
kali > npx @keygraph/shannon@latest start -u http://172.17.0.1:3000 -r /home/kali/juice-shop -c ~/juice-quick.yaml --models-config ~/models.json --followThis will take a while and your free daily tokens won’t be enough to complete the scan.
As the security test progresses, you’ll see all the commands and prompts it runs. Obviously, the frontier models will give better results.
Shannon isn’t only limited to APIs. You can perform the same scan with a local model. Many openweight models will be a great fit for it if you have the necessary hardware to make it work smoothly.
Just for the demonstration we’ll use Qwen 2.5-coder 7b.
kali > curl -fsSL https://ollama.com/install.sh | sh
kali > ollama pull qwen2.5-coder:7bWe’ll create the same models.json file to point Shannon to our Ollama.
{
"providers": {
"ollama": {
"baseUrl": "http://127.0.0.1:11434/v1",
"api": "openai-completions",
"apiKey": "ollama",
"models": [
{
"id": "qwen2.5-coder:7b",
"name": "Qwen 2.5 Coder 7B",
"input": ["text"],
"contextWindow": 32768,
"maxTokens": 8192,
"cost": { "input": 0, "output": 0 },
"compat": {
"supportsDeveloperRole": false,
"supportsReasoningEffort": false
}
}
]
}
}
}Make sure your Ollama is accessible, and change the IP address if needed.
kali > export SHANNON_AI_API_KEY=ollama
kali > export SHANNON_AI_MODEL=ollama:qwen2.5-coder:7b
kali > npx @keygraph/shannon@latest start -u http://172.17.0.1:3000 -r /home/kali/juice-shop -c ~/juice-quick.yaml --models-config ~/models.json --validate-modelBefore we do anything, let’s validate the model.
If your model has been validated and you can start scanning your project.
kali > kali > npx @keygraph/shannon@latest start -u http://172.17.0.1:3000 -r /home/kali/juice-shop -c ~/juice-quick.yaml --models-config ~/models.json --followWhen the scan finishes, Shannon creates PDF and Markdown reports with the evidence attached to them. You will also see structured JSON and SARIF files for downstream systems.
Below is an example of a PDF report. As you can see, multiple vulnerabilities were found in the project, some of them are classified as High. As mentioned before, all the findings here were validated with PoCs.
Shannon was made to find flaws in your web apps to make them more secure. It digs through the project repository and runs checks against a live system. It then creates a report with findings that were discovered with PoCs, so you get a clean report. As AI becomes more prevalent in cybersecurity, it should be used to improve the security of your projects before their release. Of course, that doesn’t replace a human in the loop, but it makes things faster. Stick to better models and don’t cut back on your security.
AI is evolving rapidly and the sooner you learn how to work with it, the greater the advantage you’ll have. That’s why we invite you to join our AI for Cybersecurity training. During this training, you will see you different ways of using AI in cybersecurity, set up local models and solve labs.
The post Artificial Intelligence (AI) in Cybersecurity, Part 30: Shannon – AI Pentester for Web Apps and APIs first appeared on Hackers Arise.
I used to think Excel was just about putting data into rows and columns and doing a few calculations. But once you start using it regularly, you realize how much time you waste doing things manually that Excel can handle in seconds.
