CylentSec

When attempting to poison the Host header in password reset flows, don't simply change the Host value. Leave the existing value and try adding the X-Forwarded-Host header: Host: victim.tld Host: attacker.tld X-Forwarded-Host: attacker.tld X-Forwarded-Proto: https Some servers (Django, for example) will frequently be configured to use the USE_X_FORWARDED_HOST header value passed from the frontend proxy. If you simply edit the original Host header it will be rejected by the proxy.

. @antirez ds4 is so fast (60+ t/s average) serving Qwen 3.8 Flash Next on my M5 Max 128GB that I don’t think I’ll need to buy a 256GB Ultra anytime soon. This is while running Outlook, Slack, and Safari. Is there a compelling reason for upgrading to 256GB over what I have now?

Hackers who work for pentesting or red teams - Would your employer pay a yearly subscription for this: An iOS app pentest tool which includes the following features: 1. Static analysis of native iOS binaries 2. Output of static analysis scan includes potential vulnerabilities in json files 3. Output includes a nice looking HTML report with graphics 4. Output includes Frida scripts tailored to static analysis results to further investigate and prove exploitability 5. Includes skills and tools to hand over the json results to an AI agent for investigation 6. Includes skills and tools that allow your AI agent to "see" and interact with the iOS device screen over USB for dynamic runtime security testing You can see the SAST scanner demo here: trellis.cylentsec.com Example HTML report here: trellis.cylentsec.com/static… What I'm proposing is a package deal that anyone with technical ability can use to run a complete iOS app pentest to OWASP MASVS/MSTG standards, without having to learn iOS reverse engineering. Would your company buy a subscription if the cost were reasonable? What would you pay for it? BTW, the Trellis URL is a demo. You can run everything locally via cli, except for AI usage, which is not included and you must provide. You bring your own AI provider. I simply provide the tools and skills you give to your AI agent.

I intensely dislike reporting vulnerabilities found outside of a pentest or bug bounty program. Although I know I did everything right and acted responsibly, and did nothing more than view page source and JS files they were serving, I still get high anxiety waiting to see how they respond.

The lower back pump pain from 15g creatine a day is insane.

Hackers: Without solid Bash skills, you're probably operating inefficiently. For example, you run an httpx scan and then nuclei scan the httpx output. Frequently port 80 will redirect to port 443, but now you've got nuclei scanning both ports. Very inefficient. Dedup the httpx results with this Bash one-liner: awk -F'://' '{h=$2; if (!(h in seen) || ($1=="https" && seen[h]=="http")) {seen[h]=$1; line[h]=$0}} END{for (h in seen) print line[h]}' httpx.log Learn more: packtpub.com/en-us/product/b…

Receiving this from someone I respect really made my day. I'm going to frame it and put it on my office wall so it can keep making my day and lift me up when I feel down. I know I'll never be the smartest person in my profession, but I'm lucky to have found a profession that I'm passionate for, and my work ethic will ensure that I keep rising.

So many posts with people going nuts over DFlash2 token generation speed with Qwen3.8 27b but my tests show that t/s is only fast for small context limits and degrades as context grows. Meanwhile Lightning MTP is faster (for me in my tests) and doesn't suffer at longer context.

I love using Hermes Agent, but now that I’ve switched to using mostly local hosted models I’m noticing something. My context is so bloated! You really should disable or remove any skills that you don’t absolutely need as well as enable mcp servers only when you need them. I’ve reduced my context bloat from almost 20k down to 4k. That’s a huge difference when you’re working with smaller context limits on local models to max performance. Imagine how much less you’d be paying for tokens using $$$ frontier models if you did this.

This is a game-changer! I was planning on running DeepSeek v4 Flash on a DGX Spark 4x cluster, but now I think it will be Qwen 3.8 27b.

Hermes Agent: Subagent delegation gave children bloated context. This PR reduced my subagent prompt from 18,390 to 4,639 tokens by giving you the option of not sending every parent tool definition to a child. This will definitely preserve context and VRAM. github.com/NousResearch/herm…

You really should try herdr. A default herdr install looks like nothing more than a modern tmux replacement until you configure harness plugins and install the herdr agent skills. Then it's got orchestration super powers. You can give one agent a prompt to do something and spawn n agents to divide the work and then you'll see new agent panes open up and get to work on assigned tasks. It works with all of the most common LLM harnesses.