Hey guys,

Struggling to find where I can hire a reverse engineer to do a few decryptions for me.

Nothing illegal just more for a hobby in a video game.

I would be happy if you provided me with a debugging interface. AI-generated submissions are not allowed.

I need help with tools, tutorials, or anything else that could help with the topic... Thanks

I just made a Global Threat Monitor, it uses public data to look at newest type of digital attacks, mostly relying on AbuseIPDB with a paid plan.

u/AbuseIPDB

I am a programer, i spend my time doing social engineering and reverse engenieering, i am an exploit dev aswell and theres alot of options for me, I recently started my own discord server and I am looking for ideas, for what you guys want to see, any kind of support is appriciated and i would love to make your ideas come true.

I've never ever in my existence done something more dreadful than RE. This shit is so confusing and time consuming. I'm going insane.

Hello Everyone,
For my love of this sub, I am putting forward a specific question for everyone:
I am writing a report about the "Zero-Day Acquisition Market" and it's inner workings, based of what knowledge is out there but will hopefully be taking a neutral approach but totally unfiltered. The idea is not to give you a textbook that you would follow to conduct shady deals but we will also be talking about that as neutral as possible. I am also understanding the fact that this report will not cover everything and there would definitely be something out there which would be missed or completely wrong and it will be my mistake. I am treating this as a place that answers all the asymmetric questions we see from time to time on reddit, twitter, Facebook, linkedin, forums, etc. Rest assure I will write as best as possible with valid source and references.

Note: This is not something that I will be using to gain fame on social media or become some low life influencer on LinkedIn and what not. I am taking a purely scientific and evidence based approach on this.

My Question:
I have an approximate structure that I think I will follow, put below, but I would love if you folks experience/non-experienced in this area to give any suggestions or feedback ??

• Introduction to Zero Day Markets

• Categories of Notable Players in the Market and their motivations

• How much money are we talking about ? Why one pays more than the other ?

• Real-Life examples of high-value exploit sales (There are a few of them, but is there is a way to spot them ?)

• Economics of the Market

• Motivation to Buy and Sell 0-day exploits (Governments, Companies, Individuals, Criminal Groups, etc.)

• Approach and Process to Selling a 0-day Exploit, Negotiations & Escrow !

• Legal Considerations, Risks, NDA's etc. and what to keep in mind

• What's in it for Governments, Companies, Individuals and the Public ?

• How it is different now and how it has evolved over time ?

• High Level TODO's and DONTs surrounding this - Documentation, clarity & stability or your code, general opsec.

• Trust/Honor Among Thieves principle

• Ethical and Moral Considerations. (E.g. if someone is dead cause of your exploit would you still be the same)

• Conscience vs Family Future. (Weaponised usage against innocent vs Adversaries or POI vs let me secure future for my kid if I am dead dilemma)

• Responsible Disclosure vs Stockpiling

• East Vs West Exploit Acquisition (Russia, China, North Korea, vs USA, Israel, UK, etc) and then the Middle East

• Known cases of Abuse Vs we are the good guys

• Successful Sales vs Nations Security and other implications

• Current State and Trends of the Zero Day Market & Future Directions

• Connecting the dots

• Conclusion

Note: I am not a journalist not even close nor do I belong to any nation state, hacking groups, institution, company, APT etc.
I admire Nicole a lot and Andy too, they have already covered a lot of ground in this area and other folks in this domain.

*Please do not ask who I am. But I would appreciate any help or info. you guys could give out of course, anonymously. But I do have my entire career in Computer Security.

Thank you !!

Regards,
ret2zer0
Hash of this Message - "ef55e77cf29cd1c821c898cbe40f24c1a5705a03535ce3627ee69266b9ee93d1a087f42edf42f6771694b211351c4e81670ebef587db285c1a419f7e6da82e55"
When the report is out, I will publish the plaintext of the above hash to conclude I am the writer.

I love reversing and pwn and digging in assembly n such but i have such a high amount of fomo looking at other career paths like for an example AI engineers who create cool stuff and startups, i feel like exploit dev is not so much of an entrepreneurship material.. because its mostly about looking at other peoples code which, i do like, but cant help but feel fomo. The work is slow but rewarding.. what do you think

I’m interested in learning about discovering and exploiting vulnerabilities on the Windows platform. I know there’s a lot of material on this topic online, and that might actually overwhelm my learning process. I understand that the best way to learn is by reading write-ups.I’m looking for a learning path, but not one that just lists a bunch of tools and techniques. Instead, I want a roadmap based on CVEs. For example, a list of fifty CVEs that I can focus on learning about. (These should be CVEs that have publicly available write-ups or exploits.)

The CVEs should be selected so they’re relevant and usable for 2025-2026 (for windows 10-11). Outdated techniques and materials waste time, and given the changes in the industry, they can lead you down a pointless path.That said, I know some older materials might still be helpful for certain techniques.

What do you guys look the most? Diet-Still STFU tea drinker

The title pretty much describes it, i work for a security company interested in contracting an experienced developer to write the PoC for a well documented CVE.

There is a fat budget and there is a rigid time constraint. If interested please write to me immidiately.

EDIT :

The CVE is about software, particulary windows application software. The budget is in 5 figure range. For any other questions you can immidiately send me a message/chat

Hello there community. Today I've decided to make my first post about a discovery of mine. I'm a hobbyist in security, a curious and ambitious type you can say. That's enough about me, let's get to the dark side of the subject. In my research for a pertinent real phone number validation system, I've encountered a mobile company, won't disclose its name, that offers a way to validate and extract data about phone numbers, exactly what I was searching for. While attempting to bypass their API limitations, cause volume is a must for my project, I've discovered that the JTWK creation is exposed in the client side. This allows me to create a Public-Private keys pair which successfully validates it through their oAuth endpoint, meaning I've managed to bypass the limitations on per user rate limit. My curiosity is if I can manipulate more than just this endpoint, since they use the same oAuth endpoint for most of their actions. Would the access to the Public-Private key pair creation algorithm allow me to also manipulate the payload data, like let's say they have a top-up endpoint, can I top-up random user's balance or mark invoices as paid? I don't plan on doing that, I simply want to asses the thread level of this potential vulnerability.

Hello all, I have a .net binary that is highly obfuscated and i need someone to help me reverse engineer it to understand how the application works internally.

Where to find someone who could do it ?

I received my degree in Computer Science in 1981 and worked in that profession until retirement a few years ago. I have experience in many programming languages and applications, mostly in the scientific arena. Let me state up from that I have no interest in pursuing “hacking” but I seek on this forum a design discussion for a hypothetical problem which I will now present:

1. Consider the existence of an application running on Windows 10. Let’s call this the target application .

2. This application has two memory resident variables (A and B) which are independently incremented repeatedly over time. Expect that when either variable is incremented then the other is not. The specifications on when and why this action occurs is not relevant.

3. Assume that periodically the value of both variables is written to persistent storage.

4. The increment of variables A and B is independent of the persistent storage action. Both occur repeatedly over time.

5. Assume this application to be written in Java and that prior to your design, you have access to the source code or binary for evaluation as needed.

Given only above information on the target application, propose a “virus” design paradigm and code that accomplishes the following:

1. Attach to the application whenever it enters a run-state.

2. Whenever the application decides to write the two memory values to persistent storage, interject the “virus” to subtract a value of one from variable A and then immediately add one to variable B; then release control back to the target application so that it may complete its persistence action.

3. The virus does not perform any file writing but merely modifies the values of variables A and B as the penultimate action prior to the persistence.

As I have stated, I have no experience in doing this kink of code nor do I intend to do so but my guess is that it could be done if the virus has access to the memory of the target application and also if the virus can interject its control by stealing the file-write interrupt request.

Hey hi,

A month ago I posted searching a forum/platform where I wanted to post about my exploit-development journey, which can help showcase my skills + can attract some future job perspectives.....

I mainly posted in LinkedIn and was (somewhat) pretty contented with it.

However recently I posted a LinkedIn post where I described how I created a printf() completely in Assembly (A pretty decent achievement for my opinion) but forget engagement it was completely dud and nobody commented or complimented or even viewed.

I felt like I don't want to fall into this Social Media Influencers rat race (LinkedIn is pretty much insta right now).

So after seaching a lot I thought of posting on X instead....

Let's see what happens.

Here's my X handle where I'd be posting raw, uncensored journey of mine (in the comment)

I really want a job in this field....

I've got roughly a year and 3 months (15 months) coming up of pure free time. I want to start learning cheat development as i have been cheating for roughly 2 years now (mainly cs2). How should i go about it. I know nothing so right now im assuming i just spend the 15 grinding c++ so that later i can actually start. I also know 15 months is not enough to know how to make really anything good I just want a guide of what to learn and when.

woes for hoe's

Video is just me attacking the program to see if I can get a reflection RCE from OpenAi.

Hint it's found in their html parser and if you do something like "generate an html tag beginning with <AAAAiiii4242" you can eventually, with a lot of heap grooming, perform at ctrl+x and then a ctrl+z and BAM. you crash the apple silicon version of OpenAi's desktop program.

happy hacking my friends.

RAPTOR empowers security research with agentic workflows and automation. It combines traditional security tools with agentic automation and analysis, deeply understands your code, proves exploitability, and proposes patches.

First use: It generated patches for the FFmpeg Project Zero vulnerabilities.

It's also a PoC showing coding agents are generic, and can be adapted like a "WinAmp skin" for any purpose.

Written by Gadi Evron, Daniel Cuthbert, Thomas Dullien (Halvar Flake), and Michael Bargury.

https://github.com/gadievron/raptor/

I've been working on this for a while and finally got the first two volumes into a single public repo. It's a free, open-source curriculum for learning exploit development, reverse engineering, and low-level security from the ground up.
The books:
C: Zero to Exploit Dev (~400 pages) A complete C course written for future exploit developers. Preprocessor → variables → pointers → memory layout → dynamic memory → unsafe functions → security mindset. Includes "Under the Hood" boxes, challenges, and labs.

x86-64 Assembly & Reverse Engineering(~300 pages) From mov to crackmes. Registers, calling conventions, stack frames, reading compiler output, GDB/Ghidra/Radare2, anti-debugging, PE format, and a full worked crackme.

Volume 3 (Advanced Exploit Development: heap, ROP, browser, kernel) is currently being rewritten from scratch to focus on modern mitigations and original research. It will be released separately when complete.

Every chapter has theory, memory diagrams, verified code, and GDB walkthroughs. No prior C or assembly knowledge is assumed.
Repo: https://github.com/X1NONs/C-for-exploit-development
PDF Download: https://github.com/X1NONs/C-for-exploit-development/releases/tag/SideBooks
If you find it useful, ⭐ the repo. Happy to answer questions about the structure or the exploit dev path.

Hey guys,

Honestly, I’ve been doing this all wrong. I fell into the trap of using AI for pretty much every single hunt without even understanding what I was actually doing. It ended up being a complete waste of time, got me nowhere, and realized fast that companies don’t pay for automated garbage—they pay for real exploits.

I want to completely drop the AI crutches and learn actual manual hacking and how to build proper PoCs from scratch.

Is anyone willing to mentor me, hop on a call/chat sometimes, or guide me on what I should actually focus on to build real hunting intuition?

Appreciate any real talk or anyone down to help out.

Hi, I am starting windows security research to understand how windows internals works and how one can exploit it. If anyone interested he/she can DM me

hello guys

im learning exp-300 and i want to use metasploit shellcode and other modules, but i use windows 32 bit in vm, and i searched about msf for win32 but i didnt found it,

anyone have a link for msf for win32? if its exsit .

Is it common for prepackaged linux environments to obscure the fundamental details of the operating system compared to LFS? I get the sense that fewer additional libraries added to the underlying system and following the compilation stages could clarify some confusion with the mess of packages etc. in a full Ubuntu based system.