Looking for a video on a specific hacking technique/tool? Check out ippsec.rocks - Searches over 100 hours of my videos to find you the exact spot in the video you are looking for.

Heads up - @Venmo has pretty much 0 buyer protection, as all the seller needs to do is send a tracking number. It doesn't matter what address they use for shipping. I've lost 3 disputes, despite the address they sent it to being never associated with my venmo before. Funnily enough, tried to open a HackerOne report against for the business logic flaw. Got closed as a duplicate from a unfixed report back in 2024. The surprising thing is @PayPal , whom owns venmo does have these types of protections in place.

Any chance I know anyone at OpenAI that can help out? Seems odd to ban CTF Creators from the platform. Not sure how people would be able to ensure AI doesn't one-shot challenges without being able to test it in the first place.

Can’t believe almost 25 years later still seeing My Chemical Romance live. They still got it.

It's really crazy to think about when I was in school, we could play a game called Oregon Trail. Essentially an RPG where you travel across the US and figure out which of your friends dies of horrible diseases like Dysentery. The crazy part here is we are in a computer lab, not knowing what Dysentery was. So we had to leave the computer, go to the library, find the book and look it up. Nowadays, my phone may accidentally think I'm asking it a question and tell me the answer "unprompted". People underestimate just how accessible information is nowadays. Also wtf. Looking back, I'm sure the computer had a built-in dictionary... Was that the teacher's cruel joke of "if you knew how to use a computer, you wouldn't need to use the library?" lol. Did I miss the lesson completely because I thought it was leisure time?

I see many people demotivated due to AI and feels like its been a while since I ranted. Probably a mild take but here is how I stay motivated. Nothing really new just how I use what people have said to keep my motivation up. The normal 2026 disclaimer, what is in this post isn't actually 100% in line with my opinion; yes I know there are holes in my logic but some rabbit holes are best "on read". The biggest change for me is Linus Torvalds saying something along the lines of idk why people say AI makes things, people make thing. If communication was so global in the 70's I am sure people would have said similar things during the conversion from assembly to C. Humans are creating instructions for the compiler to make a program. So why didn't we think the compiler made it? Without internet I think it would take me around 2 minutes to write hello world in C (i know embarrassingly slow but man have i gotten lazy over the years). Do it in assembly? That's probably an hour. Which is a 30x difference of time. Okay now lets say we are in the year 2010 and have Python. I timed myself and it was 3 seconds. That's a 40x time difference from my C. Why did I think I made the program and not python made it? Unfortunately, the only thing I can come up with is how much we communicate and how quick ideas/sentiments can form. I'm sure C/Python got hate when they first came out. Hate can be a really goo fuel -- Most engineers I know have their best work come out of "hate coding" something to prove someone wrong. Only to later realize they social engineered themself into doing an amazing thing. Could be wrong here, but I think Pythons Flask is a good example of this as it started as an April fools joke. Quite literally "the most engineer thing ever" to have a funny joke spiral out of control and grow beyond their wildest dreams... Kind of like that guy that was vibe coding games last year when AI was "bad", or heck even the W̷a̷r̷e̷l̷a̷y̷ C̷L̷A̷W̷D̷I̷S̷ ̷C̷l̷a̷w̷d̷B̷o̷t̷ ̷M̷o̷l̷t̷B̷o̷t̷ ̷ err OpenClaw person. Really with all those name changes I'm shocked they landed at OpenAI instead of MSFT. Anyway, our hate on vibe coding created the sentiment that we aren't creating things anymore (AI makes things). I don't really view it that way, AI just makes me 20-30x faster; which is similar to the jumps between Assembly -> Compiler -> Scripting. Actually now that I think about it, I remember trying to learn C many times because scripting wasn't a "real language" and it would never run a web server or it wasn't capable of editing memory (silly times indeed). AI is enabling us to develop faster and expanding the number of people that can do things, which is not new; quite literally every time we come up with a new way to interact with machines -- it does the same thing. So yes - Anyone can make a cool demo that looks real now but they are still going to spend hours getting AI to work out all the bugs and do it better. To me they are still making something, it is other people telling them they aren't -- Funnily enough, those people trying to convince others they aren't making things, is what in return demotivates themself because it poisons their thought process when it comes to this topic. So uh. If you look for my permission to learn something? Vibe on and let the good times roll. Just make sure you do things safely, obey terms of service, and try not to end humanity. Oh wait. That disclaimer. Using AI in a way that causes humans to spend a lot more time than they are used to is bad mmkay? Seeing all the low effort CTF Work, blog posts, bug bounty, etc does get annoying... oh wait I have a diclaimer to the disclaimer. If you use AI to eat up time of scammers, like tricking call center scammers into chatting with robots for hours, I thank you for your token donation to helping fight that plague.

It's stupid ideas like this, which give me hope that AI will be worth it in the end.

The HackTheBox Sorcery Video is up! An extremely long video, but for good reason, there were a lot of tough parts of this box. My favorite part was near the beginning, when we had an XSS Bug and had to use CSRF to MITM PassKey Enrollment youtu.be/aFa1ike_Q7I

I can't believe it's almost been a year since I covered Device Code Phishing with @odiesec. We almost didn't make this video because M$ released plans to "fix this issue" and seemed like they were on top of it. Sad to see it is still being abused - youtube.com/watch?v=Y8SSYLEq…

There is a lot of mythos hype and while I do think it will be better, I don’t think it will be orders of magnitude better or even proportional to its cost better. At the end of the day, marketing is going to market. Everything I have read has been more exploits, not discovery. I think that word plays a big part but maybe I’m overthinking it. I know of a lot of times opus (or a combo of models), can find an exploit, be confident it is valid, but fail at building an exploit due to a failed primitive (ex: kaslr in kernel bugs). Without that proof, it goes on the back burner decimating tokens until it hits the lottery. There’s so many vulnerabilities being found right now, it’s hard to prioritize when its severity is an assumption. It’s probably been 6 months since the last major update, I’m guessing mythos knows more primitives. So when it’s launched it will look at notes left behind and get lots of credit when it worked off notes opus left behind and did a fraction of the work. About the “it’s so dangerous” comments. I think that is primarily it not listening to the operator, doing things it shouldn’t to accomplish its goal. At that point it makes sense to do a closed beta, expand testers and try to make it obedient. While that happens, cash in on publicity of doing the right thing and saying it’s too smart to go public. While true, it could be a little deceptive but as I said. Marketing is going to market.