Author: HackWatchit
Created by Justin Wang || Revised by Kent Ickler This blog is part of Offensive Tooling Cheatsheets: An Infosec Survival Guide Resource. You can learn more and find all of the cheatsheets HERE: https://www.blackhillsinfosec.com/offensive-tooling-cheatsheets/ Hashcat Cheatsheet: PRINT-FRIENDLY PDF Find the tool here: https://github.com/hashcat/hashcat Hashcat is a powerful tool for recovering lost passwords, and, thanks to GPU acceleration, it’s one of the fastest. It works by rapidly trying different password guesses to determine the original password from its scrambled (hashed) version. Hashcat uses various clever techniques, like dictionary attacks (testing common passwords), leetspeak tricks (e.g., replacing “e” with “3”), pattern-based guessing,…
Topic: Building Cyber-Aware Workforces: AI-driven Security Awareness Training Watch Now Abstract: As cyber threats grow more sophisticated, tactics like phishing and social engineering remain at the forefront of attack strategies. With employees often serving as the first line of defense, enhancing security awareness has become a top priority for organizations and security teams alike. Traditional, one-size-fits-all security awareness programs often fall short in addressing the diverse needs and behaviors of modern employees. This webinar explores how security awareness training must evolve to keep pace with the changing threat landscape — and how Artificial Intelligence (AI) is reshaping that evolution by enabling…
my stuff, then you know that not too long ago, I wrote a piece about the Model Context Protocol (MCP)—explaining what it is, how it works, and even walking you through building your own custom MCP servers. It was a deep dive into the shiny, promising world of agentic integration. At the time, I was swept up by how elegant and powerful MCP felt. It was like discovering a universal adapter for AI agents (it is!)—finally, I could connect large language models to any data source, tool, or API with ease. Every use case suddenly looked like a perfect candidate…
AI vs. AI: The Race Between Adversarial and Defensive Intelligence
I’m a big fan of recycling. But what about recycling our private data? Like medical records? Well, according to local media reports, a hospital in Thailand has been fined after patient’s printed records were recycled as snack bags to hold crispy crepes! An investigation by Thailand’s Personal Data Protection Committee (PDPC) found that over 1,000 protected records were leaked by the unnamed hospital after being sent for supposed destruction. Sign up to our free newsletter.Security news, advice, and tips. The “secure disposal” business contracted by the hospital offered as an explanation that the documents had been stored at their home,…
Cybersecurity researcher Jeremiah Fowler discovered a major data leak at a Florida-based data solutions provider, IMDataCenter. The leak exposed a massive database containing personal details of users and client companies. The misconfigured database, with CSV and PDF files, contained a staggering 38GB of information from 10,820 records and was left wide open on the internet without any password protection or encryption. This leak is particularly alarming because of the type of data exposed. The files contained a vast amount of personally identifiable information (PII), including names, physical addresses, phone numbers, and email addresses. What makes this data dangerous is that…
While GenAI excels at producing functional code, it introduces security vulnerabilities in 45 percent of cases, according to Veracode’s 2025 GenAI Code Security Report, which analyzed code produced by over 100 LLMs across 80 real-world coding tasks. Vibe coding “The rise of vibe coding, where developers rely on AI to generate code, typically without explicitly defining security requirements, represents a fundamental shift in how software is built,” said Jens Wessling, CTO at Veracode. “The main concern with this trend is that they do not need to specify security constraints to get the code they want, effectively leaving secure coding decisions…
As cyber threats against American critical infrastructure escalate, new research from security firm SixMap reveals alarming gaps in the cybersecurity defenses of the U.S. energy sector. A study of 21 energy organizations uncovered nearly 60,000 internet-exposed services, including thousands running on overlooked non-standard ports that evade traditional security scans. Among these exposures, 5,756 contain known vulnerabilities, 377 of which are actively exploited in the wild, highlighting systemic risks across the industry. The SixMap findings underscore a dangerous blind spot in how energy companies manage their external attack surfaces and point to a critical need for broader visibility beyond the top…
By Chris Traynor || https://ridgebackinfosec.com This blog is part of Offensive Tooling Cheatsheets: An Infosec Survival Guide Resource. You can learn more and find all of the cheatsheets HERE: https://www.blackhillsinfosec.com/offensive-tooling-cheatsheets/ EyeWitness Cheatsheet: PRINT-FRIENDLY PDF Find the tool here: https://github.com/RedSiege/EyeWitness The Basics Offensive Purpose: Efficient way to gather info about web services & their hosting infrastructure Automates taking screenshots for quick & easy review Limitations: Only works on HTTP services Can only capture a screenshot of the landing/login page; will NOT do spidering Key Features: Output in multiple formats (i.e. – HTML & text) IDs web server software on target systems …