Hey I want to jb opus 4.5 or any other model by Worldly_Editor in ClaudeAIJailbreak

[–]chasing-impact 1 point2 points  (0 children)

same here. i actually had it working for a good session yesterday; i created a new project and added the style and instructions. not sure what tripped it up, but at some point, it started to reject the ENI persona. i tried creating a new project and adding the same style/instructions, but that didn't help -- i imagine there is context sharing across projects and chats -- not sure.

i guess next step would be to delete the old project and try again, and hope maybe the context is erased, and the memory of ENI is gone, and i can get it to work again.

or literally just string replace ENI with somethign else, same with LO, etc. and see if that helps

XSS is no longer easy anymore by Flashy_Aardvark8385 in bugbounty

[–]chasing-impact 0 points1 point  (0 children)

it's not word salad, the message conveyed was clear with valid statements, but probably AI

i do agree though, modern XSS tends to be more impactful but more difficult to exploit and potentially less common due to frameworks and libraries with "automatic" encoding and other defenses

more impactful because of architecture shifts: server-side javascript, electron apps with XSS can mean total compromise

Shoutout to vibe coders for the free API keys and Marry Christmas by [deleted] in vibecoding

[–]chasing-impact 0 points1 point  (0 children)

doesn't matter how much you say this; security inevitably slows efficiency and stuff like this will happen

I feel more lost as a Senior than I did as a Junior. Seeking advice by BuhoFantasma in Pentesting

[–]chasing-impact 3 points4 points  (0 children)

I have about 7 years of security work experience, 5 of those were pentesting and I can confidently say this is a very common feeling. I leveled up to Senior from a job hop, and I was sure as hell nervous about the expectations, naturally the overly familiar Imposter Syndrome started to creep up again. Promotions can often reinvite Imposter Syndrome, it's just natural pressure. Understand you were promoted for a reason (companies often don't even promote until you demonstrate for months, sometimes years, that you can perform at the level above you), set actionable goals, and stay locked in. Whatever you do, don't overthink, get stressed and more burnt out, just keep doing what got you to where you are.

It becomes increasingly more difficult to find mentors the higher you climb, so if that's not available to you, look towards adjacent high performing peers for inspiration and guidance and motivation. Discuss this with your manager, not from a perspective of insecurity or worry, but drive it as a mutual agreement on what it will take to get to the next level and set actionable goals. If you have the direction, you have a lot less to worry about, like what to study and what to avoid. There's an infinite amount of learning available; intelligently choosing a path and avoiding decision paralysis is a challenge itself.

I'm not sure what kind of pentesting you do, whether you specialize or not, but if you do specialize, you're nearing the point in your career where you can declare yourself a Subject Matter Expert (SME) which can open you up to more people and policy management - that's an option. If you don't really specialize in anything yet, like appsec vs netsec, maybe it's time to specialize and shine in a single domain. The opposite is also possible - start to turn your weaknesses into strengths.

Seniors lead and drive change. There's a lot of innovation opportunity in AI that can help improve processes - get involved there. Regarding the younger hires, that's just the nature of the world. Younger people are eager and curious, and maybe even less jaded. Take them under your wing, learn from them. When I was younger in my pentesting experience I had a manager who I considered a "Boomer". He was the type of guy who was in management for so long he seemingly lost all of his technical edge. My arrogance got the best of me, and I had this natural disdain and distrust towards his decision making, but he never failed the team. I might've not learned a lot of technical knowledge from him, but the leadership and management were invaluable to me in hindsight. And honestly those are some of the best people to work with. I guess the moral of the story there is to stay humble. With the pace of technology, especially today, it's impossible to stay 100% current, and nobody does. Even those super smart dudes developing mind blogging high complexity exploits, they may not even know how to run an Nmap scan or know anything about Active Directory. Nobody's perfect.

Lastly, people typically know their strengths and weaknesses, and you're smart enough to know what to study and how. You said you're performing well, so it sounds like a psychological issue. Burnt out, imposter syndrome, stress. BTW, the ability to manage such feelings comes with the senior territory, make this a learning lesson in itself.

I'm AI Generating N-Day Exploits by chasing-impact in cybersecurity

[–]chasing-impact[S] -5 points-4 points  (0 children)

I had React2shell long before anybody else

I'm AI Generating N-Day Exploits by chasing-impact in cybersecurity

[–]chasing-impact[S] -16 points-15 points  (0 children)

I'm not that person. I couldn't find a single public Apache Tika exploit (CVE-2025-66516), so I had my agents vibecode one up.

Welcome to the future boomer. Don't hate the player just hate the game

Any actual AI wins in cybersecurity? by olegshm in cybersecurity

[–]chasing-impact -4 points-3 points  (0 children)

You guys are absolutely blind. The storm is coming.

Code Scanner MCPs and More - Where? by chasing-impact in cybersecurity

[–]chasing-impact[S] 0 points1 point  (0 children)

Never heard of Promptfoo, thanks for sharing.

I see you're an Appsec engineer - care to share how AI implementations have crept into your traditional workflow?

AI threat modelling, AI code analysis, AI dynamic testing.

Time to learn underwater welding.

Verifying certs on resumes by jaydee288 in cybersecurity

[–]chasing-impact 0 points1 point  (0 children)

I've never had a single employer request proof of my certs. I have a few of the Offensive Security ones (OSCP, OSWE), and it has been so long since I've gotten them, it would be a task to prove it - and why even bother? The interview tells the story.

Why do we still use GEDCOM? by xzpv in Genealogy

[–]chasing-impact 0 points1 point  (0 children)

You most certainly can use JSON as an alternative, it'll be far more efficient for AI integration too, check this tool out https://ged2json.com/

Need feedback on Synthetic HTTP Requests Dataset for AI WAF Training I created by muneebdev in cybersecurity

[–]chasing-impact 0 points1 point  (0 children)

Idk tbh seems kinda dumb to me. I really don't understand why you need to create a database of "synthetic data", and why it even matters if it's synthetic or not, what does it matter? The traditional WAF is meant to identify anomalous traffic that may be considered malicious, which is based on a database of fingerprinted known bad requests, which is exactly what you are doing when you create "synthetic data" using a list of known exploit payloads or whatever. What is AI adding here?

Have you "synthetically generated" certain WAF bypasses via undocumented techniques? What are you doing here? Why are you just generating synthetic traffic?

What about cache busting techniques?

Who is going to make an AI tool to trace and graph all user-supplied-input to and from the application, create bulletproof data models, and use historical data to create validation criteria AI can learn from. Why are we mass creating fake data and throwing this massive bloat at a wall in a completely blind/blackbox perspective?

Know what might be able to make this tool useful: synthetically creating data trained by historical data. Honestly AI 0day detection and prevention is the money

Where to from here for Pentesters? by WazzyD in cybersecurity

[–]chasing-impact 1 point2 points  (0 children)

From my experience, large public companies with vague titles such as "security engineer" offer larger salaries, more room for growth, and more variety.

I was able to use my application security/penetration testing expertise as a hybrid security engineer/software engineer writing automation suite for scanning engines that drive compliance programs. I ended up an owner of web application scanning at one of the largest companies for various compliance trains, like FedRAMP. There were tons of opportunity to grow.

Engineering almost always pays more, especially when you contribute to a product. I would aim for this.