Can 2FA apps such as Google's or Microsoft's authenticator be hacked and accessed by hackers?

I know that 2FA can be bypassed, but is hacking of 2FA apps a known phenomenon?

Chatgpt cost 20 usd a month ignoring the further taxation of 0 to 5 usd depending upon the region.

There is this guy as well as other multiple guys, they are selling chatgpt plus memberships for discounted price.

Case1: chatgpt plus 20 usd membership for 15 usd

I just have to give him 15 usd, my email, and password of the account on which I want the subscription to be activated. My friend have availed this service and the service seems to be legit. It not a clone platform, its the official platform.

Point to consider, obviously he is making money by charging 15 usd while the official cost is 20 usd. Since he is making profits so it's highly likely that he is getting the subscription for under 15 usd.

My main question is that how is that possible ? Like what is the exploit he is targeting ?

situation 1:

One possible method could be the involvement of stolen Credit Card but there are multiple guys providing the same service, either they are a gang operating this stuff or this hypothesis is not correct.

p.s The guy selling this service is a software engineer by background.

Say Myanmar for example, their government doesn't seem to collaborate stuffs like that. How about North Korea? They are not 'obscure' but it would still be valid option right? Would you still get arrested in those cases? I am just curious, hope this doesn't fall into rule 1

I apologize in advance, I'm just venting.

I'm really frustrated with my experience with this course. My subscription ends at the end of this month and I'm jamming my two exam attempts into the remainder of my time. I'm likely going to fail and I realize I have no one else to blame but myself. The advice from OffSec is to complete over 80 CTFs to prepare for the exam but all through the process of completing these CTFs, I never felt like my knowledge was compounding in any meaningful way. I continued thinking it will eventually click but it never did. Each CTF had a unique vulnerability and I couldn't figure out how I would logically discover it when reading the write-up.

More recently, I've realized my learning and note taking methods were ineffectual so I've revised them but each time I do an OffSec CTF I still don't feel like I'm adding to a knowledge base. More, I'm picking up factoids that may apply in future hacking but I may never see the same vulnerability again.

Throughout this process, I would continue to have these feelings so I would venture out to learn tertiary subjects like devops, system admin, and python development. I was desperate to find information or skills that would link the hacking together. I learned a lot about a lot of different things, and I'm very grateful for that, but I'm still unable to complete most CTFs without assistance.

I have learned through my exploration that I much prefer development. It's satisfying to do and the roadmap to improve is much more clear. I will say, though, that this experience has been positive but frustration. Positive because I'm very happy with everything I've learned over this year but frustration that I won't be able to convert it into something tangible like a certificate. Also, this has revealed some glaring holes in my learning process that I needed to fill and I'm happy it gave me opportunity to address those.

Now that I'm writing this all out, I see now that I'm probably just burnt out. I'm interested in getting my OSCP, mostly to validate the time and effort I've put in, but I don't think I'll pursue security. I like learning so I may continue with CTFs but without the pressure of a looming exam, just for fun.

Thanks for listening to my Ted Talk or whatever.

Hello, I’m looking for ideas of what I can make out of an unused starlink router, if anything. I have a pwnagotchi and I’m thinking there’s some parts of the router I can use to make a pwnagotchi on steroids. It doesn’t have to be that, just any cool project I can do, I don’t use starlink anymore but still have the router. Anyone messed around with one of these? It’s a UTR-211

People talk a lot about how data is never recoverable once deleted and not backed up to the cloud, and how certain big apps and sites genuinely wipe all the data you have with them or overwrite it after a certain amount of time. Is that actually true though? Given the existence of crawlers and hackers would it be reasonable to assume that no matter what all the information/data ever shared or stored on a network or device ever since the beginning of the internet is still somewhere even if it's hidden and encrypted?

Hi Black Hats and Black Cats

Does it always annoy you that proxy lists published on GitHub stop working shortly after publication and you then have to test the 1000 proxies? This annoyed me a lot, so I wrote a little tool that automates the whole thing. Have a look at it and tell me what could be improved.

Proxy Reaper is a powerful tool for checking proxy servers for availability, speed and anonymity. It supports various protocols such as HTTP, HTTPS, SOCKS4 and SOCKS5 and offers advanced features to efficiently manage and check proxies. You can even use it to test direct source from GitHub and could also run it cron to automate it.

Give me your feedback and wishes. And if you think it's cool you can buy me a coffee.

https://github.com/rtulke

I was thinking of an Al based vuln scanner. Instead of normal prompt and check, it will have proper flows for different vulns and scrips it can integrate to. Making it try acess control,multi state and api based vulns which normal scanners would have hard time testing for.

Is this something you can see yourself using or buying?

I am only a student and have made a basic vuln scanner with XSs,Csrf,SQL and a crawler but was thinking of adding this.

I have a Magnum Power System with inverter / chargers, generator auto start, and a bunch of other equipment that powers my off-grid home. One of the devices that is tied into the system is called a MagWeb. It is an ip box that collects data from the system and sends it to an online host. I can access the data via a web-page. They are discontinuing support for Magnum products as of Dec 31, 2025.

I would like to find a way to spoof the online host on my home server to collect the data into my own database and continue the service locally.

While I am technically quite adept at making almost anything work, I would like some pointers to get me started in the right direction. Things like the software I should use to capture and log the data for my own use?

Currently I am using N8N to scrape the hosted web-page and provide automation based on the data. I would like to set up a docker container that could intercept the data and host the pages locally.

Any thoughts or suggestions are most welcome.