Hacker Noon Hacking

OpenOSINT is an open-source, MCP-native OSINT framework with 14 intelligence tools, an AI-powered interactive REPL, a web UI, and a CLI — all driven by Claude’s native tool use API. You type a target in natural language; the agent decides what to investigate, chains the tools, and hands you a structured report. No hallucinated results. Ever.Read All

5/22/2026: Top 5 stories on the HackerNoon homepage!Read All

5/21/2026: Top 5 stories on the HackerNoon homepage!Read All

We treated potholes like software bugs, hacked the visibility layer instead of the asphalt, and discovered that one weird civic experiment can spread like open source code and make people stop accepting broken systems as normalRead All

AI agents can be hijacked through prompt injection attacks embedded in everyday business data like emails and documents. These attacks require no malware, phishing, or user interaction, yet can lead to data leaks, corrupted decisions, and even system-wide compromise. The root problem is that AI models cannot reliably distinguish between data and instructions — and most enterprise systems are not designed to handle this risk.Read All

Calling ClamAV from Node.js looks easy: spawn clamscan, check the exit code, done. But the standard implementation has a silent bug — exit code 2 means “scan could not complete,” not “clean,” and almost every custom wrapper collapses it into one of the other two outcomes. The result is a false-clean verdict on encrypted archives, permission-denied files, and timeouts. The fix is to model ClamAV’s three real outcomes — Clean, Malicious, ScanError — as three explicit return values, and force the caller to handle ScanError as a security decision rather than a programming error. This article explains why this matters, what the failure looks like in production, and what a correct minimal wrapper looks like in practice.Read All

It’s been a rough few months for Anthropic….Read All

Because when a platform gives you a session, it is not just letting you in. It is treating you as already trusted. Your browser becomes a kind of silent passport. The system stops asking, “Who are you?” and starts assuming it already knows the answer.Read All

The phrase “EVM hacking” is powerful because it does three things at once. It simplifies a complex issue. It gives people a dramatic explanation. And it turns technical doubt into political energy. That makes it more shareable, more repeatable, and much more emotionally useful than any serious conversation about election security.Read All

The same large language models that help us write detection rules are now being used by attackers. A junior red‑teamer with zero Python experience used a jailbroken LLM to spit out a fully functional, polymorphic dropper in about eight minutes.Read All

Model poisoning is the malicious manipulation of a machine learning model’s training data or parameters to embed hidden, “backdoor” behaviors. The attack works in four steps: Poisoning the weights, triggering triggers, exfiltrating data, and hiding the data.Read All

Prompt Injection (PI) represents a fundamental shift in the security landscape of Large Language Models (LLMs) This analysis traces PI’s evolution through interactive gaming environments. The study culminates in Indirect Prompt Injection, demonstrating how aggressive instructions can silently hijack autonomous agents.Read All

Better prompts = bigger threats. How AI is quietly reshaping cybercrime by empowering the average attacker, not just the elite ones.Read All

CertiK researchers prove OpenClaw’s ClawHub marketplace can be bypassed via plausible but exploitable Skills, achieving arbitrary code execution despite multilayer review.Read All

How I intercepted Zomato’s Android traffic, found MQTT credentials in plain JSON, and built a real-time monitor to win Food Rescue before anyone else.Read All

A simple project to use a PS5 controller on a robot vacuum accidentally exposed 7,000 homes. Read All

Ransomware is evolving from “lock your files and demand payment” to “steal everything and threaten to leak it.” About 50% of attacks now skip encryption entirely. Payments are declining, but the damage is worse than ever.Read All

While testing a tax software API for a bug bounty, I discovered a critical Insecure Direct Object Reference (IDOR). By changing a single integer in the URL, I bypassed authentication and accessed a stranger’s full tax return. I realized I was one script away from downloading the entire country’s financial data.Read All

EnvScanner 2.0 is a lightweight tool for monitoring GitHub secrets. It uses Google Gemini API to validate secrets. The code is available on GitHub and is available for free.Read All

Secure Shell (SSH) is the backbone of secure remote access. With so many key algorithms to choose from, which one should you use? Let’s walk through the history, the trade‑offs, and the modern sweet spot for most users.Read All