Smartphone AI Pentesting Agent Can Flag Subdomain Takeover Risks Using WHOIS API

·3 views

A local AI pentesting tool called Nightcrawler, designed to run entirely on a smartphone without cloud resources, has sparked interest in the cybersecurity community for its pocket-sized offensive-security capabilities. However, phone-based large language models lack the computing power to run full subdomain enumeration and DNS resolution pipelines independently. A proposed solution involves routing reconnaissance tasks to a lightweight backend API, specifically a Domain WHOIS API that bundles RDAP data, DNS records, SSL metadata, subdomain discovery, and takeover-risk scoring into a single JSON response. Subdomain takeover — where attackers claim dangling DNS records pointing to defunct services like GitHub Pages or Heroku — is considered a high-impact, low-complexity vulnerability commonly targeted in bug bounty programs. By offloading the heavy data gathering to the API, the on-device LLM only needs to reason over structured results and surface actionable findings to the user.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Parse Pinterest URLs Safely in JavaScript Without Network Requests

Pinterest URLs pose security and reliability challenges when accepted from users, as they can arrive from country-specific domains, carry tracking parameters, or use shortened pin.it links. A naive hostname check like hostname.includes('pinterest') risks accepting lookalike or malicious domains, while fetching every URL to classify it introduces latency and server-side request forgery vulnerabilities. A safer approach uses JavaScript's built-in URL parser combined with an explicit allowlist of known Pinterest hostnames to validate scheme, host, and port before any path analysis. Once the host is trusted, pathname pattern matching can classify a URL as a pin, profile, board, ideas page, or short link, and strip tracking parameters to produce a canonical URL. This network-free method returns structured metadata — including pin IDs, usernames, and board slugs — giving applications the detail they need without making any external requests.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Repaint vs Reflow: How Browser Rendering Affects Website Performance

When a browser loads a webpage, it builds the DOM and CSSOM, calculates element positions, and draws pixels on screen — a process involving two key operations: repaint and reflow. A repaint occurs when only visual properties like color or opacity change, requiring the browser to redraw pixels without recalculating layout, making it relatively fast. A reflow is triggered by changes to an element's size, position, or structure, forcing the browser to recalculate the entire layout before repainting, which is more computationally expensive. Developers can minimize performance costs by batching DOM reads and writes, using CSS classes instead of multiple inline style changes, and preferring CSS transforms over positional properties like 'left' or 'top' for animations. While modern JavaScript engines such as Chrome's V8 and Firefox's SpiderMonkey automatically batch some layout recalculations, forcing synchronous reflows by reading layout properties immediately after style changes can still degrade performance across all browsers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI Agents Fail at 97.5% of Real Tasks: The Missing Context Problem

A senior software engineer and tech lead writing for DEV Community examines why AI coding agents succeed at only about 2.5% of real-world freelance software tasks, citing a Remote Labor Index study using Upwork assignments. The analysis draws on frameworks from CEO Dan Shapiro and AI strategist Nate B. Jones, who independently identified a five-level hierarchy of AI capability in software engineering. Successful tasks share one trait: all necessary context is present at the point of invocation, while failing tasks require background knowledge about prior decisions, system dependencies, or unstated constraints. Enterprise data from McKinsey, Gartner, and MIT Sloan similarly shows that the majority of AI pilots never reach production, often despite producing working prototypes. The author argues this pattern points to a single underlying mechanism — agents producing output that meets stated requirements but violates context that was never written down.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Engineer Who Builds LLMs Writes Book on Slowing Down in a Speed-Obsessed Tech Culture

A machine learning engineer who works daily on large language models noticed a troubling pattern: after 14-hour workdays, his brain was too exhausted to function yet still reflexively reaching for stimulation. Drawing on neuroscience, he observed that the tech industry's obsession with speed and efficiency has eroded the kind of deep, meaningful time the ancient Greeks called Kairos. Research into the brain's Default Mode Network showed him that rest is not wasted time but essential for creativity, memory, and emotional regulation. He developed a set of practical protocols — including monotasking blocks and intentional cognitive cooldowns — to protect attention amid constant demands for speed. These notes eventually became a short book, "The Art of Slowing Down in the Age of Hyper-Speed," aimed at tech professionals feeling the strain of an industry that prioritizes throughput over human limits.

0 comments Read more at DEV Community