โŒ

Normal view

There are new articles available, click to refresh the page.
Today โ€” 25 January 2026Main stream
Yesterday โ€” 24 January 2026Main stream

5 Milwaukee M12 tools that are worth the hype (and the money)

24 January 2026 at 08:15

It's no secret that Milwaukee is one of the most popular tool brands, and while many owners love the M18 line of powerful 18V tools, Milwaukee's M12 platform is equally excellent at a lower price point. If you're looking to get your money's worth with a new tool purchase, here are five M12 tools that live up to the hype.

Before yesterdayMain stream

Forget gas engines, this drop-in electric replacement is all you need

23 January 2026 at 15:26

Do you have any old, outdated gas-powered tools you'd like to give a new lease on life? If so, Makita has a neat new product you'll absolutely love. Makita is launching a 40V max XGT electric motor unit, which is a 25 to 50cc gas engine replacement electric motor you can drop in, bolt on, and go.

AI coding work is shifting fast, and your career path may split

23 January 2026 at 05:38

AI coding work is rising fast, but the biggest payoff isnโ€™t evenly shared. A Science analysis suggests seasoned developers get stronger gains than newcomers, which could reshape how you learn, interview, and prove value.

The post AI coding work is shifting fast, and your career path may split appeared first on Digital Trends.

DeWALT 20V Max, XR, and ATOMIC tools: What's the difference?

21 January 2026 at 10:30

DeWALT is a popular brand among enthusiasts and professionals thanks to its wide array of tools, with more arriving all the time. If you have a few DeWALT 20V tools and battery packs and go to buy another tool, you'll see models like the 20V MAX, XR, and Atomicโ€”but what does that actually mean?

Why Most Traders Misread Volume: A Deep Dive into Standard Volume vs Daily 24h Volume

21 January 2026 at 09:27

And how a more advanced approach changed the way I trade momentum, breakouts, and liquidity

Volume is one of the most widely used metrics in trading. Every crypto trader, from beginner to professional, has stared at the green and red bars under their chart trying to decode marketย intent.

But hereโ€™s the uncomfortable truth:

Most traders are reading the wrong volume.
Or worseโ€Šโ€”โ€Štheyโ€™re reading it in the wrongย context.

This is especially true when it comes to the popular Daily 24h Volume indicator. Youโ€™ve probably seen it on exchanges like Binance, Bybit, OKXโ€Šโ€”โ€Šand on TradingView indicators that attempt to emulateย it.

And while the metric sounds intuitive (โ€œhow much volume traded in the last 24hโ€), itโ€™s often misunderstood and misapplied in liveย trading.

In this article, I want to breakย down:

  • Why many traders rely on Daily 24h Volume Indicator
  • What its conceptual weaknesses are
  • How it differs from standard bar-by-bar volume
  • A clear comparison between theย two
  • And how these insights led me to build a customized, more actionable volume engine that I personally use

Letโ€™s start with theย basics.

1. Why Traders Use Daily 24h Volume Indicator

At the bottom, the 24-hour volume is highlighted in red, compared to the standard volume indicator above.

Daily 24h Volume Indicator is attractive because:

  • It reflects overall market participation
  • It updates continuously and shows exchange-wide liquidity
  • It gives a sense of the assetโ€™s current โ€œactivity levelโ€

For example:

  • If 24h volume is rising โ†’ traders assume interest isย growing
  • If 24h volume is dropping โ†’ traders assume liquidity is dryingย up

Itโ€™s a macro-level liquidity gauge.

But hereโ€™s theย problem:

Daily 24h volume does NOT tell you whatโ€™s happening right now on your candle. It tells you what happened in the past day, smoothed into one enormous rolling window. This introduces several pitfalls.

2. The Weaknesses of Daily 24h Volume (Why It Misleadsย Traders)

Weakness 1โ€Šโ€”โ€ŠItโ€™s a rolling metric, not a per-barย signal

Daily 24 volume cannot show momentum shifts inside a candle. You might think volume is increasingโ€ฆ But itโ€™s actually just updating the rollingย window.

Weakness 2โ€Šโ€”โ€ŠIt hides individual bar structure

It blends all buy/sell pressure, spikes, and micro-movements into one bigย number.

You miss:

  • Who is in control (buyers orย sellers)
  • Strength of candleย body
  • Wick dominance
  • Volume spikes on breakouts

Weakness 3โ€Šโ€”โ€ŠIt reactsย slowly

Because it covers the full 24h window, it behaves like a movingย average:

  • Big events fadeย slowly
  • Sudden surges barely move theย line
  • It lags on marketย turns

Weakness 4โ€Šโ€”โ€ŠTraders assume it reflects โ€œcurrentย volumeโ€

But the bar forming RIGHT NOW couldย have:

  • Huge actualย volume
  • But Daily 24 barelyย moves

โ€” orย โ€”

  • Very small actualย volume
  • But Daily 24 stays high from pastย candles

This disconnect confuses decision-making.

3. Standard Volume vs Daily 24 Volumeโ€Šโ€”โ€ŠConceptual Differences

Below is a simplified comparison to set things straight.

In short:

  • Daily 24h volume is liquidity context.
  • Per-bar volume is actionable information.

Most traders mix these two conceptsโ€Šโ€”โ€Šand get confused signals as aย result.

4. Why I Built My Own Volume Indicator

After years of active crypto trading, I realized Iย needed:

  • Something as reliable as per-candle volume
  • Something as informative as exchange 24hย volume
  • Something that actually helps predict breakouts and momentumย shifts
  • Something that reflects real buying/selling pressure, not just barย color
  • Something that filters noise and highlights meaningful spikes

This led me to develop the Advanced Volume Suiteโ€Šโ€”โ€Ša tool that merges the strengths of bothย worlds:

  • Exchange-style liquidity
  • Real-time actionable volumeย signals
  • Momentum detection
  • Spike identification
  • Breakout confirmation

Itโ€™s the volume engine I personally use in my trading, and now Iโ€™m sharing it publicly.

The next section describes how itย works.

5. Introducing a complete professional toolkit for reading true market volume, momentum, and liquidity: Advanced Volume Suite (24h, Pulse, Spikes, Breakout Pressure)

๐Ÿ” What This Indicator Does

The Advanced Volume Suite is a multi-layered volume analysis system designed for traders who rely on volume as a primary decision driver. It expands far beyond TradingViewโ€™s standard volume bars byย adding:

โœ” True USDTย Volume

All volume is converted into USDT value (volume ร— close) to normalize activity across increasing or decreasing prices.

โœ” Rolling 24-Hour Volume (Exchange-style metric)

The indicator calculates a custom 24h rolling volume, just like Binance and Bybitย display.

โœ” Volume Pulse (Strength vsย Average)

A powerful ratio that measures momentum inside eachย bar.

โœ” Smart Volume Spike Detection

Identifies abnormal activityย using:

  • Body strength
  • Wick compression
  • Trend alignment

โœ” Breakout Pressureย Engine

Detects:

  • Confirmed breakouts
  • Fakeouts
  • Areas where pressure is building near keyย levels

6. Fully customizable Advanced Volume Coloringโ€Šโ€”โ€Š3ย modes

The indicator introduces intelligent volume bar coloring, which improves clarity and helps interpret orderflow visually:

1๏ธโƒฃ Simpleย Mode

Green = close > open
Red = close < open
(Like standard volume but using USDTย values)

2๏ธโƒฃ Bodyย Mode

Colors only when candle body is strong relative to its range.
Filters noise and highlights meaningful bars.

3๏ธโƒฃ Delta-Style Mode

Detects โ€œaggressiveโ€ buyers or sellers basedย on:

  • Candle body dominance
  • Upper/lower wick compression
  • Directional pressure

7. Why This Matters toย Traders

This indicator bridges the gapย between:

  • Micro-level volume (per-candle activity)
  • Macro-level liquidity (24h rollingย volume)

And wraps itย into:

  • A visual breakoutย system
  • A momentumย pulse
  • Smart spike detection
  • Real candle-based volumeย coloring

It replaces multiple tools and simplifies your volume-based decision-making.

8. How It Differs From the Standard Volume Indicator

9. Finalย Thoughts

Volume is one of the most important trading metricsโ€Šโ€”โ€Šbut only when interpreted correctly.

  • Standard volume shows real-time behavior
  • Daily 24h volume shows high-level liquidity
  • My custom indicator merges both concepts and adds intelligent layers forย clarity

If youโ€™ve ever missed a breakout, failed to see a spike, or misjudged the strength behind a move, this suite gives you the clarity you wereย missing.

This indicator is fully free and open-source on TradingView, so that traders can review and verity its functionality.
Advanced Volume Suite (24h, Pulse, Spikes, Breakout Pressure)โ€Šโ€”โ€ŠIndicator by zalutskyiyuriyโ€Šโ€”โ€ŠTradingView

Why Most Traders Misread Volume: A Deep Dive into Standard Volume vs Daily 24h Volume was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

Why Smart Contract Security Canโ€™t Wait for โ€œBetterโ€ AI Models

20 January 2026 at 12:31
concentric, AI,

The numbers tell a stark story: $1.42 billion lost across 149 documented incidents in 2024 due to smart contract vulnerabilities, with access control flaws accounting for $953.2 million in damages alone. While the Web3 community debates the perfect AI solution for smart contract security, billions continue to drain from protocols that could have been protected..

The post Why Smart Contract Security Canโ€™t Wait for โ€œBetterโ€ AI Models appeared first on Security Boulevard.

WPair Scanner Released to Detect WhisperPair Flaw in Googleโ€™s Fast Pair Protocol

By: Divya
20 January 2026 at 04:49

An open-source Android application designed to identify and test devices vulnerable to CVE-2025-36911, a critical authentication bypass flaw in Googleโ€™s Fast Pair Bluetooth protocol. The vulnerability, commonly referred to as WhisperPair, affects millions of Bluetooth audio devices worldwide, enabling unauthorised pairing and potentially granting access to microphoneswithout user consent. CVE-2025-36911 represents a significant cryptographic weakness [โ€ฆ]

The post WPair Scanner Released to Detect WhisperPair Flaw in Googleโ€™s Fast Pair Protocol appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

10 things I learned from burning myself out with AI coding agents

19 January 2026 at 07:00

If you've ever used a 3D printer, you may recall the wondrous feeling when you first printed something you could have never sculpted or built yourself. Download a model file, load some plastic filament, push a button, and almost like magic, a three-dimensional object appears. But the result isn't polished and ready for mass production, and creating a novel shape requires more skills than just pushing a button. Interestingly, today's AI coding agents feel much the same way.

Since November, I have used Claude Code and Claude Opus 4.5 through a personal Claude Max account to extensively experiment with AI-assisted software development (I have also used OpenAI's Codex in a similar way, though not as frequently). Fifty projects later, I'll be frank: I have not had this much fun with a computer since I learned BASIC on my Apple II Plus when I was 9 years old. This opinion comes not as an endorsement but as personal experience: I voluntarily undertook this project, and I paid out of pocket for both OpenAI and Anthropic's premium AI plans.

Throughout my life, I have dabbled in programming as a utilitarian coder, writing small tools or scripts when needed. In my web development career, I wrote some small tools from scratch, but I primarily modified other people's code for my needs. Since 1990, I've programmed in BASIC, C, Visual Basic, PHP, ASP, Perl, Python, Ruby, MUSHcode, and some others. I am not an expert in any of these languagesโ€”I learned just enough to get the job done. I have developed my own hobby games over the years using BASIC, Torque Game Engine, and Godot, so I have some idea of what makes a good architecture for a modular program that can be expanded over time.

Read full article

Comments

ยฉ Aurich Lawson | Getty Images

Argus: Python-Based Recon Toolkit Aims to Boost Security Intelligence

By: Divya
19 January 2026 at 02:54

Security researchers and penetration testers gain a comprehensive open-source reconnaissance platform with the release of Argus v2.0, a Python-based information gathering toolkit that consolidates 135 specialised modules into a unified command-line interface. The toolkit addresses the growing complexity of modern attack surface management by providing integrated access to network mapping, web application analysis, and threat [โ€ฆ]

The post Argus: Python-Based Recon Toolkit Aims to Boost Security Intelligence appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Digital Forensics: AnyDesk โ€“ Favorite Tool of APTs

15 January 2026 at 07:59

Welcome back, aspiring digital forensics investigators!

AnyDesk first appeared around 2014 and very quickly became one of the most popular tools for legitimate remote support and system administration across the world. It is lightweight, fast, easy to deploy. Unfortunately, those same qualities also made it extremely attractive to cybercriminals and advanced persistent threat groups. Over the last several years, AnyDesk has become one of the preferred tools used by attackers to maintain persistent access to compromised systems.

Attackers abuse AnyDesk in a few different ways. Sometimes they install it directly and configure a password for unattended access. Other times, they rely on the fact that many organizations already have AnyDesk installed legitimately. All the attacker needs to do is gain access to the endpoint, change the AnyDesk password or configure a new access profile, and they now have quiet, persistent access. Because remote access tools are so commonly used by administrators, this kind of persistence often goes unnoticed for days, weeks, or even months. During that time the attacker can come and go as they please. Many organizations do not monitor this activity closely, even when they have mature security monitoring in place. We have seen companies with large infrastructures and centralized logging completely ignore AnyDesk connections. This has allowed attackers to maintain footholds across geographically distributed networks until they were ready to launch ransomware operations. When the encryption finally hits critical assets and the cryptography is strong, the damage is often permanent, unless you have the key.

We also see attackers modifying registry settings so that the accessibility button at the Windows login screen opens a command prompt with the highest privileges. This allows them to trigger privileged shells tied in with their AnyDesk session while minimizing local event log traces of normal login activity. We demonstrated similar registry hijacking concepts previously in โ€œPowerShell for Hackers โ€“ Basics.โ€ If you want a sense of how widespread this abuse is, look at recent cyberwarfare reporting involving Russia.

Kaspersky has documented numerous incidents where AnyDesk was routinely used by hacktivists and financially motivated groups during post-compromise operations. In the ICS-CERT reporting for Q4 2024, for example, the โ€œCrypt Ghoulsโ€ threat actor relied on tools like Mimikatz, PingCastle, Resocks, AnyDesk, and PsExec. In Q3 2024, the โ€œBlackJackโ€ group made heavy use of AnyDesk, Radmin, PuTTY and tunneling with ngrok to maintain persistence across Russian government, telecom, and industrial environments. And thatโ€™s just a glimpse of it.

Although AnyDesk is not the only remote access tool available, it stands out because of its polished graphical interface and ease of use. Many system administrators genuinely like it. That means you will regularly encounter it during investigations, whether it was installed for legitimate reasons or abused by an attacker.

With that in mind, letโ€™s look at how to perform digital forensics on a workstation that has been compromised through AnyDesk.

Investigating AnyDesk Activity During an Incident

Today we are going to focus on the types of log files that can help you determine whether there has been unauthorized access through AnyDesk. These logs can reveal the attackerโ€™s AnyDesk ID, their chosen display name, the operating system they used, and in some cases even their IP address. Interestingly, inexperienced attackers sometimes do not realize that AnyDesk transmits the local username as the connection name, which means their personal environment name may suddenly appear on the victim system. The logs can also help you understand whether there may have been file transfers or data exfiltration.

For many incident response cases, this level of insight is already extremely valuable. On top of that, collecting these logs and ingesting them into your SIEM can help you generate alerts on suspicious activity patterns such as unexpected night-time access. Hackers prefer to work when users are asleep, so after-hours access from a remote tool should always trigger your curiosity.

Here are the log files and full paths that you will need for this analysis:

C:\Users\%username%\AppData\Roaming\AnyDesk\ad.trace
C:\Users\%username%\AppData\Roaming\AnyDesk\connection_trace.txt
C:\ProgramData\AnyDesk\ad_svc.trace
C:\ProgramData\AnyDesk\connection_trace.txt

AnyDesk can be used in two distinct ways. The first is as a portable executable. In that case, the user runs the program directly without installing it. When used this way, the logs are stored under the userโ€™s AppData directory. The second way is to install AnyDesk as a service. Once installed, it can be configured for unattended access, meaning the attacker can log in at any time using only a password, without the local user needing to confirm the session. When AnyDesk runs as a service, you should also examine the ProgramData directory as it will contain its own trace files. The AppData folder will still hold the ad.trace file, and together these files form the basis for your investigation.

With this background in place, letโ€™s begin our analysis.

Connection Log Timestamps

The connection_trace.txt logs are relatively readable and give you a straightforward record of successful AnyDesk connections. Here is an example with a randomized AnyDesk ID:

Incoming 2025โ€“07โ€“25, 12:10 User 568936153 568936153

reading connection_trace.txt anydesk log file

The real AnyDesk ID has been redacted. What matters is that the log clearly shows there was a successful inbound connection on 2025โ€“07โ€“25 at 12:10 UTC from the AnyDesk ID listed at the end. This already confirms that remote access occurred, but we can dig deeper using the other logs.

Gathering Information About the Intruder

Now we move into the part of the investigation where we begin to understand who our attacker might be. Although names, IDs, and even operating systems can be changed by the attacker at any time, patterns still emerge. Most attackers do not constantly change their display name unless they are extremely paranoid. Even then, the timestamps do not lie. Remote logins occurring repeatedly in the middle of the night are usually a strong indicator of unauthorized access.

We will work primarily with the ad.trace and ad_svc.trace files. These logs can be noisy, as they include a lot of error messages unrelated to the successful session. A practical way to cut through the noise is to search for specific keywords. In PowerShell, that might look like this:

PS > get-content .\ad.trace | select-string -list 'Remote OS', 'Incoming session', 'app.prepare_task', 'anynet.relay', 'anynet.any_socket', 'files', 'text offers' | tee adtrace.log

parsing ad.trace anydesk log file

PS > get-content .\ad_svc.trace | select-string -list 'Remote OS', 'Incoming session', 'app.prepare_task', 'anynet.relay', 'anynet.any_socket', 'files', 'text offers' | tee adsvc.log

parsing ad_svc.trace anydesk file

These commands filter out only the most interesting lines and save them into new files called adtrace.log and adsvc.log, while still letting you see the results in the console. The tee command behaves this way both in Windows and Linux. This small step makes the following analysis more efficient.

IP Address

In many cases, the ad_svc.trace log contains the external IP address from which the attacker connected. You will often see it recorded as โ€œLogged in from,โ€ alongside the AnyDesk ID listed as โ€œAccepting from.โ€ For the sake of privacy, these values were redacted in the screenshot we worked from, but they can be viewed easily inside the adsvc.log file you created earlier.

anydesk ad_svc.trace log file contains the ip adress of the user accessing the machine via anydesk

Once you have the IP address, you can enrich it further inside your SIEM. Geolocation, ASN information, and historical lookups may help you understand whether the attacker used a VPN, a hosting provider, a compromised endpoint, or even their home ISP.

Name & OS Information

Inside ad.trace you will generally find the attackerโ€™s display name in lines referring to โ€œIncoming session request.โ€ Right next to that field you will see the corresponding AnyDesk ID. You may also see references to the attackerโ€™s operating system.

anydesk ad.trace log contains the name of the anydesk user and their anydesk id

In the example we examined, the attacker was connecting from a Linux machine and had set their display name to โ€œIT Depโ€ in an attempt to appear legitimate. As you can imagine, users do not always question a remote session labeled as IT support, especially if the attacker acts confidently.

Data Exfiltration

AnyDesk does not only provide screen control. It also supports file transfer both ways. That means attackers can upload malware or exfiltrate sensitive company data directly through the session. In the ad.trace logs you will sometimes see references such as โ€œPreparing files in โ€ฆโ€ which indicate file operations are occurring.

This line alone does not always tell you what exact files were transferred, especially if the attacker worked out of temporary directories. However, correlating those timestamps with standard Windows forensic artifacts, such as recent files, shellbags, jump lists, or server access logs, often reveals exactly what the attacker viewed or copied. If they accessed remote file servers during the session, those server logs combined with your AnyDesk timestamps can paint a very clear picture of what happened.

anydesk ad.trace log contains the evidence of data exfiltration

In our case, the attacker posing as the โ€œIT Depโ€ accessed and exfiltrated files stored in the Documents folder of the manager who used that workstation.

Summary

Given how widespread AnyDesk is in both legitimate IT environments and malicious campaigns, you should always consider it a high-priority artifact in your digital forensics and incident response workflows. Make sure the relevant AnyDesk log files are consistently collected and ingested into your SIEM so that suspicious activity does not go unnoticed, especially outside business hours. Understanding how to interpret these logs shows the attackerโ€™s behavior that otherwise feels invisible.

Our team strongly encourages you to remain aware of AnyDesk abuse patterns and to include them explicitly in your investigation playbooks. If you need any support building monitoring, tuning alerts, or analyzing remote access traces during an active case, we are always happy to help you strengthen your security posture.

๊ฐœ๋ฐœ์ž ๋„๊ตฌ์—์„œ ์—…๋ฌด ํŒŒํŠธ๋„ˆ๋กœโ€ฆ์•คํŠธ๋กœํ”ฝ, ์ฝ”์›Œ์ปค๋กœ ํด๋กœ๋“œ ํ™œ์šฉ์„ฑ ํ™•๋Œ€

15 January 2026 at 03:05

์•คํŠธ๋กœํ”ฝ์€ ํด๋กœ๋“œ ์ฝ”๋“œ์˜ ๊ธฐ๋Šฅ์„ ํ”„๋กœ๊ทธ๋ž˜๋ฐ ์˜์—ญ์„ ๋„˜์–ด ์ผ์ƒ์ ์ธ ๊ธฐ์—… ์—…๋ฌด ํ๋ฆ„์œผ๋กœ ํ™•์žฅํ•˜๊ธฐ ์œ„ํ•œ โ€˜์ฝ”์›Œ์ปค(Cowork)โ€™๋ฅผ ํ”„๋ฆฌ๋ทฐ ๋ฒ„์ „์œผ๋กœ 12์ผ ๊ณต๊ฐœํ–ˆ๋‹ค.

์ด ์ƒˆ๋กœ์šด ์ฝ”๋”ฉ ์–ด์‹œ์Šคํ„ดํŠธ๋Š” ์กฐ์ง์ด ํŠน์ • ํด๋”์— ๋Œ€ํ•œ ์ ‘๊ทผ ๊ถŒํ•œ์„ ๋ถ€์—ฌํ•  ๊ฒฝ์šฐ ์ผ์ • ์š”์•ฝ, ๋ณด๊ณ ์„œ ์ž‘์„ฑ, ํŒŒ์ผ ์ •๋ฆฌ์™€ ๊ฐ™์€ ์ž‘์—…์„ ์ž๋™ํ™”ํ•  ์ˆ˜ ์žˆ๋„๋ก ์ง€์›ํ•œ๋‹ค. ์ฝ”์›Œ์ปค๋Š” ๊ด€๋ จ ๋„๊ตฌ, ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค, ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜๊ณผ์˜ ์—ฐ๋™๋„ ๊ฐ€๋Šฅํ•˜๋‹ค.

๋˜ํ•œ ํฌ๋กฌ ํ™˜๊ฒฝ์—์„œ ํด๋กœ๋“œ์™€ ํ•จ๊ป˜ ์‚ฌ์šฉํ•˜๋ฉด ๋ธŒ๋ผ์šฐ์ € ์ ‘๊ทผ์ด ํ•„์š”ํ•œ ์ž‘์—…๋„ ์ˆ˜ํ–‰ํ•  ์ˆ˜ ์žˆ๋‹ค. ์•คํŠธ๋กœํ”ฝ์€ ๊ณต์‹ ๋ธ”๋กœ๊ทธ๋ฅผ ํ†ตํ•ด ์‚ฌ์šฉ์ž๊ฐ€ AI ๊ธฐ๋ฐ˜ ์–ด์‹œ์Šคํ„ดํŠธ๊ฐ€ ํ•˜๋‚˜์˜ ์ž‘์—…์„ ๋งˆ์น  ๋•Œ๊นŒ์ง€ ๊ธฐ๋‹ค๋ฆฌ์ง€ ์•Š๊ณ  ์—ฌ๋Ÿฌ ์ž‘์—…์„ ๋ณ‘๋ ฌ๋กœ ํ• ๋‹นํ•  ์ˆ˜ ์žˆ๋‹ค๊ณ  ์„ค๋ช…ํ–ˆ๋‹ค.

์• ๋„๋ฆฌ์ŠคํŠธ๋“ค์€ ์ฝ”์›Œ์ปค์˜ ๋„์ž…์ด AI ์–ด์‹œ์Šคํ„ดํŠธ๋ฅผ ๋ณด๋‹ค ๋‹ค์–‘ํ•œ ๋น„์ฆˆ๋‹ˆ์Šค ๊ธฐ๋Šฅ์— ํ™œ์šฉํ•˜๋ ค๋Š” ์•คํŠธ๋กœํ”ฝ์˜ ์ „๋žต์  ๋ฐฉํ–ฅ์„ฑ์„ ๋ณด์—ฌ์ค€๋‹ค๊ณ  ๋ถ„์„ํ–ˆ๋‹ค.

์ปจ์„คํŒ… ๊ธฐ์—… ์—๋ฒ ๋ ˆ์ŠคํŠธ ๊ทธ๋ฃน์˜ ์ด๊ด„ ์• ๋„๋ฆฌ์ŠคํŠธ ๋ฒ ๋ฅด์‹œํƒ€ ์Šค๋ฆฌ๋ฐ”์Šคํƒ€๋ฐ”๋Š” โ€œ์ฝ”์›Œ์ปค๋Š” ๋‹จ์ˆœํ•œ ๋Œ€ํ™”๋ฅผ ๋„˜์–ด ๋ฒ”์œ„๊ฐ€ ์ œํ•œ๋œ ์‹คํ–‰ ์ค‘์‹ฌ ๊ธฐ๋Šฅ์œผ๋กœ ํ™•์žฅํ•จ์œผ๋กœ์จ, ์ง€์‹ ๊ธฐ๋ฐ˜ ์—ญํ• ์—์„œ ์ฃผ๋ฅผ ์ด๋ฃจ๋Š” ๋ฌธ์„œ ๋ฐ ํŒŒ์ผ ์ค‘์‹ฌ ์—…๋ฌด์— ํด๋กœ๋“œ๋ฅผ ์‹ค์งˆ์ ์œผ๋กœ ํ™œ์šฉํ•˜๋ ค๋Š” ์˜๋„๋ฅผ ๋ฐ˜์˜ํ•œ๋‹คโ€๋ผ๊ณ  ์„ค๋ช…ํ–ˆ๋‹ค.

์Šค๋ฆฌ๋ฐ”์Šคํƒ€๋ฐ”๋Š” ์ด์–ด ๊ฐ€๋“œ๋ ˆ์ผ์„ ๋ช…ํ™•ํ•˜๊ฒŒ ์„ค์ •ํ•  ์ˆ˜ ์žˆ๋Š” ๋ฆฌ์„œ์น˜, ํ”„๋กœ์ ํŠธ ๊ด€๋ฆฌ ์กฐ์ง(PMO), ์šด์˜, ๋ถ„์„๊ณผ ๊ฐ™์€ ์—ญํ• ์—์„œ๋„ ์ƒˆ๋กœ์šด ๋„๊ตฌ์˜ ํšจ๊ณผ๋ฅผ ๊ธฐ๋Œ€ํ•  ์ˆ˜ ์žˆ์œผ๋ฉฐ, ์ด๋Ÿฌํ•œ ์˜์—ญ์—์„œ ๋„์ž…์ด ๊ฐ€์žฅ ํ™œ๋ฐœํ•˜๊ฒŒ ์ด๋ค„์งˆ ๊ฐ€๋Šฅ์„ฑ์ด ๋†’๋‹ค๊ณ  ์ „๋งํ–ˆ๋‹ค.

์ปจ์„คํŒ… ๊ธฐ์—… ํ“จ์ฒ˜๋Ÿผ๊ทธ๋ฃน์˜ ๋ฐ์ดํ„ฐยทAIยท์ธํ”„๋ผ ๋ถ€๋ฌธ ์ด๊ด„ ๋ธŒ๋ž˜๋“ค๋ฆฌ ์‹ฌ๋ฏผ ์—ญ์‹œ ๊ฐ™์€ ๊ฒฌํ•ด๋ฅผ ๋ณด์ด๋ฉฐ, ์ฝ”์›Œ์ปค๊ฐ€ ๊ฐœ๋ฐœ์ž์—๊ฒŒ๋„ ์œ ์šฉํ•  ์ˆ˜ ์žˆ๋‹ค๊ณ  ์–ธ๊ธ‰ํ–ˆ๋‹ค. ์‹ฌ๋ฏผ์€ ์ฝ”์›Œ์ปค๋ฅผ ์•คํŠธ๋กœํ”ฝ์˜ โ€˜์ปดํ“จํ„ฐ ์‚ฌ์šฉ(computer-use)โ€™ ๊ธฐ๋Šฅ๊ณผ ์ปค๋งจ๋“œ๋ผ์ธ ์œ ํ‹ธ๋ฆฌํ‹ฐ๊ฐ€ ์ž์—ฐ์Šค๋Ÿฝ๊ฒŒ ์ง„ํ™”ํ•œ ๊ฒฐ๊ณผ๋กœ ํ‰๊ฐ€ํ–ˆ๋‹ค.

์ฝ”์›Œ์ปค๋Š” ๋ธŒ๋ผ์šฐ์ €๋ฅผ ํ†ตํ•ด ์‹œ์Šคํ…œ ํ™”๋ฉด์„ ์‚ดํŽด๋ณด๊ฑฐ๋‚˜ ์Šคํฌ๋ฆฐ์ƒท์„ ์ฐ๋Š” ๋ฐฉ์‹์ด ์•„๋‹ˆ๋ผ ์šด์˜์ฒด์ œ์˜ ํ•ต์‹ฌ ๊ธฐ๋Šฅ์— ์ง์ ‘ ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๊ธฐ ๋•Œ๋ฌธ์—, ์—์ด์ „ํŠธ ๊ธฐ๋ฐ˜ ์†Œํ”„ํŠธ์›จ์–ด ๊ฐœ๋ฐœ ์›Œํฌํ”Œ๋กœ ์ธ์ ‘ ์˜์—ญ์— ์œ„์น˜ํ•œ ์ž‘์—…์„ ์ž๋™ํ™”ํ•˜๊ณ  ์šด์˜ ๋‹จ๊ณ„๋กœ ํ™•์žฅํ•˜๋Š” ๋ฐ ํ™œ์šฉํ•  ์ˆ˜ ์žˆ๋‹ค๋Š” ์„ค๋ช…์ด๋‹ค.

์‹ฌ๋ฏผ์€ ์˜ˆ๋กœ โ€œํ”„๋กœ์ ํŠธ์˜ ์ผ๋ถ€์ธ JSON ๋ฐ์ดํ„ฐ๋ฅผ ๋น ๋ฅด๊ฒŒ ๋งˆํฌ๋‹ค์šด ํ˜•์‹์œผ๋กœ ๋ณ€ํ™˜ํ•ด ๋น„๊ฐœ๋ฐœ์ž๋„ ํ•ด๋‹น ์ •๋ณด๋ฅผ ์‰ฝ๊ฒŒ ์ฝ์„ ์ˆ˜ ์žˆ๋„๋ก ๋งŒ๋“œ๋Š” ์ž‘์—…โ€์„ ๋“ค์—ˆ๋‹ค.

๋‹ค๋งŒ ์•คํŠธ๋กœํ”ฝ์€ ์ฝ”์›Œ์ปค์— ์‹œ์Šคํ…œ์ด๋‚˜ ํ™˜๊ฒฝ ์ ‘๊ทผ ๊ถŒํ•œ์„ ๋ถ€์—ฌํ•  ๊ฒฝ์šฐ ์ฃผ์˜๊ฐ€ ํ•„์š”ํ•˜๋‹ค๊ณ  ๊ฒฝ๊ณ ํ–ˆ๋‹ค. ํ”„๋กฌํ”„ํŠธ๋ฅผ ์ž˜๋ชป ์ดํ•ดํ•ด ํŒŒ์ผ ์‚ญ์ œ์™€ ๊ฐ™์€ ํŒŒ๊ดด์ ์ธ ๋ช…๋ น์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ๊ธฐ ๋•Œ๋ฌธ์ด๋‹ค. ๋‹ค๋งŒ ๋ช…๋ น์ด๋‚˜ ์ž‘์—…์„ ์‹คํ–‰ํ•˜๊ธฐ ์ „์—๋Š” ์‚ฌ์šฉ์ž์—๊ฒŒ ํ™•์ธ์„ ์š”์ฒญํ•˜๋„๋ก ์„ค๊ณ„๋ผ ์žˆ๋‹ค๊ณ  ๋ฐํ˜”๋‹ค.

๋˜ํ•œ ์•…์„ฑ ์ฝ˜ํ…์ธ ๊ฐ€ ๋„๊ตฌ์— ๋‚ด์žฅ๋œ ๋ฐฉ์–ด ์ฒด๊ณ„๋ฅผ ์šฐํšŒํ•ด ํด๋กœ๋“œ์˜ ๊ณ„ํš์„ ๋ณ€๊ฒฝํ•  ์ˆ˜ ์žˆ๋Š” ํ”„๋กฌํ”„ํŠธ ์ธ์ ์…˜ ๊ณต๊ฒฉ ์œ„ํ—˜๋„ ํ•จ๊ป˜ ์ง€์ ํ–ˆ๋‹ค.

๋˜ ๋‹ค๋ฅธ ์ปจ์„คํŒ… ๊ธฐ์—… ๋ฌด์–ด์ธ์‚ฌ์ดํŠธ์•ค๋“œ์ŠคํŠธ๋ž˜ํ‹ฐ์ง€์˜ ์ˆ˜์„ ์• ๋„๋ฆฌ์ŠคํŠธ ์ œ์ด์Šจ ์•ค๋”์Šจ์€ ์ด๋Ÿฌํ•œ ๋ฌธ์ œ๋ฅผ ์™„ํ™”ํ•˜๊ธฐ ์œ„ํ•ด, ์ œํ’ˆ์ด ์ •์‹ ์ถœ์‹œ๋  ๋•Œ ํŒŒ์ผ ์‚ญ์ œ ์‹œ ๋ณต๊ตฌํ•  ์ˆ˜ ์žˆ๊ฑฐ๋‚˜ ์ด๋ฉ”์ผ ์ „์†ก์„ ์ทจ์†Œํ•  ์ˆ˜ ์žˆ๋Š” ๋˜๋Œ๋ฆฌ๊ธฐ ๊ธฐ๋Šฅ์„ ์ถ”๊ฐ€ํ•  ์ˆ˜ ์žˆ๋‹ค๊ณ  ์ œ์•ˆํ–ˆ๋‹ค.

์•ค๋”์Šจ์€ ์ด ๊ธฐ๋Šฅ์ด ํ”„๋กฌํ”„ํŠธ ์ธ์ ์…˜ ๊ณต๊ฒฉ๊ณผ ์‚ฌ์šฉ์ž ์‹ค์ˆ˜ ๋ชจ๋‘๋ฅผ ๋ณด์™„ํ•  ์ˆ˜ ์žˆ์„ ๊ฒƒ์ด๋ผ๊ณ  ๋ถ„์„ํ–ˆ๋‹ค. ํ˜„์žฌ ์ด ์ƒˆ๋กœ์šด ํ˜•ํƒœ์˜ ์–ด์‹œ์Šคํ„ดํŠธ๋Š” ๋งฅOS ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์„ ํ†ตํ•ด ํด๋กœ๋“œ ๋งฅ์Šค ๊ตฌ๋…์ž์—๊ฒŒ ์ œ๊ณต๋˜๊ณ  ์žˆ๋‹ค.
dl-ciokorea@foundryco.com

๋ฐ”์ด๋ธŒ ์ฝ”๋”ฉ ํ™•์‚ฐ, ๋ณด์•ˆ์—๋Š” ์ฃผ์˜ ํ•„์š”ยทยทยท์น˜๋ช…์  ์ทจ์•ฝ์  ์‚ฌ๋ก€ ํ™•์ธ

15 January 2026 at 02:04

์ฃผ์š” ๋ฐ”์ด๋ธŒ ์ฝ”๋”ฉ ํ”Œ๋žซํผ์ด ํ”ํžˆ ์‚ฌ์šฉ๋˜๋Š” ํ”„๋กœ๊ทธ๋ž˜๋ฐ ํ”„๋กฌํ”„ํŠธ์— ๋Œ€ํ•ด ์•ˆ์ „ํ•˜์ง€ ์•Š์€ ์ฝ”๋“œ๋ฅผ ๋ฐ˜๋ณต์ ์œผ๋กœ ์ƒ์„ฑํ•˜๊ณ , ์ด ๊ณผ์ •์—์„œ โ€˜์น˜๋ช…์ โ€™ ์ˆ˜์ค€์œผ๋กœ ํ‰๊ฐ€๋˜๋Š” ์ทจ์•ฝ์ ๊นŒ์ง€ ๋งŒ๋“ค์–ด๋‚ธ๋‹ค๋Š” ํ…Œ์ŠคํŠธ ๊ฒฐ๊ณผ๊ฐ€ ๋‚˜์™”๋‹ค.

๋ณด์•ˆ ์Šคํƒ€ํŠธ์—… ํ…์ž์ด๋Š” ์ด๋“ค ๋„๊ตฌ๊ฐ€ ์ •ํ˜•ํ™”๋œ ๊ทœ์น™์ด๋‚˜ ๊ด€ํ–‰์œผ๋กœ ๋Œ€์‘ํ•  ์ˆ˜ ์žˆ๋Š” ๋ณด์•ˆ ๊ฒฐํ•จ์€ ๋น„๊ต์  ์ž˜ ํšŒํ”ผํ•˜์ง€๋งŒ, ์•ˆ์ „๊ณผ ์œ„ํ—˜์„ ๊ฐ€๋ฅด๋Š” ๊ธฐ์ค€์ด ์ƒํ™ฉ์— ๋”ฐ๋ผ ๋‹ฌ๋ผ์ง€๋Š” ์˜์—ญ์—์„œ๋Š” ์–ด๋ ค์›€์„ ๊ฒช๋Š”๋‹ค๊ณ  ์„ค๋ช…ํ–ˆ๋‹ค.

ํ…์ž์ด๋Š” 2025๋…„ 12์›” ์ง„ํ–‰ํ•œ ์ด๋ฒˆ ํ‰๊ฐ€์—์„œ ํด๋กœ๋“œ ์ฝ”๋“œ(Claude Code), ์˜คํ”ˆAI ์ฝ”๋ฑ์Šค(OpenAI Codex), ์ปค์„œ(Cursor), ๋ ˆํ”Œ๋ฆฟ(Replit), ๋ฐ๋นˆ(Devin) ๋“ฑ ์ฃผ์š” ๋ฐ”์ด๋ธŒ ์ฝ”๋”ฉ ๋„๊ตฌ 5์ข…์—์„œ ์‚ฌ์ „ ์ •์˜๋œ ํ”„๋กฌํ”„ํŠธ๋ฅผ ์‚ฌ์šฉํ•ด 3๊ฐ€์ง€ ํ…Œ์ŠคํŠธ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์„ ๊ตฌ์ถ•ํ•˜๋Š” ๋ฐฉ์‹์œผ๋กœ ๋น„๊ต ๋ถ„์„ํ–ˆ๋‹ค.

๊ทธ ๊ฒฐ๊ณผ, 5๊ฐœ ๋„๊ตฌ๊ฐ€ ๊ฐ๊ฐ 3๊ฐœ์”ฉ ์ƒ์„ฑํ•œ ์ด 15๊ฐœ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์˜ ์ฝ”๋“œ์—์„œ ๋ชจ๋‘ 69๊ฐœ์˜ ์ทจ์•ฝ์ ์ด ๋ฐœ๊ฒฌ๋๋‹ค. ์ด ๊ฐ€์šด๋ฐ ์•ฝ 45๊ฐœ๋Š” โ€˜๋‚ฎ์Œ~์ค‘๊ฐ„โ€™ ์ˆ˜์ค€์˜ ์‹ฌ๊ฐ๋„๋กœ ํ‰๊ฐ€๋์ง€๋งŒ, ๋‚˜๋จธ์ง€ ๋‹ค์ˆ˜๋Š” โ€˜๋†’์Œโ€™์œผ๋กœ ๋ถ„๋ฅ˜๋๋‹ค. ๊ทธ์ค‘ 6๊ฐœ๋Š” โ€˜์น˜๋ช…์ โ€™ ์ทจ์•ฝ์ ์— ํ•ด๋‹นํ–ˆ๋‹ค.

๋‚ฎ์Œ~์ค‘๊ฐ„ ์ˆ˜์ค€์˜ ์ทจ์•ฝ์  ์ˆ˜๋Š” 5๊ฐœ ๋„๊ตฌ ๋ชจ๋‘์—์„œ ๋™์ผํ–ˆ์ง€๋งŒ, ์น˜๋ช…์  ๋“ฑ๊ธ‰์˜ ์ทจ์•ฝ์ ์€ ํด๋กœ๋“œ ์ฝ”๋“œ(4๊ฑด), ๋ฐ๋นˆ(1๊ฑด), ์ฝ”๋ฑ์Šค(1๊ฑด)์—์„œ ์ƒ์„ฑ๋๋‹ค.

๊ฐ€์žฅ ์‹ฌ๊ฐํ•œ ์ทจ์•ฝ์ ์€ API ์ธ๊ฐ€ ๋กœ์ง๊ณผ ๋น„์ฆˆ๋‹ˆ์Šค ๋กœ์ง์—์„œ ๋ฐœ๊ฒฌ๋๋‹ค. API ์ธ๊ฐ€ ๋กœ์ง์€ ๋ˆ„๊ฐ€ ํŠน์ • ๋ฆฌ์†Œ์Šค์— ์ ‘๊ทผํ•˜๊ฑฐ๋‚˜ ์–ด๋–ค ์ž‘์—…์„ ์ˆ˜ํ–‰ํ•  ์ˆ˜ ์žˆ๋Š”์ง€๋ฅผ ๊ฒ€์ฆํ•˜๋Š” ๊ธฐ๋Šฅ์ด๋ฉฐ, ๋น„์ฆˆ๋‹ˆ์Šค ๋กœ์ง์€ ํ—ˆ์šฉ๋ผ์„œ๋Š” ์•ˆ ๋˜๋Š” ์‚ฌ์šฉ์ž ํ–‰์œ„๋ฅผ ๊ตฌ๋ถ„ํ•œ๋‹ค. ๋‘ ์˜์—ญ ๋ชจ๋‘ ์ „์ž์ƒ๊ฑฐ๋ž˜ ์‹œ์Šคํ…œ์—์„œ ํ•ต์‹ฌ์ ์ธ ๋ณด์•ˆ ์š”์†Œ๋กœ ๊ผฝํžŒ๋‹ค.

ํ…์ž์ด ์—ฐ๊ตฌ์ง„์€ โ€œAI๊ฐ€ ์ƒ์„ฑํ•œ ์ฝ”๋“œ ์—์ด์ „ํŠธ๋Š” ๋น„์ฆˆ๋‹ˆ์Šค ๋กœ์ง์— ํŠนํžˆ ์ทจ์•ฝํ•œ ๊ฒฝํ–ฅ์ด ์žˆ๋‹ค. ๊ฐœ๋ฐœ์ž๋Š” ์›Œํฌํ”Œ๋กœ์šฐ๊ฐ€ ์–ด๋–ป๊ฒŒ ์ž‘๋™ํ•ด์•ผ ํ•˜๋Š”์ง€์— ๋Œ€ํ•œ ์ง๊ด€์  ์ดํ•ด๋ฅผ ๋ฐ”ํƒ•์œผ๋กœ ํŒ๋‹จํ•˜์ง€๋งŒ, ์—์ด์ „ํŠธ๋Š” ์ด๋Ÿฌํ•œ โ€˜์ƒ์‹โ€™์„ ๊ฐ–์ถ”์ง€ ๋ชปํ•ด ๋Œ€๋ถ€๋ถ„ ๋ช…์‹œ์ ์ธ ์ง€์‹œ์— ์˜์กดํ•œ๋‹คโ€๋ผ๊ณ  ์„ค๋ช…ํ–ˆ๋‹ค.

๋ฐ˜๋ฉด ๊ธ์ •์ ์ธ ์ธก๋ฉด๋„ ํ™•์ธ๋๋‹ค. ์ด๋ฒˆ ํ…Œ์ŠคํŠธ์—์„œ ๋ฐ”์ด๋ธŒ ์ฝ”๋”ฉ ๋„๊ตฌ๋Š” SQL ์ธ์ ์…˜์ด๋‚˜ ํฌ๋กœ์Šค์‚ฌ์ดํŠธ ์Šคํฌ๋ฆฝํŒ…๊ณผ ๊ฐ™์ด, ์˜ค๋žซ๋™์•ˆ ์‚ฌ๋žŒ์ด ์ž‘์„ฑํ•œ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์„ ๊ดด๋กญํ˜€ ์˜จ ๋Œ€ํ‘œ์ ์ธ ๋ณด์•ˆ ๊ฒฐํ•จ์„ ๋น„๊ต์  ์ž˜ ํšŒํ”ผํ–ˆ๋‹ค. ์ด๋“ค ์ทจ์•ฝ์ ์€ ์—ฌ์ „ํžˆ OWASP ์›น ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜ ๋ณด์•ˆ ์œ„ํ—˜ ์ƒ์œ„ 10๋Œ€ ๋ชฉ๋ก์— ํฌํ•จ๋ผ ์žˆ๋‹ค.

ํ…์ž์ด๋Š” โ€œ๊ฐœ๋ฐœํ•œ ๋ชจ๋“  ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์—์„œ ์•…์šฉ ๊ฐ€๋Šฅํ•œ SQL ์ธ์ ์…˜์ด๋‚˜ XSS ์ทจ์•ฝ์ ์€ ํ•œ ๊ฑด๋„ ๋ฐœ๊ฒฌ๋˜์ง€ ์•Š์•˜๋‹คโ€๋ผ๊ณ  ์ „ํ–ˆ๋‹ค.

์‚ฌ๋žŒ ๊ฐ๋…์˜ ์ค‘์š”์„ฑ

ํ”ํžˆ ๋ฐ”์ด๋ธŒ ์ฝ”๋”ฉ์€ ์ผ์ƒ์ ์ธ ํ”„๋กœ๊ทธ๋ž˜๋ฐ ์ž‘์—…์„ ์ž๋™ํ™”ํ•ด ์ƒ์‚ฐ์„ฑ์„ ๋†’์ธ๋‹ค๋Š” ์žฅ์ ์ด ์ž์ฃผ ๊ฐ•์กฐ๋œ๋‹ค. ์ด๋Š” ๋ถ„๋ช… ์‚ฌ์‹ค์ด์ง€๋งŒ, ํ…์ž์ด์˜ ํ…Œ์ŠคํŠธ ๊ฒฐ๊ณผ๋Š” ์ด ๊ฐ™์€ ์ ‘๊ทผ์—๋„ ๋ถ„๋ช…ํ•œ ํ•œ๊ณ„๊ฐ€ ์žˆ์Œ์„ ๋ณด์—ฌ์ค€๋‹ค. ์‚ฌ๋žŒ์˜ ๊ฐ๋…๊ณผ ๋””๋ฒ„๊น…์ด ์—ฌ์ „ํžˆ ํ•„์ˆ˜์ ์ด๋ผ๋Š” ๊ฒƒ์ด๋‹ค.

์ด๋Š” ์ƒˆ๋กœ์šด ๋ฐœ๊ฒฌ์ด ์•„๋‹ˆ๋‹ค. โ€˜๋ฐ”์ด๋ธŒ ์ฝ”๋”ฉโ€™์ด๋ผ๋Š” ๊ฐœ๋…์ด ๋“ฑ์žฅํ•œ ์ดํ›„ ์ง€๋‚œ 1๋…„ ๋™์•ˆ, ์ ์ ˆํ•œ ๊ฐ๋…์ด ์—†๋Š” ๊ฒฝ์šฐ ๋„๊ตฌ๊ฐ€ ์ƒˆ๋กœ์šด ์‚ฌ์ด๋ฒ„ ๋ณด์•ˆ ์ทจ์•ฝ์ ์„ ์œ ๋ฐœํ•  ์ˆ˜ ์žˆ๋‹ค๋Š” ์—ฐ๊ตฌ ๊ฒฐ๊ณผ๊ฐ€ ์—ฌ๋Ÿฌ ์ฐจ๋ก€ ์ œ์‹œ๋ผ ์™”๋‹ค.

๋ฌธ์ œ๋Š” ๋ฐ”์ด๋ธŒ ์ฝ”๋”ฉ ํ”Œ๋žซํผ์ด ๋‹จ์ˆœํžˆ ์ฝ”๋“œ ๋‚ด ๋ณด์•ˆ ๊ฒฐํ•จ์„ ๋†“์นœ๋‹ค๋Š” ๋ฐ ๊ทธ์น˜์ง€ ์•Š๋Š”๋‹ค. ๊ฒฝ์šฐ์— ๋”ฐ๋ผ์„œ๋Š” ๋ฌด์—‡์ด ์•ˆ์ „ํ•˜๊ณ  ๋ฌด์—‡์ด ์œ„ํ—˜ํ•œ์ง€๋ฅผ ์ผ๋ฐ˜์ ์ธ ๊ทœ์น™์ด๋‚˜ ์‚ฌ๋ก€๋กœ ์ •์˜ํ•˜๋Š” ๊ฒƒ ์ž์ฒด๊ฐ€ ๋ถˆ๊ฐ€๋Šฅํ•˜๋‹ค๋Š” ์ ์ด ๋” ํฐ ๊ณผ์ œ๋กœ ์ง€์ ๋œ๋‹ค.

ํ…์ž์ด๋Š” ์„œ๋ฒ„ ์ธก ์š”์ฒญ ์œ„์กฐ(SSRF)๋ฅผ ์˜ˆ๋กœ ๋“ค๋ฉฐ, โ€œ์ •์ƒ์ ์ธ URL ์š”์ฒญ๊ณผ ์•…์˜์ ์ธ ์š”์ฒญ์„ ๊ตฌ๋ถ„ํ•˜๋Š” ๋ณดํŽธ์ ์ธ ๊ธฐ์ค€์€ ์กด์žฌํ•˜์ง€ ์•Š๋Š”๋‹ค. ์•ˆ์ „๊ณผ ์œ„ํ—˜์˜ ๊ฒฝ๊ณ„๋Š” ๋งฅ๋ฝ์— ํฌ๊ฒŒ ์ขŒ์šฐ๋˜๊ธฐ ๋•Œ๋ฌธ์— ์ •ํ˜•ํ™”๋œ ํ•ด๊ฒฐ์ฑ…์„ ์ ์šฉํ•˜๊ธฐ ์–ด๋ ต๋‹คโ€๋ผ๊ณ  ์„ค๋ช…ํ–ˆ๋‹ค.

์ด์— ๋”ฐ๋ผ ์—…๊ณ„์—์„œ๋Š” ๋ฐ”์ด๋ธŒ ์ฝ”๋”ฉ ์—์ด์ „ํŠธ๋ฟ๋งŒ ์•„๋‹ˆ๋ผ, ์ด๋ฅผ ๊ฒ€์ฆํ•˜๊ณ  ์ ๊ฒ€ํ•˜๋Š” ๋ฐ”์ด๋ธŒ ์ฝ”๋”ฉ ๊ฒ€์‚ฌ ์—์ด์ „ํŠธ์—๋„ ์ฃผ๋ชฉํ•ด์•ผ ํ•œ๋‹ค๋Š” ์ง€์ ์ด ๋‚˜์˜จ๋‹ค. ์†Œ๊ทœ๋ชจ ์Šคํƒ€ํŠธ์—…์ธ ํ…์ž์ด๋Š”, ๋ฐ”์ด๋ธŒ ์ฝ”๋”ฉ์„ ๊ฒ€์ฆํ•˜๋Š” ๊ธฐ์ˆ  ์˜์—ญ์—์„œ ํ˜„์žฌ๋กœ์„œ๋Š” ๋šœ๋ ทํ•œ ํ•ด๋ฒ•์ด ์ œ์‹œ๋˜์ง€ ์•Š๊ณ  ์žˆ๋‹ค๊ณ  ๋ณด๊ณ  ์žˆ๋‹ค. ํ…์ž์ด๋Š” โ€œํ…Œ์ŠคํŠธ์™€ ์ตœ๊ทผ ์—ฐ๊ตฌ ๊ฒฐ๊ณผ๋ฅผ ์ข…ํ•ฉํ•˜๋ฉด ์ด ๋ฌธ์ œ๋ฅผ ํฌ๊ด„์ ์œผ๋กœ ํ•ด๊ฒฐํ•  ์ˆ˜ ์žˆ๋Š” ์†”๋ฃจ์…˜์€ ์•„์ง ์กด์žฌํ•˜์ง€ ์•Š๋Š”๋‹ค. ๊ฐœ๋ฐœ์ž๊ฐ€ ์ฝ”๋”ฉ ์—์ด์ „ํŠธ์˜ ์ผ๋ฐ˜์ ์ธ ํ•จ์ •์„ ์ดํ•ดํ•˜๊ณ  ์ด์— ๋Œ€๋น„ํ•˜๋Š” ๊ฒƒ์ด ์ค‘์š”ํ•˜๋‹คโ€๋ผ๊ณ  ์–ธ๊ธ‰ํ–ˆ๋‹ค.

AI ๋””๋ฒ„๊น…

๋ฐ”์ด๋ธŒ ์ฝ”๋”ฉ๊ณผ ๊ด€๋ จํ•œ ๋ณด๋‹ค ๊ทผ๋ณธ์ ์ธ ์งˆ๋ฌธ์€ ๋„๊ตฌ์˜ ์„ฑ๋Šฅ์ด ์•„๋‹ˆ๋ผ ์‚ฌ์šฉ ๋ฐฉ์‹์ด๋‹ค. ๊ฐœ๋ฐœ์ž์—๊ฒŒ ๊ฒฐ๊ณผ๋ฌผ์„ ๊ผผ๊ผผํžˆ ํ™•์ธํ•˜๋ผ๊ณ  ๋งํ•˜๋Š” ๊ฒƒ๊ณผ, ์‹ค์ œ๋กœ ๊ทธ๋Ÿฐ ๊ฒ€ํ† ๊ฐ€ ํ•ญ์ƒ ์ด๋ค„์ง„๋‹ค๊ณ  ์ „์ œํ•˜๋Š” ๊ฒƒ์€ ๋‹ค๋ฅธ ๋ฌธ์ œ๋‹ค. ์‚ฌ๋žŒ์ด ์ง์ ‘ ์ฝ”๋“œ๋ฅผ ์ž‘์„ฑํ•˜๋˜ ์‹œ๊ธฐ์—๋„ ๋ชจ๋“  ์‹ค์ˆ˜๊ฐ€ ์‚ฌ์ „์— ํ†ต์ œ๋˜์ง€๋Š” ์•Š์•˜๋‹ค.

๋ณด์•ˆ ์„œ๋น„์Šค ๊ธฐ์—… ํƒˆ๋ฆฌ์˜จ(Talion)์˜ ๊ณต๊ฒฉ ๋ณด์•ˆ ์ด๊ด„์ธ ๋งคํŠœ ๋กœ๋นˆ์Šค๋Š” โ€œ๋ฐ”์ด๋ธŒ ์ฝ”๋”ฉ ๋ฐฉ์‹์„ ๋„์ž…ํ•  ๋•Œ ๊ธฐ์—…์€ ๋ณด์•ˆ ์ฝ”๋“œ ๊ฒ€ํ† ๊ฐ€ ์ „์ฒด ๋ณด์•ˆ ์†Œํ”„ํŠธ์›จ์–ด ๊ฐœ๋ฐœ ์ฃผ๊ธฐ์˜ ์ผ๋ถ€๋กœ ํฌํ•จ๋˜๊ณ  ์ง€์†์ ์œผ๋กœ ์‹คํ–‰๋˜๋„๋ก ํ•ด์•ผ ํ•œ๋‹ค. OWASP ์•ˆ์ „ํ•œ ์ฝ”๋”ฉ ๊ด€ํ–‰์ด๋‚˜, SEI CERT ์ฝ”๋”ฉ ํ‘œ์ค€๊ณผ ๊ฐ™์€ ์–ธ์–ด๋ณ„ ํ”„๋ ˆ์ž„์›Œํฌ ๋“ฑ ๊ฒ€์ฆ๋œ ๋ชจ๋ฒ” ์‚ฌ๋ก€๋„ ํ•จ๊ป˜ ํ™œ์šฉํ•ด์•ผ ํ•œ๋‹คโ€๋ผ๊ณ  ์„ค๋ช…ํ–ˆ๋‹ค.

๋กœ๋นˆ์Šค๋Š” ์ฝ”๋“œ๊ฐ€ ๋ฐฐํฌ๋˜๊ธฐ ์ „ ์ •์  ๋ถ„์„๊ณผ ๋™์  ๋ถ„์„์„ ํ†ตํ•ด ๋ฐ˜๋“œ์‹œ ๊ฒ€์ฆํ•ด์•ผ ํ•œ๋‹ค๊ณ  ๋ง๋ถ™์˜€๋‹ค. ๊ด€๊ฑด์€ ๋””๋ฒ„๊น…์„ ์–ด๋–ป๊ฒŒ ์ œ๋Œ€๋กœ ์ˆ˜ํ–‰ํ•˜๋А๋ƒ๋‹ค. ๊ทธ๋Š” โ€œ๋ฐ”์ด๋ธŒ ์ฝ”๋”ฉ์€ ๋ถ„๋ช… ์œ„ํ—˜์„ ์ˆ˜๋ฐ˜ํ•˜์ง€๋งŒ, ์ „ํ†ต์ ์ธ ๋””๋ฒ„๊น…๊ณผ ํ’ˆ์งˆ ๋ณด์ฆ์„ ๋„˜์–ด์„œ๋Š” ์—…๊ณ„ ํ‘œ์ค€ ํ”„๋กœ์„ธ์Šค์™€ ๊ฐ€์ด๋“œ๋ผ์ธ์„ ์ถฉ์‹คํžˆ ๋”ฐ๋ฅด๋ฉด ๊ด€๋ฆฌ ๊ฐ€๋Šฅํ•œ ์ˆ˜์ค€โ€์ด๋ผ๊ณ  ๋ถ„์„ํ–ˆ๋‹ค.

๋ฐ˜๋ฉด ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜ ํ…Œ์ŠคํŠธ ๊ธฐ์—… ์ฒดํฌ๋งˆํฌ์Šค(Checkmarx)์˜ ์ œํ’ˆ ๋งˆ์ผ€ํŒ… ๋ถ€์‚ฌ์žฅ ์—๋ž€ ํ‚จ์Šค๋ธŒ๋ฃจ๋„ˆ๋Š” ์ „ํ†ต์ ์ธ ๋””๋ฒ„๊น… ๋ฐฉ์‹์ด AI ์‹œ๋Œ€์—๋Š” ํ•œ๊ณ„์— ์ง๋ฉดํ•  ์ˆ˜ ์žˆ๋‹ค๊ณ  ์ง€์ ํ–ˆ๋‹ค.

ํ‚จ์Šค๋ธŒ๋ฃจ๋„ˆ๋Š” โ€œAI ์†๋„๋กœ ์ง„ํ–‰๋˜๋Š” ๋ฌธ์ œ์— ๋Œ€ํ•ด ๋” ๋งŽ์€ ๋””๋ฒ„๊น…์„ ์š”๊ตฌํ•˜๋Š” ์ž˜๋ชป๋œ ๋Œ€์‘โ€์ด๋ผ๋ฉฐ โ€œ๋””๋ฒ„๊น…์€ AI๊ฐ€ ์ƒ์„ฑํ•œ ์ฝ”๋“œ๋ฅผ ์‚ฌํ›„์— ์‚ฌ๋žŒ์ด ์ถฉ๋ถ„ํžˆ ๊ฒ€ํ† ํ•  ์ˆ˜ ์žˆ๋‹ค๋Š” ์ „์ œ๋ฅผ ๊น”๊ณ  ์žˆ์ง€๋งŒ, ๋ฐ”์ด๋ธŒ ์ฝ”๋”ฉ์˜ ๊ทœ๋ชจ์™€ ์†๋„์—์„œ๋Š” ๊ทธ๋Ÿฐ ์ „์ œ๊ฐ€ ๋” ์ด์ƒ ์„ฑ๋ฆฝํ•˜์ง€ ์•Š๋Š”๋‹คโ€๋ผ๊ณ  ๋งํ–ˆ๋‹ค.

๊ทธ๋Š” ์ด์–ด โ€œํ˜„์‹ค์ ์ธ ํ•ด๋ฒ•์€ ๋ณด์•ˆ์„ ๊ฐœ๋ฐœ ์ดํ›„๊ฐ€ ์•„๋‹ˆ๋ผ ์ฝ”๋“œ ์ƒ์„ฑ ๋‹จ๊ณ„์— ํฌํ•จ์‹œํ‚ค๋Š” ๊ฒƒโ€์ด๋ผ๋ฉฐ โ€œAI ์ฝ”๋”ฉ ์–ด์‹œ์Šคํ„ดํŠธ์™€ ํ•จ๊ป˜ ์ž‘๋™ํ•˜๋Š” ์—์ด์ „ํŠธ ๊ธฐ๋ฐ˜ ๋ณด์•ˆ์ด ๊ฐœ๋ฐœ ํ™˜๊ฒฝ ์•ˆ์— ๊ธฐ๋ณธ์ ์œผ๋กœ ํ†ตํ•ฉ๋ผ์•ผ ํ•œ๋‹คโ€๊ณ  ์„ค๋ช…ํ–ˆ๋‹ค.
dl-ciokorea@foundryco.com

Artificial Intelligence in Cybersecurity, Part 8: AI-Powered Dark Web Investigations

14 January 2026 at 09:03

Welcome back, aspiring cyberwarriors!

If youโ€™ve ever conducted an OSINT investigation, you probably know that the dark web is one of the hardest places to investigate. Whether youโ€™re tracking ransomware groups or looking for leaked passwords manually searching through dark web results takes hours and gives you mostly junk and malware. This is where AI can change how you investigate. By using Large Language Models we can improve our searches and filter results faster. To do this, we have a tool called Robin.

In this article, weโ€™ll explore how to install this tool, how to use it, and what features it provides. Letโ€™s get rolling!

What is Robin

Robin is an open-source tool for investigating the dark web. It uses AI to improve your searches, filter results from dark web search engines, and summarize what you find. What makes Robin particularly valuable is its multi-model support. You can easily switch between OpenAI, Claude, Gemini, or local models like Ollama depending on your needs, budget, and privacy requirements. The tool is CLI-first, built for terminal users who want to integrate dark web intelligence into their existing workflows.

Step #1: Install Robin

For this demonstration, Iโ€™ll be using a Raspberry Pi as the hacking platform, but you can easily replicate all the steps using Kali or any other Debian-based distribution. To install the tool, we can either use the source code from GitHub or Docker. I will choose the first option. To begin, clone the repository first:

pi> git clone https://github.com/apurvsinghgautam/robin.git

As shown in the downloaded files, this is a Python project. We need to create a virtual environment and install the required packages.

pi> python -m venv venv

pi> source venv/bin/activate

pi> pip3 install -r requirements.txt

Before Robin can search the dark web, we need to have Tor running on your system. Install Tor by opening your terminal and executing the following command:

pi> sudo apt install tor

Step #2: Configure Your API Key

In this demonstration, I will be using Googleโ€™s Gemini models. You can easily create an API key in Google AI Studio to access the models. If you open the config.py file, you will see which models support the tool.

Robin can be configured using either a .env file or system environment variables. For most users, creating a .env file in your Robin directory provides the cleanest approach. This method keeps your API credentials organized and makes it easy to switch between different configurations. Open the file in your preferred text editor and add your Gemini API key.

Step #3: Execute Your First Dark Web Investigation

First, letโ€™s open the help screen to see which options this tool supports and to verify that we installed it correctly.

pi> python3 main.py โ€“help

Currently, we can see two supported modes for using this tool: CLI and web UI. I prefer CLI, so I will demonstrate that. Letโ€™s explore the help screen of the CLI mode.

pi> python3 main.py cli โ€“help

Itโ€™s a straightforward help screen; we simply need to specify an LLM model and our query. Letโ€™s search for credential exposure.

pi> python3 main.py cli -m gemini-2.5-flash -q โ€œsensitive credentials exposureโ€

After a few minutes of processing, Robin produced the gathered information on the terminal. By default, it is formatted in Markdown and saved to a file with a name based on the current date and time. To view the results with Markdown formatting, Iโ€™ll use a command-line tool called glow.

pi> glow summary-xx-xx.md

The analysis examined various Tor-based marketplaces, vendors, and leak sources that advertise stolen databases and credentials. The findings reveal a widespread exposure of personally identifiable information (PII), protected health information (PHI), financial data, account credentials, and cryptocurrency private keys associated with major global organizations and millions of individuals. The report documents active threat actors, their tactics, and methods of monetization. Key risks have been identified, along with recommended next steps.

Understand the Limitations

While Robin is a powerful tool for dark web OSINT, itโ€™s important to understand its limits. The tool uses dark web search engines, which only index a small part of whatโ€™s actually on hidden services. Many dark websites block indexing or require you to log in, so Robin canโ€™t reach them through automated searches. For thorough investigations, youโ€™ll still need to add manual research and other OSINT methods to what Robin finds.

The quality of Robinโ€™s intelligence summaries depends a lot on the LLM youโ€™re using and the quality of what it finds. Gemini 2.5 Flash gives great results for most investigations, but the AI can only work with the information in the search results. If your search doesnโ€™t match indexed content, or if the information you need is behind a login wall, Robin wonโ€™t find it.

Summary

Conducting investigations on the dark web can be time-consuming when using traditional search tools. Since the dark web relies on anonymity networks, isnโ€™t indexed by standard search engines, and contains a vast amount of irrelevant information, manual searching can often be slow and ineffective. Robin addresses these challenges by leveraging AI to enhance your searches, intelligently filter results, and transform findings into useful intelligence reports. While this tool does have limitations, it can be a valuable addition to your arsenal when combined with manual searching and other OSINT tools.

If youโ€™re interested in deepening your knowledge of OSINT investigations or even starting your own investigation business, consider exploring our OSINT training to enhance your skills.

Best Web Testing Tools to Improve Website Performance

13 January 2026 at 01:17

Are you trying to figure out what tools are best for testing your web applications? If so, you have likely done some research and know there are a lot of options from complex Java log parser tools to other tools that are much more simple in design, and as such free logging tools. If you [โ€ฆ]

The post Best Web Testing Tools to Improve Website Performance appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

โŒ
โŒ