general

[frail turtle]

Just leave everythkng accessible to groups

[heady sage]

https://tenor.com/view/tommy-wiseau-oh-hi-mark-hey-mark-gif-17296134

[carmine pecan]

Test it, and you will see it works

Probably some hidden stuff in the source of bash

Maybe they have checks for binary name?

It would be an easy check in C you know

argv[0]

[scenic maple]

if possible take it to dms

[leaden canopy]

can someone help me with some homework? its not network topologies and im having trouble understanding </3

[carmine pecan]

https://tenor.com/view/water-pov-cat-gif-21660003

[leaden canopy]

https://tenor.com/view/water-pov-cat-gif-21660003

:(

[scenic maple]

https://tenor.com/view/water-pov-cat-gif-21660003

there

to get embed perms you need to be hacker rank

[leaden canopy]

i know </3

im just never on here

thank u for the reminder fr tho

[frail turtle]

I was about to fall asleep in the doctors examination room watching youtube videos

Just now

It's gotta be the chair

[carmine pecan]

intended

HTB gives auto-pwn to the author

After the first 3 solves

[scenic maple]

but they give autopwn to htb first
when you make a box you have to submit an autopwn of the box with the writeup

[carmine pecan]

How to autopwn DarkCorp

[scenic maple]

thats the real question 😩

[cerulean falcon]

hi @burnt bloom can i dm you?

[signal mica]

i dont recall reading this on the machine submission page

👁️

[scenic maple]

i am sure abt the writeup maybe autopwn thing is a myth

[carmine pecan]

autopwn is a myth

Some creators come up with an autopwn

so they can try and assure those extra money for "QuAliTy"

sure sure "quality"

[scenic maple]

we on same page then

[signal mica]

What is autopwn supposed to be? A script that assures that all relevant information along the way is present?

[carmine pecan]

autopwn is an script that automatically pwns

[scenic maple]

autopwn basically pwns the machine boot to root

gets u the flag

[carmine pecan]

thank you for coming to my ted talk

[scenic maple]

so if autopwn works it means machine is working as intented

most of the times

[signal mica]

Thats what i said

[carmine pecan]

Except if the machine is a Medium box named Hacknet

[scenic maple]

we need more boxes like rope2

[terse dune]

hello

[scenic maple]

hi

[terse dune]

why cant i connect to instance to xfreerdp in academy

?

[signal mica]

Let me check real quick

I dont know

Please be more verbose

[agile thunder]

Hi guys

I heard the us goverment is shutting down

Has that happened yet

[terse dune]

i was doing windows fundamentals , there was a task to connect to xfreerdp. i tried downloaded the openvpn key and connected , it shows connected but when i try to complete the task by connecting to xfreerdp it says i am not connected as well as when i ping the host it says host not found. i was connected when i was doing other exercise

[rapid badger]

My bank charged me $60 for only having $5.
Now I have -55 dollars.

[signal mica]

Vpn issue i guess, restart the academy instance and try again, if doesnt work redownload vpn again

[terse dune]

i did it three times already

so i came here

i was ask to do that last time it did work but today its not working

lucky dude

what else can it be

[mystic harbor]

I shall remove it before my boss sees it

[scenic maple]

u can report unsolicited dms to mors

[lilac cipher]

MORS

[scenic maple]

https://cdn.discordapp.com/emojis/809400222002315355.gif?size=96&quality=lossless

[mystic harbor]

😭 I have put ask for before dm and still

[silver forge]

https://tenor.com/view/monkey-monkey-dancing-orangutan-monkey-dance-happy-monkey-gif-12702179649294906179

[lilac cipher]

Disqualified

[willow storm]

https://tenor.com/view/jake-crying-gif-15896901980625544793

literally every server im in

[mystic harbor]

@willow storm

[willow storm]

at least u pinged me specifically

:P

[mystic harbor]

Lol

[willow storm]

feels special

[mystic harbor]

@lilac cipher Learn something bruh

[lilac cipher]

U aint special

[scenic maple]

r u?

[lilac cipher]

No

[scenic maple]

[frozen pumice]

hello how long do challenges points take to be added to profile?

completed a 10 point rev but still same points

[silver forge]

about 10 milliseconds

[frozen pumice]

why is my final score still 0?

and challenge owns graph didnt increase

although challenge progress did

[silver forge]

https://tenor.com/view/monkey-conduciendo-gif-24377638

[willow storm]

[terse dune]

this is the third time i am really frustrated

why the vpn shows connected but i cant reach the target machine

[frozen pumice]

it will happen more times

[silver forge]

ping harder

[willow storm]

if u gave the bank a world, it should rob the man, cuz the gun was robbed by the man

thonk more

[tame viper]

.

[ornate ibex]

Helloooooooo

[willow storm]

hello

[terse dune]

ok gyuys me going to try hack me

this is frustrting i am unsubing htb

bye

[lilac cipher]

[zenith ridge]

.

[patent elbow]

LinkedIn is evil

[carmine pecan]

To understand the creation, one must first understand the creator

[agile thunder]

Code your own boxes, give yourself short term amnesia and hack them again if you wanna be a pro hacker

[carmine pecan]

Just ask Gemini 2.5 Pro to do boxes for you

[patent elbow]

don’t please

[terse dune]

yeah before that i need to learn

i guess there is a process

[patent elbow]

world was better before AI 😞

[terse dune]

i dont want to get the flag or solve boxes i want to learn the process

[patent elbow]

that’s the right way

[terse dune]

and this freaking vpn is killing me

[ornate ibex]

Bye

[ornate ibex]

in what ways?

[lilac cipher]

Let me ask ai why this is

[ornate ibex]

Irony

[carmine pecan]

Indeed

TOUGH

Bloods took longer back then

https://tenor.com/view/demon-cute-gif-18252118

[zealous charm]

@grok is this true?

[patent elbow]

the fear that everything ends up being ai generated, people not really thinking for themselves anymore

obviously im trolling, overall the world is still better with ai but sometimes i get those thoughts

the classic psychological bias of « it was better back then » too

[lilac cipher]

@woeful cosmos is this true?

[carmine pecan]

Wait, people thought for themselves before AI?

Shocking revelations

[patent elbow]

[carmine pecan]

unpopular opinion

Nice very nice

69

[zealous charm]

xAI is hiring penetration testers right now. Up to $440k/year salary. On-site though 🤢

[lilac cipher]

@maiden escarp are you offering more?

[ornate ibex]

I can't deny that

[ornate ibex]

don't ping random ppl 😢

[lilac cipher]

Then don't have an ai nickname

[patent elbow]

https://cdn.discordapp.com/attachments/680837693428465679/1405261893920231497/caption.gif

[ornate ibex]

spotted @silk talon

[static pasture]

Hey XBOW, fix my code

[zealous charm]

My mind was blown when I learned it was pronounced crossbow

[carmine pecan]

Yes

HackTheBox is pronounced: PwnTheMachine

[patent elbow]

oh xbow seems impressive af

[carmine pecan]

xbox?

[zealous charm]

“Hey xbow turn off”

[static pasture]

hey homebrewer, brew

[carmine pecan]

https://tenor.com/view/brew-it-palpatine-gif-3350184901994555953

[late nova]

Guys where can i learn hacking for bug bounty huntingg??

[signal mica]

CWES

[silver forge]

lol

[late nova]

is that a website or?

[carmine pecan]

Guys there's still time to be a pioneer in GOAT farming

Start now or be unemployed

[devout sail]

I ping <@&473760315293696010>

Hello

[signal mica]

This is a certificate that hackthebox offers

[carmine pecan]

Impressive

[late nova]

ohhhhh

[devout sail]

Reply to my hello 😢

[carmine pecan]

It includes a learning path

[carmine pecan]

Zero Click RCE?!

[late nova]

meaning?

[hard harbor]

TIL

[devout sail]

It teaches you

[carmine pecan]

It's a full course

[late nova]

ohhh and its free?

[carmine pecan]

$8 a month

if you are a student

If you are not a student it's $1 Million a year

or close to that

[late nova]

i am broker than broke people so any free alternative?

[zealous charm]

Or just do portswigger (free) and actually spend time bug bounty hunting (also free)

[devout sail]

You can get discount if you use my username as coupon tho

[carmine pecan]

Portswigger

[carmine pecan]

Can confirm

[signal mica]

To some extent... if im not mistaken you start with cubes and you can buy modules from cwes (those teach you the skills)

[late nova]

what is portswigger?

[devout sail]

Another platform

[carmine pecan]

Free Courses

[late nova]

ohh

[zealous charm]

If only there was an engine where you could search things

[carmine pecan]

High quality too

[zealous charm]

I’d call that a search engine

[carmine pecan]

Damn think about that!

In the hands of the right person

[late nova]

ohhh thanks guys ill try portswigger then

[signal mica]

Cool idea, im thinking fox based theme on the app?

[carmine pecan]

it would be so so powerful

[devout sail]

Be like me, do 20 seasons
Get 500$ credit
And find a certificate which costs 500$ and get it.

Im 1/20 done

[carmine pecan]

Bro?

[late nova]

like GPT?

[lilac cipher]

Thats labs credits

[devout sail]

I'm gonna cry if they don't accept my credits for certs

[carmine pecan]

They don't

[devout sail]

Credits are credits 😭😭😭

[signal mica]

Cry now

[lilac cipher]

No they're not

[signal mica]

Stream it

[carmine pecan]

I am sorry bro

[devout sail]

Nooo

How can they

[carmine pecan]

You could try selling your account

[lilac cipher]

There goes your billion dollar plan

[carmine pecan]

AFTER you have the credits

[devout sail]

/feedb឵឵ack why u do thus

[silver forge]

I don't even know what is a season

[carmine pecan]

Like if you have $500 on HTB credit

you could sell that account for $1200

And people would buy it

[signal mica]

Easily

[carmine pecan]

🙂

[devout sail]

Nah i like my username

[carmine pecan]

Well then be poor

[devout sail]

Already am 😎

[carmine pecan]

Then just be rich?

[devout sail]

Tbh if i stay here for 20 seasons
I'm pretty sure htb gonna just give it to me lmao
Just to shoo me away

[late nova]

anyone that has hopes to be rich by doing hacking?

[devout sail]

Obviously

[carmine pecan]

By doing it?

[signal mica]

Oh you can get rich by hacking

But not in a

[devout sail]

I shall not be sad for this credits revelation

[late nova]

i dont have hopes

[carmine pecan]

two options:

• Black hat
• Sell courses

[devout sail]

Remember guys

[late nova]

😂

[devout sail]

Despair is easy
Hope is hard
And i like to stay hard

[carmine pecan]

I am hard right now

[late nova]

if i could get to black hat level then what else would i need😂 but i cant-

[devout sail]

Just buy money

[late nova]

damn i dont wanna do that

tbh if i dont make it ill js jump off a building

cant make money make the headlines💀

[carmine pecan]

omg

The sheer amount of scarcity mindset in this group

[late nova]

ill give u $2 for $10

[carmine pecan]

You guys gotta meditate more

[terse dune]

i was working as computer operator in delhi i was hired by AWS hakata , Japan

[late nova]

i will need psycological help

[terse dune]

its just luck

[devout sail]

Nah

I'm just gonna buy myself a cake and eat it

[late nova]

oh yeaaa day after tmrw my bday

[terse dune]

can i boost the server

[devout sail]

Well no happy birthday for u
I'll be getting all cakes

[terse dune]

yes i boosted another server i got tons of scolding

[late nova]

atleast a happy birthday would be good😂

[terse dune]

[devout sail]

Do it

[late nova]

from who

[terse dune]

not this server another server

[late nova]

btw how to get that cool nameplate thing besides the name

[devout sail]

I'm cool

[late nova]

and why have u written ssoosss

[devout sail]

I'm ssooss

[terse dune]

i think you need to buy it

[late nova]

yea no im gonna do this till i die if i can but dk if ill be able to thats all

[late nova]

how did u get it

[late nova]

tho i think ill die midway😂

[terse dune]

i am in platinum nitro

wasting money in discord nitro

[late nova]

i didnt know there was tiers to nitro cuz im tht broke lmao

[terse dune]

yeah just sub for a year you will get to platinum

[late nova]

ill try man but w a $0 budget its prob gonna be TOUGH😂

[terse dune]

easy peasy leamon squeezy

[late nova]

lemme hold a dolla

[terse dune]

it does man

[late nova]

it costs money for the qualifications ig man

[terse dune]

ngl

see the cost of certification

i could pay 1000

but its way beyond that

[mystic harbor]

@scenic maple this guy is everywhere 😭 I am scared

[late nova]

yea i would have to sell my laptop and take out loans from 4 diff banks

[terse dune]

if you want to hit the compliance only doing this wont help i guess

[carmine pecan]

As you should be

[scenic maple]

https://tenor.com/view/dexter-doakes-squint-stare-suspicious-gif-14432154109786838518

[royal turret]

👀

[late nova]

is portswigger a learning website or tools type shi?

[terse dune]

no idea

isnt burp suit related to portswigger

[late nova]

i think so

[terse dune]

i think its certificate also cost around $100+

[late nova]

shit i need to download burpsuite again

[terse dune]

for what?

[late nova]

the subtitles sound indian

[terse dune]

why do we use burp suite

[late nova]

bug bounty

[devout sail]

Burping

[scenic maple]

its a company that makes the best web security testing tool on the market
to promote their tool they made portswigger academy
they also have one of the most elite security research teams ever

[exotic pendant]

😄

[late nova]

packet cactching ot whatever i forgot technical term

[terse dune]

yeah i had a chance to meet albino wax

[devout sail]

infosec dudes and dudettes making up weirdest names and stuff

[scenic maple]

is he a chad irl too?

[late nova]

so i cant learn from there orr there is courses also?

[terse dune]

i was fan boying

[carmine pecan]

What's a dudette?

[devout sail]

Those who aren't dudes

[scenic maple]

https://portswigger.net/web-security

[carmine pecan]

Is my dog a dudette?

[late nova]

first thing whats ssoosss

[devout sail]

is she

[devout sail]

It's boobs
Learn your characters

[late nova]

oh thanks man

[late nova]

nah i learned german

that is german letter

[devout sail]

We aren't in geman server

ẞure

[terse dune]

anyone get to meet dawgyg?

[late nova]

but it is a german letter🤓

[carmine pecan]

The only difference between he and she is that 's' in the start

[devout sail]

ßhe

[carmine pecan]

Wenn du Deutsch sprichst, antworte auf diese Nachricht.

Hm bad use of Wenn maybe

[late nova]

i skipped classes after wie geht es dir🤓

wie heist du?

[limber arch]

Does HTB have a estimated time on merch deliveries to the US?

[carmine pecan]

F

[limber arch]

Specifically the East coast

[carmine pecan]

It's instant

[royal turret]

yall using the N word in german

[late nova]

how u know my grade

[limber arch]

I'm tryna rock a HTB shirt to a cyber conference

[devout sail]

Htb ones are great

Better than parrot ones

[terse dune]

can i have one too

[elder inlet]

https://cdn.discordapp.com/attachments/140129091796992000/1407322181301567538/image0.gif

[late nova]

im from nepal so i have no hope of getting merch

[devout sail]

I'm planning to get 2 T and 1 hoodie

[carmine pecan]

oof

[devout sail]

After season ends so i can get 50% Obv

[vivid flower]

My rastalabs shirt is already kind of messed up from the dryer

[carmine pecan]

The borders

[terse dune]

how do we get it

?

[carmine pecan]

Dude use a dryer

[devout sail]

Did i participate in the recent events

[late nova]

this dumb country doesnt have any merch gng

[vivid flower]

Note to anyone buying merch the graphics crack on high heat

[devout sail]

Oh nah, is it that kind of print

[scenic maple]

feel free to use my design

[late nova]

wdym

[devout sail]

Did u*

[carmine pecan]

https://tenor.com/view/water-pov-cat-gif-21660003

[late nova]

no why?

[royal turret]

me when her

[devout sail]

Just asking

[terse dune]

aye aye captain

[frail turtle]

My cholesterol being at 134 is too fucking low

[late nova]

ima send this to my crush

[limber arch]

i broke

its 50 euros to get it to the usa with a 50 percent off discount LOL

[carmine pecan]

Think about the turtles man

oh wait

wrong context

[terse dune]

how much to ship it to Singapore

?

[vivid flower]

Tariffs are cooked man

[frail turtle]

I need more cholesterol

[royal turret]

HTB is german right???

[carmine pecan]

Greek

[royal turret]

whattttttttttttttttttttttt

[devout sail]

U got the merch?
I don't really know much about prints
But i know there's those which u can feel like a thin film of plastic/color on cloth (bad) and there's those which u can feel the color by touch (good)
Which one is it

[late nova]

thats like 6000 in nrs

[carmine pecan]

Yes

It's Greek

[vivid flower]

The former

[devout sail]

To me it's 30% of my salary lmao

[terse dune]

better to get a tatoo i guess

[devout sail]

Ah welp, I'll hold off on purchase then

[vivid flower]

Their hoodie is comfy though

[limber arch]

geez

[royal turret]

didnt know that Greece had a culture like this (talking about tech)

[late nova]

i only have 5nrs- not enough for a tattoo

[vivid flower]

The hoodie graphic has held up better than the shirts

[late nova]

😢

i could get one ice cream tho

[carmine pecan]

They don't

[vivid flower]

Its been getting cooler so i think i may start wearing mine more

[mystic harbor]

Astrology

[devout sail]

I spent 3k INR to get like 4 great Ts
And htb single one costs 3K or so

But with shipping and all, it's kinda fair just for a occasional

Maybe i can ask my friend to print it

[devout sail]

What's hot for u?

[late nova]

where u from?

[devout sail]

Is 45° C hot?

[scenic maple]

yes very

[vivid flower]

Anything over 80 degrees (i am english i burn easy)

[royal turret]

lmao nobody suing you for that... do it

[carmine pecan]

a lot

[devout sail]

Golam said we can use his design

[vivid flower]

In freedomheit

[terse dune]

can you cook egg on the road?

[devout sail]

Hehe 20ish °C is kinda cold here

[royal turret]

I meant copying the original ones

[scenic maple]

afaik you can print a htb shirt and wear it
u cant sell it but i am not entirely sure

before actually doing this ask support

[devout sail]

Golam said yes

[vivid flower]

Dont do that lol

Well actually its not like india cares

[terse dune]

[royal turret]

thats actually a nice business idea..

imma sell it for $15...

[mystic harbor]

Golam said it ✅

[scenic maple]

selling is illegal

[vivid flower]

Make sure your shirt says you're htb staff

[scenic maple]

bro cropped by ss

see this is why we cant have good things

it always gets illegal

[late nova]

guys whats the best bug bounty hunting method?- im confused which to learn

[carmine pecan]

fight the power!!

[mystic harbor]

F

[devout sail]

I'll print golam on the back and 71 as number
Like those football players (the one which you play with kicking balls by legs)

[vivid flower]

Get a list of fortune 500 companies and find those with a private bug bounty program not on hackerone. Focus on those

[royal turret]

wdym method.... it comprises of recon, manual hunting and a lot of stuff

[devout sail]

https://tenor.com/view/looney-tunes-elmer-fudd-bugs-bunny-quietly-walking-slowly-walking-gif-17088875

[late nova]

no like sql injection and css type shi

[royal turret]

talking about bug hunting.... I got my first CVE reserved yall

RCE

[devout sail]

Yes css to rce is in the top 1 owasp

[scenic maple]

css has nothing to do with bbh

unless you are doing like a pwn thing

[late nova]

not the language-

[devout sail]

:0

[scenic maple]

css 0 days go for millions

[mystic harbor]

CSS is the best hacking language

[devout sail]

So the people in general do know stuff

[royal turret]

lmao, I barely type here

[mystic harbor]

I write exploit in html

[late nova]

i meant cross site script is that useful?

[devout sail]

Xss

[vivid flower]

Xss rarely pays out

[devout sail]

Oh i think that's why they say xss instead of css
To avoid confusion

[late nova]

i use notepad to hack ppl so dont expect that fancy shortform

[vivid flower]

Im still sitting on a few reflected xss simply because the owners do not care

[terse dune]

why does gpu libraries break changes in version upgrade guys, should it not be backward compatible?

[royal turret]

I reported a stored xss on a chatbox.. mfs were like, this is third party and closed it as out of scope

[late nova]

lmao

[terse dune]

you should always read the scope

[late nova]

bro got swindled

[devout sail]

If you report that on my project
I'll reply at 3am with reflect deez ....

[ornate ibex]

https://youtube.com/shorts/BEPBNrqSVWY?si=7v0nriQzwTGcvp8H

Imagine getting ride from an apex predator.

[vivid flower]

Wow u are credit to a more secure world

[devout sail]

Fortunately i don't have any project that has bugs

[late nova]

what do yall do to find bugs?

[royal turret]

dude, the website was in scope..after I reported it, they mentioned that the chatbox is out of scope which is ridiculous. its like saying HTB is in scope but the support chat is out of scope

[vivid flower]

Sqlmap

[rapid badger]

That has to be AI or somethin

[ornate ibex]

@scenic maple

[late nova]

and it works everytime?

[devout sail]

and greenbone openvas

[royal turret]

ghauri better

[vivid flower]

No but its easy

[royal turret]

whatttttttttttttttttt yall relying on scanners for bug hunting?

[late nova]

how much did u earn from dat

[vivid flower]

Yeah openvas or nikto also

[devout sail]

I don't hunt 💀
I shitpost

[terse dune]

if the literature in scope describes it they cannot deny but if your understanding of scope lacked something then they will surely make it an excuse

[royal turret]

yeah exactly, they didnt wanna pay

[royal turret]

lmao

[devout sail]

If you tell me your setup, and where to start
I'll put it in my todo and start doing it

[vivid flower]

I get nothing from bug bounty because its saturated

[devout sail]

I'll get 4 AI and slop everywhere

[scenic maple]

i had always wondered humans ride horses what do cats ride

[royal turret]

I just got my burp and terminal loll

[devout sail]

I'll start with curl project

[scenic maple]

jaguar it seems

[terse dune]

i never trust automated scans

[late nova]

im tryna freelance so isnt bbh the only options?

[devout sail]

Well burp is the tool I'm most familiar with

Compared to other

Tools

[ornate ibex]

I guess, cats are the real OP?

[late nova]

burp confused the shit out of me

[terse dune]

i still use zap

[ornate ibex]

https://tenor.com/view/giga-gigacat-cat-mewing-mogging-gif-12429734670640119345

[terse dune]

i dont know what is burp

[devout sail]

Wow capybara

[young glen]

😃

[terse dune]

caido

[royal turret]

burp is the best... I dont like caido and zap

[terse dune]

i only know zap

[vivid flower]

I use fartsuite

[royal turret]

zap is shit. looks pixelated

[late nova]

i hate burp cuz it confuses meh

[scenic maple]

they are genuinely very op tho https://www.youtube.com/watch?v=es5aPICeXOU

[terse dune]

maybe i am used to it

[elder inlet]

I'm running on 2 coffees and a monster energy right now. I'm dead

[devout sail]

Yeah but someone said it's saturated
So idk if it's worth going there 😢

[scenic maple]

sheep is for sleeping

[carmine pecan]

Rookie

[late nova]

guys isnt bbh the only freelance option?

[devout sail]

1 more wouldn't hurt

[late nova]

they said bbh is saturated not burp

[royal turret]

well, its like development.. too many people but, if you are good at what you do, you make it

[devout sail]

You can freelance as a developer
Make shit code
Ask them for freelance Pentest
Find bug
Ask for freelance dev (persona 3)
Fix shit code
Triple profit

[scenic maple]

look at this mans face and say that again

[late nova]

u sound rich lmao

[carmine pecan]

oh... my...

[devout sail]

Edited

[terse dune]

bro if you can setup isms team and compliance documentation you may have another job as well

[devout sail]

Cuz Pentest don't fix

[terse dune]

but i see you are searching for easier path so i think you stick with bbh

[ornate ibex]

https://tenor.com/view/patrick-bateman-calling-gif-22091641

[devout sail]

Ok guide me to start somewhere
And i might try my skills

[late nova]

im searching for money

[royal turret]

blud said easier

[devout sail]

Reposting cuz why not

[terse dune]

bro you dont need to 9-5

[royal turret]

slayy

[devout sail]

Man i got distracted and forgot to finish my job

[late nova]

9-5 is the thing im tryna stay away from so ig i should take my chances w bbh

[devout sail]

I'll do it tomorrow ig

[terse dune]

sure thing

[devout sail]

You think bbh works for 2h and call it a day?
I'm pretty sure they spend more than 9-5

[royal turret]

yoooo you got that cloudflare setup haha

[terse dune]

give it a try but to fully depend on it i dont recommend

[late nova]

but idk how to bug bounty hunt

[muted olive]

Did someone say bbh

[late nova]

ye

[devout sail]

I have no security.txt 😭
Why u poking me

[muted olive]

Ironically this was just in my mail lmao

[devout sail]

You can tell me about details

I'm customer team

[muted olive]

okay!! slides login credentials

[late nova]

tell me what u used to find bug

[muted olive]

phone

and google

[devout sail]

Anyways can I dm u

I got memea

Memes

[late nova]

tf u mean phone!!??i cant find w laptop and this guy found it in phone

this is like losing to a 6 yr old in chess

😢

[devout sail]

He hacks smart toothbrush with his phone

[muted olive]

I was kind of bored and not at home so I was poking around

[scenic maple]

is there a burp for phone

[late nova]

step by step tutorial now plez😂

[scenic maple]

🤔

[muted olive]

didn't need burp but also, you can probably get it if you get kali nethunter maybe?

[muted olive]

step 1: give me your credit card details

/jk

[devout sail]

You got those stuff in your phone?

[late nova]

i dont have rooted phone

[muted olive]

I was just searching for a specific kind of thing

[muted olive]

nah

[scenic maple]

what did u use?

[royal turret]

sure

[late nova]

tools from where?

[devout sail]

My phóne has 1gb space left
I ain't deleting memes to add apps

[muted olive]

Google. I was google dorking stuff

[scenic maple]

bishesh go do portswigger
and cwes from htb academy

after you finish you ask questions again

[muted olive]

*cwes

[scenic maple]

you already have the link for portswigger

[late nova]

cbbh free?

[terse dune]

maybe he is trying to get old faster

[late nova]

what is cbbh

[scenic maple]

its not

[muted olive]

get asked questions*

[scenic maple]

its a cert

[late nova]

yes

[muted olive]

certified bug bounty hunter

now rebranded to certified web exploitation specialist

[scenic maple]

just do portswigger academy then come back

[terse dune]

that is against the law of nature

[late nova]

i need recommendation on what to learn in portswigger tho thats wht i was asking but got sidetracked

[carmine pecan]

CSRF

Get good at CSRF

1. CSRF
2. XSS

Then start doing Easy HTB boxes

[scenic maple]

learn everything there

except for clickjacking

[carmine pecan]

in ~3 months you will be amazed with what you can do

[frigid shard]

Haiii

[late nova]

k

thanks gyz

[warped plank]

Learn SSTI, rarely looked for and still very common.

[devout sail]

Be my friend

[late nova]

hmmm alr

[stone marsh]

Ssti is such a fun little vuln

[late nova]

ive never in my life heard that from a guy

[devout sail]

Sti is fun yeah

[muted olive]

I've never encountered SSTI ever

[devout sail]

Sad

[late nova]

not sti-

[muted olive]

apart from two instances, one in a challenge and one in a box

[zealous charm]

I feel like it is as looked for as XSS

[devout sail]

I once had a crazy friend who would beat other friends it they became my friend 💀

[terse dune]

@late nova i think its better for you to look some videos of InsiderPHD and look for IDORS

[warped plank]

And if you're a masochist learn advanced SQLi and XSS

Ever hear of:
XSS to register a passkey?
or
Automating Boolean SQLi filter bypass?

[stone marsh]

I mainly see it on applications with advanced email templating

[zealous charm]

You always see payloads like "><i>test${{7*7}} sprayed everywhere

[late nova]

alright any specific vids?

[warped plank]

ngl would probably still work with just {{7 * 7}}

[zealous charm]

This covers CSTI too

[terse dune]

bro i gave you the creators name

[muted olive]

for me XSS is easier to look for tbh. Like, I don't know how to search for SSTI. Type {{7*7}} in every input field? I don't get it

[stone marsh]

Yeah just a nice combo of injection based vulns

[late nova]

lol alr

[warped plank]

Gotta identify that there's a templating engine in use first

[stone marsh]

Basically. If you get 49 they are cooked

[terse dune]

but before starting looking atleast give a look at OWASP top 10

[muted olive]

in those cases I try html injection usually

[muted olive]

Ohh

[royal turret]

I dont think there are much applications these days that use template engines.. I mean its uncommon so

[stone marsh]

But not all templating engines work the same, and some have particular methods

[late nova]

kk thx

[muted olive]

Now I use 7*7 for all my XSS alerts so that I feel like I got SSTI

[zealous charm]

If it is client side template injection the impact is the same as XSS

[devout sail]

few days ago i got medical report from one of the big hospital in my city
They used php , and get the ID in base64 in URL 💀

[terse dune]

i use 47*47 , someone in the linkedin told me to do that

[muted olive]

then what's the difference between the two?

[patent elbow]

logitech x superlight is the best mouse ever

[royal turret]

yoo what happened to that website called haktricks.. I think thats the name. its no longer indexed properly

[muted olive]

https://tenor.com/bOnH7.gif

[zealous charm]

Sounds like a good learning opportunity!

[devout sail]

But thats soo dumb i think they don't care

[muted olive]

Indeed. ChatGPT to the rescue, one sec

[zealous charm]

CSTI = angularJS xss

[scenic maple]

you should use 0+1
cause 7*7 is a bigger computation than 0+1 hence we must save time by doing 0+1 and get ahead of other bug hunters
cause remember if you come 2nd no one will pay you

[warped plank]

Well the thing is if everyone uses 7*7 then they'd just filter it out so you think there's no vulnerability

[late nova]

alr guys ima learn everything in 1 night cuz im a masochist

[devout sail]

{{1/0}}

[zealous charm]

7*7 is only used because that's what james kettle published in his initial research

[terse dune]

if you try to learn in one night , hope you dont run away from what you started

[scenic maple]

i wonder what it takes to make ground breaking research

those guys are goated

[devout sail]

Hoe

[scenic maple]

wdym

[silver forge]

it became too dangerous so it had to be put down

[patent elbow]

you know, there are polyglot payloads too

[royal turret]

time, interest and zero chicks

[devout sail]

https://tenor.com/view/tsapa-tsapistis-τσαπα-τσαπισμα-τσαπιστης-gif-23951476

[terse dune]

maybe identifying supplychain

[warped plank]

Tester: {{7 * 7}} outputs 49: You have an SSTI
Remediator: *filters {{ 7 * 7 }}*: Test again plz
Tester: {{ 7 * 7 }} no longer works, but {{ 7 * 6 }} does
Remediator: 👁️ 👄 👁️

[patent elbow]

#curl

[muted olive]

[devout sail]

Send 'eli5'

[zealous charm]

https://x.com/albinowax/status/1940062192726155563

James Kettle (@albinowax)

@1248anand Sometimes I wonder how the world would be different if I picked {{8*8}} 😂😂😂

X · Jul 1, 2025, 2:57 PM

[devout sail]

And it will explain properly

[muted olive]

RCE in client's browser as in? A sandbox shell?

[royal turret]

but, isnt there an alternative?? like its been around a year I touched a box on HTB or any other platform and now I am back, everything has changed. I dont see hacktricks.. + HTB changed. No KOTH type shi

[terse dune]

maybe they are diffrent i guess

[muted olive]

[terse dune]

i am not sure as i am still noob

[patent elbow]

i remember the cisco fix when they banned curl user agent to mitigate a CVE 😂😂😂😂

[muted olive]

hacker can do bad stuff

[patent elbow]

https://news.ycombinator.com/item?id=19507225

pjf

Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

Hacker News · Mar 27, 2019, 11:14 PM

[muted olive]

thanks that makes it very clear 😂

[patent elbow]

was so fun

[devout sail]

See easy to understand

[warped plank]

https://tenor.com/view/blinking-eyes-white-guy-blinking-meme-what-huh-gif-26334322

[muted olive]

See my immediate instinct is to change the ID in this url from 19507225 to 19507224

[warped plank]

bro can't stop looking for vulnerabilities... just because you can doesn't mean it's an IDOR

[patent elbow]

try do add '

[muted olive]

ik but my hands go on autopilot

[patent elbow]

maybe u found sqli

[terse dune]

https://tenor.com/view/calm-down-a-bit-calm-down-relax-gif-3234894596200294187

[warped plank]

too bad they used double quotes in their SQL query

[muted olive]

I am used to typing out <script>alert(1)</script> or ' OR 1=1 -- - in every input field I see

[scenic maple]

https://portswigger.net/research/xss-without-html-client-side-template-injection-with-angularjs

there you go

[devout sail]

Nah

[warped plank]

hear me out, replace that xss with: "><svg/onload="alert(1)">

[devout sail]

Why?

[zealous charm]

GTFO golam, we only ask AI to eli5 here. No one actually wants to read the original post!

[scenic maple]

yall need cwee this is basic stuff

[scenic maple]

🤫

[devout sail]

Where's your

[terse dune]

i do

[muted olive]

if it is filtered I usually do <sc<script>ript>alert(1)</sc</script>ript> before trying svg

[warped plank]

Ever seen a website that filters out svgs? I've seen script, img, even p, not svgs though

[muted olive]

nested payload is goat

[scenic maple]

[late nova]

i dont have a job so i might

[devout sail]

Oh nice
I haven't done anything official other than CTFs
So used img
Will remember to use svg

[zealous charm]

Yes, but even if all tags are filtered you can still get xss with made up tags

[warped plank]

Neither have I

[scenic maple]

altho if i do meet portswigger staff i would ask them why does their blog not have syntax highlighting and uses white as bg color

it makes 0 sesne

[muted olive]

what if it encodes input? how do you bypass that?

[devout sail]

[warped plank]

oh yeah this too, this is funny as heck just using "><pwned/onload="alert(pwned)">

[lime rose]

Yo

[scenic maple]

coal mines are fun and games until a robot does it better than you

[warped plank]

you don't,

[supple plume]

Hi ppl who are we roasting 🍖

[late nova]

im gonna js go into chess

[devout sail]

Why not use this everytime then?

[warped plank]

Because... made up tags don't work everytime

[muted olive]

Why not

[lime rose]

Don't want to sound needy, but is there a legitimate way to get some free HTB VIP? I'm trying to learn cyber security, but I'm not in the right financial position to subscribe, and wondered if there were programs or opportunities available

[devout sail]

No filter issue

[warped plank]

idk at least I don't

[lime rose]

Also sorry if I can't do that in gen

[warped plank]

There's a #giveaways active rn for VIP+ 1 month

[muted olive]

There's a student discount for $8/month

for academy

[lime rose]

Okay

[warped plank]

VIP is for labs, which I'm assuming is what they want a subscription to

[zealous charm]

Usually getting an HTML tag in is the easy part, most JS events are what is blocked

[devout sail]

I'll use

<if_u_c_dis_u_gae/onload="alert(if_u_c_dis_u_gae)">
So whoever is monitoring will ignore it

[lime rose]

Do I have to be enrolled in something specific?

[late nova]

oh shi my brotha u in the same hole as me

[lime rose]

Yeah 😭

[zealous charm]

You probably want to use onmouseover (or similar) onload will not work here

[patent elbow]

yeah there's honestly tons of ways, you can get it from seasonal rewards if you finish with a certain rank or placement, from giveaways, or in some ctf events where that's the prize

[scenic maple]

😋

[lime rose]

It'd be awesome if I could understand that

[late nova]

yea im doing this rn😢

[devout sail]

Im learning in general today
I'll remember these stuff

[lime rose]

I know hats though

[warped plank]

I'm tempted to make you two fight to the death for a VIP+ coupon

[limber arch]

request smuggling still hurts my brain a bit

[late nova]

damn u more beginner than me

[scenic maple]

dont start with that lma

lmao

[warped plank]

YOOOOO, that talk was legendary

[lime rose]

I know

How to fix beginner: become not beginner

[late nova]

so i js wsted 15mins of my life

[warped plank]

It's just a request inside a request

[lime rose]

Real

[limber arch]

using crlf right?

[supple plume]

Beginners hear me out: you don't need to spend money to put the brain to work

[scenic maple]

pick topics from here
https://portswigger.net/web-security/getting-started
after you are done then do the rest

[late nova]

come lets be friends- hopefully learn together

[lime rose]

I'm in highschool right now so TS is NOT easy

[warped plank]

among other things, there's also the other way which is to upgrade protocols or swap protocols

[zealous charm]

nah man, we're only here to yap, not actually do the learning resources that have been recommended here hundreds of times

[lime rose]

Bawlright

[warped plank]

How old are you?

[late nova]

which grade- or year or whatever idk what they do in ur country

[lime rose]

17

[limber arch]

ya

[late nova]

damn

[warped plank]

https://help.hackthebox.com/en/articles/9456556-parental-consent-and-approval-for-users-under-18

[scenic maple]

you should join this weeks cube talks to find out how to get started in cybersecurity

[lime rose]

My dad works for Distribution Management

[limber arch]

ITS A TRAP

[lime rose]

Shit

[devout sail]

🪤

[lime rose]

I walked into that didn't I?

[limber arch]

https://tenor.com/view/jeremy-wade-fish-on-fishing-gif-14304213

[zealous charm]

Everyone knows you get started in cybersecurity by giving a training platform money (this message was brought to you by a training platform)

[late nova]

is he getting kicked now or he can keep learning here?

[lime rose]

:/

[patent elbow]

most of the time yeah, but some variants are just based on rule mismatches (TE CL, double CL, normalization) or on H2 --> H1 without any extra CRLF injection

[devout sail]

He can just get his parents sign or something

[lime rose]

Well if I get kicked it was nice knowin y'all

[warped plank]

This incident has been reported
-#

[lime rose]

I stay anonymous online

[scenic maple]

8 times

[limber arch]

Mhmm I see. Is this actually a somewhat common vuln to find in the wild?

[devout sail]

What happens when there's someone who join the server with no guardian and is minor

[terse dune]

i agree with this thing, yesterday i almost vomited not figuring out why my regional model deployment was having issue with, some mf turned off one of the server accidentally and did not tell us until eod

[late nova]

bruv u already added me so we learn together now

[lime rose]

Minors always have a guardian legally

[lime rose]

W

[silver forge]

I hear hacking an intelligence agency kickstarts the career nicely

[late nova]

who from india

[lime rose]

Hey question before I'm hammered!!

[scenic maple]

idk

[warped plank]

Pretty much every government is legally obligated to provide you with a guardian, It's the same with lawyers

[terse dune]

yeah do it and get yourself wooped

[silk talon]

[zealous charm]

@maiden anvil how do i get started in cyber security?

[lime rose]

How do I continue to learn before I'm able to use HTB

[late nova]

my government would ask for money to get a parent

[lime rose]

🔥

Capitalism at it's finest

[supple plume]

There is free stuff in academy and labs that can get you some kickstart

[devout sail]

It changed recently
So not true

The govt

[patent elbow]

it's not super common honestly, personally i've never found one in bug bounty or pentest, but yeah you gotta think about it… it does exist for real, you just need to keep it in mind and have the right context, like if there's a CDN or proxy in front, you might wanna give it a shot

[scenic maple]

one day we all will get started in cybersecurity until then keep grinding

[ornate ibex]

why sad?

[late nova]

where u from?

[lime rose]

So

[limber arch]

Mmhm makes sense! Ty for the response!

[lime rose]

Do I stay in the server?

[devout sail]

[late nova]

js make ur parents sign on a napkin or smth ig

[supple plume]

You are bringing attention to that 🤫

[silk talon]

Dont know

[late nova]

OOOO MADARCH- mb got a bit excited

[lime rose]

It already got reported to higher ups which means that it's in another channel

[devout sail]

Mods

Yes using bad word

I'm deeply hurt

[late nova]

nope bad word not completed

[devout sail]

But you used

[warped plank]

https://tenor.com/view/arch-linux-arch-linux-gif-25380879

[lime rose]

Guys I can't finish the first getting started Tier 2 machine 😭

[terse dune]

@devout sail your pfp is cute

[late nova]

abhi bhojpuri me bhi dunga

[ornate ibex]

https://tenor.com/view/really-mhm-whatever-dont-care-gif-14311338872635812139

[devout sail]

I understand bhojpuri too

[supple plume]

If you get kicked good luck with starting in cyber it is good, don't give up it can be frustrating at the beginning

[lime rose]

It's bringing up a ton of problems when I attempt to use smbclient

[devout sail]

😁😁

[late nova]

uhm maithilii?

[muted olive]

6 figure job in 6 months, GUARANTEED!

(six figure job in Iran )

[lime rose]

Yeah I noticed that when practically every document was outdated or unhelpful in someway

[terse dune]

nigeria

[lime rose]

And knowing this with only 2 months of learning is saying something

[terse dune]

i think irans currency is top notch

[ornate ibex]

wuuuuttt????? fr????

[late nova]

guys my door js opened by itself

[devout sail]

Yeah parents from there
I live in south tho
So got both 😎

[late nova]

i think this ghost studied cybersecurity too

[warped plank]

Mate, every document is helpful, even if it's outdated... sure it might be hard to read or be innacurate, but hey it should provide some information.

[late nova]

oh hey

[terse dune]

check nigerias currency

[silk talon]

Close it

[maiden anvil]

you cant

[muted olive]

what/where is bhojpuri

[zealous charm]

gg, time to pack it up gents

[supple plume]

At the beginning everything feels that way

[late nova]

im not getting up gng what if it catches me-

[devout sail]

It's one of the languages of India

[muted olive]

@zealous charm how do I become hacker?

to hack girlfriend instagram?

[devout sail]

Out of gazillion languages

[muted olive]

Oh, where is it spoken?

[devout sail]

Bihar

[warped plank]

To be fair, I write my own documentation

[muted olive]

oh

[warped plank]

f* around, find out, write about it

[zealous charm]

https://cdn.discordapp.com/attachments/687864084514865152/1212047155867553862/image0.jpg?ex=68de8f60&is=68dd3de0&hm=28d35aab4c1d11be7d4021a24a1d93c09d511f64702f26c0fabb26973d4dd735&

[silk talon]

Drink lots of coffee

[terse dune]

wow irans currency is much more less

i did not know

[late nova]

but they dk bhojpuri so even if i say anything u cant do anything heheheheheh

[lime rose]

Mostly joking. I'm pointing out that when I try to use commands there's errors a lot of the time even when I copy-paste. This is user error, I know. Just showing my view

[ornate ibex]

u don't tho

[ornate ibex]

I see

[silk talon]

I drink tea

[lime rose]

I'm obviously in no position to grade the usefulness of documents

[muted olive]

Wait what? Linux??? Where's the Ultra Hacker 5000 I saw on TV??????

[lime rose]

👍🏼

[warped plank]

Ohhh, yeah that doesn't change, no matter how skilled you are one of em tools you use is just gonna spit out a random error which you have 0 understanding of

[ornate ibex]

so u ain't hacker

[zealous charm]

u right, real hacker learn from tiktok

[silk talon]

Coz I’m not a hakur

[lime rose]

ChatGPT is my hero

[subtle plover]

Hakur

[supple plume]

Based

[lime rose]

Ever since it got that big coding up

[terse dune]

if you copy paste command you are not even started your preparation to start the journey

[muted olive]

https://tenor.com/SVor.gif

[subtle plover]

Daddygpt

[warped plank]

Nahhh, there's some errors that even ChatGPT can't save you from, there's just that one obscure answer in one forum a decade ago

[lime rose]

I'm saying even if. Not that I do.

[devout sail]

Say it and see
You'll get banned

[ornate ibex]

noob

[lime rose]

That's what happens when I tried to mod SCPSL, which has little to no documentation on the API

[muted olive]

copy pasting is okay if you know what the command does

[terse dune]

legacy documentations is to understand the past and craft your own in present isn't it

[lime rose]

I do

[late nova]

are there any nepalis?

[terse dune]

or was i doing wrong

[terse dune]

i am nepali

[lime rose]

Just saying I'm proving there's no error in what I originally typed

[late nova]

cap

[lime rose]

How was y'all's day?

[terse dune]

k cap

?

[warped plank]

Real, half the commands I use are copy pasted
-# From my own docs , I preach again: F* around, find out, write about it

[silk talon]

I am malayali

[late nova]

oye what u actually nepali?

say smth more in nepali

[muted olive]

I often ask Chinaman to write my grep commands

[lime rose]

Cheat sheets are the only way ❤️

[supple plume]

Chinaman?

[terse dune]

k vanam

[scenic maple]

so how is malaysia like

[supple plume]

Is that an AI?

[devout sail]

It once saved me
I had issues with evil winrm
It made me uninstall the ruby
No more errors cuz all ruby tools got deleted

[subtle plover]

Use binbongAI

[warped plank]

devious-winrm

[supple plume]

I would like to hear that

[terse dune]

tannai cha nepali yeta

[subtle plover]

Englis pls or i ping all staff members

[scenic maple]

evil winrm is evil for a reason

[muted olive]

Deepseek/Qwen

[warped plank]

@late nova english only

[late nova]

kk

[subtle plover]

[terse dune]

speak in english ,mod will kick

[devout sail]

Lick

[subtle plover]

Chibai

[supple plume]

Just read it in english

[devout sail]

[muted olive]

the ultimate AI that can do everything... except tell you about the guy holding the grocery bags

[subtle plover]

https://cdn.discordapp.com/emojis/1295792046279491636.webp?size=64&animated=true

[late nova]

hehe fr

[scenic maple]

guys whatever you do never search "hacker attitude status yt short"

[lime rose]

Someday I'm gonna type random s* into the console and it's gonna work

[silk talon]

Beautiful, visited long back

[terse dune]

useless

deepsek qwen

[subtle plover]

Im gonna do it

[lime rose]

Okay. Thanks.

[muted olive]

whatever you do never search "." on yt

[late nova]

its all indian ppl

[scenic maple]

what do you work as tho

[terse dune]

deepseek doesnot even have settings to reset password

[scenic maple]

biggest mistake of your life

[lime rose]

Wild

[muted olive]

malaysia is awesome

[terse dune]

i know they wont pay they bounty

[late nova]

so u son of prachande or smth how u rich gng?

[silk talon]

Data entry/security

[terse dune]

so its usless reporting them

[muted olive]

yes the CCP wants to keep your passwords static

[scenic maple]

security was fine but data entry 🤔 they dont go together

[supple plume]

Golam say something in one of these weird languajes

[silver forge]

https://tenor.com/view/bing-bong-bingbong-tiktok-meme-gif-24189665

[lime rose]

Is there a point where I won't need to download some new program every lab/box?

[terse dune]

i even created a pr for them, ah dont want to improve it

[scenic maple]

no one would understand lol

[lime rose]

Sneaky golem in the pocket

[supple plume]

@subtle plover

[muted olive]

data entry is 100% ai replacement job

ngl

unless I'm thinking about something different

[terse dune]

do you think prachandas son does hack the box

[late nova]

Which language

[scenic maple]

he wont return here
he searched for "hacker attitude yt short"

[terse dune]

?

[scenic maple]

its joever for him

[subtle plover]

Its cringe asf

[scenic maple]

cant share that

[warped plank]

Chat I can speak in french, watch.

[late nova]

yea no that was dumb question

[silver forge]

it can be hard too. depending where you have to put the data

[supple plume]

I will read it and imagine it is a pissed off driver while I cut the line

[late nova]

how u rich then?

[silk talon]

Jk, I’m mostly dealing with documentation and rarely does any pentesting

[warped plank]

French press
French Toast
French Fries
French Kiss

[scenic maple]

communication with who

[late nova]

istg one day ill become rich😢

[terse dune]

i have a library in my house

[muted olive]

true

[late nova]

nah u son of sherey?

[supple plume]

OYE MALATAIN

[muted olive]

french kiss

[late nova]

oh wait sherey dont have house anymore

[scenic maple]

french fries arent french

[muted olive]

they're belgian

[late nova]

how old u @terse dune

[terse dune]

1995 i had a compaq desktop

so guess how old i am

[devout sail]

I don't like toast
I'll take fries and stuff

[scenic maple]

french fries come from the land of everydaysparkling

[late nova]

u were alive in 1995!?

[muted olive]

what's and stuff

[devout sail]

[muted olive]

wut

more like eathomie

[scenic maple]

just for one day
just one day i want to see gen chat not being weird af

[lime rose]

Cyber security.
Expectations: Six figure job with lovely wife and kids
Reality: single dude tinkering with something that they will never use in a real world scenario
THIS IS A JOKE AND COMPLETELY INACCURATE

[supple plume]

You have to become weird to unweird the weird

[late nova]

accurate

[terse dune]

i wiped windows 95 and installed RHEL

[warped plank]

I find it even funnier that I caused it

[silver forge]

https://tenor.com/view/freddie-mercury-wayne’s-world-waynes-world-gif-waynes-world-myke-myers-gif-3520536693545412169

[quick willow]

Yo did you guys know that it’s impossible to break things over a VPN pentest?

[late nova]

man u expired or smth brotha

[supple plume]

Brotha thats your future

[late nova]

my future

[warped plank]

So who told this dude that he was a red-teamer?

[quick willow]

THE cape exam '