general

[muted olive]

live action roleplay?

[novel oriole]

let me finish this 80 tons of networking theory first ig

[woven blaze]

hiii

[stable tiger]

red teaming for example is mostly Active Directory, which needs extensive Kerberos knowledge etc windows internals

[muted olive]

you dont need that much networking

[icy viper]

i agree, the bouncer needs to kick out the chef for cooking steak well done

[stable tiger]

But you won’t be writing 0days often, that’s a vuln researchers job mostly

[novel oriole]

i see.. btw u suggested David Bombal.. what video or playlist of his?

[muted olive]

and local tactics

even on non domain joined machines

which is mostly what I do

[novel oriole]

how much exactly then? can you specify?

[muted olive]

I need to setup an AD lab tbh

[stable tiger]

the lion hardcodes privesc 0days into his payload that load vulnerable drivers

[woven blaze]

hi, im new. rn we arre 2 doing offlinea challenge htb
can u someone help us how to start? we do 3 very easy challenge before and this is hard for us

[muted olive]

So you need to learn how packets travel through a network, how they're segmented, how a network is structured, how data travels across two networks, OSI model etc. You don't need to learn OSPF, BGP and things like that

[stable tiger]

they’re labelled “very easy” from a penetrate perspective, they’re not easy if you’re new

and that’s okay

some people find the easy boxes harder than medium or hard tho cos of the topic used but whatever

[novel oriole]

and the things in this junior path.. i need to hardcode them in my brain?

[stable tiger]

Strong fundamentals make everything easy

Strong understanding of how networks and computer work makes it very easy to see when something is vulnerable

[novel oriole]

ive been studying theory for last 3 days and it feels like im not doing anything worthy idk why but it feels like this

[stable tiger]

“oh wait they’re not validating user input and this thing directly queries the database?”

sqli in a nutshell

for example

[stable tiger]

Fundamental theory is braindead but essential

aim towards a goal that you like and google how this fundamental knowledge is relevant and essential and you’ll be motivated

[novel oriole]

i thought of completing network foundations section and making a complete map of it on a paper how everything works and all protocols etc evbery single thing involved in whats happening rn like how im accesing the internet.. whats happening under the hood etc

what do u say about this?

making a mental map of this structure once and for all

[woven blaze]

😭

[stable tiger]

map it to the OSI model

[novel oriole]

yup ill do that and one more thing.. i do like what i read in the networking theory but my brain feels overwhelmed by tons of it

[stable tiger]

you wouldn’t try calculus without knowing fundamental math

[novel oriole]

aghh i see

u also had to do all this?

when u were a beginner?\

[stable tiger]

yup

[novel oriole]

daamnnn

[icy viper]

@stable tiger How do I make notes ionside of ntoes on Joplin?

[stable tiger]

can’t write malware without knowing how windows works

can’t know how windows works if I don’t know how computers work

[stable tiger]

Google it I forgor

[woven blaze]

what challenge do u recommend for new users?

[novel oriole]

alll this info just to be a beginner sounds brutal bro

[stable tiger]

did you assume hacking would be easy

There’s a reason it pays well

[novel oriole]

tbh cybersec feels like toughest field of Computer Science

[stable tiger]

bcos it is

[novel oriole]

my friends busy in web/mobile app dev and its super easy compared to this.. whereas im stuck nhere in theory feeling useless

[stable tiger]

write a HTTP server in C

you’ll understand C and a protocol

[novel oriole]

should i really do this? am i on that level rn?

[stable tiger]

If you struggle with theory try project based learning

[stable tiger]

project based learning

which is what htb is built around really

[novel oriole]

i see

[stable tiger]

practical labs to learn new techniques

[icy viper]

is linux from scratch good?

[novel oriole]

btw one last question before i go back to my theory learning

[stable tiger]

depends

do you have motivation issues

[icy viper]

Not really, I love learning

[stable tiger]

you’ll really understand Linux if you do

[novel oriole]

will AI kill this field? is this field saturated? i often see very very less views on yt videos related to cyber sec

[icy viper]

Especially with stuff I'm interested in

[muted olive]

No, yes

[stable tiger]

This field is saturated at the low level

This field is not saturated at the high level

[muted olive]

is it saturated yes

will AI kill it no

[icy viper]

I think AI will help people in the field, not kill it

[muted olive]

kind of at the high level too

its saturated everywhere

[novel oriole]

Explain in htb certs terms.. What is low level? what is high level ?

[muted olive]

but, the trick is just: being better than everyone else

lol

[muted olive]

low level is, its saturated in terms of beginners who are getting into the field

high level as in, medium-senior roles are less saturated

[novel oriole]

so

cjca = saturated skill level?
cpts = less saturated?

[muted olive]

you can say that

one thing though is that specializations are not saturated

thats if you choose to commit and go deep enough

[novel oriole]

well..
do u recommend me to take cjca exam after learning all modules or go directly to pentest path and get cpts cert only?

[muted olive]

cpts is very hard, so no. recommend starting with cjca

[icy viper]

ibraheem, I'm not in the field but I wouldn't try learn everthing even though you said no compromise. Specialise and prosper

[novel oriole]

bruh i understand but its my bloody ego which makes me like this

[exotic pendant]

[muted olive]

internships etc depends on your country

what they look for and such

[novel oriole]

well im glad i didnt directly jump into pen tester path

[muted olive]

you can transition

thats not a problem

[novel oriole]

i have searched the whole web and i found out that rn cjca path is the best one out there.. nothing is better than this

for a beginner

[stable tiger]

exploit dev is not saturated

[muted olive]

I mean

[crimson elbow]

how do i discover a zero day in the windows hypervisor?

[muted olive]

its fairly new so

[exotic pendant]

Don’t read above but if you’re wanting a job certs are only 10-20% of the battle

[stable tiger]

exploit dev is not new

[exotic pendant]

[muted olive]

kind of kind of not

[stable tiger]

real

[muted olive]

ez just be @exotic pendant

[crimson elbow]

like that's really insane

[stable tiger]

game cheat spotted

[novel oriole]

can someone get job without any cert? purely due to proof of work on github?

[exotic pendant]

I can feel my motivation coming back so I might hit back at hyper v

[stable tiger]

HYPERCALLS
HYPERCALLS
HYPERCALLS
HYPERCALLS
HYPERCALLS

[stable tiger]

yes but you dont have the project

[crimson elbow]

i dont really play games anymore

[exotic pendant]

I know plenty of people without certs but a 10-20% does help

[crimson elbow]

im just looking at MSRC's website

[muted olive]

@exotic pendant have you used this before? https://github.com/doyensec/electronegativity
its kind of just a vuln scanner but its good at mapping out the attack surface

[stable tiger]

find me a vuln in the LSAIO enclave xx

[exotic pendant]

If you have 80% of what they’re looking for like experience

[novel oriole]

i see

[exotic pendant]

Then certs Arnt as needed

[crimson elbow]

what kind of vulnerabilities did you discover? i'm genuinely interested

[exotic pendant]

I got a lot of my professional experience from being a sysadmin and bug bounty

[crimson elbow]

did they pay you the 6-figure bounty?

[exotic pendant]

Hyper v escape -> UAF on host

[crimson elbow]

damn that's like 250k

[exotic pendant]

Plus it works as a rdp escape

Rdp host -> connecting host

[crimson elbow]

have you popped a SYSTEM shell on host?

[exotic pendant]

No user

[stable tiger]

i have

[crimson elbow]

prove it

[exotic pendant]

Doesn’t mean it can’t be chained with another bug

So it’s still sexy

[stable tiger]

wdym prove it its patched 😭

[exotic pendant]

Time for the gym

[stable tiger]

usermode rce -> privesc is easy to chain if you have them both

[muted olive]

cve id?

[crimson elbow]

i mean you said "i have" so i thought you're still able to

[stable tiger]

no

[crimson elbow]

ah i see then

[muted olive]

popping a system shell itself is easy. how you do it is hard

[stable tiger]

^

[crimson elbow]

yeah i meant what vulnerability did they leverage

[stable tiger]

uaf

cloud driver for the privesc

[crimson elbow]

ooh that's cool

[muted olive]

drivers yum

@stable tiger do you have any CVEs?

[crimson elbow]

that's the million dollar question

[sturdy thistle]

I have one

[crimson elbow]

critical?

[muted olive]

Nice, which one?

[crimson elbow]

if so can you reference the CVE?

[stable tiger]

none that ive found

that werent already currently reported

[muted olive]

I thought you had like ten

[stable tiger]

theyre a cve if you report them to the vendor

[crimson elbow]

so you aren't a zero day hunter then welp that's frustrating but also cool to see some experienced people here

[stable tiger]

zero day markets pay a lot better

[sturdy thistle]

CVE-2024-35203

[muted olive]

having cve != not being hunter

[sturdy thistle]

Together with @austere sigil

[crimson elbow]

they denigrate your reputation though if you're interested in a career

[stable tiger]

^

[exotic pendant]

Oh okay

[stable tiger]

no they dont lol

[exotic pendant]

[crimson elbow]

i meant prominent hunters do usually have CVEs with their name credited

[muted olive]

Nice, gg

[sturdy thistle]

Thanks

[exotic pendant]

I wish I was a hunter

[crimson elbow]

cool dude keep it up

[exotic pendant]

[sturdy thistle]

With a bow?

[exotic pendant]

Sword plz

[sturdy thistle]

Put sword in bow

I slept 1 hour

For whatever reason

[exotic pendant]

Shooting dagger from bow would be sick

[muted olive]

[stable tiger]

because i started with malware development lmao

[muted olive]

yes getting you arrow and bow now

[muted olive]

what I meant is that bug hunters dont need a cve as a prerequisite

[crimson elbow]

has anybody here achieved OSEE?

[stable tiger]

osee isnt that difficult

[crimson elbow]

that's like top tier shit

[sturdy thistle]

Probably some

[stable tiger]

sans sec760 is top tier

[crimson elbow]

isn't that a kind of more niche

[stable tiger]

no?

[muted olive]

no

[stable tiger]

sec760 is 0day hunting

[muted olive]

sans is THE top

[stable tiger]

osee is entry kernel exploitation

[muted olive]

it is?!?!?!??!

[stable tiger]

offsec just glazes it

[muted olive]

how much does the course cost?

[crimson elbow]

oh wow never heard of it

[stable tiger]

sans or offsec

[sturdy thistle]

Much much

[stable tiger]

offsec u can only take irl

[muted olive]

sans

[stable tiger]

oh

sans is like 9k usd

its fucked

stephens a great guy tho

[sturdy thistle]

Yeah pricey

[muted olive]

:P

[stable tiger]

so youd learn a lot from him

[muted olive]

thats my yearly college fees

lol

[sturdy thistle]

Damn

[muted olive]

Choice between

Bachelors degree

or 4 SANS certs

[stable tiger]

the OSEE has so few holders because it's only done irl

[crimson elbow]

ahh i thought you could take it remotely

[muted olive]

nope

[stable tiger]

no

[crimson elbow]

thanks for clarifying

[muted olive]

even remote exams have intense proctoring

[stable tiger]

sans sec 660 and 760 is the best way to exp dev

[muted olive]

I wanna :(

but no $

[stable tiger]

if you want to learn free id say start from what people used to do in the 90s, reading shit like shellcodes handbook, art of exp, smashing the stack for fun and profit etc and then moving into more modern shit like mitigations, bypasses, heap spraying for eg etc

[stable tiger]

i wanna too

they cover v8 exploitation

meesa wanna learn chrome sandbox escapes

[muted olive]

sandbox escape is easy

jk.

[stable tiger]

xsalsa giving fed

WHO HERE CAN FIND 0DAYS.

[muted olive]

it is interesting tho

electron apps are juicy

for sandbox escapes

[stable tiger]

yeah but thats electron

[muted olive]

also: windows

no linux for exploit dev

[exotic pendant]

Girl at the gym said I look bigger

[crimson elbow]

didnt they patch like 114 security vulnerabilities in the last patch tuesday

[exotic pendant]

Hopefully she didn’t mean fatter

[stable tiger]

the lsass rce fix isnt even a fix

[muted olive]

w rizz

[exotic pendant]

Not the girl who I wanted it to say but still w

[stable tiger]

they removed two things in the caller functions and they didnt fix the root issue of the UAF lmao

[muted olive]

then if you can bypass it, report it again

[crimson elbow]

holy shit that's what they get from incorporating ai into their windows source

[stable tiger]

yup

[crimson elbow]

winbloat

[muted olive]

what if, today

you meet anatoly

[stable tiger]

i promise you everyone and their mother has found it

you can find it with one patchdiff

[muted olive]

but no one might have reported!

and*, I havent found it

I havent even searched for it

is it a win11 thing?

[stable tiger]

the moment an lsass rce drops everyone is bindiffing it

[muted olive]

if so, no way

[stable tiger]

ye

[muted olive]

what is a bindiff

[crimson elbow]

honestly when i first switched to linux i never thought i'd not see low ram usage

[stable tiger]

checking what changed between old version and patched

[muted olive]

ah

[stable tiger]

usually done to find the original vuln and write an n day

but in this case its just not a good patch

[muted olive]

how do you reverse a patch though?

they just drop an updated dll (or whatever the affected component was) right?

[stable tiger]

most windows applications have debugging symbols

[muted olive]

believe me microsoft and good patches are very distant friends

[crimson elbow]

you just pull the fresh binary and provide it to windbg to generate psuedo-assembly code, also grab the kernel symbols

[muted olive]

they had to patch a web vuln I found THRICE

because I broke it the first two times

[stable tiger]

https://winbindex.m417z.com/

[crimson elbow]

and you use the website referenced to notice the previous patch

[stable tiger]

or just use ida or ghidra or binja and have the pdb files downlaoded from microsoft

and just use winbindex to get the two diff file versions

[crimson elbow]

yeah that's a reliable way too, but doesn't IDA Pro cost like a thousand bucks?

[stable tiger]

ghidra

[crimson elbow]

you also mentioned ida

[stable tiger]

i did say or

[crimson elbow]

i wouldn't bother asking then

[muted olive]

I want to get another CVE tbh

[crimson elbow]

it's very time consuming though

[muted olive]

lazy and tired so far and NOT willing to talk to mitre ever again

my last one (also my first one) took 3.5 months

[crimson elbow]

can you provide the cve here

i kinda want to see it

also is it included on CISA KEV?

[muted olive]

uhh never checked tbh

CVE-2025-50567

its CVSS 10

:3

[stable tiger]

real

[stable tiger]

you seem quite interested in 0days

is there a reason

[muted olive]

https://tenor.com/dp8Ipa87LlS.gif

/j

[crimson elbow]

yo that's a solid SQLi here dude

[muted olive]

ty

oh its on CISA-ADP

[stable tiger]

fuck me i need to reconfigure burpsuite now

[crimson elbow]

i kinda checked msrc's bounty program and i saw the astronomic bounty they pay for critical hyper-v vulnerabilities that potentially affect the azure infrastructure

[stable tiger]

whats ur previous experience

[stable tiger]

@exotic pendant shoulda reported to mark not satya

[crimson elbow]

honestly so far i might have stumbled into a heap corruption in a core hyper-v component

[muted olive]

shoulda reported to sundar

[stable tiger]

shoulda reported to whoever zerodium got replaced by

[muted olive]

sounds interesting

what you got so far?

[stable tiger]

me and the gang leaving vulnerable rdp on a box just to use frosts rce

honeypotting!!

[muted olive]

did you confirm statically?

im saying this because I made this mistake multiple times

[crimson elbow]

for now actually? yes

[muted olive]

oh thats cool then

is it deterministic?

[crimson elbow]

you really nailed it, yes.

[stable tiger]

??

[muted olive]

if you can manage to trigger it, report

[crimson elbow]

i'm actually talking seriously lol

i'll see, thanks

there are no documentations for it or any CVE record at all

[muted olive]

that is mostly expected

[stable tiger]

alright ive got kali setup guys

no need to gloat but i had too

[granite shadow]

Hello everyone! New member Suraj here, passionate about HTB labs and cybersecurity. Excited to learn from you all!

[stable tiger]

arkham goon

[stable tiger]

install gentoo on ur mums laptop to become 1337

🔥

[zealous charm]

[warped plank]

without her noticing that it isn't windows

[stable tiger]

OH MY GOSH KALI UNDERCOVER !13813481818

[exotic pendant]

Frosto ready for the weekend

Soon

[warped plank]

it's the start of the week

😭

[muted olive]

oh yeah

[stable tiger]

am i 1337 now

[muted olive]

yes

[granite shadow]

Lmao, I tried Gentoo once, but mum slapped me 😂 Sticking to kali now - any Starting Point tips?

[meager kernel]

do not use Kali baremetal

use it in VM

[stable tiger]

i honestly dont remember wahts in stp

[exotic pendant]

Why not

https://github.com/grassmunk/Chicago95

[granite shadow]

Yes, I used it in a VM

[stable tiger]

im already on that

[exotic pendant]

Frosto just uses windows but for the few times I need linux I have a windows 95 theme on it

[stable tiger]

i was using windows till yesterday

till i ragequit

[exotic pendant]

Linux has me rage quitting ngl

[meager kernel]

arent there some tools which are on linux but not on windows?

[stable tiger]

arch is fine

[muted olive]

I mean all linux tools mostly have windows equivalents

[exotic pendant]

Plz install dependency on dependency on dependency

[exotic pendant]

Like what

[meager kernel]

arch is probably the distro which makes the most people ragequit

[stable tiger]

debian issue

[meager kernel]

idk, there might be

[stable tiger]

*cachy or manjaro

[exotic pendant]

If you find one let me know

[stable tiger]

or endeavour

[exotic pendant]

I’ll tell you what I can do in windows for it

[muted olive]

@exotic pendant lee-nux or lie-nux?

[meager kernel]

lee nux

[exotic pendant]

Lin ux

[muted olive]

[stable tiger]

the linux kernel

dont say WSL2

[exotic pendant]

Wsl

[stable tiger]

wsl 1 doesnt count thats pico processes

[muted olive]

im probably the only one here who says lie-nux

[stable tiger]

wsl 2 is just a vm

so that doesnt count

[exotic pendant]

What would I need the kernel for

If I’m fuzzing I’ll use qemu

Damn this auto correct

[meager kernel]

qemu works in windows?

[exotic pendant]

Yes

[meager kernel]

i thought it was linux only

[stable tiger]

ofc

lmao

no

people dont use windows 11 because windows 11 is shit

10 was great

[meager kernel]

i use 11, im used to it

[stable tiger]

12 wont work till natya sadella steps down

[meager kernel]

my linux crashed and i just stopped using it for now

[stable tiger]

try 10 in a vm and you'll cry like a man viewing his final sunset

[meager kernel]

ik how good 10 is

unfortunately it is deprecated

[stable tiger]

it is nice to not have to hunt down drivers

[muted olive]

I still use 10

[exotic pendant]

I use 11 but make it look like 10

[muted olive]

I do use 10 in vm

for testing

[stable tiger]

thats like getting a BBL instead of going to the gym

[exotic pendant]

Only because I was forced to use 11

[stable tiger]

oh real

[exotic pendant]

Forced bbl

[stable tiger]

i use 10

in a vm

[meager kernel]

frost can i have your linked btw? 🥺

*linkedin

[stable tiger]

htb users repfarming

[exotic pendant]

You’ll have to find me but I don’t like associating my personal with online

[meager kernel]

fair enough

[exotic pendant]

I’m not hard to find

I got my certs listed

[meager kernel]

wait can you send your twitter again

[stable tiger]

he's from Pizzatown

[stable tiger]

you're trained in osint

go use it

[meager kernel]

dude

shut up

[stable tiger]

google his username dawg 😭

[meager kernel]

he has a slighty different username bruh

pls shut up, no offence

[exotic pendant]

https://x.com/frostb1ten

frostb1te (@frostb1ten) on X

Senior Penetration Tester | Red Team Operator | Bug Bounty Hunter | US Navy | Single dad | Pizza enthusiast | Traitor Legion

X

[stable tiger]

spot the twitter

[meager kernel]

yea i forgot you had a 1 instead of i

[exotic pendant]

Most in rust

Best lang

[stable tiger]

@undone fossil

[muted olive]

I already found you and sent you a connection request

when you gonna accept

[signal mica]

can some spotify enjoyer visit https://developer.spotify.com/dashboard and tell me if creating an app is disabled for them. its been like 4 weeks now since they disabled this and idk if its because i have free or whatsup

[exotic pendant]

I have no pending

[muted olive]

uh

i'll resend sec

[stable tiger]

ur being used as an example of why rust is bad but you love rust

so funny

[exotic pendant]

That was because I made the poc public

[stable tiger]

reply to him and say you love rust

[exotic pendant]

Low level also gave me a shoutout

[warped plank]

Funny how the same vulnerability would've been found if it wasn't Rust

[meager kernel]

crazy

[exotic pendant]

It’s in almost every language because how win api handles input

[stable tiger]

yup

RUST IS OVERHYPED and its a winapi issue

[exotic pendant]

Rust was the only one who said it’s not a feature

[stable tiger]

@exotic pendant can you write up a list of exploit dev 0-hero resourcs so i dont need to keep explaining it to people who join

thanks xx

[scenic maple]

2016 was 10 years ago

[stable tiger]

no shit

thats why 2026 has a 2 in it

(i am joking)

[muted olive]

@exotic pendant

[stable tiger]

dont murk me

[muted olive]

I think mine is still there somewhere

apparently I sent it 3 months ago lol

[exotic pendant]

Dm your acc

Dang it was one of the pending ones

[warped plank]

isn't it just: look at what the APTs are doing?

[stable tiger]

no

we cant tell them that

[gray wraith]

Wtf lol

[stable tiger]

they need a beginners guide or they shit themselves

[gray wraith]

Bro was jealous they didnt find it smh

[stable tiger]

also tbf apts are usually just writing bootkits

[warped plank]

well... that is what they need for their use case

[stable tiger]

yeah but thats very easy to find resoruces on

https://github.com/TheMalwareGuardian/Awesome-Bootkits-Rootkits-Development

for example

https://www.youtube.com/watch?v=oa2i7JsGOHo

https://www.youtube.com/watch?v=8Uw6Tq4rw2s

stephen my king

[warped plank]

Can't lie a lot of the same concepts apply anyway so it would be a good thing to learn

[stable tiger]

we love secureboot vulns!

@crimson elbow

seems up your ally

[exotic pendant]

Frost lifting so heavy my whoop though I was powerlifting

[stable tiger]

i powerlift

[exotic pendant]

365 bench today

[stable tiger]

frost what you squat

i need to train actually

[exotic pendant]

Lately just 495

[stable tiger]

my sleep schedules so fucked im noncturnal and hitting rpe 9 squats with no spot

😭

guys im so 1337 i sleep during the day so the #feds and the #glowies think im in #china wow 1337

https://www.youtube.com/watch?v=zpDrIvF1NiI

this is me rn

[muted olive]

how does it track?

[warped plank]

The one fed reading your messages:

https://tenor.com/view/write-that-down-taking-notes-school-universities-university-gif-17937210

[muted olive]

I can find you

I can find.... anyone

-# because im with the NSA

-# /j

[stable tiger]

the feds when they see my qubes os box that is unused and simply there if i need #opsec

[warped plank]

So can you find my future wife?

https://tenor.com/view/checkmate-check-mate-got-em-gif-6408903245572515122

[stable tiger]

im working towards a job at the aussie nsa equivalent

their pay is crazy

[muted olive]

jim im a doctor, not a magician

[stable tiger]

also being a government apt sounds fun

writing exploits and bootkits all day

[muted olive]

now I know you're from australia

gg

#doxed

[stable tiger]

i think ive vaguely said my city before

[exotic pendant]

Stress, heart rate and motion

[stable tiger]

people finding my identity isnt an issue i care if they see my open powerlifting

[stable tiger]

and sleep

[warped plank]

IF you sleep during the day in australia technically you're awake during US daytime

[stable tiger]

thats the main reason i used a whoop pre apple awatch

[muted olive]

oh you're wearing a watch or

[exotic pendant]

It’s faceless

But I have an Apple Watch on also

[muted olive]

oh interesting

[stable tiger]

most of my messages are at 5 am when im working on my projects

[exotic pendant]

Whoop is just a band, no face

[muted olive]

wait till they take over australia, then you'll be in US daytime anyway

[zealous charm]

kinda sucks they made whoop a subscription

[warped plank]

I should be asleep right now ngl, I have work in the morning, and then again at another place at night

[muted olive]

I have one of those band without face things

[undone fossil]

nah frost gets a pass

[muted olive]

but I forgot the brand

fitbit?

[stable tiger]

ive got really fucked insomnia

[muted olive]

maybe

[undone fossil]

he can actually write the language and uses it for reasonable things

[stable tiger]

takes being a 0day hunter to write rust

live love laugh

[muted olive]

if you've got insomnia, just sleep

/j

(this is a joke from an insta reel )

[stable tiger]

my psych had me on valium for sleep bro 💀

[exotic pendant]

Gork plz write me hello world in Rust

[muted olive]

is that supposed to be a controlled substance?

[exotic pendant]

Prob why the psych gave it to him

And not him buying it at the store

[muted olive]

I mean one which is trafficked

those are the controlled controlled substances

[stable tiger]

australia

adderall is illegal in aus

[muted olive]

oh 👀

[stable tiger]

you can get straight actual meth perscribed for ADHD here but not adderall

[muted olive]

wtf

isnt that uh

kind of mixed up

[stable tiger]

am i 1337 now #edrbypass with that #signeddllonly

#rustdev #0day #blackhat #clumsylulz

[stable tiger]

yes

you can be walter white but not medicated

[exotic pendant]

Beautiful lang

[stable tiger]

yes but frost

you know your shit

rust devs dont

[muted olive]

*insane

[stable tiger]

rust devs when claude code pops out the unsafe keyword and they dont know what it is

[warped plank]

should be the other way around ngl, it should be safe cos the programmer gotta guarantee that the code is safe

[stable tiger]

ur spitting

'claude write me a python to rust compiler please'

[novel oriole]

python or rust? best one for cyber sec issS???

[stable tiger]

assembly

wait no youre new

learn python first

[warped plank]

please don't learn rust first

[half vine]

Hyy

[stable tiger]

😭

[warped plank]

actually I change my mind: Do... dive head first into: smart pointers for async, and the wonderful world of generics and traits

[novel oriole]

im a cs student and i have studied assembly

though not deep but i do have some assembly knowledge

[stable tiger]

youre a computer science student but you just asked if rust or python is better as a first lang?

[warped plank]

If you're a CS student you don't go into Rust or Python, you dive into C and winapi bugs for cybersec

[stable tiger]

custom winapi functions !

live love laugh

[novel oriole]

ur getting it wrong.. i heard that rust gives better control i am a cs student but not much familiar w rust.. i can code in both python and C rn

[warped plank]

python gives enough control

[stable tiger]

depends on usecase

as with

all things

ever

[frozen zinc]

Learn Go

[stable tiger]

ur gonna summon froj bro

[novel oriole]

hmmm

btw

the entry level of which field is more saturated? what do u think? web dev or cyber?

[warped plank]

at this point cyber is as saturated as web dev ngl

[novel oriole]

literally every other guy around me is dwelling into web

[muted olive]

at entry level

[novel oriole]

only me and 2 others in my class are into cyber stuff

[muted olive]

its lesser saturated at medium and high

I think its like a pyramid

[warped plank]

exactly, you know how many skeeds are watching a this one xss payload video and then proceed to complain on hackerone

[muted olive]

cringe

[stable tiger]

if you’re in the US

[muted olive]

Its better

right?

[stable tiger]

Shits unsaturated here

Life’s good

[novel oriole]

and also i heard many people quit cyber

[muted olive]

I mean maybe

[stable tiger]

people don’t tend to like difficult things

[frozen zinc]

to become farmers that is true

[muted olive]

I got three offers from US companies so idk

for internships*

two of those and one for a part time job

[warped plank]

It's one of the most burnout heavy roles especially in SOC

[muted olive]

okay thats also mostly because of connections so

I guess I dont count

[novel oriole]

either ill become good at it or ill die trying thats all i can say now after so much junk fed into my brain by people

who say cs majors are cooked

[stable tiger]

yeah I’d fucking kill myself being a soc analyst

[warped plank]

might be cooked in finding love but definitely not cooked in jobs

[novel oriole]

what about Incident Responders?

[stable tiger]

cs majors are cooked because 99% of cs majors are incompetent

[warped plank]

where do you think incident responders start?

[novel oriole]

well i have found love already

job is the thing thats left

[muted olive]

my philosophy is

everyone is your competition. so your job is to be better than everyone else in one way or another

maybe slowly but surely

[gray wraith]

Its especially difficult when u r a newbie

[stable tiger]

just start writing iOS malware

[warped plank]

turn around and have a happy life, cyber consumes all that you are and you love.

[stable tiger]

go join the NSO group

[novel oriole]

i did realise that cs degree alone is just useless piece of junk ngl

if the amount of time one spends in doing a cs degree is utilized in a specific domain then it would be 100000x more fruitful... ill graduate next year and i feel useless

so thats why i decided to pick cybersec and drill into it

[muted olive]

3rd year of college?

[stable tiger]

a cs degree could be learnt in six months to a year

[novel oriole]

nearing the end

of it

[muted olive]

You have any security related placements?

Because those can be invaluable

[novel oriole]

i dont think so

[muted olive]

Any CS related placements?

even coding or whatever

[novel oriole]

people dont give a shit about security here unless they are hit like a truck by a hacker

[muted olive]

lol

which country?

[novel oriole]

probably

[warped plank]

most of the world is like that

[novel oriole]

Pakistan

[warped plank]

unless it's a compliance thing they don't care about security

[muted olive]

like w1ld said

[lofty warren]

[muted olive]

still, if you can get a placement, go for it

[novel oriole]

now.. the cyber scene is top notch in the capital city and some other major cities

[muted olive]

because you need experience

[novel oriole]

but in my city no one gives a shit about it

and guess what?

i live in the city

where

Bin LAden was captured

[muted olive]

lol

[stable tiger]

you mean when he got headshot and that wasn’t in a city

[warped plank]

No wonder Bin Laden was captured, they don't have high standard of security

[muted olive]

cant stand up to 🇺🇸

as venezuela learnt the hard way

[stable tiger]

world war 3 incoming

We love orange man!!!

[novel oriole]

well as per CIA he was captured in my city in a town named Bilal Town which is like 4 kms away from where i live LOL

[muted olive]

@novel oriole are you planning to do a masters?

[stable tiger]

@novel oriole you’re cooked

[novel oriole]

who knows what reality was.. nobody saw his body and multiple different agents have their own story in interviews of how they were the ones who caught him

[stable tiger]

they literally shot him

[muted olive]

yeah

[stable tiger]

why would they not shoot him

[novel oriole]

yes, but abroad hopefully

[muted olive]

yeah, it has to be abroad

maybe UK

[novel oriole]

ill do master only after CPTS completion

[stable tiger]

I promise you a masters degree looks better than the cpts

[novel oriole]

otherwise ill be useless .. or atleast ill be useless in my own eyes

[muted olive]

well if you have determination its fine

[novel oriole]

well my parents even agree w UK but UK is kinda boring as my cousion is doing CS from there and he says market is messed up

[muted olive]

just be sure to really nail in the academic stuff in order

[novel oriole]

either UK or Germany

i really wanted it to be the US but US guys are onto something, the ICE are kicking their own native citizens lol.. what would a foreigner do

[muted olive]

I think the student visas for UK got tighter too but its doable

[muted olive]

that is off the table 🤣

[novel oriole]

ofc its doable im not denying it but the country is messedup rn as per my cousion

[muted olive]

what UK?

[novel oriole]

yaa job market there

[muted olive]

Yeah I mean that is sort of true but

never mind

[novel oriole]

i prefer Germany ig or maybe finland

[muted olive]

just dont do masters in your current country

[novel oriole]

language is a barrier which im willing to learn

[muted olive]

oh for sure

germany is cool in that regard

you know, you learn the language and you dont need to pay

[signal mica]

german language is ugly

[muted olive]

or you get scholarships

[muted olive]

its kind of similar to english ngl

[novel oriole]

rn i have holaidays like till late march and i wanna get CJCA or atleast finish the junior path modules if not the cert before i start uni again

[novel oriole]

except it seems more rude

[warped plank]

Ngl with your knowledge half that shi gonna be boring af

[muted olive]

Germans are organized as fuck though tbf

[novel oriole]

and some words are spelled like a kid spammed a keyboard

[muted olive]

Very very very punctual

[novel oriole]

im already dying cuz of this heavy theory

but do i have any other choice? am i going to give up? am i not worthy? i dont think so

well yes i can transition to web dev.. i have a very very strong foundation in JAVA but i dont want to do that im fascinated w cyber stuff

[warped plank]

Java isn't used in webdev...

[novel oriole]

backend dude

[warped plank]

It really isn't

[signal mica]

oh but it is

[novel oriole]

it is...

[warped plank]

What abomonation is this?

[muted olive]

It is, but not in recent times

its mostly used in legacy stuff

which cant be replaced with anything else

[novel oriole]

alot of legacy systems are on java

ALOT

[zealous charm]

Any hacking today?

[signal mica]

one of my previous jobs was handling whole auth part of hpe support portal. WHOLE backend regarding to that was in spring java

[muted olive]

yas

[novel oriole]

JAVA is still going strong.. still among top 10 languages

[muted olive]

discord hacking

[warped plank]

what the actual fuck

[frozen zinc]

just learn java and get marry bro

[signal mica]

its impossible to migrate out of it wild

java is like crack cocaine

[novel oriole]

what about that kid in me that wanted to become a hacker? should i disappoint him?

[stable tiger]

💀

[signal mica]

just learn as you go

[frozen zinc]

just learn go and asm and buy a camper bro

[stable tiger]

bars

[warped plank]

website running on a virtual machine with a garbage collector is crazy

[muted olive]

one thing
if you get a job in another IT field like web dev or dev for a couple of years or so, you can transition into security more easily

this is what I've heard more experienced people say

[novel oriole]

honestly.. its kinda of an egoistic problem w me.. i can be weird.. i see 99% of the people around me going into the dev stuff.. i dont want to be among them.. call me stupid or whatever but this one is a psychological issue

[stable tiger]

https://tenor.com/view/alpha-wolf-sigma-male-gif-26562640

this you twin

[warped plank]

I'd say that's a good thing if dev is your passion. Don't just chase something because it's unique, chase something because it's what makes you happy. If you go into cyber then you're gonna meet a lot of people in cyber and then 99% of the people you know would be in cyber

Most people I know are in cyber

[deep ferry]

If you strive to be different, you don't have to pick a different job. Every job has millions or thousands of people doing it

[novel oriole]

as i told u before im also fascinated by cyber as well so theres that

[warped plank]

Being surrounded by like minded people is a gift, not a burden

[muted olive]

I wish I was

lol

[zealous charm]

this is why we yap in discord

[novel oriole]

hmmmm

[muted olive]

but yeah

here I am

[stable tiger]

if you strive to be different you should be unemployed

[muted olive]

so thats good

[meager kernel]

i wish i got that gift too

[frozen zinc]

and try Arch

[muted olive]

irl, no one gets cyber lol

[deep ferry]

That's why I joined

[muted olive]

I know one guy who is great at programming and is great at AI stuff

thats about it

[warped plank]

It's the whole reason I became a mod... totally by accident btw

[signal mica]

"and try arch"

[meager kernel]

ik VERY FEW people irl who do cyber

[frozen zinc]

btw

[muted olive]

well thats better than me

I know 0

[zealous charm]

yap enough on discord and it can land you a job too

[warped plank]

funnily enough I know a lot of blue team and engineering peeps

[stable tiger]

i know a few and theyre all smelly

[signal mica]

i know 2 but tmk they are just running nessus

[warped plank]

security engineering that is

[muted olive]

I mean my family know a bit of cyber now because I yap a lot

lol

[deep ferry]

[warped plank]

Meanwhile my fam when I yap about cyber:

[zealous charm]

my wife can explain XSS because I find it so much in bug bounty 😆

[warped plank]

https://tenor.com/view/glee-emma-pillsbury-nod-nodding-yes-gif-3737306875204656768

[meager kernel]

im actually happy cyber is not as common as dev, less competition for me

[muted olive]

same, basically everyone in my family can explain SQL injection

[muted olive]

less but more

[deep ferry]

It's still a huge competition because of Indians

[meager kernel]

😂

[deep ferry]

and cybersec youtubers hyping it up

[muted olive]

I dont think cyber is heavily competed in India

dev? yes unimaginably

[signal mica]

@usama0 @brathadair @nlte @devout sail

[meager kernel]

its not

[meager kernel]

dev work is insanely high

[muted olive]

tbf I'm happy that dev is competed in India

Its a good thing

[mystic harbor]

Yeyyyu

[frozen zinc]

what is not competed in India?

[mystic harbor]

[muted olive]

good thing unless you're a dev*

[muted olive]

good point

[deep ferry]

dev in the big 26 🥀

[mystic harbor]

Me

[stable tiger]

well typically

you need to build applications

[muted olive]

lack of a degree for one thing

as im finding out now

[mystic harbor]

I have no degree

[warped plank]

I'm a dev
*professional chatGPT prompter*

[deep ferry]

two degrees, a vibe coded website, certification

[meager kernel]

pretty sure you can get a cybersec job right after school
if its remote job from another country, then college degree maybe also not required

[deep ferry]

lie that you know all languages and frameworks

[stable tiger]

skill issue

[warped plank]

lie and say you invented all languages and frameworks

[muted olive]

you mean anyone in general?

[meager kernel]

you in specific

[stable tiger]

I invented the windows api

[deep ferry]

and you also have to commit to the linux kernel regularly

[muted olive]

ah I want a degree lol

[warped plank]

I invented silicon

[novel oriole]

is it possible to never find a bug when ur participating in a bug bounty event?

[stable tiger]

bars

[muted olive]

of course its possible

[signal mica]

lowkey if you understand how transistor works, inherently you understand everything

[muted olive]

it has three prongs

do I understand everything now

[deep ferry]

I invented a scalable, industry-agnostic frameworking templating engine for JavaScript with microprofiling of multiprocess-archiecture

[stable tiger]

mfw lack of voltage = 0 and voltage = 1

[signal mica]

the job is yours jo

[novel oriole]

like.. there are godtier bughunters.. they might find it before eveyone else 90% of the time

[signal mica]

hired

[meager kernel]

bro has the chance of skipping all main quest cause of his high level and still chooses to not speedrun

[stable tiger]

who needs to write assembly i memorise opcodes

[muted olive]

everyone from my great-great grandfather and below has a dual degree

so

[meager kernel]

they dont have a CVE though

you do

[deep ferry]

That's why you need to be fast and skilled. Low-hanging fruits are picked very fast as far as I'm concerned

[muted olive]

welp

its annoying

no one replies

[meager kernel]

[stable tiger]

skill issue + level up + cve + ezpzp $$$$

[muted olive]

when are you going to get one?

[meager kernel]

idk, im not as good

[lofty warren]

wife material

[muted olive]

nah, its a matter of when not if lol

might as well start trying

[deep ferry]

just one more week and they'll reply

[meager kernel]

lol i struggle in HTB machines

💔

[muted olive]

https://tenor.com/bsYm1.gif

microsoft and mozilla havent replied

neither has the other 3 on bugcrowd

neither has openai

[deep ferry]

we all do

I guess

[muted olive]

no one replies anymore

[stable tiger]

post the PoC publically

for all of them

if they dont reply its on them

[muted olive]

nah its been a week since the last reply lol

[muted olive]

just need code review skills

[zealous charm]

same, i'm sitting on 11 pending bugs

[muted olive]

or, more accurately, the abiilty to filter out noise

[deep ferry]

Sell it to a skid that will kill their entire business or something

[muted olive]

they never reply :(

mozilla's security team is basically a bunch of devs lol

[zealous charm]

worst is when the customer accepts but doesnt pay right away I've got 5 accepted pending payment, 3 triaged, 3 awaiting triage

[muted olive]

yeah they usually have a weekly/monthly schedule for bulk paying

[muted olive]

and yeah

I dont think they're primarily security oriented despite being the security team

[deep ferry]

[muted olive]

which isnt a bad thing but

takes more explanation

[zealous charm]

Yeah, just makes me nervous because they can always scam up until the bug is paid out. An unpaid bug is worth $0

[muted olive]

and convincing

[deep ferry]

it is a bad thing though

[muted olive]

An unpaid bug is worth $0
words to live by

[deep ferry]

Security team which is not oriented towards security

[muted olive]

not necessarily

they understand how the code works and how the infra works

they just dont understand the security impact

once I explain it, it makes patching easier

[zealous charm]

I cant tell you the number of times I've fooled myself into thinking "ok Ive got $XXXX in unpaid bugs" only to get $YYY

[muted olive]

because they know exactly what they have to fix and how

[muted olive]

I think im getting $XXXX only to get $0

lol

[deep ferry]

because it's the job of yours

[gray wraith]

Trying to understand offensive sec sometimes feel like battlingvagainst shitty genetics

[muted olive]

Where do you hunt? @zealous charm

h1 or bc?

and what programs?

[deep ferry]

[muted olive]

because thats the hardest part for me

choosing

[deep ferry]

have you tried just dorking for random sites?

[muted olive]

yes and its very ineffective

most of them dont have BBPs

[deep ferry]

Alright

[muted olive]

I did get a few that way though

but mostly not worth it

or youll run into random german/chinese ec2 instances

[zealous charm]

I like BC. I looked a bit at a public gov program earlier this month and shut it down after sending a bunch of crits haha. Now I've moved onto a private web program and a private desktop app

[muted olive]

oo private 👀

I'm on one private program but not really found much

its very hardened

its electron based so there is a lot of holes but no way to reach :(

[zealous charm]

I sent 2 command injections bugs on this desktop app. Like file import -> click -> RCE and they were both downgraded to P2 by triage. idk what they expect for a desktop app, I feel like thats about as critical as it gets

[muted olive]

they want you to take over the internet

thats P1

[deep ferry]

Yeah

[muted olive]

but also thats wild...

nice hardening

[deep ferry]

The server explodes and kills all employees is P1

[zealous charm]

Hopefully the customer is cool and accepts it higher. For their threat model (and no exposed network services) this is about as good as it will get

[zealous charm]

a desktop app? Or web too?

[muted olive]

both

I'll dm

[mystic harbor]

[devout sail]

Epik fail

[novel oriole]

guys

i need some help

im done w network foundations section and im finally on skill assesment page

im not starting it yet .. after a revision ill do

but i dont understand one thing.. my htb labs access is denied and it says my account is sanctioned.. since day 1

i wanna know whyy is my account sanctioned????

and also does this assesment have to do anything w labs?

[molten bobcat]

No

Skill assessments are part of academy

[novel oriole]

can perform tasks on my own linux instead of the pwn box..? pwn box is slow as a sloth

[muted olive]

contact support

[molten bobcat]

Yes you can

[muted olive]

and, you can

[novel oriole]

btw is it due to my country?

[molten bobcat]

I use my own Kali

[molten bobcat]

Probably since you mentioned sanctions

[muted olive]

I doubt it

[novel oriole]

and what if i provide my national id card and university student card.. would that be enough?

[molten bobcat]

Htb is EU based

[muted olive]

I don't think he meant literal sanctions

[molten bobcat]

For the student subscription? Ye

[meager kernel]

finally completed a machine

[muted olive]

airtouch?

[meager kernel]

monitorsfour

[novel oriole]

i already got the student subscription.. but for some reason i cant access labs section since day 1 of account creation

Oops!
We’ve spotted a compliance issue with your account.

Your HTB account has been sanctioned.

You can’t access HTB because compliance requirements haven’t been met based on our
User Agreement policy
.

If this seems incorrect, review the required
documents
and send them to HTB.

[muted olive]

Ohkay

[molten bobcat]

Wild

[muted olive]

I think thats potentially a conflict with your student status that you need verified

[novel oriole]

but they gave me subscription based off my std account and i also verified it

[lime trout]

Nothing to do with student status.

[novel oriole]

nvm ill just send what they need for confirmation... student id card and national id card that should be enough

[muted olive]

Then?

[lime trout]

This is legal requirements by goverments to make sure we're not serving terrorists etc

[muted olive]

Ah

[novel oriole]

haha damnn

[muted olive]

Okay

[lime trout]

if you have the same name as someone nasty, we gotta make sure your not them

[novel oriole]

what to do ????

[lime trout]

Reach out to support, send them what they need

and we'll get you sorted

im not overly familar with the process tbh, beyond that it may take a minute as its handled by a very limited group of ppl internally due to the sensitivity

[novel oriole]

well tbh im annoyed asf .. but i cant blame htb.. its a fair action from their side if u consider the broader spectrum

[lime trout]

let me poke around and see if there is anything i can do

no guarantees, touchy process but ill see

[novel oriole]

[e-mail]

this one right?

[lime trout]

Yes, correct

[novel oriole]

ill send national id card and student id card

a live selfie would help or no need of that???

[lime trout]

doubt a selfie is needed

[novel oriole]

ok let me prepare a formal mail then ig and ty for help

[meager kernel]

why do i have a feeling that this has potentially happened before and it led to some legal issue?

has it happened before?

[lime trout]

happened before as in?

to my knowledge, we've never had any terrorists using our platform lol

[novel oriole]

am i gonna be jailed even before the start of my hacking career LOLLLLLLL?

[meager kernel]

some bad person used HTB and got in trouble and HTB had to answer to some police too

[lime trout]

but being a company operating in the EU/US, we are required to follow US & EU sanctions, which have liability laws that scare me.

you can search the lists yourself using tools like https://sanctionssearch.ofac.treas.gov/ for the US lists, and we have to make sure your not the person there

[meager kernel]

not terrorist like actual big ass terrorist
just criminals

[novel oriole]

this has to be normal for people in my region i literally cant access labs since the account creation day

[opaque flume]

hey hello there

[devout sail]

Goals 😎

[opaque flume]

Death is the end of all things, and madness is an eternal melody. >> like this

[lime trout]

you do not want to be on here.

It'll block you from using VISA/MC as an example

issued by any bank

[devout sail]

😔

[lime trout]

even just sharing a name with someone on it creates headaches

[devout sail]

Okk, i was joking, if anyone here is hunting bug on that site
DO NOT use my name to test

Golam would edit the source to troll i guess

[sturdy thistle]

NAP time

[devout sail]

What protocol is that

[obtuse fern]

Wasn't there someone last year that had a similar problem?

This sounds like a #modules question, it also helps to provide module name and section name

[lime trout]

there is a decent non-zero amount of people who experience this

[novel oriole]

i have sent the images to prove my identity to the support's mail

is it enough or do i have to consult someone else as well?

[dull meteor]

I can't spawn pwnbox anyone knows why?

There are no instances available. Please try again later

[obtuse fern]

I ate all the infrastructure bandwidth

[molten bobcat]

Nomnom

[obtuse fern]

Cloud

My framework comes today

:3

It said delayed, but those bastards lied

https://tenor.com/view/richard-benjamin-harrison-pawn-stars-talk-bastards-those-bastard-lied-to-me-gif-17564603