general

[sturdy thistle]

@scenic maple

check my site - added a start page

[supple plume]

I see

The iq of the temperature of the room

[cloud osprey]

@sturdy thistle want to see the big shark tooth i found this weekend at the beach?

[sturdy thistle]

oh yeah sure

[alpine pumice]

dammit paint

[cloud osprey]

new record worlds largest

[sturdy thistle]

noice

[cloud osprey]

thats all of the ones i found

[sturdy thistle]

poor shark

without teeth now

[cloud osprey]

poor shark rich paint

[sturdy thistle]

aight bed time

ikea tomorrow

[cloud osprey]

meatballs

[scenic maple]

looks good

[austere sinew]

nu uh

stay up

no choice

@sturdy thistle

[austere sinew]

(i am attempting to make sure youre too sleep deprived to make your way out of the ikea maze) @sturdy thistle

[austere sinew]

i missed these guys...

[cloud osprey]

yare yare

[austere sinew]

AN UNSTOPPABLE YOUNG LADY

i remember when every asian was fighting to be like THEYRE NOT FROM US BLAME THE OTHER COUNTRY

peak times

[sturdy thistle]

Eating some nuts now and watch Netflix

[austere sinew]

hell yeeeee 🔥

[austere sinew]

i've been binging final space recently

[ocean marsh]

trying some cachyOS here

[lunar kindle]

can any body get this xss in here ?

function check($input) {
    $whitelist = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789;"/';
    $result = '';
    $len = strlen($input);

    if(str_contains($input, '<')){
        return false;
    }
    if(substr_count($input, '"') > 1){
        return false;
    }

    
    for ($i = 0; $i < $len; $i++) {
        $char = $input[$i];

        if (strpos($whitelist, $char) !== false) {
            $result .= $char;
        }
        else {
            return false;
        }

        if ($char === '/' && isset($input[$i+1]) && $input[$i+1] === '/') {
            if (strpos($result, '"') !== false) {
                break;
            }
            $result .= '//';
            $i++; 
        }
    }

    return $result;
}




function remove_all_whitespace(string $s): string {
    return preg_replace('/[\p{Z}\p{C}\s]+/u', '', $s);
}



$name = remove_all_whitespace($_GET['name'] ?? "Guest");

if (!check($name)) {
    $name = "Guest";
}

?>


<h3 id="welcome"></h3>
<script>
document.getElementById("welcome").innerText = "Welcome, <?=$name?>";
</script>

[sturdy thistle]

Wall of text

[ocean marsh]

fluff reference

[supple plume]

Why do you do this to me I'm with my phone here

[late sleet]

https://klipy.com/gifs/read-23

[lunar kindle]

xD

[austere sinew]

where is this from? 🤨

[sturdy thistle]

Same

[lunar kindle]

a local ctf in my country

[supple plume]

I believe there could be some client side template injection that leads to xss

But I'm with my phone

Check throughly the $name variable

[lunar kindle]

but the whitelist only allows the normal chars and ;/ and a one "

[sturdy thistle]

Wouldn’t it be cheating if we solve it for you

[ocean marsh]

cant you bypass some blacklisting of characters?

[cloud osprey]

cant even use proper syntax highlighting in discord, you get no help from me

[supple plume]

Idk please don't tease me with this questions it's after midnight and this keeps my brain turned on 😩

[lunar kindle]

it's just for edu like these kind of challs https://x.com/AmirMSafari/status/2020569860472750512?s=20

just the alert will be the solve there is no flag in it

[sturdy thistle]

Still

Imo if you can’t solve it and ask for someone else it’s cheating

[scenic maple]

we dont want to solve it for you
we want you to solve it yourself

lookup xss filter bypass guides specially portswigger and payload all the things

[lunar kindle]

my point is it's not a competition it's just a chall someone dropped and the writeup for it will be there tomorrow so if i did solve it or not i will not get any benefit but knowledge

[austere sinew]

so then wait for the writeup if you cant figure it out, golam gave you a pretty good idea on where to research

[sturdy thistle]

Or wait until the writeup was published

[lunar kindle]

chill guys you're right i know, it's just the chall tickled my brain so i was wondering if any of you have the way

[scenic maple]

then start tickling the challenge not us bro 😩

[sturdy thistle]

I watch Netflix

Solve it on your own

[austere sinew]

enjoy mick

[supple plume]

Now I feel the urge to turn my pc on and solve it

[sturdy thistle]

No

[austere sinew]

NO ECHOES

BAD

[sturdy thistle]

Or I get you banned

[austere sinew]

golam helped plenty

they told them where to look

horse water drink

[supple plume]

I need to start watching something to fall asleep to

Too much coffee today

[austere sinew]

ask mick what he's watching

ezpz

[supple plume]

I watch something specific at night

[austere sinew]

this sounds

[supple plume]

No

[lunar kindle]

one last question don't you think the hint lookup xss filter bypass guides specially portswigger and payload all the things is really broad like it's a custom filter no something famous

[supple plume]

It's not what you think

[scenic maple]

read this https://owasp.org/www-project-application-security-verification-standard/

[supple plume]

I just dont know how to say it correctly in English

[austere sinew]

all filters are gonna be custom, and have you done what he said yet?

tinker around see what works

[scenic maple]

but if i tell you exactly what to do then its the same a giving you the writeup
what you need to lookup is

• what chars can you write
• what chars cant you write
• then from the stuff i mentioned look up the payloads that you can use based on step1 and step2

[sturdy thistle]

Im watching superstore

[supple plume]

I usually warch youtube channels that narrate some fictional niche creepy pastas

[lunar kindle]

valid point tbh

[lunar kindle]

okay thanks alot mate have a good night

[rancid snow]

Ive tried nothing and its not working!!

[scenic maple]

reddit story reading bot

[supple plume]

I used to do that but tbh most are lame

[scenic maple]

I came here to hack, not read ~ cinzinga 2025

BC top 10 btw

[supple plume]

CHINGA

Best name ever

[austere sinew]

aita for stealing my neighbour's cat after he abused my hamster's favourite comfort character?

[supple plume]

Next cat aill name it thingthinga

[scenic maple]

get a bigger cat so you can protecc

[cloud osprey]

what you need is a capybara

[iron galleon]

please paint me blue

[supple plume]

What you need is g0blin beard

[lunar kindle]

i wassss asking for a hinttt not the straight solverrrr chillllll

[iron galleon]

i just want to be covered in blue paint

[warped plank]

If you spent the same amount of effort in just trying to solve the challenge as you did asking for a hint in here then you would've solved the challenge by now

[vital heron]

How long has HackTheBox been around for?

The actual website.

[supple plume]

Before you were even a thought

[vital heron]

I doubt its that old but yes

[supple plume]

But yes

[lunar kindle]

got you're point but trust me it's not that simple or at least for me
like what do you mean how can i get xss with no . or ` or () or " or '

[iron galleon]

When is Hack The Box the movie coming out?

[ocean marsh]

Just search for blacklsited char bypass

try it

[supple plume]

Idk but we can gather some weirdos here with a camera quickly

[ocean marsh]

Keep trying and researching

[cloud osprey]

literally paste the chal in chatgpt and be like, "help pls"

[scenic maple]

wait i seeo now lol

its innerText

[warped plank]

bro could've asked the same question in google or chatGPT or LLMs

[scenic maple]

there is no xss

[supple plume]

What about what I mentioned?

[scenic maple]

unless u get out of string

[cloud osprey]

my favorite is when somebody at work would come up and ask a question, and the first thing i do is google it right in front of them

[scenic maple]

what did u say

[supple plume]

.

[lunar kindle]

i did but literlly told me there is no bypass for it xD

[scenic maple]

hmm could be

[lunar kindle]

no { or < or %

[warped plank]

I'll just try to suggest the most complicated method possible.

@lunar kindle stop lying and start using hex-strings \x00

[lunar kindle]

.

[molten bobcat]

Goooooood evening

[cerulean knoll]

Yooo chat my portswigger lab just solved itself 😂

[dense turtle]

This way it’s way too hard focus on the modules, you guys are funny

[cloud osprey]

i google then click first link, and if it answers their question i chastise them

[scenic maple]

did u lookup burp xss cheatsheet as i said? and payload all the things

[rancid snow]

which challenge is it

[molten bobcat]

I'll be less funny from now on sorry

[lunar kindle]

i swear i did

[scenic maple]

sometimes its a get request solve
so if you were fuzzing or let burp ai do it its possible

[warped plank]

why you lyin?

[molten bobcat]

Or you can just

[austere sinew]

guys

[molten bobcat]

Say the name of the challenge

[austere sinew]

the writeup is tomorrow

[molten bobcat]

Instead of pasting it here lmao

[austere sinew]

let's just let them wait

[supple plume]

Its going to be what I said

[ocean marsh]

OSCP wolo 🤔

[austere sinew]

youve said where to look

[austere sinew]

it is 12.19

hush

[rancid snow]

damn you have the whole source code and havnt solved it?

[austere sinew]

youre right but hush

[lunar kindle]

it's inline script

<h3 id="welcome"></h3>
<script>
document.getElementById("welcome").innerText = "Welcome, ";heremate//";
</script>

[ocean marsh]

wth does that mean

[supple plume]

Its 1 hour later in spain

[austere sinew]

rip

[austere sinew]

no oscp at this time of night

[supple plume]

All good im unemployed

[molten bobcat]

I'm on break from work

[austere sinew]

mood

[ocean marsh]

Oh I see

get some good sleep later on wolo

[lunar kindle]

i said i will what some just askedddd

[ocean marsh]

yk it helps a lot

[warped plank]

bro just ask chatGPT it's literally giving the right answers

[iron galleon]

When's Hack The Box the movie coming out

[supple plume]

I know how to.solve it

[ocean marsh]

wes anderson is currently taking care of the stopmotion

dw

[supple plume]

I just realized

[austere sinew]

see it's the way that you asked which threw everyone off, you didnt mention what you tried, you didnt search up what the others said, and the way you were like what xss works would have given up the whole challenge. there wasnt a lot of effort on your end which is why everyone is reacting the way they're reacting

[lunar kindle]

````I've confirmed the filter bypass (// early break, $name retains full input, // in JS comments trailing ";). That part I fully understand. It's the execution of the actual cookie theft with the restricted charset that I cannot figure out. 🙏```

cluade

[iron galleon]

bro the movie is gonna be so good

[cerulean knoll]

Naa this is different.
I was working on the bypassing 2FA authentication lab.
I accessed the lab and was just messing around trying to find something interesting. I'd create an account login and move from page to page then log back out.
After about 2 mins of messing around I get hit with the Congratulation lab solved message.

I was confused and thought the lab was broken. So I closed the browser and started the lab again and it was still there.

So I checked the solution and apparently what I called messing around was actually the way to solving the lab 😂😂

[rancid snow]

pasted the code in base free gemini and got exact payload too lol

[supple plume]

I know how to do it

[ocean marsh]

some ban c1oud

[supple plume]

https://tenor.com/view/made-by-clown-gif-4428586269206149108

And I decided to gatekeep it

[ocean marsh]

https://klipy.com/gifs/cat-cats-150

[warped plank]

You do realize he can technically claim a mod role if he wanted to...

[lunar kindle]

i don't have to prove it to you but i have spent like 3 hours on it really trying and again i said i will wait why are you taking it personal guysss

[rancid snow]

You actually do have to prove it when youre looking for assistance

[supple plume]

I took a look with my phone for 4 minutes and I figure it out

No gpt

[ocean marsh]

I also realized I made a joke

[lunar kindle]

will i guess i have to study more client side

[warped plank]

Also it's not HTB anyway so we aren't allowed to help

[supple plume]

It helps

[west lynx]

No hints are allowed for the duration of the event. Once the event is over, feel free to share solutions.

[warped plank]

Y'all should really start making your jokes clearer, it's really hard to convey tone in text, this is why when I joke I always end in a laughing emoji

[iron galleon]

context clues

[ocean marsh]

mb

[rancid snow]

how to ask for help:

1. Describe problem
2. Describe steps done to solve it.
3. Describe roadblocks
4. Describe how youve tried to get around roadblocks.

When you receive help:

5. Describe how you implemented the help
6. Describe what results you got vs what you expected.
7. Correlate new data with the roadblocks. Did new roadblocks arrive? Old ones change?
8. Repeat from step 1

[sturdy thistle]

Too complicated

Just and over and over the same question

Kiss

[ocean marsh]

tf

[sturdy thistle]

Im putting my phone away

[warped plank]

Personally I just: Gimme answer in exchange for k-pop baddie gifs

[sturdy thistle]

Or I yap more

[ocean marsh]

dude has a chat only for himself in OSI

[austere sinew]

nait nait @sturdy thistle

[supple plume]

https://stackoverflow.com/help/how-to-ask

[warped plank]

They removed it, so now it's everywhere

[sturdy thistle]

Ah that ping

[ocean marsh]

lmfaooo poor guys

[rancid snow]

Also interestingly, the above is also an effective strategy when trying to get AI to help you too. Just verify as always.

[warped plank]

Nahh they asking for it

[sturdy thistle]

Almost thought u say like stay here

[supple plume]

Just replying to ceald 1 year ago

[supple plume]

When do we pin something like this

A bot command would be best

[supple plume]

My first pin

[ocean marsh]

why is that arm so strong

dude has premium emojis

[austere sinew]

Im laughing at the pins

[warped plank]

Just saw my message that was pinned...

who tf pinned that?

[ocean marsh]

lmfaoooo

omg

[scenic maple]

hmmm i tried it now its actually easy

got js execution without asking ai

[supple plume]

Aright time to sleep

[sturdy thistle]

🍿

[scenic maple]

but what now

[supple plume]

Now you spent the night awake

[sturdy thistle]

Now u explain me how u did it

[supple plume]

Gatekeep it

[scenic maple]

escape the string

[sturdy thistle]

That looked weird

[ocean marsh]

sleeping like he pays the bills

bruhhh

[rancid snow]

preferably in the form of a spoon in my mouth

[supple plume]

I'll get to see my cat next week

[scenic maple]

https://tenor.com/view/humm-miam-gif-7752014409153192480

[ocean marsh]

same bro

[scenic maple]

does he want to see u tho

[supple plume]

This is my cat

[ocean marsh]

he a jojo char

[supple plume]

No

[ocean marsh]

https://klipy.com/gifs/jojos-bizarre-adventure-jojos-bizarre-adventure-diu

[sturdy thistle]

Ai cat

[supple plume]

Based of my real cat

[ocean marsh]

nah bro he's real

he looks like that

[sturdy thistle]

Man

I put my phone away

Don’t ping @austere sinew

[supple plume]

Same

[sturdy thistle]

Busy sleeping

[ocean marsh]

echoes

wait

[supple plume]

Same @austere sinew

[supple plume]

Quick

[austere sinew]

WHAT

[sturdy thistle]

I wanna k ow

[austere sinew]

STOP PINGING ME PEOPLE

[sturdy thistle]

Quickly

[austere sinew]

what

[sturdy thistle]

Ok

[austere sinew]

ok

say

SAY

WHAT IS IT

[supple plume]

[sturdy thistle]

Say it

[austere sinew]

.

.

.

[sturdy thistle]

Got ya

[austere sinew]

SAY WHHAAAAAAT

[ocean marsh]

take a look

[austere sinew]

.

.

[supple plume]

Got em

[austere sinew]

right

[sturdy thistle]

What what

[austere sinew]

both of you

[sturdy thistle]

What

[ocean marsh]

my evil cat

[austere sinew]

im just gonna

fight you

both

keep in mind

[sturdy thistle]

Ok

[molten bobcat]

Howdy hey are fighting now

[austere sinew]

both of you are a plane ticket away

[sturdy thistle]

Try

[austere sinew]

i shall have this information used maliciously

[sturdy thistle]

Invite me to fight ya

[pale belfry]

Hellen Keller was not real

[scenic maple]

i need to visit china

[austere sinew]

i can make my way to germany and spain

[supple plume]

Vro despawn

[austere sinew]

i am in prime location to torture you both

[sturdy thistle]

Or we come to you

[austere sinew]

even better

[ocean marsh]

just ban wolo already

[sturdy thistle]

Ryan will protect me

[austere sinew]

a fight in my homeland

[molten bobcat]

Oh this antisemitic asshole still here lol

[sturdy thistle]

(Hopefully)

[austere sinew]

shut it

[scenic maple]

but u arent fish

[pale belfry]

Who is antisematic

[austere sinew]

i will just

uh

i dont have a threat

[sturdy thistle]

What

[austere sinew]

but no one can save you

[austere sinew]

planes

[sturdy thistle]

I can

[pale belfry]

Somebody said “this antisematic asshole is still here”

[supple plume]

It must have been the wind

[sturdy thistle]

You are a plane?

[molten bobcat]

Who knows

[scenic maple]

wdym where?

[austere sinew]

i can be

i can learn how to fly

nyoom

[sturdy thistle]

On the ground

To the floor

Hit the floor

[supple plume]

Npc walks away with arrow in buttcheek (skirim ref)

[sturdy thistle]

My English sucks

[molten bobcat]

My German sucks

[pale belfry]

Learn Hebrew

[molten bobcat]

I think it's funny, how you think you're being clever.

[pale belfry]

Yeah? What about it?

Somebody has to be the best

[sturdy thistle]

[austere sinew]

guys does yall hear something

[sturdy thistle]

Are the best

[molten bobcat]

True

[ocean marsh]

nah bro

[sturdy thistle]

I can hear my tv

[ocean marsh]

keep it to yourself

dw

[austere sinew]

it sounds like

a failed troll who never got much love as a kid

[sturdy thistle]

[austere sinew]

either that or the wind

[pale belfry]

Is this the silent punishment?

[sturdy thistle]

Oh

True

[pale belfry]

For expressing my opinion?

[sturdy thistle]

Wind it is

[molten bobcat]

I had chicken salad for dinner

[austere sinew]

yummy

[sturdy thistle]

Nice

Took picture?

[austere sinew]

i had souvlaki

[molten bobcat]

Nah we ordered it I didn't make this one haha

[austere sinew]

wasnt that good though

[sturdy thistle]

Did u took pics?

[molten bobcat]

I don't take pictures of food I didn't cook myself

[dense turtle]

Guys, how can I learn how to hide ptrace?

[scenic maple]

sometimes i wonder how blind people are happy sometimes i dont cause they dont have to read chat

[molten bobcat]

Blind people touch grass more than us

[scenic maple]

true

[ocean marsh]

W ALBUM

[austere sinew]

WDYM ALBUM

damn it's so windy today

[sturdy thistle]

Bro

[ocean marsh]

BRUHHHHHH

[molten bobcat]

This guy doesn't know what an IP address is lol

[sturdy thistle]

Shut up, thanks

[sturdy thistle]

@pale belfry

[ocean marsh]

@austere sinew

good album

[pale belfry]

What the hell did I do? I’m a paying member of this community

[austere sinew]

souvlaki is a food you dingus

[zealous charm]

All I know is it burns when I P

[ocean marsh]

yk bro, just introducing you to some peak

[austere sinew]

i audibly cackled

[molten bobcat]

You can pay however much money you want that doesn't make you immune to the server rules

[sturdy thistle]

^

[pale belfry]

What rule did I break? Did I say something offensive?

[austere sinew]

guys the wind is smelling like poop

full of it actually

[molten bobcat]

Following moderator instruction is a server rule

He asked you to shut up

Because every message of yours so far has been a troll

Engage with the community honestly or get the fuck out lol

[pale belfry]

I offered help for CPTS

I am

[austere sinew]

cloud when are you gonna apply to be a mod

[sturdy thistle]

You that this is cheating

[molten bobcat]

I already was

[austere sinew]

sigh

[sturdy thistle]

And I hope you get punished

[pale belfry]

No… for studying

[molten bobcat]

People got very very pissed off that I enforced the rules lol

[austere sinew]

idk i woulda banned "theadmin" by now...

[pale belfry]

Help somebody study for CPTS is not against the CPTS rules

[sturdy thistle]

You didn’t say that

[supple plume]

If I was a mod I would be a bad one

[sturdy thistle]

So keep your trolling away

[austere sinew]

real

[ocean marsh]

you used to be a bad one in chaos

[sturdy thistle]

I'd appreciate it

[ocean marsh]

dictator wolo

[pale belfry]

I feel like everybody is attacking me for nothing

[austere sinew]

the second i stopped modding there the server became 4channy and everyone was too uncomfortable to type there

i wasnt the problem in that server

[ocean marsh]

DUDE IM KIDDING

😿

[molten bobcat]

I'm not a fan of the antisemitic dog whistle comments either

Like "Hellen Keller isn't real"

[pale belfry]

That’s not antisemitic

[molten bobcat]

All of these excuses are paper thin and so is your personality

[pale belfry]

Damn this is cyber bullying

[molten bobcat]

Hardly

[pale belfry]

I am trying to move on and you guys keep causing fights

Why can’t we all live in peace

[molten bobcat]

If you think someone saying you suck on the internet is "fights" you're mistaken lol

[sturdy thistle]

Just stick to rules

[molten bobcat]

Change yourself for the better

[sturdy thistle]

Or someone will remove you from the server eventually

[manic anvil]

thats why its called cybersecurity

[molten bobcat]

One more hour left of work

Also.. bleh. I've been chosen by management

[pale belfry]

I want to work at an MSP for the rest of my life

[lime trout]

https://quack.pics/u/53089dfb-4b43-4e7d-baa6-66d49776e243.png

[molten bobcat]

I do indeed need a mentor

[pale belfry]

1 month ago I went on a rant to assert my dominance. It clearly worked

Everybody remembers me as the best hacker in here

[sturdy thistle]

Well

[austere sinew]

clearly worked in a fast ticket to the white padded room

[manic anvil]

choose cyber mentor you will get more emails than your family everyday

[molten bobcat]

You're currently remembered as a "douche" so sure it made an impression alright

[sturdy thistle]

The hard truth is that you are just annoying us

[supple plume]

You wouldn't be the best even if you were alone in the world

[pale belfry]

Everybody enough bickering

What is everybody’s favorite color

[obtuse fern]

mentor deez

[obtuse fern]

hi cloud how are you?

[molten bobcat]

I'm alright

[sturdy thistle]

@austere sinew rescue me

[molten bobcat]

Having my tea and a smoke

Waiting on the shift to end

[austere sinew]

run away....

RUUUUNNNNN

[sturdy thistle]

I can’t run in bed

Would be awkward

[austere sinew]

THROW THE DAMN PHONEEEE

[supple plume]

Run harder

[sturdy thistle]

Poor iPhone

[austere sinew]

[sturdy thistle]

Okay bye

[austere sinew]

gngn mick

[supple plume]

Cya chat

[terse dirge]

better late than never I guess

[sturdy thistle]

Im staring at my phone

[terse dirge]

finally got like half of my CI CD pipeline in gitea actions workin

[terse dirge]

I now need to get a working templating engine for helm charts for these docker images

[sturdy thistle]

Fine

Bye

Enough staring

[elder inlet]

@terse dirge GET BACK IN YOUR CAGE!

@austere sinew Why'd you let Ceald out?!

[terse dirge]

Noooo

[elder inlet]

https://tenor.com/view/dean-winchester-dean-winche-go-to-the-cage-jesens-go-to-the-cage-gif-24508065

[gloomy yoke]

yurrr

im knew here

obviously

[west lynx]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[terse dirge]

@gloomy yoke

[heavy oak]

You from the East coast?

[dire plaza]

thats hard

[manic anvil]

so the company that supposed to handle the discord ID scanning got hacked?

[iron galleon]

mb

[warm lava]

The only ranked points we get came from seasonal machines right?
I mean, a seasonal machine after a week its just a normal machine and dont grant any points

[muted olive]

yes

yes

the logic is hard to understand tbh

[lofty warren]

gm everyonee

[austere sinew]

I cannot contain the ceald...

[ionic berry]

sup

so basically

[warm lava]

Interesting, so i'm changing my focus on machines since i'm taking many days to finish a bo

work 3 shifts and try ctf it's just sad lol

i'll def go back to vip

[dense turtle]

hostname
htb-hnoob6uhd2

[dense turtle]

why does it have noob ? 🤡😭

[warm lava]

yoru rank

[dense turtle]

nah this is bullying

[warm lava]

lol

[dense turtle]

😂

[warm lava]

script kiddie isnt so walcoming also

[dense turtle]

is what comes after the noob?

[warm lava]

it's whats expecting you

i'll try to finish wingdata today for a better role lol

[dense turtle]

bruh

[wooden jacinth]

welcome

[warped plank]

Literally just do an active box, ez script kiddie rank.

[warm lava]

bro saying that like it was nothing

[iron galleon]

buss down thotiana

[warped plank]

Well after 24 hours of a box release you can just ask for hints on it...

[dense turtle]

thank you x)

where do u see classifications ? i just saw tiers

[wooden jacinth]

idk, im focus on get better, not worry about ranges

[warm lava]

click on season 10 -> leaderboards

i think the rank system it's pretty cool to get motivated on the learning process

[warped plank]

Season rank != platform rank btw. Season ranks are the bronze, silver, etc. platform rank is noob, script kiddie, hacker etc.

[dense turtle]

thanks guys

[warm lava]

oh i remember sawing that on the htb post's on faq i guess

[elder inlet]

https://tenor.com/view/shia-motivation-gif-13565052

@austere sinew

[muted olive]

@austere sinew

[dense turtle]

Do the exams have an expiration date, or are they lifetime certifications?

[gaunt gale]

I believe they are lifetime

at least for HTB certs

[dense turtle]

bruh

    link/none
    inet 10.10.15.46/23 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 dead:beef:2::112c/64 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::a48d:e468:643:443d/64 scope link stable-privacy
       valid_lft forever preferred_lft forever
alienware@pop-os:~$ whoami
alienware
alienware@pop-os:~$```

[gaunt gale]

nice

[dense turtle]

you can make fun of me

😂

[gaunt gale]

honestly, my linux box is named windows

as a joke

[dense turtle]

lmao

[gaunt gale]

so you should be making fun of me

but whatever

[dense turtle]

The funny part is that I was expecting it to show something like noob@parrot lol

[gaunt gale]

that's ok

[molten bobcat]

If you need any advice just ask

[gaunt gale]

I would be fine if a box was noob at parrot

like who cares

linux users give non-serious names to their device all the time

who fucking cares

[dense turtle]

I think I wasn’t clear in what I said, I was trying to connect to the Pwnbox, but I had only connected to the VPN lol.

[ornate ibex]

https://lichess.org/YnYpLsiHzHWx

[dense turtle]

time to play cs2 and then finally go sleep

[ionic berry]

do u play cod

[dense turtle]

what is cod?

[ionic berry]

Call of duty

https://tenor.com/view/cs-go-gif-13721675797957922733

[dense turtle]

nope, used to play fortnite, but since on linux switched to cs

crazy how many cheaters in cs2

[tired sleet]

I'm having trouble accessing any web servers on my kali vm in the CTFs. Everything else works perfectly fine, I am able to pull headers with curl, I add the hostname to /etc/hosts, but I am unable to actually access the port 80 webserver on firefox itself

[rapid swallow]

https://klipy.com/gifs/luffy4k-60fps

[frozen zinc]

How started:

How is going:

[quick verge]

What is it

[frozen zinc]

Could be a favicon

[quick verge]

An icon?

[frozen zinc]

for example

[quick verge]

What application are you using to create it?

[frozen zinc]

gimp

[quick verge]

Ok thanks

[dense turtle]

things that ia cant do 193389129012142

[mighty scroll]

Hi HTB team, is there any issues going on with spawning machines??

I have to keep on changing the servers to get the machine spawned

[rugged dune]

lemme try for u buddy

which machine u trying to spawn ?

[mighty scroll]

I am facing this issue from last day

[rugged dune]

send me link

u mean it's with all machines , or a specific one ?

[mighty scroll]

It’s with all modules

Specifically Active Directory module

[rugged dune]

ah on academy?

i ll test now

[mighty scroll]

Yup on academy

[rugged dune]

give me a sec

[mighty scroll]

I have to wait for like 30 mins and then change the servers to other locations

[rugged dune]

which server you are on

am spawning one now let me check how much it takes

[mighty scroll]

On EU4

[cerulean bloom]

@scenic maple codeforces has been hacked

[mighty scroll]

Then i have to change to US 1-4

[rugged dune]

ngl it also always takes some time for me but not that long

[scenic maple]

Full compromise?

Shiiiiiiiit

[cerulean bloom]

maybe

it is definitely not good

[mighty scroll]

Past days it was seamlessly working. From last day I don’t know what happened

[cerulean bloom]

they told everyone NOT to submit any code until it gets resolved

[mighty scroll]

I never had that issue in academy before.

[scenic maple]

Source?

[cerulean bloom]

they posted an announcement (as a popup) for everyone

u can go to the site and see actually

[scenic maple]

Dang i missed it

[cerulean bloom]

u can still check it lol

[rugged dune]

@ornate ibex maybe can help

[cerulean bloom]

it pops up

[mighty scroll]

Mostly on eu servers i am having issues

[scenic maple]

How tho

I went on mobile nothing yet

[cerulean bloom]

just go to the site

[cerulean bloom]

huh

weird

[rugged dune]

i tested with UK took 5 min to spawn

[cerulean bloom]

I went to the site on mobile just now, immediately popped up

[scenic maple]

Maybe cause i am not loggedin

[rugged dune]

servers on academy are pretty slow and hell sometimes i have same issues and reported it before specially when they give u a jump kali lol nightmare ..

[cerulean bloom]

ohhh

maybe

[mighty scroll]

Really. I don’t know what the issue. It takes eternity for me to spawn machines.

[scenic maple]

Nope went on pc still cantvsee

[cerulean bloom]

but here’s the thing, a new blog post came out

[scenic maple]

Can u show me urs

[cerulean bloom]

uhh

[scenic maple]

Gib link

[cerulean bloom]

I closed it lol

[mighty scroll]

Yeah servers are sometimes super slow

[cerulean bloom]

its a popup

let me send ss

but someone says that they were the ones to send this message, not codeforces

but most likely just a troller lol

[scenic maple]

[rugged dune]

I mentioned tejas he might look into it

[cerulean bloom]

well, u can still do CSES lol

[rugged dune]

but what i usually do is i always check if there is a lab in the end of the module and spawn it directly before reading when i finish reading i find it spawned lol

[mighty scroll]

I am doing that same way. But after finishing the content my status is still on spawning target

🤣🤣

[tired sleet]

nvm i fixed it

[rugged dune]

i tested now with eu & uk and it takes less than 5 mins

[rugged dune]

that weird because for me it didn't take that long

[mighty scroll]

Still for me it’s taking a while .. 🥺

[rugged dune]

am on EU 6 UDP

[mighty scroll]

Let me check on that server

[cerulean bloom]

@scenic maple new announcement lol

[mighty scroll]

For now it's working fine on that Server. Not sure what was the issue..

[scenic maple]

i dunno i just dont see

[rugged dune]

Maybe tcp

[cerulean bloom]

weird

[mighty scroll]

I always on UDP

[supple rain]

hi all

[hard oracle]

hello, is there and admin or moderator here? i would like to open a ticket concerning an issues i found in the academy

[hard oracle]

hey man, sorry for the ping, can i DM you or can you tell me how to open a ticket about the issue i'm talking about in my previous message? thanks in advance

[scenic maple]

Sure

[bronze lion]

U killed the chat ⁨@scenic maple⁩

[green kite]

Again?!

[bronze lion]

Ye

[green kite]

🍨 for all who chat

[molten bobcat]

I'm fixing my report

[bronze lion]

[green kite]

A bit of tlc

Sprinkle of screenshots

[bronze lion]

Have fun

[molten bobcat]

It ain't too bad

Just takes some time and love

[green kite]

You got this

[molten bobcat]

Of which I have plenty

[green kite]

1.5yo is pretending he’s on a phone with an electric BPmonitor

[muted olive]

[smoky agate]

Hey guys, I create a simple Bash script to automate setting up Neovim and Tmux in Debian based systems. This is the X post: https://x.com/r0m3o_101/status/2025099498419356105?s=20 Try it and share your thoughts

[rapid badger]

Setting up nvim and tmux for me ? Thats too intimate bro

[smoky agate]

Just sharing my automation script in case it helps someone. No pressure.

[sonic blaze]

Do some people not want to work in cyber security or IT but want to do bug bounty hunting as a side thing ?

[obtuse fern]

yes

[green kite]

That’s me

Although I’m slowly leaning into dipping my toes in it

[sonic blaze]

You do bug bounty hunting?

[unborn wharf]

Does it take time on weekends for support to respond?

[green kite]

I do from time to time

[green kite]

Yes, support is less staffed during weekend

[molten bobcat]

Half my report is done now

[green kite]

yay!

how long have you got to submit?

[molten bobcat]

7 days

[green kite]

you got this boo

[molten bobcat]

Only reason I'm stopping is because it's 3 am and I need sleep lol

[green kite]

yeah 😄

good night C1oudy

[static burrow]

why does comtia think insiders are a bigger threat than phising when it comes to intellectual property

this whole cert feels like a joke

[supple plume]

Morning

[static burrow]

morning

[supple plume]

@mystic harbor

[minor loom]

box the hack

let's defend should be renamed to box the hack like mitigate the hack but hack the box

[supple plume]

@mystic harbor

[copper geyser]

[bronze lion]

What are u talking abt bro

[green arrow]

Hello how to access the subscription page I would like to subscribe as an individual and not a company

[bronze lion]

Academy or labs?

In labs just press plans and billing

[obtuse fern]

the /billing endpoint on both platforms

[bronze lion]

U should be able to see vip+

[green arrow]

i dont no. i have see the plan in https://help.hackthebox.com/fr/articles/7257535-abonnements-plateforme-principale

[obtuse fern]

sorry it may have changed endpoints

it's /vip for app.hackthebox.com

[obtuse fern]

this doesn't answer the question...

[bronze lion]

https://app.hackthebox.com/vip

[obtuse fern]

there are multiple different subscriptions:
Academy has the monthly and yearly plans
Main Platform (Labs) has VIP+ and ProLabs

VIP has been removed, it is only VIP+ now, they dropped VIP a while ago

[bronze lion]

Ye

[obtuse fern]

that article is from 2 years ago

[green arrow]

Thanks when I logged in, I was always on the account page

[bronze lion]

Wdym? Did u get what u were looking for now or?

[obtuse fern]

#📣-announcements message

[obtuse fern]

they were on https://account.hackthebox.com instead of the labs or academy platform

[bronze lion]

Oh ok got it

[green arrow]

When I went to any page I was not logged in every time and it put on the account page the link you gave me to go to the app and directly connected that's why I couldn't find it I didn't know the URL by heart and I couldn't access it via the links

[bronze lion]

Ok were u able to do it now after logging in tho?

[minor loom]

about talking the talking about about

[green arrow]

When I clicked on your link I was already log

[supple plume]

What does 'hs" mean in hs.hackthebox.com

You have 20 seconds to answer

[upbeat tangle]

DANCE!

BOOGIE WONDERLAND

[green arrow]

Yes

[upbeat tangle]

@austere sinew happy Bir... nvm

[austere sinew]

WHY DID YOU STILL PING IF THERE WAS A NEVERMIND THERE

[upbeat tangle]

[lyric robin]

how do i increase these points

[supple plume]

Hacking active content

[lyric robin]

retired doesn't count right

because i remember it increasing whn i did retired

[supple plume]

You probably misunderstood, it doesnt count. There is a link on htb if you search on google introduction to points. Find the htb website link it explains it very well

[muted olive]

@austere sinew happy 51st day of the year day

[austere sinew]

@muted olive WHYYY

[muted olive]

@austere sinew idk

[austere sinew]

@muted olive quit

[muted olive]

@austere sinew ok

[austere sinew]

@muted olive like rn

[muted olive]

@austere sinew ok sure

[austere sinew]

@muted olive stop pinging

@muted olive do not respond to this message

[muted olive]

@austere sinew acknowledged 👍

[supple plume]

wth

[sturdy thistle]

What do i see

And morning

[mystic harbor]

@iron galleon

[wild tusk]

do you need to find the login page of worpress inorder to do RCE

[upbeat tangle]

I think more context is needed to answer this question

[wild tusk]

one of the machines ask is wordpress and it says i need to find username but i cant find a login in page so what is the point of lookin for username if i cant login in and its rce machine web

[upbeat tangle]

You need to think here what kind of tools are available to you in order to find where the login page may be located.

[wild tusk]

well i tried everything looking for hidden vhost subdomains directories but still there is no login in page for the wordpress they have hidden it i think but cant find it

[south nova]

How do i know which things to memorise and which to just take notes of?

[left atlas]

hi there where should i start learning in hacking ?

[wild tusk]

try htb academy

or tryhackme

[left atlas]

hello there sir are you already an experienced hacker?

[south nova]

I’m in the file transfer module. i’m seeing a lot of practical stuff like commands and tools and i find it very hard to memorise even a bit of them. So i just take notes of the tools and example commands of them and just keep in mind that there are many ways to transfer files that differ in operating system and in internet protocols.

[minor loom]

@cerulean bloom Can I ask you something? Have you ever made dough in a bug bounty before?

[left atlas]

are you guys an experienced hacker?

care to teach me or give me some tips please

[upbeat tangle]

Go study and teach yourself

All the materials you need are right here

[left atlas]

which channel

[upbeat tangle]

go to the hacktebox website and sign up

[left atlas]

okay thank you

[upbeat tangle]

then you open your wallet and put your money where your mouth is

[austere sinew]

Woah that was mean

[upbeat tangle]

i dont think it is! i buy vip+ because im a cheap mf and if i purchase something im going to make damn sure i get my moneys worth so i spend obscene amounts of time

[austere sinew]

Idk :/

[upbeat tangle]

Putting your money where your mouth is, is a self motivator

[austere sinew]

If you say so

[cerulean bloom]

I don't do bug bounties

not yet

[upbeat tangle]

What do you believe?

[austere sinew]

I think it came off a bit aggressive

[upbeat tangle]

Maybe blunt is a better descriptor!

[austere sinew]

Either way, not really positive encouragement

[supple plume]

vre

[supple plume]

male encouragement works better with a punch on the back of the neck

[minor loom]

I see. thanks for your response.

[supple plume]

this is how we got @meager kernel to rank up

[austere sinew]

Damn 😭

[cerulean knoll]

Hi @zealous charm hope u good. Want to really thank u for the advice u gave me sometime ago on starting bug bounty.
I started with portswigger and I love the contents. I'm learning a lot.

At what point will I be able to tell I've done the 70% of learning and it's time to start bug hunting

[ocean marsh]

do you have the necessary informatino on /etc/hosts?

[gray wraith]

Do you know about resolving hosts

[supple plume]

yeah, add htb target ip and domain wingdata.htb in your /etc/hosts then wait a couple of minutes for the browser DNS cache to refresh

[devout sail]

Did u do starting point? How would your machine know where wingdata.htb is??

[devout sail]

I never had to wait at all
Weird

[ocean marsh]

Always add the domains/subdomains you discover in the /etc/hosts file

[supple plume]

look it up, you can do things to not have to wait, but most times is not instantly

you can verify it instantly by running curl

[ocean marsh]

That's host resolution

[devout sail]

So you tell your machine, wingdata.htb is on this IP in there

[dawn frigate]

guys, what's the difference between HTB and THM ?

[supple plume]

because things work this way

[devout sail]

This guy got nice icon decoration tho

[supple plume]

THM sucks, HTB doesnt

[devout sail]

Oh cuz the creator decided to redirect

[dawn frigate]

what's your reason ?

[devout sail]

I redirect on my machine too

I don't want y'all to use it with IP

[supple plume]

just join thm and discover yourself, I shouldnt talk too bad about thm here, staff doesnt like that

cool

it depends on some things

[devout sail]

Both good
You asking here so HTB
If you ask there it will be THM

[supple plume]

are you using burp?

[devout sail]

Yep

[ocean marsh]

@dawn frigate If you can, try a month of HTB academy or HTB labs and see for yourself if you like it

[dawn frigate]

exactly LOL

[supple plume]

yes, important

I believe burp is one of the things that makes it delay

I recommend using burp always too, it will record all your requests and help you see more stuff

[austere sinew]

If you want an objective choice, hackthebox is more detailed to say the least

[devout sail]

Weird name tho

[supple plume]

burpsuite?

[devout sail]

Burp

Yes

[supple plume]

burp = burpsuite

[thick forge]

i am hacking

[supple plume]

blame portswigger

xd

[devout sail]

Yes

[devout sail]

[ocean marsh]

You'll probably feel dumb, but dont get discouraged and just keep searching

[thick forge]

[devout sail]

Hacking what

[supple plume]

heck yeah

learning how to fly mid air

[dawn frigate]

i haven't enough time for discovering.
i must save money for my university. i just have 2 years
i just want to know which one is better for learning fudamentals for cybersecurity. offensive security BTW

[devout sail]

If need any help, don't hesitate to ask @supple plume

[devout sail]

Pick HTB alright

[ocean marsh]

IMO its HTB academy, they have a student discount for the academy and also some free contentt

[austere sinew]

Hackthebox has cpts which has a lot of detail that many people say can rival the oscp.

[ocean marsh]

try and see if you like

[supple plume]

specially about web stuff

[ocean marsh]

yo @thick forge , send the cat screaming emoji before I leave

[austere sinew]

Tryhackme afaik does not go to the same level of detail

[devout sail]

My previous answer was for the unnecessary comparison people do everyday here.

But if u really gonna spend on shit, do HTB . With student discount or some fancy ahh subscription

[devout sail]

[dawn frigate]

@devout sail @ocean marsh @austere sinew thank you so much for caring about my question. i won't forget

[ocean marsh]

If you need something just ping me and I'll try to help

[patent hollow]

@austere sinew

[thick forge]

[austere sinew]

[ocean marsh]

Also, nice pfp

[patent hollow]

@austere sinew

[ocean marsh]

I love you bro

[dawn frigate]

BTW all of THM rooms contents are accesible through medium.com LOL

[austere sinew]

🤨

[devout sail]

[austere sinew]

Those are called writeups…

[patent hollow]

how are you @dawn frigate

[ocean marsh]

what are you studying today

[dawn frigate]

thanks. western genre is always nostalgia. especially hang 'em high movie

[austere sinew]

Im not studying today, am meeting fwends

[patent hollow]

how are you @dawn frigate

[austere sinew]

Im in the middle of transit rn

[dawn frigate]

uh yeah shit

[ocean marsh]

Niceeeee

have fun wolo

[austere sinew]

Danke

[upbeat tangle]

Me and my father used to have a thing were we would watch 3 hour long extremely boring old western movies as a joke when i was a kid

[patent hollow]

Bitte

[dawn frigate]

just trying to survive and shit

[patent hollow]

i was talking to undeadwolo

[devout sail]

That's the issue on every competitive platform
Here too
The rule is to not publish any writeup for active
But there's always someone doing it

[austere sinew]

Why were you pinging him then?? 😭

[patent hollow]

but i replied to you

[dawn frigate]

all of western genre movies are about justice

[upbeat tangle]

@dawn frigate The thing with the oldschool western movie is that it can go 20 minutes between people saying something 😄

[patent hollow]

@dawn frigate

[devout sail]

Breh as a Joke 💀💀

[dawn frigate]

right. and shooting less than a second

[upbeat tangle]

My father had funny cures for boredom. One of them was also to sit on a chair and stare into the wall for an hour

[patent hollow]

@dawn frigate how fast can you shoot

[dawn frigate]

but as i said. it's nostalgia
i guess everyone have good mind about their past.

[devout sail]

You inherited any?

Breh he's underage

[patent hollow]

dude...

[devout sail]

Delete and Ignore him

[upbeat tangle]

For sure hahahaha. The idea behin the wall stare is that it will activity your brains own capacity to entertain itself, you out ot this boredom you will explore new ideas

[dawn frigate]

right

[devout sail]

Hmm or just spin up any insane machine

Easy blank stare for hours

[dawn frigate]

@upbeat tangle did you ever watched high plains drifter movie ?

with your father ofc.

[upbeat tangle]

i cant remember, so i dont know

its like 30 years ago

[dawn frigate]

but good, bad and the ugly is unforgetable

[west venture]

Sounds like torture

[lofty marsh]

Where the cube talks atttt

[upbeat tangle]

It would be torture to any average gen alpha kid

[west venture]

It would be torture to me

I'm not gen alpha

[cerulean bloom]

wat

thats was yesterday

[devout sail]

I think he was there yesterday?

[cerulean bloom]

ye

[west venture]

in case of sevear lightning, please go to a well exposed area with a tall metal rod and hold it as high as possible. This will cause the buildup of charges to discharge through you, instead of hitting your house, thus protecting your electronics.

[supple plume]

whatchodoing here

@lofty marsh vre I blogged my blog bloperly https://echoesofwhoami.github.io/CurlSwiggerLabs/

[ocean marsh]

this is so clean

congrats

[devout sail]

You can do same with a gun, it will follow the path of bullet

[muted olive]

nice blog

[supple plume]

thanks

[dawn frigate]

sounds perfect

[supple plume]

I could make anew article today

any suggestions?

[muted olive]

SSTI? XXE? GraphQL injection?

[supple plume]

I want something that is not easy but not insanely hard

just a bit hard

chained vulns, crazy bypasses

[meager kernel]

Alot of pings

[muted olive]

JWT forging?

sounds ideal

[meager kernel]

Yea you guys suck at motivating

[supple plume]

hmm sounds easy to me but probably because I am familiar to it, it could be a good suggestion tho, I'll take a look

[zealous charm]

Glad to hear it is going well! You can try your hand at real bug bounty programs at any point, I would say that experience is the most valuable

[muted olive]

@zealous charm any hacking today?

[cerulean knoll]

Well noted 🫡.
Thank you 😊

[zealous charm]

Nothing major planned, might look at some source code review output, but thats it. You?

[supple plume]

@muted olive jwt great suggestion I always wanted to learn this one lab-jwt-authentication-bypass-via-algorithm-confusion-with-no-exposed-key

well mostly JWT algorithm confusion attacks

[muted olive]

I found a vuln in Claude today

[zealous charm]

Nice!

What was the bug class/impact?

[muted olive]

Will tell you in dms, waiting for monday to report it

[dawn frigate]

gorilla

[supple plume]

IN claude???

[muted olive]

yup

[supple plume]

gaddayum

🎉 congrats 🎉

[muted olive]

ty

still have to report it

waiting because they wont reply on the weekend :(

[red ore]

"Now I can see the full picture clearly"
#ShitAISays

[supple plume]

proceeds to fuck it up even worse

[red ore]

MAJOR BREAKTHROUGH!

[ocean marsh]

congrats!!

[devout sail]

RCE IN AGENT IF U USE !CMD

Wait that would be command injection

[mystic harbor]

the spam

[devout sail]

Leave

[supple plume]

@mystic harbor @mystic harbor @mystic harbor get some extra pings just in case

[devout sail]

It pings just once 💀

[zealous charm]

[supple plume]

@mystic harbor

[thick forge]

[twin spindle]

Hey everyone, maybe i'm missing something but is there a repo with all the retired machines writeup PDF ?

[gray terrace]

https://tenor.com/view/y'all-know-what-time-it-is-mark-philips-rdcworld1-you-already-know-it's-time-gif-16278785187524007501

https://tenor.com/view/ready-gif-25457147

[zealous charm]

do the hacky hacky

[remote lintel]

Hi, I had an accidental auto-renewal on my subscription and just noticed the charge. I’ve already cancelled it. Could you please let me know if a refund is possible?

[hoary dawn]

just started doing electrical stuff and man this world is cooler than the coding world

i have a mobile thermostat on my hands at the moment, not sure what i can venture into hacking related but ill get there

[zealous charm]

if you contact support they can refund it and cancel the subscription

[remote lintel]

Okay thank you! @zealous charm

[cerulean bloom]

@austere sinew health check

[gray terrace]

https://tenor.com/view/michael-meka1-i-am-meka-get-the-fuck-out-leave-wtf-gif-16780052

[bronze lion]

lol

[dawn frigate]

aye aye, captain

[west lynx]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[lime trout]

contact support they'll get you taken care of

[zealous charm]

hello support, plz halp

[austere sinew]

Shut the fuck up dont speak to donut like that wench

[austere sinew]

Im good ty hru donut you amazing individual 🫂

[thick forge]

updating i am suite brup

[cerulean bloom]

❤️ I'm good

[cerulean bloom]

I don't speak spanish

[supple plume]

someone told me I know nothing about hacking and coding

[cerulean bloom]

LOL

[thick forge]

que es saber ?

[austere sinew]

Glad to hear it 🫂

[cerulean bloom]

I'm in vc hehe

[zealous charm]

jajaja

[bronze lion]

when did u start acting kind?