general

[ocean marsh]

ofc bro

[sharp shuttle]

Thats cool but its better to have a palantir profile that is transparent

the more "dirt" feds have on you, the easier your life will be

and said dirt is just lies

i search up shit im not interested in at all

duality of identity is the new opsec

you have to give up your "proximal" identity

[alpine pumice]

Making excuses for your furrycon searches?

[sharp shuttle]

noooooooo

[alpine pumice]

you just admitted you randomly searched though so now they know

[sharp shuttle]

broo why you gatta doxx me like that

[sharp shuttle]

allegedly

[alpine pumice]

you're in oregon it's assumed most of oregonians have a duck fetish

i see them wearing it all the time

[sharp shuttle]

my fetish is very easy to find here in oregon

(trees)

[alpine pumice]

what kind of wood do you like?

[sharp shuttle]

dawg that birch messes with me

an man some treated cedar

fuuuuuu

https://tenor.com/view/omg-leonardo-di-caprio-fist-bite-suit-bored-gif-5065709

[alpine pumice]

birch is good for sure

a nice strong hard wood

[dense turtle]

vac laughing at the corner

[sharp shuttle]

That shit arbors my vida

[warm dome]

ngl its crazy looking at my old notes and how bad some where compared to the ones i do now

[ocean marsh]

https://tenor.com/view/jgmm-cat-meme-ragebait-cat-think-cat-ponder-gif-7034802297606826390

interesting conversation

[sharp shuttle]

thats you

[ocean marsh]

I had to go through my notes during an exam

I cringed

ngl

[warm dome]

bruh i feel that fr

[ocean marsh]

never cringed so hard

[warm dome]

like i've been rewriting them similar to hacktricks for references but just process ones on boxes has changed so much

gone from this okay could replicate it roughly to a i could give them to someone and they could follow

[ocean marsh]

But I think that's totally normal because the first time you learn something

you have different eyes for that

notes are meant to be changed

[warm dome]

yeah i learned alot of it outside htb without notes or mostly having word for word notes, so was due for improvement for a long time coming

[ocean marsh]

That's the hard part, my multi pivoting explanation involves a building with a vacuum tube

https://media.discordapp.net/attachments/1058232336598171679/1058234225670754305/Me_When.gif

works for me though

same

I did a whole mental map

[civic lance]

take is a keyword python?

[cerulean bloom]

ayyyy

[cerulean bloom]

apparently it is in caveman python

[civic lance]

Does any1 ici own a homelab?

[hushed frigate]

Because that requires an IQ above room temperature

[maiden anvil]

relatable

[ocean marsh]

ngl bro, my first attempt on cert exam got me depressed

never felt worse

I felt dumb af

[cloud osprey]

https://tenor.com/view/hump-day-wednesday-camel-office-wednesday-hump-gif-5522475

[ocean marsh]

I'll be doing cpts next month

https://tenor.com/view/meowl-owl-cat-owlcat-spring-excited-gif-9638611985122140704

ty

[civic lance]

true story?

Ur tuff

I cant focus when emotions is disturbed

Sitting down laying around feels better

Nahhh that’s tuff

Cuz how da hell you retain information😭

Then u wanna go and take an exam😭😭

I never taken an CPTS exam but I heard it’s multiple days

And then you have to give a report that’s reproducable

What the machine?

😭😭

7 hours is insane

You finna have to research

I heard ppl make directories for their boxes

And work from their

With their research n stuff

Really?

Isn’t that encouraged tho?

Like when I say researching, is googling and figuring it out

So no Google?

So why da hell……

[muted olive]

thats lesser than average for an insane machine

it takes entire days for me

[warped plank]

Good box ngl, forced me to learn a lot about a certain authentication method as well as learned a lot making a PoC in Rust (my team already had PoCs in python and I just wanted to be different)

[civic lance]

Wth is a PoC

[warped plank]

Proof of Concept

[civic lance]

Wait yall have to write your own programs for some of the boxes?

nahhhh ur not a reel hacker

Reel hacker make their own programs

Like men

Reel hackers say fuck dat toool

Imma make a better tool

[cloud osprey]

i remember i had the choice to buy an engagement ring for my ex, or a laptop which i was going to bare metal kali on

and the rest is history

[muted olive]

fuck POCs in rust

[maiden anvil]

you never heard of a group called milw0rm

[muted olive]

gotten too acquainted with them now

[maiden anvil]

definitely before your time

[civic lance]

Yo

[maiden anvil]

they hacked a power plant

[civic lance]

In the U.S?

[cloud osprey]

installing the nvidia drivers for that kali machine was a pain

[maiden anvil]

I cant remember exactly

I want to say maybe Israel or something like that

[warped plank]

I agree, but also: hehe type safe and memory safe exploit go brrrr

[civic lance]

Yo where tf rust came from

[maiden anvil]

ah Mumbai

thats where they hacked a power plant

[muted olive]

Yesterday's finding was duplicate :(
Got another one now though

[muted olive]

who?

[civic lance]

How do u hack a Power plant?

[maiden anvil]

milw0rm

[civic lance]

A power plant has open ports?

[iron galleon]

gl0wrm

[civic lance]

(I’m on HTB starting point)

[maiden anvil]

we like 0ur 0's dont we

[muted olive]

yes

PLCs and HMIs be having open ports

[civic lance]

Acronyms

Amazing

[iron galleon]

witchplayer

[terse dirge]

Kubernetes time!

https://klipy.com/gifs/pulled-pulled-away

[civic lance]

Oooo

I heard of that word before

It’s like using other computers to attack

[maiden anvil]

this is what happens to my brain when I think about conspiracies

[civic lance]

I learned about it in highschool

[civic lance]

Most conspiracies are true right?

A lil

[maiden anvil]

dunno about that, but whatever the truth is it's definitely far stranger than any fiction we can come up with

[civic lance]

I would tell everyone the earth was flat

[terse dirge]

No

[civic lance]

Cuz Kyrie Irving said so

[terse dirge]

Kubernetes is container orchestration not botnet c&c

[civic lance]

Oooo

[maiden anvil]

says you!

[civic lance]

Does HTB boxes have hornets?

Bot nets*

Too expensive maybe

[maiden anvil]

all hail cobalt strike

[civic lance]

How many boxes u did?

[maiden anvil]

idk i'd have to check cuz I dont really remember

[civic lance]

Nice, I’m just starting out. How did u get started?

[terse dirge]

Yo Emma, I got kubevirt and kubevirt manager up in the cyber range

[maiden anvil]

ig when I was in high school a really long time ago, but it's complicated cuz everything was different then

before htb

before even offsec

actually maybe offsec was around then

yeah that kinda checks out cuz that woulda been circa bt3

[civic lance]

Damn ur a old head

[maiden anvil]

yeah, ive been studying this stuff over half my life now

fun times

like if you took my time alive so far in half, more time would be spent learning hacking than not

[civic lance]

That’s crazy and scary

Damn

Have u landed a job?

[maiden anvil]

yeah

[civic lance]

Sysadmin?

[maiden anvil]

I was a network engineer for a long time, then a red teamer, now a pentester

[civic lance]

Do your managers push u to use AI?

[maiden anvil]

yeah but for like normal stuff

cuz tbh i dont really have all day to have writer's block

trynna get an exec summary going

when I can just have some chatbot get it going for me and it's company-specific and written really nice

[civic lance]

Wait

Most of ur time is just writing reports?

[maiden anvil]

yeah most of the job is doing stuff other than hacking in a funny way

[civic lance]

😭

Writing

[maiden anvil]

oh bro

you're in for a really big surprise

you know all those diagrams and stuff in books that nobody reads?

[civic lance]

……….

[maiden anvil]

they actually mean stuff

check this out

[civic lance]

Bro😭

[civic lance]

Ewwwwww

[maiden anvil]

this is basically the entire job in a nutshell

[civic lance]

Actually

This is what HTB Boxes reinforces subconsciously

[meager kernel]

Where is privilege escalation

🥀🥀

[maiden anvil]

Im guessing that would fall under number 4

[civic lance]

So it’s like a loop?

Over and over

[maiden anvil]

yeah from test to test, project to project, client to client

etc

[civic lance]

Damn, I wonder

They’ll prob try to make an AI do this

[meager kernel]

I just landed a pentesting internship, like yesterday, any tips and advice you can give?

[civic lance]

Enumeration is key

[maiden anvil]

think twice before jumping to responder

good way to blow up everything

[meager kernel]

Pentesting itself is not what Im scared of
Im scared of corporate environments

[civic lance]

You never been in a corporate work setting?

[meager kernel]

I have been but it was work from home

[maiden anvil]

I think as long as you test what you're doing before you do it live you're generally fine

[meager kernel]

This new internship will be in office

[civic lance]

Ehhh, you’ll be fine tbh. As long as you know what ur doing, ppl will cut u slack

Idk

Ion think there is much to be worried about being in a corporate work setting

[maiden anvil]

yeah best of luck to you kratos

[meager kernel]

Thanks

Hopefully it goes well

[civic lance]

Like u landed an internship😭

Cmon now

[maiden anvil]

good chance they'll have you shadow someone for a couple weeks

[meager kernel]

Yea

Im already appointed a mentor

[maiden anvil]

i dont think they'll just put you into some strange situation without any heads up

[civic lance]

Wait they do THATTT????

I thought it was only for healthcare workers😭

Where they have the newbie follow the vet all over the building

[meager kernel]

Im supposed to shadow a senior who will be doing pentest on pre-production AD environments

And I'll be given assignments

And projects

To do

[civic lance]

Wooooah

[meager kernel]

Hopefully in a team

[civic lance]

What type projects

[meager kernel]

I cant do shit alone

[civic lance]

Do they do

[meager kernel]

Pentesting stuff bruh

What else

[civic lance]

I wanna knowwwwwwe

The detail

[meager kernel]

Depends on what projects and clients the company recieves

[meager kernel]

Idk myself, i haven't done onboarding myself

Im just telling what usually happens in companies

Who do pentest

[civic lance]

You finna have hella fun

[meager kernel]

They make stuff for clients, and before the environment is released, you do either white box pentesting or black box pentesting on it

I think im roughly correct

[maiden anvil]

i think maybe one thing to consider is growing as an engineer through pentesting

like for example at some point having 10 criticals on a report kinda stops being fun in a way

[meager kernel]

@maiden anvil I'm roughly correct, right?

[maiden anvil]

yeah basically

[meager kernel]

Ive only done pentest on pre-production environments
Cause they aint letting an intern near a production environment lmao

[civic lance]

Speaking from experience😭?

[maiden anvil]

well after who knows how many reports you write eventually the magic kinda wears off

so then you start thinking differently about the types of stuff you find

[meager kernel]

Report writing is the most boring part

[civic lance]

Jesus, I don’t wanna write essays

[maiden anvil]

like for example cranking out one policy update as a result of a test is worth over 9000 criticals

because if you find an issue that scales across the business, the business has to rethink how it operates

[civic lance]

Just let AI write the report✌️

[meager kernel]

NOOOO

NEVER

DUDE

[maiden anvil]

so then these type of high value output artifacts from your tests start defining what kind of portfolio you're building for yourself

[civic lance]

😂😂

[meager kernel]

You never EVER leak data to a LLM

It violates the NDA

[maiden anvil]

then instead when you move jobs you're not bragging about "hey look I find 100 criticals"

[meager kernel]

I just had to sign like 3-4 NDAs for this intern

[maiden anvil]

now you're saying "hey look at these 8 new policies as a result of my testing and high scale remediation"

[civic lance]

4 NDAs?

Tf?

[meager kernel]

Yea

[civic lance]

FAANG company?

[meager kernel]

They go to different branches of the company

[meager kernel]

Not telling here

[civic lance]

Oh okay

[maiden anvil]

then you stop getting offers for junior positions and start looking at senior and higher titles

anyway tldr im kinda rambling

[meager kernel]

They also give like 3-4 Criminal Disclosure Forms

[maiden anvil]

sorry

[meager kernel]

If you've ever had criminal record

There's forms regarding not giving insider trading information

[civic lance]

Oooooo

It’s a public company that have stocks

[meager kernel]

Bro is gonna try dox me

[civic lance]

STONKSSS

Nah

[maiden anvil]

im trynna work for the lizard people

hit me up

[civic lance]

Wait

Those that shit down something that stopped consoles?

Shut*

[maiden anvil]

idk the interdimensional lizard people that control everything

thats who i wanna work for

[civic lance]

Ooooo

Rothschild

[maiden anvil]

imagine hacking the mothership

[civic lance]

Or black rock

[meager kernel]

@maiden anvil you cannot tell your current clients too right?

[maiden anvil]

I prefer not to

Im certain I cant disclose clients

[meager kernel]

Yea

Alot of restrictions, which is fair

[maiden anvil]

anything that goes on a report is NDA

[civic lance]

Do u guys own homelabs?

[meager kernel]

Pentesting in itself is very fun

[maiden anvil]

[civic lance]

U do?

[meager kernel]

I have an old PC which runs as a server 24/7

Thats pretty much it

[civic lance]

I was thinking bout starting one, but idk

[maiden anvil]

chillin

[civic lance]

Like the use cases don’t really

Seem of use

[maiden anvil]

my lil proxmox cluster

[civic lance]

You have a NAS?

[maiden anvil]

oh no this is 3 NUCs clustered together

[civic lance]

wtf is that

[maiden anvil]

cute lil beefy PCs

[civic lance]

NUCs?

[opal saddle]

What's up guys , just posted a new project on my github. Would love some feedback
https://github.com/d-velopr/vuln-springboot-app

[maiden anvil]

very interesting, will add this to my lab 👍

[civic lance]

NDA go crazy

Do yall stay up doing boxes on a school night?

[maiden anvil]

I did before I started doing this for work

now not so much, once in a while on weekends maybe

[civic lance]

U got work tmrw?

Bro finna write 10+ pages of reports

[maiden anvil]

you gotta encourage a culture of sharing documents at work

so even random bullshit ideas get written down and passed around

reading is the real pain

I couldnt tell you what ungodly amount of content I read in a day but it's unreasonable beyond all logic

[civic lance]

Damn, you should take those ideas and write a fiction book

Nah that’s stupid😂

[civic lance]

Fostering a no judgment zone

[maiden anvil]

if you dont like reading and writing, pentesting might not be it

[civic lance]

I actually own a book shelf

[maiden anvil]

red teaming even more so if you wanna be on the cutting edge of maldev

[civic lance]

With books on it

I have manga and fictions

[warped plank]

don't red teamers hate documenting their methods cos they're afraid it'll be burnt?

[maiden anvil]

I cant imagine it'd be easy to remember several chains of syscall resolution techniques by memory

[civic lance]

I think he means sharing

[maiden anvil]

I cant even remember the difference between hell's gate, halos gate, tartarus gate

i'd have to check my notes

[warped plank]

Well if they red teaming then they built diff

[civic lance]

I learned how to use burpsuite today

Brute forcing is a long procress

Gawd damn

[meager kernel]

Why is this field so hard

[warped plank]

Burp's intruder is rate limited for free users, use ffuf or something else.

[civic lance]

Ooooooh

No way burpsuite cost money…..😭

I didn’t know that

[meager kernel]

499$ per year for professional license

[civic lance]

Fuck no😭😭😭

[meager kernel]

Theres a whole way of burpsuite app validating your license
You input the licence key, the portswigger website grants you another key, you input that particular long key, it gives you an even longer key for the response, you input that response key again in burpsuite, and it grants you the access to professional @civic lance

[civic lance]

Oh okay

[meager kernel]

There's like a whole 3 factor authentication

[civic lance]

But I don’t think ppl will even pay for burpsuite

When there’s alternative

[meager kernel]

Companies do

For their employees

One company shares the licence to all employees

[civic lance]

Companies are different

They have cash to burn

[meager kernel]

Individuals normally dont, unless there's someone who REALLY wants it

[maiden anvil]

bug bounty hunters too, some private programs dont want you leaking stuff to public collaborator servers as an example

[meager kernel]

Yea but you dont discuss that in public

[humble wyvern]

i see

dont dm me for it then

[meager kernel]

First rule of fight club
You dont talk about fight club

Same is in the piracy community

[civic lance]

Ppl break that rule all the time

[humble wyvern]

and get caught

[meager kernel]

Yea and thats why piracy website and sources get shut down
People are stupid

[gaunt gale]

Ya you can only get into the piracy community if you know where to look

[humble wyvern]

not hard at all ngl

[civic lance]

No way they paying for burpsuite just to get so little in return

[meager kernel]

Yea its mostly by word of mouth

[gaunt gale]

True true

[gaunt gale]

Ya for sure

[meager kernel]

Nah there are alot of features in professional burp suite

[civic lance]

In terms of profit

[humble wyvern]

its really good

[meager kernel]

Yea

[humble wyvern]

u pay for it?

"pay"

[meager kernel]

No

Had it in my old company

[civic lance]

$499 for a license

How much do bug bounty pay?

$2?

[meager kernel]

No fixed amount

Depends on the vulnerability you found

[civic lance]

Oh so they can scam

Gaslight u into thinking a severe vulnerability was a minor

And pay u less

[meager kernel]

Theres a CVSS rating system for each vulnerability

Also, bug bounty hunters and companies are often bound by contracts, so its hard to scam, but it does happen sometimes

[maiden anvil]

not likely to happen, because then they'll get a bad reputation and no one will test them

there are some cases of triagers claiming findings and telling the researchers they had dupes

[civic lance]

Ahhhh bet bet

I have a digital forensic class

The labs are pretty annoying

I learned delete files just get sent to unallocated space

[warped plank]

They aren't sent anywhere, the OS just removes its records that something was ever there... They're still there until they get overwritten

[rancid snow]

from reading r/bugbounty the reverse is more likely. Ton of delusional 'researchers' claiming criticals over worthless bugs

[warped plank]

Well it's a constant tug of war cos the triagers wanna give as little money as possible so they downgrade reports while researchers wanna get the most money for their efforts...

Pro Tip: XSS with javascript execution in CVSS is actually a scope changed since it goes from attacking the web-app to attacking the client browser.

[rancid snow]

nah browse r/bugbounty youll see what I mean lmao

[warped plank]

yeah I know what you mean, that's why I highlighted researchers and efforts

In the end it's all about saving the most money vs making the most money

[rancid snow]

people will genuinely report shit like 'if I log into account A and then log into account B but then take account B's cookie and plug it into A's browser, Im logged in as B! broken auth! critical!!!!'

you can then explain to them how cookies work and theyll just argue for hours

I know because I've argued for hours while bored lmao

[warped plank]

better than half the LLM bug report slop I see

[fiery ice]

How can I start learning malware development
What's the best language for that

[rancid snow]

maldev acadmey, c and asm

good luck maldev is a brutal field

[warped plank]

Hear me out: learn Rust so you solve the memory problems of working with C but now you have 2 problems.

[rancid snow]

at least those would be vulnerabilities if they werent hallucinated and not just a fundemental misunderstanding of a what a vulnerability is

[warped plank]

No no, I've seen some that were genuinely stupid like: if sudo is configured and I have credentials I get root access

[rancid snow]

yeah no thats exactly the kind of stuff Im complaining about lul

[warped plank]

yeah LLMs are not so different from humans cos they're trained on humans

[warped plank]

Is bro trolling?

[rancid snow]

nope

r/bugbounty is a treat if youre bored

this is like 90% of posts

the other 10% are people writing manifestos on how they hate triagers and that every platform are just scammers and then when you ask for details it turns out to be the same shit as the other 90% of posts

[torn cedar]

What did I just read

[rancid snow]

the reason why Im always skeptical about someones bug bounty complaints without context/knowing the person

[meager kernel]

Its common for many adult content websites to do this

I once found this typo squatting domains with reddit too

[rancid snow]

yeah

its a 'no shit sherlock, you really think someones going to pay you a bug bounty for reporting a typosquat???'

[meager kernel]

Lmao

[rancid snow]

not even one trying to steal credentials or pretend to be the target even

[meager kernel]

Its kind of a shitty thing to do tbh
Typo squatting
Like someone mistakenly types a website name wrong, and now they're on an adult Website infested with malware

[meager kernel]

Alot of adult sites do have malware tho

[rancid snow]

yes, again its a no shit sherlock moment

my 80 year old customers asking for Facebook assistance understands this

[meager kernel]

I remember I once fell for a trojan horse website which copied discord
A friend of mine got his account hacked, the attacker sent me a message from my friend's account, and his way of talking genuinely convinced me that he was my friend.
He redirected me to some other discord-type website which required a discord login, I entered my credentials and saw the URL of the website later.
Luckily I noticed it right after entering my credentials and I changed my email and password before anything happened to my account

[rancid snow]

you couldnt torture that info out of me

[meager kernel]

Ehh its not an embarrasing info tbh

I fell for a scam, I recognised it right after falling for it and didn't face any damage

It was an old account too, I have created like 3 more discord accounts after that which I deleted

[dawn frigate]

sherlock or poirot?

[manic anvil]

i have question for bug bounty hunters , do you guys use auto scanners like i see that scopes say no auto scanners allowed but by that do they mean just the result or the auto scanner as whole , like you can use it to detect a bug then you go test it yourself as a PoC and submit it?

[manic anvil]

didnt Troy Hunt also once fell for a scam as well?

[warped plank]

If it's not allowed, it's not allowed, it's illegal to go outside scope for any VDP/BBP

[manic anvil]

in most videos i see people use burpe scanner and such but i guess will just go manual

[warped plank]

Well they're either incriminating themselves or have special permission or are doing a bounty without the auto scanner scope limitation.

either way best course of action is one where you don't end up behind bars or not allowed to touch a computer

[manic anvil]

not my pc

[warped plank]

It's usually not just your own computer but any device connected to the internet for that matter.

[rapid swallow]

https://tenor.com/view/dog-dance-husky-dance-dog-dance-fun-gif-4784425400772020802

Hello hackers

https://klipy.com/gifs/patrick-blush

Any idea when an AI cert will come out?

[warped plank]

for HTB? Yeah they tend not to disclose that information as they don't wanna be hard locked by a deadline to the community and don't really wanna tip off their competitors

[muted olive]

This is a bad system as well

That response can be forged and you get a cracked version of pro

[rapid swallow]

I see

Well hoping soon

Bro these badges

For academy

They need a way to showcase them

[muted olive]

Depends but usually both

[rapid swallow]

And show them off

[meager kernel]

Usually how burp suite piracy works

[meager kernel]

Lmao yea

Classic

[scenic maple]

When you least expect it thats when they strike

[rapid swallow]

So tomorrow

Life be hard

[scenic maple]

but u are now expecting tomorrow so not tomorrow

[rapid swallow]

Sometimes I feel like im way behind cause I cant do a certain box

[warped plank]

At least it's only sometimes and not all the time like me

[dense turtle]

I think deep down everyone feels that at some point. The real goal is to stop looking at anyone else and just try to be better than yesterday. If you're learning new stuff, making steady progress, you're already on the right path. No point overthinking it.

[rapid swallow]

I need to build a CTF team

Lol

Issue is majority of the time im learning

So im always doing retired boxes

[scenic maple]

You can find one in #1318239802931286066

Good luck

[warped plank]

Bro saying good luck as if he doesn't lead a team that accepts anyone

[scenic maple]

Well we used to take everyone

Too many people nowadays

So it went up to some machines / challa from no activity

Tbh if you think abt it

China is the most populous

But i have only met like 3 chinese people in htb

Hmm

[dense turtle]

math isnt mathing

lmao

[scenic maple]

https://cdn.discordapp.com/attachments/1012079751445352518/1413942071512924160/speechmemified_pasteimage_1.gif

[manic anvil]

can we scam the owners and getting infinity cubes

[scenic maple]

Htb staff get Infinite cubes

Just work there

[manic anvil]

what is the requirment to be staff

i am all ears

[scenic maple]

Apply for a position

Pass the interviews

Thats it

[torn cedar]

[safe jacinth]

anyone wanna study while playing game

[warped plank]

What kind of studying involves playing games?

[safe jacinth]

all of it

[warped plank]

You mean like studying academy and playing games by doing labs right? RIGHT?

[safe jacinth]

ya

its always blue vs red

anyone?

[warped plank]

You mean you're looking for someone to play as red team against your blue team? With what labs though? battlegrounds no longer exist and attack vs defense labs aren't really that common.

[safe jacinth]

😅

i dint mean that lets game same team as blue and fight the red

[manic anvil]

what happened to battlegrounds they got nuked before i try them?

[warped plank]

Well noone really plays them so...

[safe jacinth]

can i install steam on liunux

[warped plank]

so why did you mention blue vs red?

[manic anvil]

i guess fair enough , maybe they would be better as weekly or monthly events

[safe jacinth]

i answered that too

[manic anvil]

also holy OSINT module is 1000 cube

[uneven beacon]

[safe jacinth]

?

[warped plank]

Yes you can install steam on linux...

but what did you mean by you're looking for someone to study while playing game

& it's always blue vs red?

[manic anvil]

yeah

[safe jacinth]

i meant blue as savers and red you know wat it is

[warped plank]

yes but in what context? you looking for someone to play games? or to study? looking for someone who's red? or looking for someone who's blue?

[safe jacinth]

i play for blue

[warped plank]

So do sherlocks and CDSA... but if you're looking for a red teamer to study with you're out of luck because you'd be studying the complete opposite things and there isn't exactly a lab where you can defend from their attacks in HTB.

[safe jacinth]

can i play finals on it

[warped plank]

no, eac doesn't work on linux

[safe jacinth]

eac?

[warped plank]

Easy Anti Cheat

[safe jacinth]

how did u study

[manic anvil]

0xW1LD ate the books about cybersecurity

[dense turtle]

vac - valve allow cheating 😂

[warped plank]

I do labs... boxes mostly, and some web challenges...

bro's jumping around topics and it's getting harder to keep up

[safe jacinth]

u game?

[warped plank]

bro jumps from studying to gaming in less than a minute...

[scenic maple]

What can i say tech is unstable

[safe jacinth]

[warped plank]

bro context switches faster than my cpu

[dense turtle]

i just started interpreter , but anyone to hvh cs2?

[warped plank]

did you just get influenced by this dude and go from hacking to games?

-# at least you're still on topic with hvh

[safe jacinth]

😴

[dense turtle]

i mean,. my cooldown already passed ..

[safe jacinth]

why dont guys game

[dense turtle]

boxes are our game

[safe jacinth]

but creating a GUI like interface to solve those boxes are way easy

[dense turtle]

i used to play fortnite tbf, but no longer windows user

[warped plank]

I find it as just a distraction

[meager kernel]

How would you do that

[warped plank]

So do insane boxes

[torn cedar]

They're 100% a distraction.

[warped plank]

I mean some people like having a distraction from existential dread and pain. I personally prefer drowning my brain in tv series and movies

[torn cedar]

I'm the opposite with the latter being games or hanging out on discord. I've yet to finish Dexter or Silicone valley

[safe jacinth]

try to map all the possible commands and use the as possible outcome to build a game like GUI

[meager kernel]

What if a particular box doesn't fall into that criteria and requires a different command which the GUI isnt aware of

[warped plank]

Bro understands this level of English? I thought I was having a stroke for a moment reading that

[meager kernel]

Lmao

[safe jacinth]

got to the script and code my self

[meager kernel]

It doesn't remain a GUI anymore since there's involvement of terminal

If a GUI requires a user to go into the terminal then its not a GUI anymore

[warped plank]

I feel like this convo is essentially one about metasploitGUI vs manual exploitation...

[safe jacinth]

?

its about playing game

[meager kernel]

Pretty much

[warped plank]

What do games have to do with boxes?!?

I'm so confused now...

[safe jacinth]

[torn cedar]

I believe he wants to turn the learning element of hacking into a game where instead of just reading walls of text, you play a game and absorb the information that way.

[warped plank]

Well isn't that what HTB does? But if he finds it easy then good for him...

[torn cedar]

No they just gameify what you do. Like have you ever played a math game where you do math and it progresses the game? I'm thinking along the lines of that

[warped plank]

Well fair enough but you aint gonna get good at hacking by playing a game cos 90% of hacking is learning and you can't have time to make a game out of everything you have to learn

[torn cedar]

True, but now we know what he was trying to say, at least I the assume handshake emoji means correct hahaha

[warped plank]

@safe jacinth best to do boxes on labs and treat it as a puzzle game I guess.

[safe jacinth]

i don't know what to type now

[warped plank]

Probably that puzzles are boring and not filled with dopamine moments like action games...

[torn cedar]

I remember Greyhack being a thing on steam, but I doubt any of that knowledge can truly carry over to real life.

[safe jacinth]

thank you guys

[muted olive]

Chat, I think I found a bug in Rust

[manic anvil]

the game?

[muted olive]

the programming language

-# there's a game called rust?

[safe jacinth]

cool

[manic anvil]

yeah and it have a bounty program

[manic anvil]

how do you find a bug in programming language ?

like whats considered a bug?

[signal mica]

End me

[manic anvil]

[safe jacinth]

I just wanted to talk while I learn. It creeps me out to ask my doubts to an AI

[muted olive]

well anything

memory safety bugs, logic bugs

programming langs are also coded by another lang

[manic anvil]

AI will go rogue randomly

[manic anvil]

i think i should check this

[safe jacinth]

you know it

[frozen zinc]

https://tenor.com/view/xmen-97-rogue-hair-flip-x-men-97-gif-9559882622494787549

[cerulean bloom]

@lofty marsh cube talks in spotify now

[safe jacinth]

channel?

[safe jacinth]

?

[torn cedar]

Go to sleep

[cerulean bloom]

I'm just letting them know?

[cerulean bloom]

its 6 PM

6:30

[torn cedar]

You're in the future

[cerulean bloom]

yees

[safe jacinth]

what do them talk about

[cerulean bloom]

they answer questions from people during the talk

[dense turtle]

    The user requested packaging>=24.0
    pwncat-cs 0.5.4 depends on packaging<21.0 and >=20.9```
ok , changed requirements to packaging>=20.9,<21.0
pip install
```The conflict is caused by:
    The user requested rich==13.7.1
    pwncat-cs 0.5.4 depends on rich<11.0.0 and >=10.4.0```
AAAAAAAAAAAAAAA

[frozen zinc]

Just unistall and install again

will be more easier than go dependency after dependency

i recommend you to use virtual env with python also

[scenic maple]

use venv 😭

[dense turtle]

i am in venv 😭

but installed

[mystic harbor]

Run linux in docker

[dense turtle]

just needed to setup this rich rich>=10.4.0,<11.0.0

[ornate ibex]

use uv

[frozen zinc]

it will be something else probably after rich

[dense turtle]

i think we fine now, lemme try run it 👀

[terse dirge]

Python moment

I use go btw

[ornate ibex]

I used go only once at work. I wrote code with python and asked cursor to convert it to go and it worked well

[warped plank]

This looks VERY familiar

[sharp shuttle]

0xBrath has entered the chat

its 0xChat now

[dense turtle]

yeah, u were right lol

[dense turtle]

what the hell is uv

[ornate ibex]

https://docs.astral.sh/uv/

[muted olive]

correct

[muted olive]

would've considered using it but...

[ornate ibex]

It is really fast AF, try it out

[muted olive]

yeah will do

been meaning to but keep forgetting

[ornate ibex]

https://cdn.discordapp.com/emojis/1308772568865574983.webp?size=128&animated=true

[scenic maple]

rust keeps helping other programming languages and dev ex

[muted olive]

I'm traumatized by rust

will never heal

and will never forgive

[ornate ibex]

meh

had rust programming briefly in uni

[muted olive]

my condolences

[ornate ibex]

In secure coding subject iirc

[scenic maple]

sings of a good uni

and furries 😩 😩

[ornate ibex]

I guess, we had c as well

[muted olive]

but also 👀 seems like a good unit then

if they taught you rust

[ornate ibex]

they didn't teach rust, they thought us secure coding

use after free, double free etc etc shit in c

I can't tell now, been ages

[austere sinew]

@sturdy thistle

[muted olive]

do they really teach these in uni? 👀

[terse dirge]

@sharp shuttle you should learn kubevirt and VM orchestration in kubernetes

[muted olive]

because if so

my view of it just changed

slightly

[glossy hollow]

Hi guys

I need help please

[scenic maple]

i see

[glossy hollow]

I'm stuck in an academy module where I can't answer all the questions because I can't spawn target IP
Is this a general issue or what could be the fix?

[west lynx]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[frozen zinc]

https://tenor.com/view/see-catherine-ohara-moira-moira-rose-schitts-creek-gif-20254744

[dense turtle]

print("i am cooked")

[lofty marsh]

FUCKING

FINALLY

GAH DAYUM

[dawn frigate]

[lofty marsh]

IT'S BEEN A DECADE

[spare horizon]

man we trollin

i prefer not to talk about it

[odd abyss]

Hello guys! I'm new here... Hope to get along with you all!

[dawn frigate]

understood

i must delete my messages before i got muted by mods

[lofty marsh]

Dude fucking finally I listen to cubetalks 💀

I've been waiting for 1.5 weeks

I got answered all my question 😭

[tidal musk]

immunefi on top

[green kite]

you do know there's message logs?

[carmine fulcrum]

why I cannot see the firstblood anymore here?

[mystic harbor]

in activity

[carmine fulcrum]

yh but I don't see how much time has taken to complete the chall

https://tenor.com/view/dislike-boo-thumbs-down-adam-sandler-gif-17739368

[silk pasture]

can i enroll in 2 paths at the same time

[zealous charm]

[green kite]

no, but you can change between them

[zealous charm]

Rise and grind gents, let’s get this bread

[heady sage]

Dude I spent all day making a challenge

[zealous charm]

Have you been doing a lot of web3 bug hunting?

[heady sage]

Yesterday

[muted olive]

@zealous charm 👋

any hacking?

[heady sage]

@zealous charm @muted olive yall wanna try your luck at it?

[muted olive]

challenge making?

i've already made around a dozen or so

[zealous charm]

Still looking at Google this week

[muted olive]

I had made them for a previous CTF

basic stuff though

I think 1 web challenge, 3 pwn challenges, and a lot of other stuff in crypto and forensics and OSINT etc. Basically every category

It was intended to be a beginner CTF so most of it was easy, with the exception of a few

[dawn frigate]

don't punish me

[heady sage]

No solving a challenge I made!

[fiery ice]

Is c++ good for malware development

[static bloom]

yes

[void sapphire]

Anyone got problems spawning targets (shell & payloads if it matters) ? Not working for like 1-2 hours now

[zealous charm]

@muted olive any update on your bugs?

[tidal musk]

no i just started but i have this for the moment, i use to do HackerOne web2 mostly

[zealous charm]

Nice, best of luck!

[tidal musk]

at least web3 isnt saturated

one report can change ur life with the rewards they have 😭

[zealous charm]

I’ve only worked on web2 bug bounty but it is always fun to follow the web3 writeups and see the payouts

[heady sage]

Damn just ignoring me?

[zealous charm]

Still on my first coffee, my bad

[tidal musk]

they are much more serious which i like, i got an answer 10 min after my report at 3 am on the weekend and the whole project got added within 20 min 😭 in hackerone i still have a crypto.com report pending bounty after triage for like a month now they afk 🙄

[dawn frigate]

yes
c++ gives you access to memory,windows registery,files,procceses & network
if you use python for example , you couldn't do it with using libraries such as wrapper

[fiery ice]

So I should learn c++

[dawn frigate]

yeah , c++ is one of the best languages for malware development
c++ gives you a good access to both of hardware and software

btw c++ is good for bypassing antiviruses

[cerulean bloom]

LETS GOOOOOOO

[fiery ice]

Thanks

[austere sigil]

crashes, so many crashes to triage

[dawn frigate]

you're welcome

[heady sage]

Without AI?

[dawn frigate]

@fiery ice btw, it's better to learn C before C++

[cerulean bloom]

except for errors that occurred (normally I can figure out what they are, but sometimes, it just doesn't show exactly what happens nor can I debug in that space), yes

[zealous charm]

Nice, fingers crossed some turn into legit bugs!

[heady sage]

I’m so proud of you

[odd abyss]

Hi vader!

[heady sage]

No bugs yet @zealous charm still upskilling and making my own challenges

[heady sage]

Hello

[cerulean bloom]

❤️

[odd abyss]

wassup? everything good?

[heady sage]

Yeah everything’s cool, just making Ctf challenges and chilling

[odd abyss]

cool!! that's nice!

[heady sage]

Finally hung my letter from nasa on my wall

[odd abyss]

daymmm🔥

[heady sage]

I keep getting private invites on YesWeHack

[odd abyss]

that's so cool!!!!

🔥

good stuff gurl!

[heady sage]

Preciate it

[odd abyss]

😁 👍

[heady sage]

I’m gonna make a challenge for OSI today

[muted olive]

On google, microsoft and meta, no. I found a vuln in Python yesterday which they are investigating. Found a vuln in Rust stdlib today, just sent it in :3
Also found a vuln in some random crypto funds transfer app, got closed as duplicate. Found another in the same app and submitted, expecting to hear back in a couple of hours

[muted olive]

🔥

[heady sage]

Hades….do my challenge!!!!

[muted olive]

I haven't hung mine on the wall yet 🤣

I should though

[muted olive]

will do

[cerulean bloom]

wat challenge

[zealous charm]

Nice! Microsoft is on my list after I get bored with google, but I've been having fun with it for the lsat few weeks

[cerulean bloom]

I saw you pinged me a few days ago

[zealous charm]

Are the crypto bugs web3? Or web/mobile?

[muted olive]

You'll hate microsoft triage 🤣

[muted olive]

rust panics caused by malformed user input

[manic anvil]

dude it seems like yahoo is the most platform filled with bugs

[exotic pendant]

[zealous charm]

Yahoo was one of the first big programs, at one point they would pay $3k for every SSRF

[exotic pendant]

Goal is to get a home from bugbounty this year

[manic anvil]

yeah back then websites like hackerone used to pay bug bounty hunters with bitcoin

the regret that i didnt born earlier to be part of that

[muted olive]

make 2 million dollars from bounty and buy a home in malibu or newport

[muted olive]

if you want bitcoin, just click on my link

ez

[zealous charm]

its a good plan, that's how i paid mine off

[zealous charm]

I think H1 still has crypto as a payment option

[meager kernel]

They're searching for a new IppSec

[manic anvil]

not sure but like back then bitcoin worth was less and so they paid really more

[exotic pendant]

Ewe Malibu

lol

[manic anvil]

so like they pay people to post writeups and such or is it the otherway around?

[exotic pendant]

$2m might get me a 100sq ft closet

In Malibu

[meager kernel]

First option

[muted olive]

Because their employers quit as well 🤣

[manic anvil]

i cant find it

[meager kernel]

Yea alot of them have

[manic anvil]

[muted olive]

get a house in beverly hills then

3.43 million

[heady sage]

Alrighty, Time to read HackerOne reports or bother hades for challenge inspiration

[manic anvil]

you are one of the triage team?

[heady sage]

Nope just an enthusiast

[exotic pendant]

that’s the same thing lmao

[manic anvil]

"hey any news on the report"

[heady sage]

Trust me I hate h1 triage too

[muted olive]

unless they misplaced the decimal point

[exotic pendant]

Frosto will get a 500k house in Texas and a custom made pizza oven

I’ll be set

Plus I’ll have a big back yard with room to grow food for self sustainment

[cerulean bloom]

man

500K????????

I mean

you do make thousands and millions from bug bounties lol

but

wow

[manic anvil]

[muted olive]

is reasonable price for US house

[zealous charm]

in some states that is the price of a starter-home lol

[manic anvil]

to make pineapple pizza?

[muted olive]

Use the rest of the money to invest in other property. Appreciates, sell, more money ez

[heady sage]

Frosto needs to do my challenge so I can make improvements to make it harder

[muted olive]

ahem california ahem

[exotic pendant]

Straight to jail

[exotic pendant]

I’ll poke when I get time

[muted olive]

pizza with icecream topping

[exotic pendant]

No I’ll make more pizza

[muted olive]

chocolate ice cream

[muted olive]

open up a papa frostb1te pizza chain

[exotic pendant]

Only customer is me

But it’s all business expenses

Frosto is already set to retire at 45

[cerulean bloom]

really????

cuz I know how much money my parent's make LOL

and uhhhhh

[manic anvil]

that was a trick question , you pass

[muted olive]

yes... depending on the state
500k will get you a small condo in California but a large ass home in North Carolina

[cerulean bloom]

huh

[manic anvil]

what about new york

a studio ?

[muted olive]

idk small apartments maybe

depends on whether its upstate or not

[half sedge]

Beef chezzilla

[supple plume]

Hi chat

[manic anvil]

time to hunt bugs with no experience but portswigger labs and a dream

[scenic maple]

man i want to post a political meme so bad

[half sedge]

Yap it kinda cool and comfy

[scenic maple]

its so relevant to the discussion

[supple plume]

Send it to my dm

[manic anvil]

dm it

[scenic maple]

us citizens feel free to dm me to get the meme

[supple plume]

Dang I have to become a us citizen firstc🥀

[manic anvil]

damn whyyyy

[scenic maple]

i mean its for all of us but its very relating to them

[zealous charm]

tbh that is all you need. 50% study portswigger/read hacktivity, 50% actually bug hunt. Anyone trying to sell you a course to do bug bounty is crazy

[scenic maple]

dont hurt my business like that vro

[signal mica]

dont hurt my business like that vro

[heady sage]

Dude I just like source code review

[zealous charm]

plenty of src code review programs out there. Or pick one with an executable in scope and reverse it

[heady sage]

Bug bounty is kind of secondary to that

[manic anvil]

join my course i will make you richer

[manic anvil]

or hear me out make AI help you lol

is there linux tools that are AI based so far?

like they relay on you for work ?

[scenic maple]

you see in linux you dont really use gui tools

you would use cli and pass in and pass out output via piping

i only do cybersec for fun my main area is web dev frontend to be specific but the major ai tools will work everywhere

[manic anvil]

i feel dumb lol an AI based tool would need a database or a server to go back too which linux tools dont

[scenic maple]

at the end of the day they just hit a http post anyway

[zealous charm]

It's definitely good to have exposure to them. In the beginning you wont be replaced by AI, but you will be replaced by the workers embracing AI as a tool

[heady sage]

Here’s the thing, I really wanna do blackbox but I suck at it

[scenic maple]

you have 2 options

• use big cloud providers and just use a service be it free like claude code
• host yourself https://ollama.com/

[austere sigil]

he.. he understands 👀

[manic anvil]

when i get a robust pc

[heady sage]

Which order should I do the portswigger labs in?

@scenic maple @zealous charm

[zealous charm]

Idk I’ve only done like 7 of them, but I think they have paths now?

[scenic maple]

been a long time i should get back and finish some more

[heady sage]

I’m yelling one, two,three, four, five I am the most stubborn hacker Al-ive!

[clever goblet]

Can we expect to have an Android cert from HTB anytime soon?

[scenic maple]

we will have it but how soon we dont know

[clever goblet]

hmmm. So, I believe there is still some content to be added.

[zealous charm]

Taught by professor golam 👀

[heady sage]

Golams rate my professor score finna be atrocious

[manic anvil]

guys look we got golam to give us a free bug hunting course

[scenic maple]

had to open source it cause no one buying

[manic anvil]

like application pentesting or android system in general ?

[zealous charm]

The formula is: find 1 bug, clout chase on social media, cash out and sell udemy course

[scenic maple]

this is get rich scheme in 2026

[civic lance]

Yooo

[zealous charm]

The icing on top is when you look up the authors on h1/BC and they have negative rep (this is true if several well know course sellers)

[civic lance]

Why this chat still talking about bug bounty😭

[manic anvil]

you forgot to do the "be partner" for extra things

[scenic maple]

negative rep is peak lmfao

[manic anvil]

because easy money

[scenic maple]

it takes true dedication to get there

[zealous charm]

Because hacking real websites is more fun than intentionally vulnerable labs

[civic lance]

The domino effect is real, there was a convo about bug bounty at like 1-2AM

And it trickled down all the way to 7AM

Crazy😭

[manic anvil]

i can change the subject

[zealous charm]

Any (non-bug bounty) hacking today?

[manic anvil]

so whats the chances that one of kali tools have a backdoor

[scenic maple]

https://tenor.com/view/money-money-money-make-it-rain-dolla-dolla-bills-dollars-cash-gif-15485267

[muted olive]

@zealous charm you should try out the 1password CTF

[muted olive]

well

npm exists

[zealous charm]

Netexex just patched a bug in their tool, so probably very likely

[scenic maple]

npm do be getting most backlash

[muted olive]

you hack their login page and escalate to get the flag

everything is fully hardened and kept up to date

so only way is by finding a 0 day in the depedencies

bounty is 1 million dollars

[manic anvil]

i mean what if its there on purpose like what the TAO did

[scenic maple]

which one is it

[muted olive]

second one

[scenic maple]

owww its not a ctf

lol

[muted olive]

also 1st one

yeah its basically bug bounty

but not prod systems

no user data

[zealous charm]

Bug bounty is a CTF with money instead of flags

[idle birch]

so does it still pay?

or its just ctf

[muted olive]

if you can get the flag, they pay you $1m

[idle birch]

oh bro

i see

i thought u were trolling lmao

[muted olive]

nah, they've had it for a while

[scenic maple]

have you checked if its hidden inside the websites favicon

[idle birch]

brilliant

[manic anvil]

this make me wonder what if there is a CTF platform out there owned by another company where the CTF labs are just a replica of their system to get free pentesting

[scenic maple]

some ctfs do be like that

[scenic maple]

thats just vdp tho

in vdp you dont get paid for submitting bugs

but you do get recognition

[muted olive]

tfw when you find a bug in claude all models but dont get paid

[manic anvil]

i will VDP with a reverse shell on your system

[scenic maple]

maybe u disclosed it in the wrong place 😈

[muted olive]

havent yet disclosed

have to do through anthropic vdp

[manic anvil]

like that guy who leaked all of patreon databse after they refused to pay anything for the bug he found

[muted olive]

reward: $0 🔥

I mean if you're hacking foundational internet software you're likely gonna get nothing

[manic anvil]

man pentesters are funny , its like pay me or i do evil

[scenic maple]

no most of them have morals and ethics

[meager kernel]

Yes

Thats me

[scenic maple]

thats also why most of them are poor

but it is what it is

[meager kernel]

Pay me or I do crime

Jk

Dont ban me Golam

[muted olive]

If VDPs give me something cool other than money, I would do it

like NASA

[meager kernel]

https://tenor.com/view/who-is-we-spoonmadethis-we-me-us-gif-5237515834956269985

[muted olive]

@scenic maple when you gonna hack NASA?

[manic anvil]

remember we complete each other evil hackers is what make good hackers exist

[meager kernel]

@scenic maple is running nmap on someone's website illegal?

[manic anvil]

starbucks used to give free coffee coupons

[zealous charm]

6 years of bug bounty and never once have I gotten swag

[muted olive]

I dont drink coffee

[scenic maple]

dunno tbh things been going real good with web dev for now
i only do cyber to escape when i get burned out

[muted olive]

Hack the dutch government

you get a tshirt

[meager kernel]

Golam ignored me

[muted olive]

I got Cloudflare swag but that was because I won a giveaway lol

[zealous charm]

I've gotten platform swag, and swag from LHEs. But never any sent to me for a bug

[manic anvil]

an orange one?

[scenic maple]

it could be

[muted olive]

grey

[meager kernel]

Is it illegal or no?

Genuinely

[manic anvil]

dutch prison clothes are grey?

[meager kernel]

Is running enumeration tools on someone's website illegal??

[muted olive]

Thats why you hack the dutch govt, they send you tshirts for bugs

[scenic maple]

possibly illegal

no way to tell for sure

[meager kernel]

Brother.

[manic anvil]

i mean if it DoS the website or take it down then yeah?

[muted olive]

It says on it "I hacked the dutch government and all I got was this lousy tshirt"

[meager kernel]

No, just enumeration

[muted olive]

yes in most cases

[meager kernel]

Oh

Haven't been arrested yet

[muted olive]

*unless you have permission

[manic anvil]

yeah enumeration sends a lot of traffics

[muted olive]

or unless they have a bug bounty with safe harbor which would exempt you from most anti hacking laws which would otherwise apply

[zealous charm]

https://klipy.com/gifs/black-pants-bree-i-do-what-i-want

[muted olive]

tfw physical pentest

[manic anvil]

physical pentesting , beat up the CEO and steal their laptops and the company key cards

[zealous charm]

did you see curl is going back to H1 lol

https://daniel.haxx.se/blog/2026/02/25/curl-security-moves-again/

[muted olive]

They're gonna have a hard time arresting everyone who tries to attack their site

[muted olive]

I thought they closed?

[manic anvil]

in the report write "weak CEO body build get gud"

[muted olive]

because of AI slop?

[zealous charm]

Yeah they closed due to AI slop, made a big stink about it online and all the "infosec influencers" talked about it. now back to H1

[muted olive]

i'm omw to get a physical pentest job at OpenAI

[muted olive]

but why

it was genuinely better without it

[manic anvil]

show them how weak the hardware is to baseball bat