general

[flint copper]

good night

[terse dirge]

I'm thinking we just keep old shit just for the novelty tbh

[flint copper]

running what? COBOL apps? Lol

[terse dirge]

they don't run anything lol

[remote bolt]

its 10am here

[gilded fern]

https://tenor.com/view/hungry-jerry-tom-e-jerry-mouse-gnam-gif-15123486425933471953

[flint copper]

let me run elasticsearch on them

[fierce vale]

cobol and x.25

[terse dirge]

already got an elastishit cluster

[flint copper]

I'm moving that out of my stack soon

Dunno when though

[subtle ermine]

Who is new to HTB

[gilded fern]

janne808 uses arch btw

[terse dirge]

I use arch btw and void linux

[high cobalt]

I use Mint btw

[fierce vale]

I do use arch btw

[proper dragon]

whats arch

is it some kind of text editor

[high cobalt]

It's a religion

[terse dirge]

linux distro

[proper dragon]

of an architectural variety I presume?

[terse dirge]

try out void linux vro

[fierce vale]

have you heard about our savior arch linux

[proper dragon]

now THIS is proselytizing I could get behind

"let me take a second to tell you that pacman is the superior package manager"

[high cobalt]

But I love my SystemD

[terse dirge]

they're implementing age verification in it tho

void linux and the other fork of debian without systemd don't have it

[mystic harbor]

[terse dirge]

https://github.com/systemd/systemd/pull/40954

[high cobalt]

They just implemented a way to set date of birth, not age verification though ...

[terse dirge]

"Stores the user's birth date for age verification, as required by recent laws"

[supple plume]

It would be impressive if you had an arch pfp and then use windows or some shit

[raven rain]

that would be me

i love pacman! but i use windows

[fierce vale]

well yeah it's amazing people are still using windows in 2026 isn't it

window manager bolted on top of msdos

[high cobalt]

Honestly I am not that concerned with this. Imo some stuff in Linux gets too much hate and unnecessary drama

[fierce vale]

running 70s pocket calculator processor code

[rough mirage]

i use windows im a normie

wish it was more customisable tho

[terse dirge]

install a linux distro

[rough mirage]

I mean hmm

ive seen using linux on virtual machines for years

I know the basics and such

[terse dirge]

best way to learn linux is to force yourself to use it

[rough mirage]

but im just too attached to windows since ive used my whole life

[terse dirge]

stay away from static systems like mint

[rough mirage]

that's what I use on vm 😭

its that or debian

[terse dirge]

they're great if you don't want to maintain your system or ever have to up date it

[rough mirage]

ah I see

ive been using arch too

and kali linux but that's maybe once a month lol

[terse dirge]

real arch or cachy?

[rough mirage]

real

vm arch

what do u use?

[terse dirge]

arch on my gaming rig and void linux on my laptop

[rough mirage]

arch for.. gaming?

never heard of void linux

well tbf i guess steam is on linux

[terse dirge]

yeah, I get up to date stuff and as much control as possible of my system

I used to use manjaro then got sick of the repos being trashy and not being able to do certain things on it

[rough mirage]

hm, yeah that's true but the problem sometimes is incompatible anti cheat software and such. also devs don't support it that much

[fierce vale]

have you not heard of steam deck

[terse dirge]

it wasn't that I'm just a control freak when it comes to linux lmao

[rough mirage]

majaro is the arch based one, right? heard of it before

[rough mirage]

yeah

[terse dirge]

it's arch made easy

[fierce vale]

steam deck is arch btw

[terse dirge]

well no

[rough mirage]

it is?

[terse dirge]

it's arch based but it's not arch linux

[rough mirage]

yeah what I was thinking

[terse dirge]

it's steam's immutable version of arch

with a bunch of stuff preinstalled

[rough mirage]

steam deck and linux in general also can't do multiplayer games like valorant and cod

but ig a workaround is cloud gaming

but that's a bit slow

[fierce vale]

if it runs pacman it's arch brother

[terse dirge]

it's arch based not real arch 😉

[high cobalt]

Just like Ubuntu is Debian based but not the same as Debian

[gilded fern]

janne808 uses arch btw

[rancid swallow]

sup

[hoary dawn]

My bad I fell asleep lol yes it is basically an older visual studio 😂

Before I was grep’ing manually on Linux I was using AstroGrep on windows years and years ago now I know where the name comes from

[rose onyx]

what do you mean?

It does more than just wrap API calls, such as dealing with api limits and has some (what i will call helpful) built-ins like regexing any machine that has an info section for asusmed breaches to conver to un/pw.

[ornate ibex]

Now that's cool

[terse dirge]

Team stats are gone vro

Also the whole ranking handle thing doesn't really make sense, what's it for?

Like if I run HTBClient.Rankings.Team(1234) what's the handle for that it returns?

Like what does it do lol because I don't think it has any methods or variables that are exposed from the type

[rose onyx]

🤔 you might be right that there's nothing left for it

[rose onyx]

To be fair, most of those ranking endpoints are no longer on the website which is why i removed them. I assume they will delete them soon, or bring them back later.

But with the whole new ranking system, I'd lean on those being removed

[summer urchin]

there is a new ranking system? do u mean XP?

[terse dirge]

I mean it's not really a big deal tbh. It was just with a specific endpoint being able to see all the bloods was nice but again it's not a big deal

[rose onyx]

yes the xp thing

[summer urchin]

ah, I thought that wouldn’t be part of the rankings

[rose onyx]

it's snot. they are two different things. but arguably it's still a method of ranking which is why i called it such

[summer urchin]

ahh, gotcha

[terse dirge]

Should I add tracks to the tui?

Or fix the yaml automation?

[minor edge]

whats the best method to study the theoretical stuff ? , i understand the modules itself but lots of times its hard for me to retain all the theory information

[jagged storm]

When learning all of this stuff, you're not expected to remember every single thing. Think about doctors and how many dozens of books they go through while learning. Nobody can remember everything.

But if you do pay attention, the strengths you build will be in knowing where to go, when you can't remember something.

[rancid swallow]

[marble hearth]

Interesting pizza

[raven rain]

looks pretty good

[marble hearth]

Its actually amazing

$20 which isnt expensive either

Including delivery

[rancid swallow]

[minor edge]

thank you , now ill just read and understand stuff carefully without the anxiety of writing everything down and try to remember it , ill now focus more on grasping the information which will save more time and make it more efficient for me

[jagged storm]

Nono, you should still be writing everything down. Notes are incredibly important. Even just the act of writing the notes (in your own words - not copy/paste) helps you retain information.

Just don't worry if you can't remember it - as long as you know where to go in your notes to recall.

[rancid swallow]

[terse dirge]

researching more when you don't get something is part of doing research and it teaches you more than using AI tbh

AI isn't terrible but I think you should use it as a last resort imo

[rancid swallow]

true agreed

[zealous charm]

[vital aurora]

You mean all those people saying you are behind the curve if you don’t use AI to study are wrong?! /s

[fallen coral]

Hey dear, I am nowbie and have been i HTB academy for a while. I need someone to guiding, showing and teaching me, How to works. I so eager to learn about those all the staff to be better all of it.

[terse dirge]

AI is a tool, not all tools are able to be used at some jobs

I'd get used to not being able to use all tools

or not relying too much on a tool

[jagged storm]

That's what academy does.

[lavish sage]

nowbie

[zealous charm]

[fallen coral]

I need some kind of help, It's just bit difficult in the acadmey

[high cobalt]

If you don't understand the topics, you are probably either doing the wrong modules first or you are missing basic knowledge in general. What Modules did you try to do?

[ornate ibex]

looks like a lot of calories

enough for a day perhaps

[terse dirge]

cyber isn't entry level.

[raven rain]

bro is playing hyprland

[high cobalt]

Others are playing VS Code

[terse dirge]

[high cobalt]

2 hours of hyprland? Must be a good game.

[terse dirge]

[hybrid temple]

[rancid totem]

💀

[hybrid temple]

I’ve been playing this game “VMware” for 6 hours yesterday.

[rancid totem]

who is playing hyprland

oh yeah i knew it

[high cobalt]

.... How do you have 44 hours?? ... Are you ok??

[rancid totem]

I'm not okay, it's really different

I just take notes

[lime trout]

gday chat

[rancid totem]

sometimes I get sad to my laptop

Hey

[high cobalt]

https://tenor.com/view/blinking-eyes-white-guy-blinking-meme-what-huh-gif-26334323

[ornate ibex]

henlo

[high cobalt]

The longest running server at work has much lower uptime than this wth

[ornate ibex]

lemme show u a screenshot

[hybrid temple]

Bro’s uptime funked up

[rancid totem]

I think there might be a specific case for you

[ornate ibex]

it is a server lol

[rancid totem]

Yeah

[ornate ibex]

or say a vpc at work

[rancid totem]

They're working hard for us

[lime trout]

henlo

[high cobalt]

What are you all doing that you a) can keep such an uptime. Are you never updating or live patching kernels??? b) how do you not have any weird problems??

[high cobalt]

Okay server I am fine with. Although, even then, sometimes even the nicest server needs a reboot

[ornate ibex]

I deffo asked my manager

[balmy basalt]

https://youtu.be/SYRlTISvjww

[ornate ibex]

he didn't reply

so it means no rest for it.

it is going to be punished until we migrate the service to another place

[vestal nimbus]

https://cdn.discordapp.com/attachments/1481097048559194164/1481823931626291373/togif.gif

[rancid totem]

just bunch of different researchs and kernels going on back there and I don't want to open them up again because it is sorted and in the correct place right now

Everything is in the correct place, that's why I can't power off

[high cobalt]

A few weeks ago a MariaDB with 360 days uptime started to act weird and having random usage spikes with 90% CPU despite not doing anything. Guess what, restarting the Database helped somehow. Just the service, not even the whole system. I was like 🤔😐

[rancid totem]

scheduler? logs

MariaDB has a few default schedules right

I don't know what was the conf but

[high cobalt]

Idk, I am definitely not that good in DB administration. I also suspect that is has something to do with a task or something. Maybe because it is a large unoptimized DB and taking up idk 30 or 60 GB or RAM and wanted to shupple around memory?

But I don't care this database should really just die in a few months because it is too old and brittle

[rancid totem]

If it is unoptimized

Memory + InnoDB is going crazy

InnoDB's buffer pool can bloat if you haven't tuned the innodb_buffer_pool_size correctly I guess

[high cobalt]

Yeah its InnoDB and has 2 or 3 large tables. One of them CMS contents and another one a ... editing history. With 120 million records ...

[rancid totem]

woah

how is that thing keeps living

[stone pewter]

whats up everyone

[high cobalt]

Idk. I hope we can clean up the same history table if we fully migrated to our new CMS version. Because I definitely don't want the 2nd database also to pile up 120m records because people save their pages after every character they type and want to have a history for 15+ years xD

[marble hearth]

It was indeed

• dipping sauce

[minor edge]

oh okay thank you ill keep on doing that then

[stone pewter]

can someone help me with a bug bounty problem

i am a little bit stuck

[balmy basalt]

Ask your actual question.

[stone pewter]

ok so i have tryed every basic vulnerability check, also checked for html injection ,sqlp, etc but i am now stuck as in what to do now

also tried port scanning, finding subdomains

mind you i am just staring my bug bounty journy

[hybrid temple]

You port scanned a bug bounty program? Is that even allowed in your engagement

Most automatic scanning tools are banned from bug bounty

[stone pewter]

yes only DOS,DDOS etc attacks are not allowed

[hybrid temple]

Interesting

[stone pewter]

they dont mind as long as i dont distupt the sevice they offer

[hybrid temple]

Well check out Owasp top 10

[high cobalt]

There is a loooooot more possible vulnerabilities you probably didn't check

[terse dirge]

No. The scope tells you what you're allowed to touch. If it's domains then you're stuck on web

[stone pewter]

i am sure there are thats why i am asking my brain is a little full

[stone pewter]

it is web but also network sub domains

[terse dirge]

A bug bounty program's scope already tells you what to test, no need to port scan lmfao

[hybrid temple]

That’s what I’m saying am I crazy or what

[stone pewter]

just in case 🙂

[terse dirge]

Doesn't matter, you're not going to magically find sub domains with a port scanner lol. The scope normally tells you the sub domains you're allowed to touch if it's all of them and they're not explicitly listed then do something like Google dorking

[high cobalt]

As mentioned, OWASP Top 10 is good. There could also be logic bugs which might be interesting for example a web shop allowing entering unlimited coupon codes or something like that

[stone pewter]

thanks thats helpfull ill investegate

[terse dirge]

That's bad practice and you won't find anything other than 80 and 443 depending on your scan you already violated their program rules

[sick gate]

report to the nearest police station

[undone fossil]

To play devils advocate, some are very widely scoped and could be useful. I.e. DoD’s bug bounty scope is “anything we own” or something

But yeah generally rare to need it

[terse dirge]

Yeah that's definitely an exception but normal programs won't do that lol

[stone pewter]

hahaha i really didnt know

[zealous charm]

If you listen to some bug bounty "influencers" they will tell you scope is negotiable

[stone pewter]

put i got nothing usefull

[molten bobcat]

Like that one dude who threatened a hospital?

[terse dirge]

Maybe if you already had like 10k points lmao

[stone pewter]

OWASP it is

[zealous charm]

not sure about that guy, but jhaddix teaches that in his $1000 course

[stone pewter]

rather learn on my own

[undone fossil]

Like that one company who said the hospital wouldn’t have been ransomed if they used their solution

[molten bobcat]

I found it

[high cobalt]

I would also advise you to listen to the other advise though. You also honestly sound a bit inexperienced in cyber and I would advise you train on private targets first. Like hack the box machines. Also even if you don't get legal consequences admins still might be not happy with you if you randomly poke around too much even if they have a bug bounty. Tools etc. sometimes can cause a DoS by accident

[high cobalt]

Ahaha, as a Website admin I hate this 😂 I would be so annoyed seeing his IP in logs. But eh scrapers are doing shit, too, so nothing you really have control of

[molten bobcat]

Considering the person doing it is doing so with their full name attached

[stone pewter]

thanks and yes i am a little new still experimeting daily and yes i also tried ctf in htb and other free boxes, but now i am looking for a real challange with' ''trowing'' myself into bigger projects, because for me personaly i learn more with hands on learing learning as you go and i do listen to others, but not to arrogant ones

[molten bobcat]

They can actually do something this time

Like pressing charges lmao

[stone pewter]

cute

[molten bobcat]

"hi I'm purposely fucking with your org so you pay me"

"hi that's called extortion and is a crime"

[stone pewter]

dont really care about the pay, but i care about learning new stuff

[molten bobcat]

Paying the mob for protection or else they'll break your store

[molten bobcat]

I'm referring to the LinkedIn post I shared and the idiocy it implies

[stone pewter]

oh my bad 🙂

[terse dirge]

I wonder if he's been arrested or at least sued for that yet

[molten bobcat]

I hope so lol

[west venture]

No cloud, you don't

[sick gate]

Dude his bio is like this subtle threat against any employer

[supple plume]

I hate when they say: this trick made me half a mill.
And then there is no trick

[sick gate]

At one stage it was a threat of a mass shooting

[molten bobcat]

Dude

[sick gate]

Yes lmao

[molten bobcat]

That's crazy lmao

[zealous charm]

The trick: just grind for years and/or get lucky

[high cobalt]

Excuse me, what?

[sick gate]

Yeah very briefly

Against some company for advertising remote jobs that weren't remote

[jagged storm]

https://tenor.com/view/the-secret-ingredient-is-crime-jbone666-mouthful-building-walking-the-street-gif-16400025

[high cobalt]

Thats not even just crime, that sounds kinda mental ...

Johnny Silverhand irl ...

[heady sage]

That’s when you cut their phone lines so they can’t call the police

Work smarter not harder.

[exotic pendant]

😄

Chips ahoy ice cream with cocoa pebbles today3

[high cobalt]

Then I would advise you to start with hack the box first :) There is explicit permission to hack the whole machine you spawn and it also is probably more mentally rewarding than bug bounty where you might find nothing

[heady sage]

Careful, you’re gonna get sued for “defamation”

[molten bobcat]

That's only if it's not true 🙂

[sick gate]

I can SHOOT you a juicer one if you want

[molten bobcat]

lmao

[exotic pendant]

😄

I am finally a l33t haxor

https://tenor.com/view/haxor-gif-9997760

[undone fossil]

only disagree with the middle 2 tbh

[exotic pendant]

Some people need more school honestly

[velvet grail]

Hello, sometimes I feel lonely when I start a CTF and I'd like to solve it in a duo or trio.

However, family life means I don't have a specific and regular time to play (it could be a weekday evening or a weekend morning).

Do you know if there's a kind of room where you can watch other players in a CTF with the goal of joining them and playing with them?

As you can see, my playing time is irregular, and even though I'd like to, I can't join a team for that reason. The idea is to play with the "current player."
Thanks! 🙂

[zealous charm]

@grok is this true?

[ornate oracle]

Hello everybody new member here hope ya guys have a good day!

[tender zealot]

Guys, is there any software engineer here that also got CWES or CPTS?

I'm currently graduating at software engineer but I'm uncertain about which cert would help me the most (cjca, cwes, cpts).

Last year I tried CPTS and I couldn't get a single flag 😮‍💨 but now I understand more about web and all, and that got me more confident about trying CWES.

Anyone had the same experience or similar?

[foggy stream]

Hi

[lapis tundra]

Is there someone who is good in name creation? :D

[sick gate]

I christen thee "Toiletwaterdrinker"

[summer urchin]

[lapis tundra]

:D

no legit we need to make a name for a cybersec community for financing from some org for startups/student projects but we are not creative enough to make something without buzzwords or something yk

[west venture]

I am lowkey considering switching to windows 11

[upper badge]

Hello is there any hackers here ? Im looking to create a clan and work together for a project, dm me

[zealous charm]

no hackers here, only yappers

[meager kernel]

@terse dirge need some help

pls

[rancid totem]

so don't ask to ask

[gilded fern]

janne808 uses arch btw

[gilded fern]

bassochiave?

[gaunt hinge]

GUYS, IS THERE ANY WAY I CAN TRACK MY MOTHER'S LAPTOP? IT JUST GOT STOLEN, BUT THE THIEF PUTS IN MY MOTHER'S EMAIL ON HIS 2 PHONES. I HAD SIGNED OUT OF THOSE 2 PHONES AND MY MOTHER'S LAPTOP.

[gilded fern]

Dm @mortal forge for recovery

[molten bobcat]

All your mom's passwords need changed

[compact bridge]

greetings people

[gaunt hinge]

I had only changed the only email she puts in that laptop

[molten bobcat]

There's no point in tracking it, chasing thieves is a great way to get hurt

[molten bobcat]

All of them need changed

You have to assume everything is compromised if you can't confirm what specifically was compromised

[gaunt hinge]

I can give it to the police

[quaint sun]

Does season 11 start on Saturday or is there an intermission period?

Submitted the feedback form

[molten bobcat]

Unfortunately retrieving stolen property is a low priority

You have to take measures now to protect the data you have

[gaunt hinge]

Thankfully my mother said that email is the only one there but I think the thief was running and then he tried signing in while I was checking the email

[ornate oracle]

Are you by any chance from the Balkans?

[gaunt hinge]

So he literally right after he signed it, I instantly signed it out

[gaunt hinge]

Nope

[ornate oracle]

Sorry to hear that man that sucks. But remember better a stolen laptop than a stab wound

[molten bobcat]

Do you know how to revoke active logon sessions and check MFA devices?

Attackers when they steal accounts will often make their own cellphone the MFA device for the account

[gaunt hinge]

I only know how to sign it out, I'm still learning how to hack, I'm literally a very very beginner guy

[molten bobcat]

Das okie I was gonna offer

[gaunt hinge]

After I find that location, I can give it to the police

[thorny cradle]

Sorry to hear about your mothers laptop! And sorry to ask this out of topic: but is this the right place to ask for hints for HTB academy exercises?

[molten bobcat]

It depends on the email server you were using

[molten bobcat]

#modules

[gaunt hinge]

It's ok

[molten bobcat]

Does your mom's account have MFA?

[thorny cradle]

Ahh thanks! Sorry about that, its was not on my channel list

[molten bobcat]

If not, it might be time to add it

[gaunt hinge]

She has a thing where you need to put a passkey to verify that, that is your account

[molten bobcat]

A lot of things use passkey

[gaunt hinge]

But her email was still able to be logged in from another guy's phone

But I changed the password and signed it out in like 2-10 minutes

[ornate oracle]

Maybe install "Aegis" for Multi Factor Authentication and add it right now for your mothers account ( You can choose or take one the more experienced people here recommend )

[molten bobcat]

Microsoft's MFA is fine too

So is googles

[gaunt hinge]

Wait, I really need you guys to answer this question, is my mother's Gmail account ok?

[molten bobcat]

No

That's why I'm telling you to cover all accounts lol

[gaunt hinge]

But I changed it to a very long password and signed it out from all devices except my mother's phone

[molten bobcat]

Remediating compromised accounts is part of my day to day job lol

[molten bobcat]

Does not matter

But! I'm glad you did this second step 🙂

[gaunt hinge]

The thief won't be able to sign in again after I changed the password and signed it out all of the devices

[molten bobcat]

When you "sign out of all devices" you're revoking any active logon session tokens to ensure the attackers session is nullified.

[gaunt hinge]

Right?

I signed it out one by one

[molten bobcat]

Typically the order is "password reset, revoke logon sessions"

[gaunt hinge]

Literally when the phone says just now

[molten bobcat]

But those are the correct steps to remediate a compromised account yes

[gaunt hinge]

Then how is my mother's account not safe?

[molten bobcat]

Accounts plural

[gaunt hinge]

What's that?

[molten bobcat]

Plural means more than one haha

I'm concerned about all accounts except Gmail get me?

[gaunt hinge]

The thief only knows my mother's email, how can he even access the email now

[molten bobcat]

Like banking shit?

[ornate oracle]

You can see all active / inactive sessions in the google security portal kill them all

and remove all devices wipe the whole thing

[molten bobcat]

The thief has the computer so you have to assume everything the computer was used for

Is toast

And needs fixed

So thats Gmail, banking, and everything else that had a username and password

[ornate oracle]

@gaunt hinge C1oud is right bro

[gaunt hinge]

Ok, that laptop is new, every Microsoft application was pirated, and the only email that was there is my mother's email. (My mother didn't log in to her Microsoft's email at all)

[molten bobcat]

Woof lmao

[gaunt hinge]

And that email was only for work communication

[molten bobcat]

Her work computer was stolen?

[gaunt hinge]

So, now, is it safe?

[gaunt hinge]

Her laptop used for work is stolen

[molten bobcat]

Was it a BYOD thing

Bring your own device

[gaunt hinge]

No, she just needs a laptop for work because she doesn't have one

[rapid badger]

Sry bro, your mom is hacked now. Time to get a new one.

[gaunt hinge]

She literally bought it like 1 month ago

[molten bobcat]

I'm asking if her laptop is owned by her or her workplace lol

Okay so it's hers?

[gaunt hinge]

Owned by her

[molten bobcat]

Word

[gaunt hinge]

Word is not even signed it

[molten bobcat]

I am saying "word" as in "word, I heard that"

Lmao

[gaunt hinge]

Ouh

But she had used LinkedIn on that email though

[molten bobcat]

Anything that used that email needs to be reset

The odds that your mom reuses passwords is high

[ornate oracle]

Yep

[molten bobcat]

Compromises are very, very annoying to completely fix

[ornate oracle]

Make a coffe bro, password manager, and get to work site by site

[gaunt hinge]

I will use a very different password

[molten bobcat]

Not even different passwords, use MFA

Having a secondary layer of authentication skips you over a lot of headache

Your mom just has to be aware that "hey, only click accept on this notification if YOU are the one signing in and you recognize what you're signing in to"

Phishing is the number one initial access vector

[zealous charm]

Phishing isnt always bad. One time my spotify got hijacked, when I logged back in the dude had made some banger russian rap playlists

[molten bobcat]

I feel like one could do this without losing their account access to a Russian dude lmao

[gaunt hinge]

So is my mother's email currently safe?

Also, if we know the laptop's serial number, can we track that?

[molten bobcat]

The email address itself and inbox? Probably fine. What she used that email for? Still needs work

[molten bobcat]

No

I would abandon hope of attempting to track the device

You need tracking software installed before it's stolen.

So it's not something you can fix "after it's too late"

[gaunt hinge]

She literally uses it for LinkedIn only, I had changed her LinkedIn password too

[molten bobcat]

Then just stay vigilant for a while and monitor banking closely

Because the first thing they will go for is the money

All its ever about :/

[ornate oracle]

true, you can setup with the bank that you get a notification for every transaction you need to approve it with fingerprint

[gaunt hinge]

There is no bank password in that laptop or email at all

[molten bobcat]

I don't care

[ornate oracle]

check with the bank and enable that option

[molten bobcat]

Monitor your banking shit closely after an incident occurs lol

[gaunt hinge]

I was replying for this

[molten bobcat]

It's one of those "better safe than sorry" type things

[gaunt hinge]

Ohh

[ornate oracle]

I can't buy 1$ worth without approving it with the app

so they can f themselfs

[molten bobcat]

Yep there's a lot of options available for fraud protection

[minor heart]

when did the academy ranks happen

[ornate oracle]

Very good advice ! @molten bobcat

[molten bobcat]

A week or so ago

[austere sinew]

new pfp is cool

[minor heart]

thanks wolo xD

[molten bobcat]

I do this for a living

[minor heart]

oh ok

was wondering wth the prodigy thing was

[ornate oracle]

I can see you are skilled af ( Don't get it the wrong way I am just a noob )

[austere sinew]

i just spent 5 hours in a truck today because the guy let me join him on a sidequest whilst moving my stuff

it was glorious

country roads are so pretty

[minor heart]

I feel like a nerd

[zealous charm]

check for sneaky email forwarding rules

[minor heart]

[molten bobcat]

I've just been doing this for a few years and try to help where I can

[austere sinew]

it just means you're accomplished 🔥

[ornate oracle]

@molten bobcat Awesome that is also the reason I wanna get good at sysec

[molten bobcat]

It just takes practice

[ornate oracle]

because irl I can handle thieves but online you know

[minor heart]

and htb found my no life spot haha

[molten bobcat]

An unfortunate reality is that I show up when the damage is done and just prove how it was possible

[zealous charm]

sigh-ber security

[molten bobcat]

Sigh bear

[zealous charm]

Cus all the dumb stuff you see will make you sigh

[molten bobcat]

[worthy cargo]

Good morning, folks. How's it going? What's everyone up to

[minor heart]

academy was my excuse to not do boxes right now lol

[austere sinew]

i had sm fun

[minor heart]

now ppl are going to be like - ah bc you're a study nerd

[austere sinew]

hru

[ornate oracle]

Hello my friend ah what happens happens it's all part of some process

[austere sinew]

nah it means you're not stupid

😤

[molten bobcat]

I'm stupid fr

[minor heart]

oooh I definitely don't know about that one hahaha

[austere sinew]

YOU OF ALL PEOPLE DON'T GET TO SAY THAT ONE

[molten bobcat]

[worthy cargo]

Just waking up. Starting my own company today. I met someone yesterday who also has a bachelors in cybersecurity but can't find work. So we're going to team up. He's going to get clients and I'll do the work.

[minor heart]

book smart and life stupid is like the worse combo

[molten bobcat]

I go take shower

🧼

[austere sinew]

ooh good luck

[worthy cargo]

Brainstorming what services we'll offer to start with

[austere sinew]

shhhh you're great don't worry

[minor heart]

stinker :3

[worthy cargo]

I'm not such a great pentester yet, so I might need to contract that out to someone capable.

[austere sinew]

i dont wanna hear you say you're life stupid after how you finished those rooms up @minor heart

[minor heart]

aye kk

[zealous charm]

sir plz halp me recover my gf's instagram account

[austere sinew]

the irony in this statement

dms

[minor heart]

I just never have free time and when I do, it's either study or um try some diy to fix broken things that ultimately fails

[minor heart]

I would say handle all the legal stuff first

It is exceptionally important to have your own outlines and sows and all that and if there are certain constraints - should be in there

so maybe a lawyer if you're going to outsource anything

council is usually free

insurance i think is the other big one

I never started a business though

[minor heart]

I'm so glad I rarely get these

[south nova]

Are the servers dying?

[zealous charm]

yes, all the servers

[south nova]

It says 100000 ms on all the regions for the vpn💀

[worthy cargo]

Ok

[zealous charm]

Nice, best of luck! I'm curious to hear how it goes

[elder inlet]

@austere sinew

@austere sinew

WOLO

[gaunt hinge]

Ohh ok

[cunning tulip]

Hey guys I'm a bit confused with pricing and access works, does the silver academy plan unlock the Pentester path for CPTS? Or do I need cubes to unlock that path?

[molten bobcat]

It does yes

[jagged storm]

The silver annual, yes

[hardy frigate]

Hey guys

How to unpack a memory dump on linux

[summer urchin]

you’re alive?!??!?

[molten bobcat]

Unpack?

I've never seen a dump file that was compressed

[hardy frigate]

I mean how to convert a memory dump i.e. lsass so I can see creds

[molten bobcat]

Oh

Well dump files are gonna be .dmp files

You just need a tool that can read it

[hardy frigate]

There is like some tool for it but I cant remember the name

[molten bobcat]

I thought mimikatz had the capacity to pull creds from lsass memory?

[cunning tulip]

Thanks! @jagged storm

[molten bobcat]

I thought that was it's whole point

[jagged storm]

Yep

[hardy frigate]

Yeah but mimikatz is not always evasive and sometimes u cant use it

[molten bobcat]

Be advised that choke slamming the lsass process for a dump file is always noisy lmao

[jagged storm]

And if you can get a dump, you can likely just run mimikatz anyway

[molten bobcat]

I was gonna say if you have the .dmp file surely there's a way to process it offline off the host

But .dmp files are large

[jagged storm]

What evasive way are you dumping lsass

[molten bobcat]

Yeah forreal we have detections for anything getting a handle to LSASS

[hardy frigate]

I'm just dumping it now but maybe later I will do more evasive methods

[azure remnant]

Unplug the disk ig

[elder inlet]

Im dead

[summer urchin]

oh

[summer urchin]

my condolences

[chrome tree]

Oh man, you're toast?

https://giphy.com/gifs/RespectiveCollective-funny-meme-bread-F8TEhwhmBZqWt9NJ02

[elder inlet]

Nah, that's @blazing bloom

[blazing bloom]

Sup

[chrome tree]

Wait, don't we have a toasted toaster too?

https://giphy.com/gifs/toaster-the-brave-little-toasted-fXI281waabdCg

[elder inlet]

@limber arch

[chrome tree]

Holy heck. We have so many carb based people now.

[elder inlet]

https://tenor.com/view/carbs-carbohydrate-hydrate-hydration-hydrating-gif-19135234

[rancid swallow]

[chrome tree]

https://giphy.com/gifs/movie-food-michael-cera-DbuwoWpHqN5F6

I just remembed this clip for no reason lol

[rancid swallow]

[elder inlet]

[chrome tree]

https://giphy.com/gifs/cat-learns-intolerance-hXafx5jj9HVBe

[blazing bloom]

Epic!!!

[rancid swallow]

[rancid swallow]

[devout sail]

https://www.kkinstagram.com/reel/DV6wZKLDCT-/

[chrome tree]

Holy sh**, your website is wild as fuck. How long did it take you to develop it? Little dizzying but the layout and effects are out of the box and is a cool way to scroll through the website

[rancid swallow]

1.5-2 weeks approx
Yoinked some open source/free elements and stuff ofcourse but ya

[supple plume]

fuck

[chrome tree]

The "rotation" of the characters within the headers are super cool and the achievement scroll over effects kind of remind me of the Killer7 angels when they die

[flint drift]

Would you consider linux-exploit-suggester better than linpeas regarding flagging kernel exploits? Have times where either of these tools is flagging stuff the other isnt

[jagged storm]

Both are last ditch effort tools, that are more likely to give you false positives than anything useful

[sturdy thistle]

the damn "congratulations"

[supple plume]

"congratulations there is no reward for your hard work"

[sturdy thistle]

ye

i know that

informal/duplicate

[frozen terrace]

Better luck next time

[supple plume]

I have one critical pending

in another program

valid bug

I've been waiting for almost a month

[minor edge]

:(( hopefully u get it

[supple plume]

it can't be a dupe that time

it's too bad to be just there hanging in the wild

hopefully

otherwise I'll have to look for a job serving tables or something

[hardy frigate]

Guys I am so sick of modules

I just want to hack something

Just been reading walls of text for the past week

[supple plume]

nobody is stopping you

[iron galleon]

https://tenor.com/bUAOI.gif

[hardy frigate]

Computer trash

[iron galleon]

Mossad red teamer

https://tenor.com/9cGp.gif

[jagged storm]

https://tenor.com/view/okay-then-gif-26630246

[limber arch]

https://tenor.com/view/toast-gif-23358366

[buoyant minnow]

how do you "rankup" is it just machines or challenges and machines

[jagged storm]

Active machines and challenges

[obtuse fern]

Active machines and challenges * for now

[minor edge]

htb academy gives exp no ?

[obtuse fern]

They're replacing this system soon.tm with the exp system

[obtuse fern]

Yes, for the new system, not the old one, which is still in use

[jagged storm]

soon-actuallysoon-(reallysoon)-final-v4

[minor edge]

there is +10 xp under the section im studying rn

[jagged storm]

Yeah both systems exist at once right now

[obtuse fern]

We're talking about 2 different things lol

[minor edge]

oh i see

mb

[fickle kernel]

Chat, HR invited me to a “employee experience” meeting

[snow wraith]

[obtuse fern]

Repeat the funny joke to hr

[jagged storm]

https://tenor.com/view/cry-sad-toy-story-woody-so-long-partner-gif-9797730

[iron galleon]

how do i answer

fuck

[gilded fern]

slide

[balmy basalt]

https://giphy.com/gifs/onegreatforce-kid-slide-drift-dgZSywPxSlNeUc3BjG

[upbeat tangle]

good evening general

[summer urchin]

good morning

[zenith tide]

Night

[proud dock]

anyone cannot spawn target on academy?

[autumn moss]

I cannot

Working now

[proud dock]

Yeah mine just working too, thanks man

[pure terrace]

Heyy

I had a question for the better ones here

So i've been doing boxes for quite some time

and I realized that simply doing boxes and boxes again and again, reading writeups and leaving might not be the best way to learn

[stone pewter]

i have the same problem but i now focus on bounty hunting

its more challenging that boxes

[pure terrace]

I'm really eager to learn and climb my way up the difficulties but I'm facing trouble even at easy boxes. Sometimes it happens I simply don't take good notes or am lazy but sometimes I don't find the way. In those cases I was wondering how to get better. I found (someone gave me the link to) a blog post talking about taking the most from a box. The main idea I kept from it which applies to my case a lot is the post-root phase. Usually I just leave after root but the author was suggesting staying and

• study the exploit used to understand what was vulnerable
• search for more vulnerabilites and find other ways to get root if possible

I'm having trouble understanding how one would use their root access to find other exploits? Would you try simple recon to see what you could have missed from the root persepective (crons, user commands, services' configs and maybe user files or such)? Do you run every scan you can think of/run a linpeas and study the details of the answer?

I'm really wondering, that would be huge help if I could understand how to find other ways/ how you continue once root accessed

[turbid goblet]

Ok

[pure terrace]

also from a note taking point of view i started taking global throwaway notes when doing a box: i write everything in separate files in obsidian that i then merge into one when done to note what was important in the writeup. What I was wondering is: sometimes I go back and forth between services when testing those for example, how do you handle that, take proper notes? What's your notes system?

[gilded fern]

https://tenor.com/view/patrick-spongebob-spongebob-meme-patrick-meme-dumb-patrick-gif-9974665538168463324

[pure terrace]

thank you

[pure terrace]

does that help you get better or force you organizing better?

[austere sinew]

I’ve witnessed so many kinda mad at that

[gilded fern]

I think it's normal to still not be comfortable resolving machines completely independently. Practice a lot and if you make mistakes, don't take it as a reason to give up, but to learn from them. I can assure you that anyone in this field, even the most experienced, learns new things every day and constantly improves 💪

[summer urchin]

WOLO

[austere sinew]

Hai hai

Hru donut

[summer urchin]

sleepy

I’m going to sleep

[austere sinew]

WHAT THE FUCK DO YOU WANT MATTHEW

[austere sinew]

Awh, sleep tight donut

[summer urchin]

MATTHEW

[summer urchin]

thx

🛌

[austere sinew]

Honk shoo

[summer urchin]

sleep timeee

[summer urchin]

honk?

https://tenor.com/view/di-goose-honk-honk-angry-honk-honk-gif-17648939470482040238

[austere sinew]

NO DONUT

[summer urchin]

sleep time

[austere sinew]

SHOO BEGONE TO SLEEP

[summer urchin]

gngngngngn

[austere sinew]

SWEET DREAMS

[supple plume]

STAY AWAY FROM MY SANDWITCH

[quasi ridge]

https://tenor.com/view/aditi-mittal-to-the-kitchen-order-instruction-command-gif-11840569

[chrome tree]

Sand witch eating sandwich

[jagged storm]

https://tenor.com/view/tf2-heavy-my-honest-reaction-gif-8870827506935116922

[pure terrace]

thanks for the encouraging message, i'm really wondering how to enumerate once root has been acquired but i appreciate the message

[jagged storm]

Post-exploitation is mostly only a thing in prolabs/certs

[pure terrace]

well... I was doing this box (kobold) and I don't want to spoil it to others but let's say I found more than one way to get in

what i was wondering is once you are root, maybe there is a faster way to enumerate all the possibilities to get there more easily

you are root after all

[upbeat tangle]

Yeah

you can look at all the configs

[pure terrace]

yeah ok so config files, just for the websites?

or config files for the box?

[upbeat tangle]

all

[pure terrace]

sorry im not trying to be rude just really understand

so you have website configs

there has to be a config file for the box you're trying to get, right?

like for the box dog a dog.conf or something?

[jagged storm]

It really depends, and that isn't necessarily going to get you the answer. From your question above, academy is the best place to get the knowledge you're looking for.

[pure terrace]

yeah i get website is not the only place to get ingo

yeah thx ill keep in mind the academy

[upbeat tangle]

The summary of all the pieces is what makes the "box", not the one specific individual config

[jagged storm]

If you don't understand an exploit, you're not going to be able to spot it, even with root.

[pure terrace]

ok i think i kind of get it

but then you really have to enumerate everything you can (config files for websites, crons, groups, users, services, ports, ...)?

[molten bobcat]

Yessir

It's called an Audit

[jagged storm]

https://tenor.com/view/thanos-infinity-war-everything-avengers-gif-14066494

[balmy basalt]

Some of the same stuff applies. Linpeas like you mention can be good. If you want some more fun, you could also look at installing an agent for log collection and finding the tracks from your exploit and or what other players are doing on a shared instance. Just be careful not to hamstring the intended path.

[rapid badger]

Knowledge is power

[manic anvil]

guys is it normal that i forget alot of things from modules ? at least modules that i dont like use

[pure terrace]

ohhh yes that's a good idea too, thx

[jagged storm]

Are you taking detailed notes

[molten bobcat]

Think about it this way, every single one of these exploit checks is checking something by asking the system a question. Based on how the system responds we can make a determination.

Since this takes a while to ask a single question at a time

People often script

To have buttloads of questions asked

So determinations can be made

This is the logic behind winpeas and stuff

Linpeas

[manic anvil]

i am but like what i am forgetting is like the commands and such not the concept it self

[molten bobcat]

I guess you could say that's the logic behind every script

Lol

Automation 🪄

[pure terrace]

sorry who are you answering?

[upbeat tangle]

i think you

[jagged storm]

That's fine. As long as you know where to go in your notes, that's what is important. Knowing where to get the information you need is more important than just memorizing commands.

[molten bobcat]

You

I'm explaining how we get around the fact that.. boy howdy there's a lot of things to check

[pure terrace]

no its ok i get it haha, thanks

what i thought is: when i enumerated the box i found a few things, noted those and tested a few exploits. Then with some tests I got a way in but maybe i missed another way in, a quick way in or something. So maybe using linpeas as i did for the first way in will not solve it and maybe ill just find the same i found before really, i might think the same way i did before

[upbeat tangle]

The fun part is tricking the systems, decieving and cheating and breaking the system and bend it to your will 😉

[molten bobcat]

Sometimes boxes will have more than one answer

[balmy basalt]

^ That. I definitely can't keep everything in my head and look into my notes all the time.

[molten bobcat]

Unintended paths exist

[pure terrace]

so maybe there's a way to look at the box differently once you're in to get all the answers

i think ill test config files, it seems like a good idea

[molten bobcat]

After the box retires a public writeup is released you can compare to!

That way you can know for a fact "did I do this right?"

[pure terrace]

though this way if you did it the right way you don't really find the wrong way, do you?

[limber arch]

Also, be realistic with yourself. It takes awhile to find unintended paths in something that is suppose to only have one path in

[jagged storm]

There may be, but it really depends on the method that was set up. If you don't know the method, you probably aren't even going to be able to spot a misconfiguration.

[upbeat tangle]

Depends if you keep looking

[pure terrace]

that's good to know

[molten bobcat]

Just an option for boxes you can't solve and stuff

[pure terrace]

yeah ok that makes a lot of sense

[molten bobcat]

Eventually the answer comes out and you can see what or why you missed it

[pure terrace]

that's the question looking for what, but i have a better idea now thx

[jagged storm]

It's best to put a lot of time into studying in academy, so you at least know the basic flow, and what you might need to research, if you don't know.

[upbeat tangle]

some of my friends they dont enjoy a machine anymore once they have beat it, got the root and now thats past. So in their case they probably wont be looking for alternative paths other than the one they took

[molten bobcat]

There's a rhythm to it all

Find yo beat

[pure terrace]

yeah i get that it's not as fun but i think it's a good way to improve

[pure terrace]

yeah ok. That works, thx

[silver forge]

https://tenor.com/view/dance-monkey-dddd-gif-16453062350115083247

[upbeat tangle]

Meanwhile some of us psychopaths like to dissect the attack path into the smallest details

[frail turtle]

Anyone here likes astrology?

[upbeat tangle]

and realy go deep

[jagged storm]

https://tenor.com/view/no-officespace-disgust-nope-noman-gif-4702588

[pure terrace]

you mean study why it works and what made it possible?

[frail turtle]

[upbeat tangle]

Yes, go even depper than that!

[frail turtle]

The zelda stories of old go hard man

Like that shit is straight dark

[pure terrace]

yeah that helps a lot. For the first time i took a lot of notes for kobold, found 2 unintended ways and tried understanding the exploits, i find myself understanding the box a lot more, it's quite nice

as if i really mastered the box

almost

[upbeat tangle]

what you mean almost, you spent a lot of work on it, your allowed to brag

you did master kobold

be proud

[frail turtle]

Yeah i would never think about even downplaying anyone who spent time working on a challenge

Those shits are hard bruv

[pure terrace]

lmao yeah good summary

[pure terrace]

thanks, i am

[frail turtle]

Sometimes i even have trouble following ippsec on his solutions

[rancid snow]

theres not necessarily always alternative paths either. Usually theyre unintended if so

[pure terrace]

suppose i finished a box that is not released yet, is it allowed to discuss it with other people who finished it too?

[molten bobcat]

Privately

[rancid snow]

You can do whatever you want if you dont snitch on yourself

[jagged storm]

Gotta confirm they did it, too

[upbeat tangle]

Usually what happends is, someone finds an unintended way thats way easier then the intended path, gets root and never looks at the machine again. So they will never know the intended way. thats what im saying

[rancid snow]

that has happened to me before

[frail turtle]

Subdomains subdomains give me your subdomains

[pure terrace]

so like you ask for their profile you give yours and if both have solved it its fine, if someone snitches on you you won't have problems?

[frail turtle]

Dont think too hard about it the world is free and the only rule is there are no rules!

[pure terrace]

lmao

[jagged storm]

You can search anyone on htb lol

[pure terrace]

you're the rock from eveything, everywhere, all at once?

im really trying to not get banned from htb

i like the platform and it would be a shame

[frail turtle]

Eat a pikachu for dinner.

[rancid snow]

Cheating is so easy that if someone is going to great lengths to fake completeing a box just to tease an answer out of you then fuck it they can have the answer

[molten bobcat]

Real

[jagged storm]

Nah, report always. Reduce the trash.

[rancid snow]

I promise you the cheaters arent out here trying to scam box completers into slipping them answers

[upbeat tangle]

@pure terrace You can search players profiles on the website, so you check if they completed it already if you dont wanna leak anything unintentionally

[frail turtle]

Theres no point in cheating in HTB. Even if you get a job from your rank, you wont be able to cheat in your job.

[pure terrace]

im just saying if someone gives you the profile of someone else then can you be blamed for leaking answers, if you didn't know?

[jagged storm]

Nobody is getting a job from rank lol

[frail turtle]

You never know

[pure terrace]

lmao yeah

[upbeat tangle]

How would they do that, you can verify your profile on discored

[frail turtle]

Maybe not people on discord but there are job listing looking for ranks

[jagged storm]

No. It's far too easy to fake rank. Absolutely no place worth a damn cares lol

[frail turtle]

Like theyll ask for hacker and up

[upbeat tangle]

@pure terrace if you click my name here, and u see "verified" on roles, that means my discord is connected to my profile

so then you know, its me

[jagged storm]

That's just through the platform, to stop spammers

[pure terrace]

ohhhhh i forgot about that

[jagged storm]

Imagine getting 10k applications from skids

[frail turtle]

Too easy? Really? You think people are just going through the motions to fake a rank? You know how much dedication that takes?

[pure terrace]

thanks a lot, that solves it

hey im not verified

damn

[jagged storm]

None at all? lol

[pure terrace]

i had vip for more than 2 months and am still not verified haha

[upbeat tangle]

Must be something you missed

[pure terrace]

yep

[jagged storm]

There's usually a writeup for active boxes in a dozen different places, within the first few hours.

[silver forge]

https://tenor.com/view/rat-mouse-hamster-cheese-munch-gif-3597455348738038110

[frail turtle]

How many people are on the platform active solving challenges

Isnt it like 2000

At best.

[rancid snow]

bruh I see it all the time

[jagged storm]

Yeah, challenges are not nearly as popular. Maybe more will be with the new rank system.

[rancid snow]

theres people in this chat now I know faked rank

[iron galleon]

POLICE THEY BE WATCHING ME. EVERYDAY THEY CLOCKING ME.

[frail turtle]

Not me i didnt fake rank that shit took me actual days

No not days

[rancid snow]

I didnt say you

dont self report lmao

[frail turtle]

A whole fucking week just for one box

[jagged storm]

https://tenor.com/view/tf2spy-he-could-be-any-one-of-us-gif-22141763

[frail turtle]

An easy one 😂

[silver forge]

whats fake rank

[molten bobcat]

Mods asleep post coelacanth

[rancid snow]

cheaters

[jagged storm]

Dumpers

[rancid snow]

cheating is more common the higher up in ranks you go

[frail turtle]

One one occasion i did see a writeup on how to solve one challenge but i didnt even understand it. I went straight to here just to even ask wtf was going on.

[manic anvil]

how tasty when fried with some lemon juice on top?

[pure terrace]

are you supposed to link discord to htb from #social-profiles in settings?

[iron galleon]

You fighting an armed robbery, shawty, that's what they offering.

[naive nest]

I worry about choosing the wrong box and it goes inactive after so long

[rancid snow]

I spent a weekend in a cheater discord server where Id just go down the user list, see them joined to htb with the same discord account. screenshot their activity supporting cheating and then report them.

A LOT of the cheaters I reported were top 100 leaderboard peeps

[frail turtle]

What?!!

[pure terrace]

bruh

[frail turtle]

God whyy would people do that

[jagged storm]

That's why I trust hacker rank more than higher ranks. A cheater won't stop at hacker lol

[manic anvil]

cheating like the season or the machines in general?

[frail turtle]

You get literally fuck all out of the HTB rank

[silver forge]

while I believe you, it baffles me why you care

[pure terrace]

ngl it's not that astonnishing, someone i know is cheating for a fact is top 40 undisturbed and his profile is veeery weird

[rancid snow]

I was bored and trying to prove a point to someone at the time

[pure terrace]

like he started cysec without knowing how to connect a vpn but climbed to top 100 in less than 6 months

[jagged storm]

epeen, just the same as people cheat in video games

[frosty temple]

hey, i need some advice
been learning cyber security and so far i have a good grasp on the fundamentals, but i haven't really learned any coding language very well. i've coded since i was young but im kind of wondering if i should go learn C or Python.

[jagged storm]

Depends on what you're learning, and what you want to do. For starting out with pentesting, you really only need bash/powershell

[jagged storm]

You would also see people with super high rank get stuck on really easy modules for certs lol

[iron galleon]

just become a cop bro

perfect job for policing

[pure terrace]

lmao

[frail turtle]

WHY would peolle pay on a platform to cheat on it

[pure terrace]

that's just a shame relaly

but a bit fun too

[frosty temple]

i am just wanting to do pentesting and CTFs. rn im just refreshing my memory on a few key topics since i switched to hackthebox from a competitor and need to regain my footing within cyber.

[jagged storm]

I remember when an elite hacker rank came into #cpts for help with the metasploit module

[balmy basalt]

Flex fake internet points.

[rancid snow]

tbf I dont think anybody is paying to cheat on htb

if they are theyre extra stupid and I have a bridge to sell

[balmy basalt]

Hehe. I remember a higher rank than that at one point that couldn't troubleshoot openVPN connection issues.

[molten bobcat]

Fuckkk that's brutal

Lmaooo

[jagged storm]

You don't need to do much/any programming. Some lite python.

[manic anvil]

so just for the record dont learn coding rn because you want to (unless you have the time to spare beside learning pentesting) learn when you need to , like when you reach the point where you exploit websites you will start to learn java and html and such
when you reach the point where you want to build your own tools and automate things you will start learning pyhton for that i think you already learning bash or powershell as these are like the basics

[frail turtle]

Okay i can see someone asking for help on how to attach a process to another in metasploit, i mean that i could see happening bevause i forgot how to do that myself

[balmy basalt]

Like I mean the supper basic, "Do you have more than one instance running? Are you on the right lab? etc."

[frail turtle]

Its a relatively advanced technique

[frosty temple]

alrighty tysm

[frail turtle]

But if its genrating some payload like you should be a greay name

[frosty temple]

ahhh i see, thank you!
i've done a litle bit of XSS and thereby learnt a tiny bit of javascript, but im sure down the line it'll come back 😁

[jagged storm]

The module was super basic.

You even went though it for cpts lol

[frail turtle]

Sigh thats embarrassing

[novel sun]

Not gonna lie, I was super stuck on a Password Cracking module back in the days, and I probably would be stuck even today 😅

[manic anvil]

yeah just learn things when you need them really for something else , when you reach the point where you feel you are good at pentesting you can have the freedom to learn anything else out of "i can" like reverse engineering or malware engineering (i am not sure if these two are the same thing or not lol) and so on

[jagged storm]

https://academy.hackthebox.com/course/preview/using-the-metasploit-framework

That one

[frail turtle]

It was for a module

Wait wait

Wait

Lol

[jagged storm]

Yeah, elite hacker rank was asking for help with it, in #cpts

[frail turtle]

An elite hacker going through cpts doesnt know basic metasploit 👀

[jagged storm]

Just straight up telling on himself lol

[frosty temple]

metasploit is pretty chill. its kinda like physics in the sense that you just find the right module, plug in the data and boom progress.

[manic anvil]

i mean lol we can have a good faith that he was super elite he never used metasploit

[jagged storm]

If he has any skill at all, the module is trivial

[austere sinew]

I DONT WANT IT LET IT GO IT WAS AN ACCIDENT

[balmy basalt]

RIP. Password cracking can lead to some long term side tracks.

[frail turtle]

Lol

[manic anvil]

wait the problem was with the module or metasploit it self?

[jagged storm]

The questions in the module were too hard for him

[manic anvil]

wtf lol

[novel sun]

At least thick applications are no longer part of the path (I hope) ^^

[frail turtle]

I wonder if the module covers what i spoke of, because if i recall the process hijacking thing i looked it up on some blog before going through cpts

[manic anvil]

yeah that just straight up telling on yourself

[rancid snow]

honestly this is the secret truth of why I like spotting cheaters. Its fucking hilarious

[jagged storm]

Oh? That finally happened?

[manic anvil]

what you asked about?

[frail turtle]

No basically its where you take the running process of a metasploit shell and slap it into another process on windows

[novel sun]

I remember hearing that it was removed about a year ago? Or did I dream of that? lol

[frail turtle]

Kill the one you made

[jagged storm]

I hadn't heard anything. I was sure it was still terrorizing people.

[manic anvil]

uh no it dont have it

[heady sage]

What a nice man, I wonder what he has to say?

[frosty temple]

correct me if im wrong, but isnt it just using meterpreter to move metasploit over to another process?

[manic anvil]

the closer thing is you can chain payloads from metasploit it self like running a payload in the background and delivering a second payload based on that

[frail turtle]

Hmm

[novel sun]

Okay, it was a dream apparently. It still exists, and I feel sorry for all future CPTS takers 😐

[frail turtle]

You got it in reverse, its moving the shell made with meterpret---- BAH why am i explaining just look it up

Its mostly an obfuscation technique

[jagged storm]

You mean just migrate? lol

[frail turtle]

Yes migrate thank you rat

[frosty temple]

oh right thanks :D
been a lil bit since i played around with metasploit 😆

[frail turtle]

Metasploit basically puts the process of your shell into the memory page of another given the right permissions to write and whatever

Like it writes it in the end

[jagged storm]

You just 'migrate <pid>' from meterpreter

[frosty temple]

doing cyber at my age feels so foreign. everyone is so old compared to me 😭

[jagged storm]

Filthy disgusting meterpreter

[frosty temple]

HERETIC

METERPRETER IS AWESOME

[manic anvil]

"Back in my days we used to hack a nuclear facility with a USB"

[jagged storm]

https://tenor.com/view/wolfhowling-yes-gif-20150350

[frail turtle]

GOD I JUST BIT MY LIP ENOUGH TO DRAW BLOOD WHILE EATING

that shit hurt

[sleek dome]

The days of http are long gone too 🤣

[frosty temple]

XD
i have a friend who is doing some cyber things, but im self studying faster than his education. i want to play CTF with him, but there's still like a year left before he'll be ready education wise.

[jagged storm]

If you eat and shitpost, you'll do neither very well.

[manic anvil]

the probelm is how can you fall for such an attack it was during 2010 like the basics of security were not to "stick a USB you found randomly"

[frosty temple]

lowkey excited for uni. high school is so boring.

[manic anvil]

the learning curve wil be real

[sleek dome]

How else am I meant to see what’s on it 😝😝

[manic anvil]

use it in your own laptop not A NUCLEAR FACILITY

[frail turtle]

i found an SD card with malware in it one time

it had some guys pictures

i still ended up using it

[manic anvil]

lol wtf

[frail turtle]

reinstalled windows and all

dont worry i myself was not hacked

[sleek dome]

Just scarred 🤣

[frail turtle]

no not scared either

why would i be scared

of malwarebytes flagging some file

[sleek dome]

From the dudes pics 🤣

[rancid snow]

I do data recovery jobs. Ive seen worse

[limber arch]

“Elite Hacker”

[green kite]

Can you recover my bank account’s balance?

[rancid snow]

no

[green kite]

It just dropped 100k over the past weeks, I do know where the money went, but I want the balance back

[rancid snow]

unless your bank password was only written inside a text file on your waterlogged macbook, I could help with that

[green kite]

Damnit

[rancid snow]

usually its people needing dead relatives photos that they never backed up till it was too late

[green kite]

I don’t own a MacBook what now

[green kite]

That’s sad. But yeah, know how that feels

How’s everyone today

[rancid snow]

I think my favorite one was a mother who was transferring phones using some stupid verizon file transfer app that failed halfway and deleted her recorded calls from her son who died of cancer.

I managed to find a log file from the app that still has the data and wrote up a python script to extract it

[green kite]

Must’ve felt heartwarming

That you were able to help the mother

[frail turtle]

I think

[rancid snow]

I thought it was going to be totally helpless at first, which sadly isnt unusual, but we got lucky

[frail turtle]

I wanna try Qt 6

I was gonna use GLFW

but Qt6 shiny idk

i mean just look at the font for the docs

[pure terrace]

im back

and finally verified

[dusky jacinth]

Congrats

[manic anvil]

SKIIID

[analog perch]

Do you guys think that buying compatible router with OpenWrt to run SQM can fix the bufferbloat issues?
I'm thinking to get cheap router and upgrade firmware with Openwrt
I got 5 mb upload speed
Trying to fix latency in cloud gaming
I also checked with wave website and got F constantly from bufferbloat test

[dusky jacinth]

https://tenor.com/view/cute-tired-baby-gif-27658791

[pure terrace]

thanks, it took me a long time

almost 5 minutes

[dusky jacinth]

Custom make your own router

Buy esp32

[analog perch]

not sure how to make my own router, don't wanna buck it up

[dusky jacinth]

Googlize it

[analog perch]

googlize and legalize, ok thanks for the suggestion. I watched somebody on youtube that he has his own routerize

[dusky jacinth]

It’s not that hard actually

You fs could watch a video on YT and figure it out

[rancid totem]

just read docs boy

[jagged storm]

pfsense, card with multiple NIC ports

SFP ports, if you want to get fancy

Slap some fiber on that bad boy

[dusky jacinth]

Excuse me??

How dare you assume I can read

https://tenor.com/view/cat-hiss-cat-hiss-mean-cat-leave-me-alone-gif-16182916

[pure terrace]

for someone on computers that's a huge assumption indeed

[dusky jacinth]

I just have ChatGPT read it for me

Duh

[pure terrace]

say, how do we get all the htb tags here?

i mean roles or whatever this is

i wanna show off if anyone's wondering, not anyone can be bronze during seasons

[dusky jacinth]

Like your rank?

[jagged storm]

Roles are based on rank, or achievements in certs.

[pure terrace]

yeah

[jagged storm]

They haven't updated discord to use the new rank system yet

[pure terrace]

has the old one been deleted or are both used now?

[jagged storm]

The old rank is still in use here. Both ranks exist at once on the site.

[pure terrace]

oh ok

since i only verified now, it might not have updated yet

[jagged storm]

But the new rank will kick in on discord soon enough

[pure terrace]

is it done automatically or when i update ranks?

[dusky jacinth]

Legacy ranks are related to % of content ownership

[jagged storm]

it might take a few hours

[dusky jacinth]

Actuvey*

Active**

[pure terrace]

yes ik ik, ive been on the platform a bit

[pure terrace]

thanks

[jagged storm]

You can disconnect/reconnect it, to force an update.

Certs update as soon as you register them.

[gilded fern]

tgcom24

https://tenor.com/view/zia-carmelita-barbaradurso-carmelita-durso-pomeriggio5-gif-13961919

[pure terrace]

you mean disconnect reconnect htb?

ill wait tomorrow evening really, thanks

[jagged storm]

yeah, in the profile

You hacker rank now?

[pure terrace]

bruh no i dont think so

[jagged storm]

Oh, then nothing will update here lol

[analog perch]

I completed 5 hours talk and 18% battery consumption with ISP today. Do I deserve a badge?

[dusky jacinth]

You’ll get your little season badge from completing active seasonal machines

[pure terrace]

im not even sure what rank i am

but yeah didn't think of that haha

[jagged storm]

You're a script kiddie

[dusky jacinth]

Which you only get points for the week they are active (that’s how I have the bronze badge)

[pure terrace]

ill try to do one but i thought i had done one already

[analog perch]

https://tenor.com/view/no-yes-ok-yes-no-maybe-gif-14428545

[pure terrace]

rn im always waiting for easy linux so its not that often

[dusky jacinth]

Ohhhhhh

[jagged storm]

Hacker is the next rank above you.

[dusky jacinth]

Rough…

[pure terrace]

damn i really am a script kiddie

its just mediums seem so out of reach

[dusky jacinth]

All easy machines rn are Linux I’m pretty sure