resources

[remote wind]

For those who are getting started

[fast wraith]

Currently taking the TCM OSINT course, really fantastic stuff. Actually has a very nice UI and video player. It's TCM material so it's very methodology-heavy training and easily worth 4-5x what he's charging
https://academy.tcm-sec.com/courses

[crimson thunder]

it's top notch 😄

[fast wraith]

have you finished it?

[crimson thunder]

not this specific course, I'm halfway through the peh course (taking a pause due to other responsibilities)

I was talking about his material in general

[fast wraith]

ah okay gotcha, yeah I finished his udemy course when it first came out - didn't do the AD stuff yet though

and I currently have his Windows Escalation course I haven't gotten around to yet

I know he has a certification in the works too I'm excited for

[magic idol]

Thanks for that link James. Something I can do while at work and with nothing to do

[dim marlin]

If yall have any comprehensive resources on threat intelligence please lets me know

Needs to read all this before summer

[proud pebble]

I'm 40% through the PEH got a fair bit to do.

[craggy onyx]

https://github.com/hslatman/awesome-threat-intelligence

[cloud sluice]

Does elearn have a monthly subscription to the cyber pass pr is that a myth?

I saw themayor11 ask them and i think they said yes but if anyone who knows can confirm this

[faint sluice]

they do, its $200/month

[magic idol]

Ive heard you have to contact them to get the monthly plan

[cloud sluice]

Oh really, okay thats good to hear! Thnks for the heads up @faint sluice @magic idol

[shut ferry]

That's awesome! I didn’t know that 😍

[light crystal]

beginner Certified Information Systems Security Professional- CISSP 2020 beginner

recyclePrice: $150 Free

o️Source Link: https://infosec4tc.teachable.com/p/certified-information-systems-security-professional-cissp-2020/?product_id=2640261&coupon_code=JHJFJDFHLSKJDF&preview=logged_out

Coupon Code: JHJFJDFHLSKJDF

i hope i can put this

[crimson thunder]

https://www.freecodecamp.org/news/kubernetes-vs-docker-whats-the-difference-explained-with-examples/

[hazy trench]

Is it a real one or the training?

[light crystal]

idk i got this in another server

[hazy trench]

It's not real. It's training for the real CISSP

[river ocean]

https://www.infosecarticles.com/

[cobalt trout]

What is the best resource to get started with Reversing and actually with Vulnerability Research?

[balmy arch]

I wouldn't focus on 'the best resource' and just start, don't fall for that toolbox fallacy.

that being said, I hear good things about no starch press, and they have a book (or two) on reversing. You can find it here: https://nostarch.com/catalog/security

(You'll end up a better researching by starting today than you will waiting for that elusive 'best' resource 😉 )

[azure widget]

@cobalt trout ```md

Resources

These are the resources I have found while learning about the binary exploitation.

Blogs:-

• https://syedfarazabrar.com/
• https://kileak.github.io
• https://d4mianwayne.github.io/
• https://ctf101.org/binary-exploitation/buffer-overflow/
• https://blog.skullsecurity.org/category/ctfs

Youtube:-

• https://www.youtube.com/channel/UCi-IXmtQLrJjg5Ji78DqvAg/videos
• https://www.youtube.com/playlist?list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN

Wargames:-

• http://pwnable.kr/
• http://pwnable.tw/
• http://pwn.eonew.cn
• https://www.root-me.org/?lang=en
• http://smashthestack.org/
• https://exploit.education/

Pwn Related Stuffs:-

• PwnTips - https://github.com/Naetw/CTF-pwn-tips
• Quick guide -https://trailofbits.github.io/ctf/exploits/binary1.html
• Pwn Challenge List - https://pastebin.com/uyifxgPu

Stuff Robin gave me:-

• Course materials for Modern Binary Exploitation by RPISEC - https://github.com/RPISEC/MBE

• Learn ROP - https://ropemporium.com/

• For Linux binary Exploitation - https://github.com/scwuaptx/HITCON-Training

• Intro to binary exploitation / reverse engineering course - https://guyinatuxedo.github.io/

• A collection of pwn/CTF related utilities for Ghidra - https://github.com/0xb0bb/pwndra

• Some pwn challenges selected for training and education. - https://github.com/BrieflyX/ctf-pwns

• A set of Linux binary exploitation tasks for beginners on various architectures - https://github.com/xairy/easy-linux-pwn

• ASM Basics - https://asmtutor.com/#lesson1

https://link.medium.com/OOfh4A1sbcb

[proud dome]

Recently made an interactive cheat sheet website for Windows/AD hacking, think it could be really useful for people: https://wadcoms.github.io/

[unborn gust]

@topaz gulch Just read your OSCP blog post and wow that was amazing! Congratulations on passing! I am trying to also get the OSCP but currently feel like I do not know as much information to sign up. I have been doing a lot of tryhackme to prepare and get some more experience, but your post gave amazing advice also.

[topaz gulch]

Glad it was useful 🙂

[crimson thunder]

Almost metallica

[light crystal]

https://www.udemy.com/course/penetration-skills/?couponCode=B14D4E969AFBC64910E6
Udemy

[odd quest]

Oof udemy

[tepid patio]

I updated this! https://blog.tryhackme.com/free_path/

[dim marlin]

https://marcoramilli.com/2020/08/24/how-to-reverse-office-droppers-personal-notes/

[prime sable]

https://github.com/oldkingcone/slopShell

[sonic abyss]

Possibly one of the worst udemy ethical hacking courses I've seen (In my opinion, the instructor doesn't explain things clearly, the video quality isn't good, he just skips over the most important things and much more)

[glad hazel]

LOL Why?

[prime sable]

fun tip

you can unzip excel docs to see what they have contained in them.

[sonic abyss]

Patched but quite interesting

https://youtu.be/0f3RrvC-zGI

[cloud sluice]

Anyone have a good article explaining port forwarding pls?

[odd quest]

Do you understand NAT?

Once you understand NAT and how it works, port forwarding becomes a lot easier to understand

[cloud sluice]

Yes I do, learned that through elearns course

[odd quest]

So, port forwarding is just mapping a port on the public side to an IP+port on the private side. Any traffic to that port on the public IP gets sent to whatever IP+port you set it to be sent to.

[cloud sluice]

Wow thats legit explaining NAT devices, thnks for the simple explanation!

[light crystal]

ok idk i wont send anything now

everyone scolds me 😦

[quasi scarab]

@spark hedge When you get the chance, could you DM me real quick? I'd love to get your opinion and thoughts on some write up stuff :)

[sonic abyss]

Nah it's not your fault, you got a free course which is good but honestly it's not really a good one

[wooden vigil]

Can someone recommend the Practical Ethical Hacking Course of TCM-Sec?

[faint sluice]

yes, it is really good

note you will want a HTB paid account to fully take advantage of the course

[wooden vigil]

nice thank you

[distant gust]

I've just accepted an offer for a junior incident response role, but I'm still pretty green to this side of cybersecurity. Can anyone recommend any good resources / certs to start working through?

Ideally something cheaper or my wife will murder me

[faint sluice]

I'd definitely look at DFIR Diva, she has a ton of resources

https://dfirdiva.com/

[distant gust]

Exactly what I was looking for, thanks!

[modest hedge]

TCM teaches htb boxes in that course?

[faint sluice]

He uses HTB retired boxes to show techniques. You could just watch and follow but what I do is try the box first by myself then watch the video

[sonic abyss]

https://freetraining.dfirdiva.com/

For the free resources / training)

[topaz gulch]

Think he'd be open to having us dev some free ones for him?

[faint sluice]

too slow

[faint sluice]

Heath? thats who the HTB reference was 🙂 he's already your boy

[topaz gulch]

Yeah, fair enough 😄

[modest hedge]

True one doesn't learn by just watching

[odd quest]

Some people do and I don't think you should ignore that

[sonic abyss]

oh no, I posted it on purpose because she has paid and free resources

[shrewd ginkgo]

Xbox Game Pass ultimate is £1 for 3 months right now, includes 3 months of Discord Nitro (if you've never had nitro before)
https://www.xbox.com/en-GB/xbox-game-pass

[sonic abyss]

oh shoot

lets go

[shrewd ginkgo]

it's working

[hasty fox]

"Never had nitro before" also includes the snowsgiving nitro a loooong time ago fyi

[hasty fox]

What's a good resource to learn docker and kubernetes?

[unreal hollow]

in what context

how to setup, use, or hack

[hasty fox]

setup and use

[unreal hollow]

Google has some good docs on Kubernetes

[upbeat token]

Humble Bundle has a huge collection of No Starch Press infosec books right now for very cheap 😄 https://www.humblebundle.com/books/hacking-101-no-starch-press-books

I had like half of these in my wishlist already, so I figured I'd share it here as well

[tepid patio]

Compose your own @cloud brook opera, rather cool exploration into composition of music and the harmony of pitches https://artsandculture.google.com/experiment/blob-opera/AAHWrq360NcGbw?cp=eyJyIjoiS3pYczhiN055UV9HIn0

[topaz gulch]

Infosec resources Bee smh

[tepid patio]

Please avoid self-promotion of paid content here.

I checked!

[topaz gulch]

Infosec resources!

[cloud brook]

I’m honored that they made AI in my name @tepid patio

[unreal hollow]

I though blob was doing opera now

[cloud brook]

I am

[azure widget]

Not specified

[topaz gulch]

I am specifying now

[azure widget]

Boooo

[azure widget]

https://github.com/SwiftOnSecurity/OrgKit

[magic idol]

Any thoughts on rangeforce?

I did a few hands-on blue team type exercise in a complete virtual environment right in the browser.

[verbal siren]

$5 books and videos on Packt. any recommended books here?
packt.live/2q0AbGZ

[faint sluice]

Packt is greatly hit or miss, more miss than hit. timtaylor did mention this book (I believe) as being good when I asked about something other than Portswigger academy https://www.packtpub.com/product/burp-suite-cookbook/9781789531732

[night ether]

how did you find it? can't tell you how many emails i've had from them

[magic idol]

Saw someone mentioned them on linkedin. Looked them up, signed up and thats it

[magic idol]

Very cool practical training. Right from the browser

They are definitely not spamming my inbox. Maybe you are special :)

[tepid patio]

https://github.com/rocky-linux/rocky

[tepid patio]

https://blog.cloudflare.com/cloudflare-pages/

[tepid patio]

Wait TIL you can replace backend with server-less functions, effectively you can have a webapp without having a server which is a big plus for security (provided you trust the provider though)

[agile pawn]

I don't know if anyone has sent a list but what are the best books for OS Hacking?

[azure widget]

@agile pawn what do you mean by OS hacking?

that’s a very broad term

[agile pawn]

I mean like that book "Android Security Internals".

Do you recommend another like this?

[sonic abyss]

https://cybr.com/ebooks/

[agile pawn]

This list looks amazing, thanks

[sonic abyss]

No worries, it's a pretty knew company which is cool

[ember gulch]

Yay thanks for sharing @sonic abyss ! Someone just told me they saw a mention of it so wanted to drop by and offer my support / say hi

[red blade]

https://github.com/trimstray/the-book-of-secret-knowledge

https://awesomeopensource.com/projects/hacking

[sturdy shell]

Bee you already knew this -- AWS lightsail (:

[tepid patio]

AWS lightsail is managed EC2 like DO

it has a backend 😛

unless you meant lightsail container services?

[shut ferry]

https://0xrick.github.io/lists/stego

[tepid patio]

https://www.reddit.com/r/tryhackme/comments/kfmqoa/this_week_was_about_well_check_it_for_yourself/

This weeks cyber security news in a nutshell 😄

[gritty barn]

lightsail is amazing, it keeps everything nice and cheap

[hollow crater]

Hey y'all! Does anyone have cool resources or a blog post on a good Kali setup for THM? I have tried: WSL Kali on my main machine, Kali 2020.4 on an older laptop, and then the THM attackbox Kali. WSL Kali has issues with persmissions and I'm not loving win-kex or xrdp, "vanilla" Kali is cool and has all the 2020.4 features that WSL doesn't but it's on a slower machine, and the attackbox has significant delay for me. I'm fairly new to Linux and networking but have a programming background, so I'd like to stick to my main Win10 machine +WSL if possible.

[odd quest]

Just make a Kali VM. WSL is not a good solution due to how it works.

Mostly the networking setup

[hollow crater]

Cool, thank you. I have very little understanding of why networking would be better on one over another so I appreciate that.

[sick berry]

does anyone know of a good room to experiment with ROP?

[summer iron]

Which is better for 4gb ram laptop VM VIRTUAL BOX Or WSL

??

[prisma bison]

#infosec-general but VMWARE VM imo

[hushed estuary]

Wsl2 is basically a VM, but it's still hyperv which precludes using userspace hypervisors

Though it might get more interesting once Microsoft natively supports Wayland

[azure widget]

That’s not why James suggests against WSL2

[azure widget]

as he said here it’s because of the jank networking

[hushed estuary]

Seems to work ok enough for me but it's a bit janky on some machines I guess

It uses a hyperv virtual switch

[jagged tiger]

I have also had really terrible experiences with the TCP/IP stack in WSL.

[edgy plank]

anyone have some good resources for network forensics? 👀

[livid timber]

This site has some great challenges - https://cyberdefenders.org/

[edgy plank]

thanks!

[sick berry]

CyberDefenders is pretty good

[fast wraith]

Install a mail-server on your Pi! I use this to forward various logs like my DD-WRT and PiHole logs to a local e-mail specifically meant for my home network administration. (it also has chat rooms!) https://www.citadel.org/easyinstall.html

[odd quest]

https://www.sans.org/blog/getting-the-most-out-of-shodan-searches/

[sage walrus]

are they paid ??

does this site requires subscriptions

[azure widget]

seems like something you could find out easily for yourself

[sage walrus]

yes/no would have been fine.

[odd quest]

Hacking is 90% research

[sage walrus]

Noted.

[fast wraith]

Finally got my password management off the cloud and now using KeePassXC, Lastpass makes it really easy if you export to CSV. https://keepassxc.org/

[jagged tiger]

Droogy, if you are into self managed options check out bitwarden. You can do cloud, private cloud, and local only

Nvm, they changed the app version - used to have an option for a local db.

[night ether]

big fan of lastpass

[fast wraith]

I do like lastpass too, and for 99% of people it's totally acceptable but in the long term I want my data stored locally

[faint sluice]

I like lastpass because I can use it on my phone and computer

[fast wraith]

my android phone is so old autofill works maybe 5% of the time so it doesn't even matter to me lol

ideally I would like to just have a yubi-key/physical (non-biometric) solution for everything on my phone

[shrewd ginkgo]

What do people think of 1password in comparison to lastpass?

[topaz gulch]

I use it 🤷‍♂️

[unreal hollow]

I use Last Pass for personal and at work we use Keeper, they both are kinda similar, I just like the layout of Last Pass better

[wind osprey]

I've had problems setting up the most recent Kali as a virtual machine in vmware. Anyone have any luck with this?

[subtle dirge]

Wrong channel. Ask in #infosec-general with some more details about error and possibly a screenshot.

[gritty barn]

dashlane is also a good option imo

[shrewd ginkgo]

https://gosecure.github.io/template-injection-workshop/#0

I haven't done this workshop yet, but it looks kinda cool

[livid timber]

Thanks, that does look interesting

[ornate delta]

ooh

[calm ermine]

Sm9l - I wouldn't have thought so. There very few (if any) ethical reasons for that sort of attack which is why we don't really talk about them here.

[prisma bison]

That and

We are teaching about security vulnerabilities and accessing boxes

[gritty barn]

i mean, stress testing is a type of testing as well @calm ermine @prisma bison , as long as it is agreed in the scope of engagement.

[prisma bison]

My point still stands haha

[gritty barn]

it is still a vulnerability. Certain CiscoOS versions are susceptible to a DoS vulnerability that can crash it or make it exclude the ACLs for following packets

i can provide you with loads of them if you are interested, i am just saying that DDoS is bad, but DoS seems like a quite unimportant topic, nonetheless you want to avoid them in client engagements

[prisma bison]

Mhm of course

[livid timber]

Free release of the training materials from a course on Source Code Auditing at Hack In The Box in 2018 - https://blog.recurity-labs.com/2020-12-23/code-audit-training-archive.html

[light crystal]

https://www.udemy.com/course/wireshark-packet-analysis-and-ethical-hacking-core-skills/?ranMID=39197&ranEAID=*7W41uFlkSs&ranSiteID=.7W41uFlkSs-Kd3zzQ2SzkRdmlAzUgjjNA&LSNPUBID=*7W41uFlkSs&utm_source=aff-campaign&utm_medium=udemyads&couponCode=DAVIDBOMBALCHRISTMAS

[languid parcel]

https://www.udemy.com/course/the-complete-internet-security-privacy-course-volume-1/

https://www.udemy.com/course/the-complete-cyber-security-course-anonymous-browsing/

https://www.udemy.com/course/network-security-course/

[sonic abyss]

Udemy

[unreal hollow]

Nathan House has good resources on his StationX site as well

[languid parcel]

definitely

Nathan is top tier

[faint sluice]

I've seen those classes saw the logo and clicked off ... just its a bit much

[sonic abyss]

Expired :(

[light crystal]

it had 2 hrs left

after i posted

[light crystal]

Free Linux course: http://bit.ly/34G73WP

Free Ansible course: http://bit.ly/37KyoJu

ONLY 2 HRS LEFT

@sonic abyss

pinged u be4 its expired

[sonic abyss]

Gelocating tool for Santa :P 🎅

https://www.noradsanta.org/

[keen field]

https://www.youtube.com/channel/UCPeJcqbi8v46Adk59plaaXg

Amazing resource

[cloud kite]

Thanks for the Udemy links. Was able to nab a bunch of courses for free. Just need to find the time in between work and uni

[shut ferry]

https://www.udemy.com/course/cisco-ccent-icnd1-100-105-complete-course-sims-and-gns3/?couponCode=NCCHRISTMAS Literally free prep course for CCNA!

[vital trench]

The course of Nathan from Udemy. What do you mean "its a bit much"? Just out of curiosity

[faint sluice]

the logo

[vital trench]

gotcha

[azure widget]

All of Udemy is meh for cybersec except for TCM and Tibs

[faint sluice]

yeah TCM is solid, there is a lot of good AWS stuff there,

Udemy does have a money back guarantee, I've totally bought a course and realized it wasn't for me

[azure widget]

I dislike the discount by 90% all the time system of Udemy and I dislike that because courses are community made some of them are just horrible

[shut ferry]

Those who put udemy courses with 100% off are amazing people

[light crystal]

https://www.udemy.com/course/digital-forensics-for-pentesters-hands-on-learning/?utm_content=promo&utm_campaign=2020-12-27&utm_source=email-sendgrid&utm_term=5294450&utm_medium=1888568&couponCode=4A8CD4935427827ED0D4

[light crystal]

@shut ferry

[jaunty raven]

Overpass

[tepid patio]

This is a cool blog post https://www.reddit.com/r/tryhackme/comments/kl8h13/upgrade_your_common_hacking_tools/

[odd quest]

Is there an accessible mode for feroxbuster?

[tepid patio]

no but i think I can convince Tib to make autorecon accessible

i did bug John the other day too with one of his CTFs lol

[odd quest]

The first thing I noticed was the banners

[tepid patio]

is there a way to host mp3 files

somewhere

https://github.com/Tib3rius/AutoRecon/issues/73

ok nice

[tepid patio]

Lex Fridman is an AI researcher, but he also has a podcast where he interviews some really big names. Unlike other podcasters, Lex actually studies the topics of the people he interviews so you end up with some really interesting discussions. Some of the big names hes interviewed:

• Elon Musk
• Dan Carlin
• Joe Rogan
• Jack Dorsey (I loved this one, Jack calls himself a hacker instead of a CEO which is cool)
• Vitalik Buterin
• George Hotz (GeoHotz)

I highly recommend this podcast. Also, all of Lex's MIT lectures on DeepLearning are fantastic.
https://www.youtube.com/c/lexfridman/videos?view=0&sort=p&flow=grid

[faint sluice]

nice

[solar socket]

https://fieldraccoon.github.io/posts/How-to-make-Boot2Root-machines/ for people who want to make their own machine but arent sure where to start

[honest basin]

anyone got more resources for pwn stuff?

[odd quest]

There's a bunch pinned

Like a LOT

[honest basin]

oh thank you I haven't check the pins sorry

I will suggest one myself no clue if anyone has linked this before: https://pwn.college/

[shut ferry]

you chad

[crimson thunder]

https://blog.yeswehack.com/practical-vulnerability-disclosure-white-paper/

[prime mantle]

https://gist.github.com/bastman/5b57ddb3c11942094f8d0a97d461b430

[fast wraith]

Anyone with a good RSS feed willing to share their OPML? Or any good blogs (with RSS) in general

[tepid patio]

its a lot of sources tho

feedly doesnt actually tell me because its too many

it just says "1k+"

[fast wraith]

thank you so much! I debated using feedly but I have a lot of privacy concerns with them, it was actually super annoying finding a good, open-source RSS reader for Windows

[jaunty pulsar]

I would recommend launch scprits by category, example if you use "--script=auth" will try to auth with default credentials,

AutoRecon is nice, but that output woould be really helpfull, i have to write the sentence for nmap

[reef rampart]

Came across this cyberchef like site yesterday - Universal Encoding Tool - UnEnc
https://www.unenc.com/

[tepid patio]

https://savebreach.com/stealing-private-documents-through-a-google-docs-bug/

[tawny stone]

Just released Stegseek v0.5 (The Official StegCracker Killer ™️ )
https://github.com/RickdeJager/stegseek
Changes:

* No longer eats all of your ram
* Scales better with cores. (Can try all of rockyou in under 1 second if you give it ~16 threads)
* Can take stupidly large wordlists as input. (15GB worked fine)
* Some bugfixes and whatnot
* 12 000 -ish times faster than StegCracker

[tepid patio]

https://ine.com/

[languid parcel]

o.o

not a bad offer

[faint sluice]

https://twitter.com/thecybermentor/status/1343679225925160961

Heath Adams (@thecybermentor)

Last coupon of 2020 - HALFOFFNEWYEARS

Takes 50% off anything. PEH, OSINT, PrivEsc, Hacker Bundles, and All-Access.

By request, this works on both @TCMSecurity Academy and Udemy.

https://t.co/c9y1tFtyuk
https://t.co/CADCSe1ITx

Expires Jan 1st. kthxbye ❤️

Twitter · Dec 28, 2020, 10:04 PM

also this if you haven't seen it https://twitter.com/TibSec/status/1342514769916551175

Tib3rius (@TibSec)

If you didn't win, you can grab my courses for $9.99 each for the next 5 days using coupon code XMAS2020:

https://t.co/tCsOgtn9ZU

https://t.co/oXkwRiTlq2

Merry Christmas! #InfoSec #OSCP

https://t.co/eqLxVvRv6C

Twitter · Dec 25, 2020, 4:57 PM

[spiral zodiac]

https://pentestlab.blog/2017/12/15/microsoft-office-payloads-in-document-properties/

[azure widget]

That’s seems like a lot of work since macros are still a thing

[spiral zodiac]

^ same, but I posted it anyway 🤷‍♂️ 😄

but it might help in evading av I guess? but the Shell in the macro should get flagged by av anyway

[fast wraith]

Finding an open-source RSS reader for Windows that doesn't look like total crap, has the features I need, and supports dark mode was actually more annoying than it should've been. Found this one which is rather good.
https://github.com/yang991178/fluent-reader/releases

[tepid patio]

😦

[fast wraith]

👀
i got a smartscreen warning on install that I just clicked thru lol
looks like that triggered in Edge?

[azure widget]

It’s looks like it forces you to write them onto disk on an SMB share which is odd

[fast wraith]

somewhat decent article about the state of security architecture and best practices written way back in 2005.
Also has this really fun line

My prediction is that the "Hacking is Cool" dumb idea will be a dead idea in the next 10 years.

https://ranum.com/security/computer_security/editorials/dumb/index.html

[unborn heath]

HAH

But we’re all still here buddy! Go do your blue team stuff and stop trying to discourage the red!

[distant gust]

Does anyone know of any good resources for learning how to use Autopsy?

[azure widget]

The free autopsy course if that is still free

[distant gust]

Damn, it looks like I really missed out on that one

[gritty barn]

Yo guys, me and @digital swan created a small tool to help out on simple stack based overflows: https://github.com/ChevalierOnGithub/Overflowy , feedback is welcomed

[azure widget]

https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo/edit#gid=0

[shadow blade]

Hi everyone I just made a python tool used to automate the execution of the following tools : Nmap , Nikto and Dirsearch but also to automate the report generation during a Web Penetration Testing
https://github.com/Anteste/WebMap
This project is free and Open Source so use it as you want

[topaz gulch]

@shadow blade bearing in mind that nmap doesn't work properly for more advanced scan types if not run as root, are you running that script with the SUID bit?

[shadow blade]

@topaz gulch No am just using os.sytem("nmap -T4 -A " . ip)

[topaz gulch]

Oh, I can see that

Hence asking -- because if that script is given any kind of extra privileges then it turns into the easiest privesc I've seen in a long time

[light crystal]

he means nmap uses root priv for some comands

so u goota add sudo

and tell user to run it as root

[topaz gulch]

Which is a shame, because it needs SUID/sudo if you want nmap to use a SYN scan rather than a TCP scan

[light crystal]

i will keep in mind while making my own peoject

[topaz gulch]

Problem with that is said walking talking vulnerability

[light crystal]

thanks for telling

this will help

[shadow blade]

But we don't sudo if we just want to use an agressive scan.

[topaz gulch]

It's all in my nmap room 🤷‍♂️

[shadow blade]

@topaz gulch you're room is awesome

[light crystal]

wait i didnt do that room till now why

ok lets continue this in #general

or muirs gonna warn us

[topaz gulch]

Aggressive is just shorthand for -O -sV -s C + traceroute @shadow blade

It's still built on one of the other scan types

[light crystal]

all in 1

[topaz gulch]

-sT by default with no sudo, -sS with sudo

Ideally you want -sS

[light crystal]

muir for rustscan how do we say which port specify?

[shadow blade]

For example I have to run the script as root then run the nmap scan also as root.
But the script will be vulnerable to a SUID privesc

[topaz gulch]

No clue -- I've only used it a few times I'm afraid. It'll be in the docs for it

[light crystal]

oh np

[shadow blade]

I can just run the nmap scan as root and when the user will start it will ask for his passwd and it will not be vulnerable

[topaz gulch]

Yes. It needs root privileges, but if you give it SUID then it's vulnerable to an SUID privesc (assuming you take advantage of the SUID). You would be better adding it to sudoers but keeping a password.

Mhm. That's a better option

[light crystal]

thats a better option

[shadow blade]

But how can I add it to the sudoers ?

[light crystal]

use sudo in front of every command

i HOPE the person may have it

[shadow blade]

Thx guys I will add it

[topaz gulch]

Honestly your idea of adding sudo into the os.system is probably the way forward, but ideally you want to use something like subprocess rather than system

[night holly]

If you’re using a VM just suid it , my vm has at least 4 ways to root

[fringe spire]

give me your ip

[night holly]

Okay, won’t do much don’t have any ports forwarded or open 🤷‍♂️

And actually having a unintended privesc In your vm can save you a lot of time when manjaro removes your user from sudoers after a few failed login attempts

[shadow blade]

You can login as root like I do

[night holly]

I didn’t have a root pw set at the time

[fallow knoll]

someone was asking about setting up AD labs in general the other day, there's some interesting stuff in the replies to this tweet: https://twitter.com/netsecfocus/status/1344197765165887493

NetSec Focus (@netsecfocus)

Question on our Mattermost: anyone have any nice guides to setting up an build up/tear down AD environment to practice pentesting on your own lab?

@UK_Daniel_Card this sounds right up your straat.

Twitter · Dec 30, 2020, 8:24 AM

[tepid patio]

New OSINT OS from TMHC https://twitter.com/v3nari

V3nari (@v3nari)

New OSINT OS coming soon

Tweets

1

Followers

11

Twitter

[odd quest]

Depends on the machine. This is not the correct channel. Try #site-support or #room-help @ivory flint

[icy marsh]

https://www.udemy.com/course/wireshark-packet-analysis-and-ethical-hacking-core-skills/?couponCode=GOODBYE

^ this is free for year end sale I guess.

[keen field]

http://www.xss-payloads.com/

[magic idol]

Nice little cheat sheet for anyone thats interested

[odd quest]

You can also fuzz it

[hazy trench]

Can I post Udemy courses here?

[tepid patio]

is it self promotion

and is it free (mostly)

then yes

generally

i mean

the rules are in the uh

that box

next to the channelk name

Please avoid self-promotion of paid content here.

[hazy trench]

Learn ethical hacking, Python, web development and more with these 9 FREE courses! Happy New Years!

https://www.udemy.com/course/ethical-hacking-kali-linux/?couponCode=HAPPYNEWYEAR

https://www.udemy.com/course/ethical-hacking-python/?couponCode=HAPPYNEWYEAR

https://www.udemy.com/course/python-complete/?couponCode=EE03C893BA5B7A8127D1

https://www.udemy.com/course/front-end-web-development/?couponCode=HAPPYNEWYEAR

https://www.udemy.com/course/full-stack-javascript/?couponCode=HAPPYNEWYEAR

https://www.udemy.com/course/linux-system-admin/?couponCode=HAPPYNEWYEAR

https://www.udemy.com/course/python3-for-beginners/?couponCode=HAPPYNEWYEAR

https://www.udemy.com/course/google-chrome-extension/?couponCode=HAPPYNEWYEAR

https://www.udemy.com/course/ethical-hacking-professional/?couponCode=HAPPYNEWYEAR

#udemy #couponcode
credit: ロックン | ばかユジン

[hazy trench]

No

[hazy trench]

I know the rules...

[tepid patio]

?

[hazy trench]

U guys don't trust others

[tepid patio]

what?

i have no idea what you're talking about lol

[violet fjord]

man thank you very much for the free courses

[hazy trench]

Welcome

[violet fjord]

but is there a way to search for more free udemy courses? because i'm also interested in other things

[sonic abyss]

Hotukdeals

[faint sluice]

there is a reddit of udemy deals, forget whats its called but you can google

[prisma bison]

@paper bolt These were posted above by another user 🙂

[paper bolt]

I can’t see lol ive f my discord up

[prisma bison]

oof

[odd quest]

I'm deleting it because they are right there and it's a wall of embeds

[hazy trench]

You can try the same coupon code..they r valid till 5th Jan..may be the same coupon code would work for other courses u like

[violet fjord]

i've tryed but it seems that the coupon is working only with that courses because they have been all published by the same person

[hazy trench]

Ohh...

[gritty barn]

@white pivot mind helping my pal out @remote wind with some resources? he is trying to follow your steps 😄

[remote wind]

Lol i already contacted him @gritty barn

😂

He once teached me about stack pivioting

[stoic field]

Hey! I am planning to take the Modern Binary Exploitation course by RPISEC soon but need some computer organization knowledge first. Are there any courses or resources you could recommend? The topics mentioned on their github are:
MIPS assembly, x86 assembly, Datapaths, CPU Pipelining, CPU Caching, Memory Mapping

[white pivot]

# Resources

These are the resources I have found while learning about the binary exploitation.

### Blogs:-

* <https://syedfarazabrar.com/>
* <https://kileak.github.io>
* <https://d4mianwayne.github.io/>
* <https://ctf101.org/binary-exploitation/buffer-overflow/>
* <https://blog.skullsecurity.org/category/ctfs>

### Youtube:-

* <https://www.youtube.com/channel/UCi-IXmtQLrJjg5Ji78DqvAg/videos>
* <https://www.youtube.com/playlist?list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN>

### Wargames:-

* <http://pwnable.kr/>
* <http://pwnable.tw/>
* <http://pwn.eonew.cn>
* <https://www.root-me.org/?lang=en>
* <http://smashthestack.org/>
* <https://exploit.education/>


### Pwn Related Stuffs:-

* PwnTips - <https://github.com/Naetw/CTF-pwn-tips>
* Quick guide -<https://trailofbits.github.io/ctf/exploits/binary1.html>
* Pwn Challenge List - <https://pastebin.com/uyifxgPu>

### Stuff Robin gave me:-

* Course materials for Modern Binary Exploitation by RPISEC - <https://github.com/RPISEC/MBE>

* Learn ROP - <https://ropemporium.com/>

* For Linux binary Exploitation - <https://github.com/scwuaptx/HITCON-Training>

* Intro to binary exploitation / reverse engineering course - <https://guyinatuxedo.github.io/>

* A collection of pwn/CTF related utilities for Ghidra - <https://github.com/0xb0bb/pwndra>

* Some pwn challenges selected for training and education. - <https://github.com/BrieflyX/ctf-pwns>

* A set of Linux binary exploitation tasks for beginners on various architectures - <https://github.com/xairy/easy-linux-pwn>

* ASM Basics - <https://asmtutor.com/#lesson1>

@remote wind

[remote wind]

Can i dm u?

[stoic field]

Sure

[glass mulch]

https://www.guitmz.com/having-fun-with-ansi-codes-and-x64-linux-assembly/

[lapis herald]

A ctf on binary exploitation and assembly http://io.netgarage.org/

[full vapor]

That looks pretty good! Come at the right time for me, wanna get back I to that! Thank you for the link L-Drago

[odd quest]

https://www.sans.org/blog/device-profiling-with-windows-prefetch/

[tepid patio]

@topaz gulch can I share super nerdy maths videos here that I think people will like? I.E: https://www.youtube.com/watch?v=k7q0Y2W0Rn4

[karmic socket]

Home lab suggestions for newb? Ive got a few lightweights machines..And Im sure there are several "best" routes..Got a quad core 16gb windows desktop, a quad core 16gb windows laptop, and older windows laptop ,1 core x 2-4 gb ram. ( install linux?) Would appreciate some professional opinions if someone has the time. TIA Looking to do network analysis, nmap, pentesting, wireshark, metasploit, CTF Tools.... I really don't know yet.

[lapis herald]

Ctfs
https://overthewire.org/wargames/bandit/ (basic linux)
https://overthewire.org/wargames/natas/ (web based)
https://w3challs.com/ (category wise web,crypto etc)

[storm ether]

Windows version of OverTheWire
https://www.underthewire.tech/index.htm

[prisma bison]

Hi @cobalt oriole,

We only accept content that is English in this server (Please refer to rule 8), and try avoiding self-promoting.
Excessive advertisement is also against our rules (rule 3) :)

[cobalt oriole]

@prisma bison Ok

[prisma bison]

Thanks!

[tepid patio]

https://berthub.eu/articles/posts/reverse-engineering-source-code-of-the-biontech-pfizer-vaccine/

Not infosec, but VERY cool

also

https://deepmind.com/blog/article/muzero-mastering-go-chess-shogi-and-atari-without-rules

DeepMind's AI has mastered Go, Chess, Shogi & Atari games without any rules or human input or domain knowledge

[serene coyote]

Really impressive !

[azure widget]

https://github.com/jfmaes/SharpHandler

We don’t mess with mimikatz anymore all my homies use SharpHandler

[light crystal]

https://medium.com/@ismaelr/oscp-2020-review-passed-in-the-1-attemp-being-a-newbie-8a0d506cf41b

[prisma bison]

Is this an accepted writeup?

[river ocean]

I haven't submitted there

Should I submit there first?

[prisma bison]

Please only share accepted writeups

[river ocean]

okay

[prisma bison]

Thanks C:

[fast wraith]

Great SANS video on Threat Hunting/Detection, apparently SANS youtube is infosec's best kept secret as theres only a few thousand views on each video and they are all super high-quality https://www.youtube.com/watch?v=LVSwYyDN2Sk&list=PLtgaAEEmVe6DYtY3XggF8Z4AYJAIY97Rp

[gritty barn]

https://github.com/hasherezade/hollows_hunter

[keen field]

https://open.umn.edu/opentextbooks/textbooks/733

[craggy onyx]

Eric Conrad is top top.

[fast wraith]

oh for sure, you can tell the guy is a Windows guru. love the fact that he almost exclusively recommends mitigations and techniques that are software-agnostic, lots of easy wins you can take away from that talk for blue-teamers. definitely starting to see why SANS is worth it!

[keen field]

i think SANS is the best

[shut ferry]

@fast wraith sans yt algorithm ceases to exist on a platform like yt. Aint gonna see sans as a recommended video pop up. Sucks doe

But than u got Harvard lectures that just pop up randomly on my recommended like

[cloud brook]

Harvard 🤢

[nova oyster]

thanks for this great resource I finish it all and it gives me a different vision on this topics.

[open magnet]

hello

[shut ferry]

hi

[fast wraith]

Cool open-source packet analysis tool. chain this with an SSL/TLS decrypt key for ez traffic analysis
https://github.com/nesfit/NetfoxDetective

[livid timber]

At 7k a course the should be the best! out of my price range though 😦

[azure widget]

Sans does a lot more for the community than just their courses

you can get a lot out of SANS for free

[hasty fox]

Kringlecon!

[winter plover]

Burp Customizer -- Because just a dark theme wasn't enough!

-Burp Suite 2020.12 replaced the old look and feel classes with FlatLaf, an open-source look and feel class that also supports 3rd party themes developed for the IntelliJ Platform.
-This extension allows you to use these themes in Burp Suite and includes a number of #bundled themes to try.

https://github.com/CoreyD97/BurpCustomizer

[cerulean viper]

Does it has black background with green texts on it ? Or blue/neon texts ?! 👀

[winter plover]

I don't really know, I haven't tried it yet but at least black background is better than the white only.

[cerulean viper]

Haven't you tried Burp Suite's Dark theme yet ?! I'm afraid

[keen field]

Burp new UI is more than amazing
from a ZAP fan 😄

[silent walrus]

What version is it currently

I think I have to update

[fast wraith]

PIA have a pretty good VPN sale, $80 for 3 years and they are no-log
https://www.privateinternetaccess.com/pages/buy-vpn/

[limber oak]

Hello everyone can have an idea about RedTeam Manual Book new version?

[craggy onyx]

Please use the #bookclub to ask about books.

[fast wraith]

I'm sure blogging veterans knew about this already, but just found out about Twitter Cards and how to set them up for your blog - which basically are just link previews but way more enticing to click
https://developer.twitter.com/en/docs/twitter-for-websites/cards/overview/abouts-cards

[tribal gull]

speaking of twitter tags, most sites also support opengraph which is more widespread and is an open standard 😄
https://ogp.me/

[icy marsh]

https://www.udemy.com/course/android-penetration-testing-using-diva/?couponCode=FREE3DAYS

^ this is also free. 1 day remains i think. Don't know about the course quality though.

[velvet maple]

Thanks!

[icy marsh]

np ❤️

[halcyon kernel]

hey guys if someone here knows how to do it
Im trying to use grep that starts in letters and ends with digits can someone help?

[faint sluice]

look at grep -e

[humble needle]

life could be dream

[fleet star]

anyone know where i can get new updated password dictionary thats hashed already? Newer than the one john uses? or does john hashed them automatically?

a password list

[glad hazel]

I'm not sure this will help you or not but here : https://wordlists.assetnote.io/

[fleet star]

@glad hazel that was very helpful. thx bud

[serene coyote]

I picked the link, thanks :)

[icy marsh]

https://www.udemy.com/course/complete-webapplication-penetration-testing-practical-cwapt/?couponCode=SESSION9

https://www.udemy.com/course/linux-unix-shell-scripting-certification-training/?couponCode=LINUX_SHELL_UPLATZ

Free ones ^

[remote wind]

Any reviews on the WAPT one??

[icy marsh]

i actually got this before. it's looked kinda beginner friendly to me. but didn't go through enough to give u concrete review. it's free so enroll first then check the reivews. lol

[remote wind]

Lol i enrolled and then asked

[cloud token]

https://github.com/LasCC/Hack-Tools

[fringe spire]

Adding those, now i have 27 courses on udemy that i have claimed but never tried going through one 😅

[velvet maple]

I also stack many videos on Udemy.... I should study.😤

[keen field]

where did u find the codes leg?

[keen field]

all free?

[jaunty raven]

Same xD

[light crystal]

with those i have 50 courSES

and i did go through any

59*

[fringe spire]

Bought one, got a couple from giveaway and all remaining were free.

[dim marlin]

https://www.youtube.com/watch?v=6vj96QetfTg

very good talk

[shut ferry]

I only have 288 course by this way ....never completed any

[fringe spire]

I'm proud of you

[cerulean viper]

I have 1500+ courses 👀

[languid parcel]

o.o

thats alot

[cerulean viper]

1644 to be precise xD

[fleet star]

anyone explain how vulnhub works exactly?

[azure widget]

they host ovas and you download them then run them

[fleet star]

ovas?

[odd quest]

https://en.wikipedia.org/wiki/Open_Virtualization_Format

[fast wraith]

SELKS is a pretty cool Debian 10 based alternative to SO
https://www.stamus-networks.com/scirius-open-source

[icy marsh]

https://yofreesamples.com/courses/free-discounted-udemy-courses-list/

this gets updated every hour or so giving u all the free udemy courses. The site is awesome!

[shut ferry]

you... sniff you're a good person

[simple juniper]

Thank you so much.

[fringe spire]

Can't use mobile data 👀

[icy marsh]

lol isp blocking?

[fringe spire]

🤷‍♂️

Working on wifi

[balmy arch]

Does anyone recall a resource passing by here that interactively suggested ways to attack AD, depending on what you had (Eg: unauthenticated, authed but not privileged, ..) ?

[shut ferry]

some free resources in hacking please

[balmy arch]

Scroll up, this room is filled with them

[shut ferry]

ok

[fringe spire]

Best resource:
https://tryhackme.com

[night holly]

https://wadcoms.github.io

[velvet maple]

I didn't know this. pretty interesting, [interactive cheat sheet]. Thanks

[inland yacht]

https://www.freewebcart.com/udemy/

[fast wraith]

How do you guys track site analytics for a personal blog? I'm thinking about just parsing apache access logs but don't want to exactly re-invent the wheel here. I would setup Google Analytics but I don't want my visitors to be tracked or make people change their privacy extensions.

[azure widget]

Netlify / github analytics. I think @topaz gulch uses a .link for analytics

Canary

[jagged tiger]

are you self hosting somewhere? egress logs to ELK and Prometheus

[fast wraith]

ah I do have SO, seems like I could do something with grafana there

not just for threats!

[tepid patio]

I use Cloudflare server-side analytics

Simple Analytics, Fathom, Plausible, Matomo are all privacy friendly analytics

netlify analytics is good too

[faint sluice]

remember the days when websites had little counters...

[jagged tiger]

oh geocities - at least we still have the wayback machine

[tepid patio]

https://www.immersivelabs.com/resources/blog/test-your-cyber-mettle-for-free-immersive-labs-community-is-now-in-public-beta/

Code GIMMEFREELABS

Let's you sign up with ya personal email 🙂

[keen field]

https://hackertube.net/

[fast wraith]

noted - thanks bee!

[glad hazel]

What is that used for Bee?

[tepid patio]

What is what used for?

Cloudflare Analytics?

For my blog, I run it behind Cloudflare CDN as it's static content (90% is cached so it's super fast) so I use CF Analytics for it too 😄

[unreal hollow]

is it free with CF

[tepid patio]

Yes, with the tracking script

but I pay for CF and I get server-side analytics 😄

Also they're releasing a netlify competitor

I paid £29 / month for hosting and £15 / month for analytics before, now I only pay £14 / month for CF. The idea that I can do analytics + CDN + hosting all on CF is simply amazing! 😄

[topaz gulch]

How the heck was your hosting costing so much?

I'm on a fiver a month total

[fast wraith]

yeah luckily i probably have less than a couple visitors a week so i dont have to scale up my $5 droplet yet

[tepid patio]

A lot of views

[topaz gulch]

My analytics are also free. Albeit not particularly verbose

That fiver gives me unlimited traffic

[tepid patio]

and it wasn't static

so hosting sucked

[topaz gulch]

For a wordpress blog

[tepid patio]

ah, on a VPS?

[topaz gulch]

Nah, managed hosting for my blog, given I can't be bothered setting up bruteforce/DOS protection and it's inbuilt that way (plus I set it up before I got into server management)

[tepid patio]

Ah, the managed hosting for Ghost is 29 / month ahhaha

[topaz gulch]

Oof

[tepid patio]

was deffo worth it, but they weren't static

[topaz gulch]

I just rent server space from Ionos. Comes with a tonne of perks

[tepid patio]

which meant CDN didn't work out so well

[topaz gulch]

Had to install the stuff myself obviously, but it works 🤷‍♂️

Although most of my other stuff is on VPSs now

[tepid patio]

Ghost is going down a really weird route rn too

Like a Substack competitor

for some reason

[azure widget]

Brute force time?

[topaz gulch]

It's managed through the provider, so good luck

[fast wraith]

I did a droplet with a manually installed lamp stack to host wordpress which was a pain, 2nd time I migrated my site to the one-touch droplet configured for Wordpress which was super easy

[topaz gulch]

I also added in a fail2ban, just to catch anyone being sneaky

[tepid patio]

also I used Simple Analytics (cause I cared about privacy, and the creator is a mutual friend) which was £14 / month (it was rather nice, but far more expensive than literally any other competitor lol)

[fast wraith]

i recently got a vpn and forgot I set the wp-admin to only accept my certain IP address and had fun troubleshooting that one

[tepid patio]

wait i can show u my expensive month of my blog

that was because i got a lot of email subs and my email provider decided to automatically scale me

and i brought Ahrefs (£99)

[fast wraith]

lmfao thats mad

[tepid patio]

yeah i literally had a heart attack

i exported my email list and i havent even touched it since LMAO

more stats for ya

I stopped caring much in 2020, my advertising platform started advertising crypto-scams which meant I couldn't justify the high pricetag (I removed them from my site) so I just stopped everything for the whole year, 2021 I'm tryna stay under £40 / month hopefully 😄

[unreal hollow]

Bee is just super popular

[tepid patio]

😅 I'm actually not, I just love writing a lot and I guess people want to read what I write haha 😄

That hasn't translated to social media fame, thankfully though

or unfortunately depending on how you see things

Actually, if you're interested in writing I have an article on it -- although I primarily ran my blog out of pocket so if you wanna make tons of cash don't look at me hahaha (but do look at IndieHackers, those peeps are experts) PS: this article is a giant mess as I just copied / pasted from Notion, it's primarily for my own use so sorry it's horrifically bad to read! https://skerritt.blog/blogging/

[fast wraith]

https://tenor.com/view/elmo-burning-hell-gif-4808980

bee just watching the analytics grow

[glad hazel]

I meant this - #resources message

[tepid patio]

uhhh

tryhackme competitor

but for

universities

i think they're making it open to anyone though?

idk tbh

i applied for a job and they gave me that code

and its in their blog post too

[glad hazel]

Oh good luck man

I'm happy with THM 😄

[tepid patio]

I love THM a lot too!!!

Very great

Easily my fave place on the internet

[rose stratus]

Thansk bros :3

for what i need discord token :)?

[ebon valve]

https://docs.tryhackme.com/docs/discord/verify

[rose stratus]

Thanks @ebon valve ❤️

I come to suscribe to premium service ❤️

Good comunnity

[ebon valve]

[rose stratus]

@ebon valve ❤️

[verbal siren]

https://twitter.com/driscollis/status/1348663155208163329?s=20

Mike Driscoll (@driscollis)

I decided to make Python 101 free for 72 hours!

If you're a beginner or intermediate developer who wants to learn #Python, now's your chance!

https://t.co/Wndtf0dNEx

Twitter · Jan 11, 2021, 4:08 PM

[shut ferry]

anyone have a tool that helps to identify and crack hashes? I tried hashcat and it dosent work for me for some reason ;-;

[prisma bison]

JohnTheRipper

[shut ferry]

I'll try that, thanks

[tepid patio]

https://base64.ai/

Cool way to mass process data and get important details about it

[azure widget]

I just want something to mass process meta data and images for me

[tepid patio]

this does images 🤷

Similar to No More Google
https://nomorefacebook.xyz/?ref=producthunt

[south marlin]

For identification use hashID : https://github.com/psypanda/hashID
(or outdated version hash-identifier : https://tools.kali.org/password-attacks/hash-identifier)
Based on the output find the # for your hash type in the hashcat manual and then use it with -m flag. (https://hashcat.net/wiki/doku.php?id=hashcat)
Or use JohnTheRipper and find the hash format here : http://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats

[topaz gulch]

Although bear in mind that they can only guess

[azure widget]

HashID low key sucks ngl

context

[tepid patio]

my implementation of Hash-Identifier is actually better

maybe I should release it

it still guesses

but at least it doesn't guess it's a Wattpad Hash before it guesses SHA-1 LMAOO

[faint sluice]

always a bubble bee never a bumble bee

[balmy arch]

Fantastic, thanks!!

[shut ferry]

Thanks

[fast wraith]

cool service you can use to turn some old domains you have laying around into an e-mail forwarder
if someone ever asks for an e-mail its always fun to tell them its their name @yourdomain.com
https://forwardemail.net

[sonic abyss]

I have my own tool which identifies it and then tries to crack it if your interested

[shut ferry]

im intrested, some tools cant identify NTLM

[sonic abyss]

Its a WIP but here is the github

https://github.com/Jayy001/HashHammer

[shut ferry]

thanks

[tepid patio]

Oh nice, I'm working on the exact same thing https://github.com/bee-san/HashSearch

The Ciphey of HashCracking™️

[prisma bison]

Bee

How much work have you done recently

[tepid patio]

on whatt?

[prisma bison]

HashSearch

[tepid patio]

oh

quite a lot

it actually runs

i just need to fix ur JTR func

and it'll be ready to ship 😄

[prisma bison]

Not my fault it's broken

JTR is stupid

[tepid patio]

i know it isn't

[prisma bison]

Stupid potfiles

[tepid patio]

ii might code my own hashcracker in rust or something that's accessible via an API

would be fun to explore GPU acceleration

[prisma bison]

I kinda want to start some projects once I'm finished

With coursework*

[tepid patio]

they are fun

[prisma bison]

I just need to improve my programming skillls

and give myself an objective.

[tepid patio]

only way to do that is to code!

you should try some competitive programming

gets the mind flowing

[prisma bison]

I was thinking about looking at outdated tools

Then picking the best programming language and bringing them back

[tepid patio]

oh

sherlock.py

the username search thing

they suck

im 99% sure ii know how to fix their biggest bug

just need to fix this function huh

[prisma bison]

Haha

My base code worked

Calling John I mean

[tepid patio]

John

Hammond

👀

[prisma bison]

Yes

Call him

[tepid patio]

btw

https://twitter.com/RealSexyCyborg/status/1349319623242436611

Naomi Wu 机械妖姬 (@RealSexyCyborg)

@CNN For those who are unaware, if you have Gboard installed, Google and so the US gov with a warrant can read your outgoing messages. The Incognito flag is a request only- the app cannot impose it on a non-compliant keyboard. Such a keyboard can be pushed to your device by Google.

Twitter · Jan 13, 2021, 11:37 AM

interesting attack vector

would be solvable by implementing your own keyboard

[sonic abyss]

We could Collab if you wanted?

[tepid patio]

Ah, sure ❤️ I was doing it for Ciphey and because HashBuster was broken and uh, abused the ToS of companies 😅

DM me! 😄

[sonic abyss]

Yeah, I actually did it to because was fed up of hashbuster not working

[distant steeple]

I finished a splunk room on the blue primer series and would love more. Are there any other resources on the net for hands on splunk?

[sand mist]

Splunk has free version that you can run at home and do all sorts of things with it. There are also docker images, and trial downloads that you can play with. They also have github repos with past Boss of the SOC (BOTS) competitions and data sets which is a jeopardy CTF. What kind of hands on are you looking for?

[distant steeple]

similar to the rooms i guess, a guided approach as im still learning about the splunk language etc. The answers you confirm are very helpful in guiding and making sure im on the right path etc

[sand mist]

Splunk Fundamentals 1 is a free training that is guided

They have a pretty robust community as well, keep an eye on Splunk Answers, there are lots of questions that get answered with sample data that is generated on the fly, and showcase various things that can be done with SPL

[distant steeple]

ok, many thanks for the help

[balmy merlin]

oh no

those pirated

@honest dock

[honest dock]

Done

[glad hazel]

How you created logo.gif for this? Man, whenever I visit your repo I always amazed with something

[sonic abyss]

Canvas

[glad hazel]

How do I create my own? if you have link for tool or fro canvas?

[tepid patio]

Canva 🙂

https://skerritt.blog/make-popular-open-source-projects/#beautiful-logo-as-simple-as-canvacom

you might like this

I make all my logos in Canva, but eventually I pay @quasi scarab to design me one 😄

[glad hazel]

Thanks Bee

[fast wraith]

Just got a new phone and wanted to get away from LastPass/cloud storage-based pw managers. Imported my .kdbx KeepassXC file and has been auto-filling/working really well on Android 10
https://github.com/PhilippC/keepass2android

[quasi scarab]

You bein' sweet to/about me again? 🥺 ❤️

[unreal hollow]

just your awesome skills

[quasi scarab]

[tepid patio]

❤️ ❤️ ❤️

I might have some more work to commission u for 👀

and i can afford it this time

with my fancy THM salary

[quasi scarab]

And I might have a bunch of time to gladly and willingly dedicate to you ❤️

[azure widget]

https://hakin9.org/manuka-a-modular-osint-honeypot-for-blue-teamers/

[tranquil shuttle]

https://enotes.nickapic.com/

[azure widget]

Hey awesome notes, just be careful you’re actually allowed to share everything in there... for example I aw an OSCP BoF which I know offsec doesn’t like and a few HTB machines which I think are all retired so that should be fine

[tranquil shuttle]

Hey, thanks for the comment and yes all of the stuff here are from retired machines the OSCP BoF is notes from the OSCP BoF Prep Room

[dusky lodge]

Really awesome stuff @tranquil shuttle

These are yours ?

[tranquil shuttle]

Thanks a lott

[tranquil shuttle]

yess

[night ether]

if offsec saw the bof prep room here i'm sure they'd ask for it to be taken down lol

[tranquil shuttle]

naah its a general Buffer Overflow room tbh but a very great herlp

[night ether]

i mean this one https://tryhackme.com/room/bufferoverflowprep

[tranquil shuttle]

yup thats what i meant as well

its just basic bufferoverflows Offsec cant say that BoFs are to be taken down

[night ether]

well no but the program and the prompt are the same as the exam one

[tranquil shuttle]

i am not too sure i dont think so

[fringe spire]

Oh congrats, You been trying hard i see

[topaz gulch]

Oh, they already tried

That's why it's no longer called "oscpbofprep"

[tranquil shuttle]

Thaanks a lot mahn and yess hahah trying to include more AD content

[remote wind]

Why site is not opening for me??

[tranquil shuttle]

huh thats weird

updated the link check it out now @remote wind

[remote wind]

Sadly it's not working, i tried from other device on different network too lol

It just don't load

[tranquil shuttle]

hahahah thats soo weird

maybe try in a bit

as its working for me

[sullen turtle]

Damn, that's some pretty extensive notes

Cheers! @tranquil shuttle

[tranquil shuttle]

Thanks a tonn 😄

[sonic abyss]

👍 Awesome stuff

[tranquil shuttle]

Thaanks mahn

[light crystal]

@tranquil shuttle its amazing u spend a lot of time in it

[remote wind]

@light crystal is that opening for u?

[light crystal]

yes

[remote wind]

It's not opening for me 😭

[dusky lodge]

Maybe your country blocks sites with the keyword "Hacking"

[remote wind]

We are from same country XD

Light10 and me

And i think @tranquil shuttle too

I visited his GitHub and go to the link from there

It's not same but anyway, notes are there lol

👍

[unborn gust]

This is an AMAZING RESOURCE!! thank you so much for sharing this! 😆

[light crystal]

huh

[tranquil shuttle]

Thanks a lot mahna dn yes hahaha its been a while

[tranquil shuttle]

i am not too sure why yous is not working

[tranquil shuttle]

No problems at all

[craggy onyx]

SANS DFIR (Digital Forensics and Incident Response) Hunt Evil Poster
https://www.sans.org/security-resources/posters/hunt-evil/165/download

[night ether]

that's actually very very very useful ^ i currently work in a soc and see lots of alerts with those processes

so if you're looking for a soc role, familiarity with the processes in that document would help loads

[craggy onyx]

We'll have an upcoming room covering some of these processes 🥳

[tepid patio]

https://secret.club/2021/01/14/vbox-escape.html

[tepid patio]

https://github.com/Yunolay/Cheatsheet/blob/main/tryhackme.md

I found this

Quite cute to see a THM specific cheat sheet

[sullen turtle]

the timeless question

in pinned

https://discordapp.com/channels/521382216299839518/554713196804440101/698543439918268518

uh

not off the top of my head

but I would try to install linux vm

so you get very fast at navigating the command line

one sec

there's a video on the file system

which is worth learning

ah nice, that's good

uh

I doubt you'll have to read the source

start looking into how programs are actually executed

[odd quest]

There are good books on Linux kernel programming

[sullen turtle]

then you could potentially progress to rootkits

and kernel level stuff

if you want to keep it hacking related

Yeah, you might need to build up to it

But try and get a deeper understanding of assembly etc.

it will provide a good grounding for linux and windows

[odd quest]

There are different architectures

Like ARM or x86

[tepid patio]

https://www.youtube.com/watch?v=-qsbORUW0jM&feature=youtu.be

👀

[sullen turtle]

👀

[azure widget]

What the heck

How did it go from 16 minutes to 15 hours

[glad hazel]

Bee you are amazing and always so helpful

Thanks

[naive arrow]

https://www.fireeye.com/blog/threat-research/2020/10/threatpursuit-vm-threat-intelligence-and-hunting-virtual-machine.html

[fast wraith]

Someone who worked in hiring open-sourced a vulnerable web-app they used as part of a technical assessment in interviews
https://github.com/RamadhanAmizudin/lazyweb

[glad hazel]

Nice find 👆

[light crystal]

https://www.udemy.com/course/python-for-penetration-testers/?referralCode=74966DAC9EFEA9E87191&couponCode=PYTHONISTA2021

[sonic abyss]

Wouldn't this be more suited for #programming or...

[topaz gulch]

Nah, it's a resource

[light crystal]

jayy u always have some thing against me

[sonic abyss]

I'm sorry

Can I post it in there anyway?

[light crystal]

sure

[sonic abyss]

Ty

[gritty barn]

https://www.cybok.org/knowledgebase/

[dark mortar]

Cool and an Informative talk ^_^ @tepid patio

[haughty yarrow]

can anybody recommend a guide for getting started with API testing, for somebody who already tests web? basically just want to get up to speed on any API-specific tools, bugs to look for, etc. that I should know

[unreal hollow]

postman has a lot on that

[haughty yarrow]

you mean the postman documentation has information on using it for security testing? I can't see that. or did you just mean I should look into postman as it's a commonly used tool for it?
edit - sorry, I maybe should have been clear in my question that I meant security/pentesting

[lapis herald]

https://twitter.com/CristiVlad25/status/1351154329135312899?s=19

Cristi Vlad (@CristiVlad25)

Python is still one of the most 'spoken' cyber languages out there.
Use PYTHONISTA2021 to learn for FREE with my Python Basics course.
Tell others.

Course link: https://t.co/8aysj9IMtJ

#python #pentesting #cybersecurity #bugbounty

Twitter · Jan 18, 2021, 1:07 PM

[shadow perch]

https://www.youtube.com/watch?v=2cjneuTnORY

[unreal hollow]

Postman can be used to test api's, what part of an api are you trying to test

[haughty yarrow]

I'm interested in learning how to pentest APIs in general

[unreal hollow]

If you know the structure of the api, you will want to research fuzzzing techniques then

[haughty yarrow]

thanks. I assume there's more to it than just fuzzing though. that's why I'm asking if anybody knows any good guides which give a good, thorough overview of the tools/methodology, so that I have a plan for everything (or all the priorities anyway) of what I should research. rather than hearing about one thing here, another thing there.
like I say, I'm already comfortable with web testing. I assume there must be lots of people who've been in a similar situation and have shared info on what a web tester needs to get up to speed with to look at APIs

[fast wraith]

API testing - like most web testing - involves a fundamental understanding of the underlying technologies. I would begin with reading up on API frameworks like RESTful or SOAP and going from there.
Heck, look at what happened with Parler, all of that app data was exfiltrated via their API by simple fuzzing/IDOR techniques, nothing fancy at all.
https://swagger.io/docs/specification/2-0/what-is-swagger/
https://www.soapui.org/docs/soap-and-wsdl/

[haughty yarrow]

Thanks, yeah I'm not after anything fancy - just want to cover any blindspots that I have since I'm coming from a more web app focussed background. I do know a bit about REST, SOAP, etc. already from that, but will cover those links to make sure it's all clear!

[glacial gazelle]

just reposting this but

working on an install script for programs and services for ctfs/general hacking
and tools suggestions people have?
I've definitely missed tonnes

[fast wraith]

Kali comes with basically everything you need. I'll typically use some version of this script for fresh installs https://github.com/JohnHammond/ignition_key/blob/master/ignition_key.sh

[glacial gazelle]

ah thank you, I haven't seen that from John before

what are the key differences between apt and apt-get, John switches between them at about halfway through the script

from what I can see online, it just looks like apt is the updated version and you only need to use apt-get for some features that haven't been implemented yet

[fast wraith]

eh no huge difference, some packages require backwards compatibility with apt-get while others use the preferred apt which will automatically grab newest packages

[odd quest]

what no

apt and apt-get are the same

They do the same things

apt-get is the stable scripting interface

Apt is not

[fast wraith]

well according to the apt man page they are not exactly the same

[odd quest]

They work the same

But your statement was not correct

They install packages the same way

There's no such thing as a package that installs with one and doesn't with the other, or installs differently

They both automatically grab the newest packages

[tepid patio]

Hey y'all! The free path was updated (thanks @balmy merlin @topaz gulch @hallow meadow @glossy blaze for help in choosing the rooms)

+ Shodan
+ RustScan Room
+ Hacker Methodology

https://blog.tryhackme.com/free_path/

PS: The Shodan room is updated 👀
https://tryhackme.com/room/shodan

[light crystal]

https://hackmyvm.eu/
HackMyVM
new platform similar to vulnhub but very good came out a month ago

[jaunty raven]

Yeah it's a good platform

[tepid patio]

Hey! I'm running a lil giveaway for THM vouchers.
https://twitter.com/bee_sec_san/status/1351594084633370637

It is self-promo, but not of paid content so idk if this channel is right?

Brandon (@bee_sec_san)

Let's run a little giveaway! 3x 1-month TryHackMe vouchers. To win, you must:

• Follow me (so I can DM you) 😄
• Retweet this 🐦
• Reply with your favourite TryHackMe room! (I'll use this in a blog post, you'll get credit too ❤)

Winners will be selected on 20/01 at ~5pm UK! 💘

Twitter · Jan 19, 2021, 6:15 PM

[glad hazel]

Thanks bee I hope I win one lol

[sonic abyss]

https://pwnable.tw/challenge/#1
https://overthewire.org/wargames/bandit/bandit0.html
https://go.joincyberdiscovery.com/tutorial

Some websites with challenges to do in cybersecurity

[copper cove]

you forgot picoctf

[remote wind]

List of wargames and some practice ctfs

https://github.com/zardus/wargame-nexus

https://captf.com/practice-ctf/

[glacial gazelle]

The biggest CTF of 2021 so far, with over $5k in prizes, and random swag giveaways to teams (because let's be honest, who doesn't want free swag). 

Running from 23rd-30th of January at: https://ctf.offshift.io/```

[light crystal]

0/1771717177171

[gaunt hollow]

https://cyberlite.substack.com/ Created by: Oliver Kitchin (Not Me)

[dusky lodge]

@gaunt hollow That's your substack ?

[gaunt hollow]

Oh, no. Should have credited the author, one second. Found this on Reddit last night

[prisma bison]

Possibly post this in #thm-community-media instead? Not sure if it counts as a resource

[glacial gazelle]

sorry, it was my first published writeup so I didn't really know where to put it

[prisma bison]

Don't sweat it, no problem :)

[glacial gazelle]

how long do the admins normally take verifying the writeups?

[prisma bison]

It's not admins

It's room creators

And it's completely up to them whether they accept, deny or ignore it

[glacial gazelle]

Ahh right

Well Umair said it was great if I did one

so uh

my chances aren't too bad

[topaz gulch]

Which room @glacial gazelle?

[glacial gazelle]

Chocolate Factory

[prisma bison]

Has it been accepted or?

[glacial gazelle]

Not yet, Umair is going off on an adventure so his replies are pretty slow

[topaz gulch]

Soooo, the writeup you posted earlier as being approved is not approved?...

No, it isn't

Please don't release/promote writeups publicly until they have been accepted on the room @glacial gazelle

[fast wraith]

free training from the CISA

101 Coding for the Public
101 Critical Infrastructure Protection for the Public
Cryptocurrency for Law Enforcement for the Public
Cyber Supply Chain Risk Management for the Public
101 Reverse Engineering for the Public
Fundamentals of Cyber Risk Management
Don't Wake Up to a Ransomware Attack - 1 Hour
Introduction to Cyber Intelligence - 2 Hours
Don't Get Caught in the Storm - Protecting Your Cloud Assets - 1 Hour
Cyberessentials - 1 Hour
Cloud Computing Security  - 2.5 Hours
Foundations of Cybersecurity for Managers - 2 Hours

https://fedvte.usalearning.gov/public_fedvte.php

[topaz gulch]

For anyone interested in bored uni student coursework:
https://abertaycoursework.xyz
I may or may not have been bored enough to set up a site with mine 🤷‍♂️
Got some fun tools in there

You are most welcome @tepid patio ♥️

Don't know why the bot deleted your kind thank you message

[jaunty raven]

You got me :(

[fast wraith]

don't tell him it only emboldens his behaviour

[glad hazel]

What is this?

[gaunt rain]

does anyone of you know about a list or repo containing applications and the place and format they store credentials? I know that there are some metasploit post modules in post/<platform>/gather/credentials but I assume there are way more applications that store (user) credentials in an unsafe (reversible) way.

[night ether]

@gaunt rain i haven't looked at that module, but i assume that just gets all system passwords

however different applications such as apache will have for example .htaccess

but i'm not aware of any tool that has this functionality of searching all applications, i've been looking before

but if you run some enum script and gather all applications on the system you can manually go through each and google the location of creds

[gaunt rain]

yeah that's how i do it now, thought that maybe someone compiled kind of a directory like PayloadsAllTheThings for known apps. thx for the reply!

[keen field]

is there any detailed resource available for metasploit's meterpreter commands
cuz i really can't understand what some of 'em means
write Writes data to a channel (what channel?)

[fast wraith]

new raspberry pi! https://thepihut.com/collections/raspberry-pi-pico/products/raspberry-pi-pico

[fast wraith]

probably referring to channels you open up when you run shell from within meterpreter, i guess it would just write to stdin on whatever specified channel

also their docs are pretty good https://docs.rapid7.com/metasploit/manage-meterpreter-and-shell-sessions

[velvet maple]

looks interesting. what temperatures it can withstand?

[fast wraith]

85C according to the datasheet, i probably wouldn't rely on these things for production purposes but are perfect for prototyping stuff

[velvet maple]

also good for playing with as a digital toy.

[keen field]

honestly that's not a toy 😄

[odd quest]

It's just a microcontroller?

Just get an ESP, they're super cheap and do micropython

And you can graduate to Arduino running on them if you want something better

Plus wifi and bluetooth

[velvet maple]

ESP? this? https://docs.micropython.org/en/latest/esp8266/tutorial/intro.html

[odd quest]

8266 or 32

32 does bluetooth and is more powerful, 8266 is cheaper but only wifi

[velvet maple]

Interesting! Thanks, today I learn new knowledge.✨

[topaz gulch]

I really need to do more with my ESP. Haven't used it since first year of uni 😆

[odd quest]

I can't find the docs for the Bluetooth protocol I want

Well, docs yes but 0 examples

[topaz gulch]

Ouch

Have fun

[odd quest]

https://www.sans.org/blog/the-ultimate-list-of-sans-cheat-sheets/

Sans cheatsheet cheatsheet ftw

[static veldt]

Anyone got a wordlist of common linux commands that can be used for fuzzing a web cmd?

[spark hedge]

https://github.com/danielmiessler/SecLists might find what you're looking for here

[magic idol]

Rangeforce has a special promotion going on right now for their Blue Team Battle Paths, $50 per path up to 3, usual price is $200/path. https://www.rangeforce.com If you are interested let me know I can put you in contact with the right person

[fast wraith]

@magic idol I think ill take you up on that offer, lmk

[keen field]

Here are some common ways to spawn a shell via installed Programming Languages:
Python:
import os; os.system("/bin/sh")
also
python -c 'import pty; pty.spawn("/bin/bash")'
&
python3 -c 'import pty; pty.spawn("/bin/bash")'
PHP:
exec("sh -i");
Perl:
exec "/bin/sh";
Ruby:
exec "/bin/sh"
Lua:
os.execute("/bin/sh")

If the awk command can be run, a shell can be spawned with the following:
awk 'BEGIN {system("/bin/sh")}'
The find command can attempt to spawn a shell with the following command:
find / -name foobar -exec /bin/sh \;

[magic idol]

Here is also a good one:

script -qc /bin/bash /dev/null

[keen field]

i've also forgot how text editors can run commands and scripts inside of them,
add 'em here too

[cobalt thicket]

-_-

[untold valley]

We all know how important it is to do enumeration on target machines so that we can choose our exploits wisely. So here is a small blog covering intro to enumeration with an example of SMB Enumeration. I'm learning and writing at the same time 🙂

Critiques are most welcome or even if you wanna collaborate

https://praddy2009.github.io/portfolio/blogs/Enumerate.html

[grim plume]

Hi!
Does anybody know of some good resources to dive deeper into windows core processes?

[craggy onyx]

Did you complete the THM room on that topic? @grim plume

The definitive book on that is: Windows Internals Part 1: System architecture, processes, threads, memory management, and more, Seventh Edition by Yosifovich, Ionescu, Russinovich, Solomon.

[fast wraith]

Created a OSINT tool for Twitter! Needs API keys to work. Kronos is a simple bash script that will return a list of links containing people that your target is following, starting with the oldest first (history goes up to 1000).

https://github.com/Droogy/tools/tree/master/kronos

[grim plume]

@craggy onyx I’m working through it right now. Found it very interesting so that’s why I wanted to know if there are any resources to continue learning about it. Gonna have a look at the windows internals-book. Thanks!

[light crystal]

Machine Learning (60+ hours) - https://www.udemy.com/course/machine-learning-concepts-and-application-of-ml-using-python/?couponCode=ML_FULL_UPLATZ

[tepid patio]

The free path has been updated to have.... a networking section!

Some things have been moved around, AOC1, AOC2, and Owasp top 10 make a feature!

https://blog.tryhackme.com/free_path/

[short sleet]

@tepid patio Thankyou so much for keeping it updated 🙂

[short sleet]

ping?

[night ether]

pong

[topaz gulch]

@grim crown
A) Writeups go in #thm-community-media
B) please don't post writeups that haven't been approved by the creator. It's very disrespectful, and against our rules in here.

[fast wraith]

good guide to harden your Discord account https://www.kaspersky.com/blog/discord-privacy-security/38546/

[slender mirage]

Join @shut ferry and I this Friday at 6 PM BST where we will be talking about how to harness your LinkedIn network to break into cyber!

Twitch link : https://lnkd.in/eCqNr7i

It will be recorded for YouTube as well if people can't make it.

[distant gust]

Can anyone recommend a script similar to APTSimulator on GitHub? I'm trying to work on IR and forensic skills

I just need a somewhat realistic attack simulator to run against a VM

[craggy onyx]

Atomic Red Team https://github.com/redcanaryco/atomic-red-team

[distant gust]

Thanks! I'll check it out tomorrow

[chrome zodiac]

https://twitter.com/dazzyddos/status/1354063389312442369

Dazzy (@dazzyddos)

JWT mindmap. Please retweet so that it could reach to many.
Thanks to @srini0x00 @Offensivelabsin , your course helped me to build this mindmap.

Twitter · Jan 26, 2021, 1:47 PM

[fast wraith]

made a script utilizing the VirusTotal API to run some basic analysis on malicious links/files
https://github.com/Droogy/VirusTattle

[azure widget]

virus tattle aint that right

bunch of snitches

[magic idol]

Nice script

[fast wraith]

thank you very much! (pls PR and make it better 😭 )

[azure widget]

dont use bash

thats how you make it better

bash good short term long term bweh

[fast wraith]

very true, been slacking in python - plan on re-writing my homebrew stuff with concurrency

[pearl siren]

You sound like a zsh guy... 😂
But yeah... Zsh made a huge difference for me

[magic idol]

I was just using virus total a whole bunch doing the range force stuff. This could have been put to testing @fast wraith

Might actually redo it with your script, if you dont mind.

[fast wraith]

please go right ahead! just keep the api call limit in mind (4 per/min)

[magic idol]

I saw a good idea out there for a possible script. Potentially like a Yara rule generator :)

[fast wraith]

we're referring to the bash shell scripting language not the actual shell itself

[pearl siren]

Oooh. I stand corrected in the case.

[magic idol]

Yara rules are simple in itself..but a script would be nice to plug and go

[fast wraith]

definitely, seeing lots of opportunity for scripting in blue team stuff

[magic idol]

I finished soc 1 capstone and things like iptables, fail2ban etc def could use some scripting

My brain is not big enough for that tho haha

[azure widget]

nah all my homies use xonsh

[magic idol]

Im the manual type of guy

[fast wraith]

honestly just having a script that runs decent configs for all the usual suspects is more than enough, its easy to forget things when you're running through like 6 .conf files in a row lol

[magic idol]

I lack in that department, mainly due to not actually doing it

I feel like its faster to do stuff manually, especially when you are jammed for time

[fast wraith]

true, if you know what you're looking for a good one-liner is all you need which is why i've been leaning on bash so much lately

[pearl siren]

I'll be sure to check it out...

[craggy onyx]

There's also an upcoming THM room on Atomic Red Team in April 2021. 🥳

[glass mulch]

https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit

[night ether]

looks good :D i also recently made something utilising the VT api, however for files i use this site: https://analyze.intezer.com/, it's very OP

[fast wraith]

time to end the OS wars https://github.com/SerenityOS/serenity

[prisma lodge]

Does anyone know of a CTF or virtual labs for ICS (OT) environments?

[hushed estuary]

x86 (32-bit) kernel? whyyyyyy

[fast wraith]

great video on tshark usage and monitoring - shame these SANS videos don't get more love

https://www.youtube.com/watch?v=ikhKUylOJCw

[trim pier]

hiya
has anyone found any active exploits or been able to exploit CVE-2021-3156 (the sudo cve for privesc)

[odd quest]

No PoCs yet.

[trim pier]

ok thank you for update
i was unable to find any also so just confirming

[serene coyote]

https://securityaffairs.co/wordpress/113900/hacking/sudo-vulnerability-cve-2021-3156.html

There is a video of a poc.

[azure widget]

https://www.youtube.com/playlist?list=PLiFO-R_BI-kAqDPqtnOq2n70mtAZ6xg5N

[shut ferry]

Yo

[light crystal]

[fast wraith]

good twitter thread for port-forwarding/tunneling tricks
https://twitter.com/infosec_scarlet/status/1354528499105636353
TLDR for those without Twitter

Local Port2Port
Open new Port in SSH Server --> Other port
    #Remote port 1521 accessible in port 10521 from everywhere
    ssh -R 0.0.0.0:10521:10.0.0.1:1521 user@10.0.0.1
    #Local port 1521 accessible in port 10521 from everywhere
    ssh -R 0.0.0.0:10521:127.0.0.1:1521 user@10.0.0.1

Port2hostnet (proxychains)
Local Port --> Compromised host(SSH) --> Wherever
    ssh -f -N -D <attacker_port> \   
        <username>@<ip_compromised>

SSHUTTLE
You can tunnel via ssh all the traffic to a subnetwork through a host.
Example, forwarding all the traffic going to 10.0.0.1/24
    pip install sshuttle
    sshuttle -r user@host 10.0.0.1/24
    
METERPRETER
    portfwd add -l 80 -r 172.16.0.0 -p 80

NCAT PORT FORWARD
    mknod pivot p
    nc -l -p < port to listen on> 0<pivot | nc 1>pivot
    
REMOTE PORT FORWARDING
    ssh -N -R 10.10.1.1:4455:127.0.0.1:445
    attacker@10.10.1.1
    
Socks5 with SSH
    ssh -N -D 127.0.0.1:8888 admin@10.1.1.1
    
DYNAMIC PORT FORWARD
    ssh -N -D 127.0.0.1:1337 user@remotehost -p 8888
    
NCAT HTTP PROXY
    ncat -vv --listen 3128 --proxy-type http
    
SSH GRAPHICAL CONNECTION (X)
    ssh -Y -C <user>@<ip> 
    #Y is less secure but faster than -X

Infosec Scarlett (@infosec_scarlet)

I have seen a lot of #pentesters struggle with tunneling and port-forwarding concepts. All #hackers should definitely understand these concepts for successful tests.

This thread is dedicated to Tunneling/PortForwarding tricks.

#infosec #pentest #tunneling #security #bugbounty

Retweets

584

Likes

2017

Twitter · Jan 27, 2021, 8:35 PM

[odd quest]

sshuttle > all

[tepid patio]

https://www.reddit.com/r/tryhackme/comments/l7t92w/weekly_cyber_news_recap/

[fast wraith]

Is that a THM community newsletter? would be nice to contribute to something like that @tepid patio

[fathom bear]

Hey someone know good resources to learn socket with python?

[tepid patio]

uhhhh, its caramel_members weekly news recap she does does r/nordvpn, you can DM her to help 😄

[tepid patio]

https://twitter.com/FiloSottile/status/1355124205080240131

Filippo Valsorda 💚🤍❤️ ✊ (@FiloSottile)

Exploitable heap overflow in libgcrypt 1.9.0 (┛ಠ_ಠ)┛彡┻━┻

It's the crypto library that gpg uses. Homebrew has 1.9.0 right now. 🚨

https://t.co/obYrz5b7z0

Retweets

222

Likes

474

Twitter · Jan 29, 2021, 12:02 PM

[fast wraith]

gotcha, well if theres any interest in a THM newsletter count me in - ill reach out to her as well

[tepid patio]

So the cats out of the bag! I've released a new tool with help from @sonic abyss @night plinth !

🔥 Introducing Name That Hash - Modern Hash Identification system with popularity ratings, Hashcat, John, and descriptions.

GitHub: https://github.com/HashPals/Name-That-Hash
Web App: https://nth.skerritt.blog/
Twitter Announcement: https://twitter.com/bee_sec_san/status/1355500939881406464

Brandon / Bee (@bee_sec_san)

🔥 Introducing Name That Hash - Modern Hash Identification system with popularity ratings, Hashcat, John, and descriptions.

The little secret project I've been working on for weeks with @q8fawazo @Jayy_2004 @OrielOrielOriel and more!

https://t.co/SWDr5Wu7DF https://t.co/Uyu4Mrmm4S

▶ Play video

Twitter · Jan 30, 2021, 12:59 PM

[sonic abyss]

👀

[tepid patio]

Special thanks to @sharp aspen @sand schooner @night ether @hushed estuary @fast onyx @hallow meadow @thin dagger for testing and feedback 😄 ❤️

[hushed estuary]

Gj

[prisma bison]

:<

[tepid patio]

you're getting thanks in the next tool release which is probably a couple of days

[sonic abyss]

heres your thanks

@prisma bison

[thin dagger]

Waiting for more ☺️

[glad hazel]

Oh is it in python?

I thought bee will make something using rust LOL

Looking good though. Thanks bee and all the contributors

[tepid patio]

It's in Python because the original HashID was and we use some of their code (with full-credit ofc!) ❤️

[sonic abyss]

[vast moat]

Hey everyone, I made a tool that generates reverse shells with supplied args. Never leave the browser again!

https://github.com/djjoa/genshell

[gritty barn]

nice tool. just a small grammar thing i spot under #Usage Examples

[dim marlin]

I remember there was a free path blog for tryhackme which recommended free room. Anybody have the link for it?

nvm I found it

[prisma bison]

!docs free-path

[fast onyx]

Aww 🙂 it's great, I used it earlier to figure out which tool to use 🙂 Thank you

[vast moat]

Nice! Thanks for the catch. I put that README together at 3 am yesterday morning

[vast moat]

Just fixed it. Thanks again 🙂

[gritty barn]

np np

[sonic abyss]

https://github.com/ihebski/DefaultCreds-cheat-sheet

[magic idol]

Awesome resource for blue teamers out there https://github.com/fabacab/awesome-cybersecurity-blueteam

[azure widget]

https://malwareunicorn.org/#/workshops

[dark mortar]

DEDMAP Alpha Version 1.1 is out!!🔥🔥 Go check it out 👇🏻https://7Ragnarok7.github.io/DEDMAP
What's New in this Update :-
-Lots of Bug fixes
-Major Code and Performance optimization
-Great Improvement in port scanning speed.
-Drastically reduce Space and Time Complexity
-New slick seamless installer❤️
-Patched to Natively support all android devices🔥🔥
❤️
And guess what? With this new update it defeated Nmap in port scanning speed! (POC in the video below)

It beats Nmap even in its Infamous Stealth Scan mode with superuser privileges!!! All of these without even introducing multithreading in the tool yet🔥

Do use the tool and share me your feedback after using it. :) I will continue developing it. Also, it would be great if you can star the tool on GitHub and share it if you liked it 😊 ..as it has very low reach to people as of now. I will add awesome new features to this tool in near future 🙃

[sonic abyss]

Can I recommend for recording your terminal

https://github.com/faressoft/terminalizer

Might be easier then recording with your phone 🙂

Other then that, looks great!

[dark mortar]

Thanks for the suggestion!

[remote wind]

Is it approved write up?

[prisma bison]

@next marlin Is that approved?

(If you do not respond within 5 minutes, I am going to delete it)

Submit it to the room in the writeups section

[clear tree]

Click on the Writeups tab in the room and then click Add Writeup

it will be reviewed by the room authors

[remote wind]

https://www.udemy.com/course/automate/?couponCode=FEB2021FREE

[tepid patio]

Rizin is a Radare2 fork by the creators of Cutter 🙂 https://rizin.re/

[prisma bison]

ooo

[odd quest]

@frigid jacinth Please only post actual resources

[azure widget]

https://adepts.of0x.cc/kerberos-thievery-linux/

https://www.delaat.net/rp/2016-2017/p97/report.pdf

[untold herald]

Any recommendations to learn basic stuff of os and windows os and linux(rgt now iam learning it from linuxjourney.com,any further recommends are welcome) in the perspective of cybersecurity.

[frozen horizon]

have you done the tryhackme linux fundamentals room?

[untold herald]

Yup.. completed

[frozen horizon]

well that should be most of the basics, as you go on to do more cybersec rooms on THM it should further develop your understanding if you run into problems

for windows, not sure if there are similar rooms, maybe one on powershell

[odd quest]

UnderTheWire for powershell

OverTheWire for linux

[untold herald]

K..what is wt iam doing now...but still confused on learning windows os

Like how to learn it from core.

[untold herald]

Iam doing it rgt now...but before going to start powershell...i want to learn abt event logging,user management,sec. auditing and file system hierarchy in windows os...

[odd quest]

I listed two

[untold herald]

But before learning powershell..it's better to learn the basic stuff of windows os...rgt??..

[odd quest]

Powershell is a language

You can learn it

[jagged tiger]

Learning about the OS, you will have to interact with it in some way. On windows, one of the most common ways to interact with Windows is PowerShell. Skipping PowerShell, in my mind, is very similar to wanting to understand Linux without learning bash (or another shell). It's possible but increases the lift substantially.

[odd quest]

They're asking the opposite

[jolly apex]

Introduction to Windows is what you are looking for @untold herald

Its a room on THM

[mystic jetty]

Can anybody tell me the efficient way for learning the SQL injection?