unkempt herald
took me a minute to figure out what I was doing wrong
#site-bugs
pine quiver
simple CTF, exploit no longer works. Tried rebooting several times, continuously returns like this (should be returning ||mitch's email and password||)
green hare
Question from "Google Dorking" takes the "dorks" as correct without the ":", this wouldn't work in real life. Without that the results are significant different
You have problems validating the flags -/-- and now :
pale flare
Hacking with Powershell question 3.3 correct answer should be 7935 but says incorrect answer
spiral flame
Not incorrect, you are not filtering properly
Don't trust writeups, they can be wrong and shouldn't directly give answers
pale flare
can i dm you ? dont want to spoil too much
pale flare
okay
buoyant dagger
Room: Kenobi
Issue: missing id_rsa in /var/tmp
spiral flame
Not an issue, user error
You need to copy it
it's not in /var/tmp when you deploy it.
tulip kettle
I am doing Attackerb room but the it is showing IP of Source.. I tried 3-4 times restarting, login out everything same error.
tulip kettle
is that so?.. oh I thought I have just complete the Source
and then that is showing here
short jackal
its the same VM, it just also got released as a standalone room
tulip kettle
thankyou..
short jackal
Another page button bug
Steps to reproduce:
- Enter hacktivities
- Filter rooms so there is only one page and the page buttons disappear
- Change the filter so there are more than one page and the buttons reappear
- The "Next" button is disabled
Expected behavior: "Next" button should be enabled
covert kernel
hi is there negative marking in points when i give wrong answer cause i've completed a room and my points are so much less while others have good points ....my points didn't increase why??
pine quiver
@covert kernel the people who complete the room first get bonus points. There is no negative
its also up to the room creator if the questions give points
short jackal
@covert kernel are you getting 8 points while others have 30?
for walkthrough rooms you get 8 points for one question, in challenge rooms it's 30 + 50 if you're first
if you're getting less points than others it's probably because these other people finished the room before the point conversion and while converting all answers were set to 30 points
covert kernel
all are getting 600 points mine is stuck at 172
sorry at 176
yeah thanks man got it
yeah but why
olive drum
A verification link from the email expires after a couple of hours while these two work for two weeks straight
covert kernel
why so?
covert kernel
@olive drum so is it normal getting 8 points for each question in walkthrough?
cinder crow
yes
olive drum
^
covert kernel
how to finish the room before point conversion?
cinder crow
You don’t
the point recalculation was done a bit ago and so anyone who did the room before that time got the points you see there’s no way to get that amount of points now
covert kernel
i'm getting this so we've got like a date or sth before that who finishes will get 30 points each and after that will get 8 am i right?
cinder crow
no the point recalculation happened a while ago for all rooms and questions the rooms from now on generally have 8 points for walkthroughs and 30 points for challenges no matter what
The only time you can get extra points now is if the admins assign bonus points to a question or if you get first blood on a question in a new challenge room
covert kernel
oh thank you for clearing my doubts appreciate your help
dapper silo
found a bug, Attacking Kerberos room, when ran mimikatz.exe, it gets removed by default Windows Protection
dapper silo
mimikatz is preloaded into the provided vm
cinder crow
can you terminate and redeploy for me
dapper silo
u mean the room vm?
cinder crow
yes
dapper silo
done, redeployed
spare cobalt
I think there is a answer problem in the Blue room. Task 2 Question 3 where it asks to enter in the required option for windows/smb/ms17_010_eternalblue_win8 Its supposed to be "RHOST", but the answer is not working. Even the demonstrated video shows RHOST is the answer.
cinder crow
RHOSTS
spare cobalt
Wow, thank you so much. I don't get why it would be plural
cinder crow
there’s a difference between RHOST and RHOSTS I’ll let you do your own research
@dapper silo I just deployed an instance of it it’s fine for me not sure why defender decided to pop up on your instance
dapper silo
thx
i think its cuz when i enter command "kerberos:ptt [0;116c31]-2-0-40e10000-Administrator@krbtgt-CONTROLLER.LOCAL"
it got qurantined
the file was missing extension.kirbi , thus it picked it up
cinder crow
It shouldn’t have everything is turned off on that machine
dapper silo
👀 ,ok
worn light
In the room "PS Empire" for task 3.7, where you need to answer what it is you need to specify to change browser profile, the answer is ||ServerVersion|| but on a new install of Empire, the "info" panel now lists the command as|| Headers||
brave reef
It’s already been addressed.
worn light
damn, has it? I tried to find out if it had been through the Discord search function
nvm, found it 18/06/2020
dire ferry
Maybe I don't understand the terminology correctly. But on CTF "knockknock" question #3 asks what port is the last knocked and the answer you have to give is incorrect.
should be ||9000||
sorry if this would not quality as a "bug" didnt know where else to submit.
brave reef
cinder crow
nah if it is a problem with the answer of a question it belongs in here
brave reef
Oh whooops I read it wrong
dire ferry
ok cool. I got screen shots if needed otherwise it might throw others for a loop like it did me.
orchid remnant
@dire ferry As it happens, I reported that a while back.
Now I have room edit perms
Thanks for reminding me 😁
dire ferry
@orchid remnant NP thank you!
green hare
The https is not loading here https://tryhackme.com/room/owasptop10
spiral flame
It loads just fine for me
median sapphire
^
brittle juniper
cinder crow
@frosty cape the AttackerKB room banner cuts out the rapid7 logo
frosty cape
@frosty cape the AttackerKB room banner cuts out the rapid7 logo
@cinder crow Whats your screen resolution out of interest?
vale nest
cinder crow
1366 x 768
cinder crow
its not their banner not sure if he can really do that
karmic delta
!!
buoyant dagger
Room: CC: Radare2
Issue: there are several <krb> or <code> tags that are empty.
Bug Location:Task 3, Task 4, and Task 5.
olive drum
@covert kernel fix ^
crystal juniper
I would like to report a bug with the room --> brainstorm
FTP client has an issue on that box says bind port in use and cannot run dir/ls on it bind address already in use
topaz venture
Ah yes, that's a known one fortunately. Connect to either EU-VIP or EU-Regular 1 and use the passive switch (-p) in your ftp command @crystal juniper
if it's your first time switching VPN servers you'll have to regenerate your config but any switches after that you won't need to
crystal juniper
every time i use the -p it hangs up
on 227 Entering Passive Mode (..)
ill try a different vpn region
@topaz venture I was able to access FTP as normal without -p
I appreciate the help!
serene obsidian
Not a big deal but found a typo on the 'Network Services' Room, Task 10. In the example for the Hydra command the reference a username of 'Dale' however it is 'Mike' not sure if thats on purpose or a typo
random monolith
Im having an issue with the Burp Suite room, Ive followed it to the letter 3 times now with no success once I get to Task 3 Exercise 8 I get the following error in my browser : The proxy server is refusing connections
brave reef
That's most likely not a bug with the room
random monolith
Do you have any idea what could be the problem?
topaz venture
Your browser is still trying to use Burp Suite as a proxy. Which I'll assume by that error you either have the interceptor turned off or Burp Sleep closed all together @random monolith
Either turn the interceptor on or configure Firefox to not use a proxy 🙂
random monolith
Yeah the browser is using the proxy I told it to like it says to in the room, I cannot open anything in the browser eg google. Is the interceptor turned off by default? This is the first time Ive ever opened it today?
cinder crow
from the sounds of it either you have yet to forward the request burp is intercepting or you have yet to import burps certificate
random monolith
I can't get to the stage of the CA certificate. The problem is if Im following a room that is supposed to be a pathway of teaching, when you follow the instructions to the letter it should work. Nowhere does it say turn on interceptor or configure Firefox to not use a proxy.
The interceptor is 100% running Ive turned it on an off 5 times. If i remove the proxy from Firefox I get another error: unable to connect of which makes perfect sense.
fresh tide
When you unsub then
Typo: should be Don't instead of Dont
median sapphire
*Dont instead of Don't
warped stag
Guys. How do you access your host shared folder from@docker container ?
I’ve installed docker and a custom pentesting lab. But I need to share some files between host and container
median sapphire
How does this belong in #site-bugs?
lament kraken
Hey there. I used ./enum4linux.pl -a {host for "Basic Pentesting"} https://tryhackme.com/room/basicpentestingjt but not responded. I will check walkthroughs but i think somethinks is wronge.
spiral flame
lament kraken
ok its fixed 🙂 thx
dusk oak
Not sure if its a bug or if im making a mistake but in the room ninja skills, I cant seem to find the file "bny0", I have no problem finding the others with the find command so? sorry if its not a bug but me being an idiot
covert kernel
On Advent of Cyber, there is a missing image
Not sure if its a bug or if im making a mistake but in the room ninja skills, I cant seem to find the file "bny0", I have no problem finding the others with the find command so? sorry if its not a bug but me being an idiot
@dusk oak Me too. Ask someone to look at few days ago. Maybe someone can fix that?
spiral flame
Chances are it's not missing, it's just being blocked
Make sure you can access Imgur properly
covert kernel
imgur works, but there is a certificate issue on carlisletheacarlisletheatre.org, firefox nor chromium can reach that
fresh tide
in room: https://tryhackme.com/room/ignite
clicking on lollava takes you to a 404 page.. i think para changed his name on THM so that's why?
median sapphire
He did 🤔
spiral flame
@orchid remnant quick one for you
orchid remnant
Fixed 👍
pine quiver
offensive pentesting path shows a red bar even though ive completed both rooms in the section
fresh tide
@pine quiver new task added in kali machine
orchid remnant
@frosty cape would I be right in thinking this was due to the naming scheme changing?
Might need fixed manually. I believe Mr Holmes' one is still working too
covert kernel
yah so there is that xD
covert kernel
yeah so it works but my internet is hot potato and i don't know will this upload
pine quiver
room Authenticate, I imagine it's supposed to say should be difficult to decrypt or something
same room, the token given in task 4 is actually the token to authenticate as admin, not user2, which is what its supposed to be showing you
which gives the answer to the question btw^
fresh chasm
You can change your email in Your Profile on tryhackme.com and not have to verify it?
lyric crown
covert kernel
second paragraph. i think they meant to say ssh was replaced with telnet, as the answer to question 2
pine quiver
@covert kernel that is what it says?
spiral flame
second paragraph. i think they meant to say ssh was replaced with telnet, as the answer to question 2
@covert kernel Wait, what
Telnet did not replace SSH
pine quiver
Oh I see. Yea no it’s right as is
covert kernel
@covert kernel Wait, what
@spiral flame read replacement
spiral flame
It's just fine
pine quiver
just. fine.
covert kernel
pine quiver
Boi no it don’t
pine quiver
Indeed it is
covert kernel
green hare
Does anyone have problem with mrrobot ctf!! With a simple nmap scan the machines comes down, even worst if i launch wpscan, im considering downloding the vulnhub version
pine quiver
Been awhile since I’ve done it but I don’t remember any problems
covert kernel
Does anyone have problem with mrrobot ctf!! With a simple nmap scan the machines comes down, even worst if i launch wpscan, im considering downloding the vulnhub version
@green hare check your vpn?
spiral flame
There's no machine
orchid remnant
Yet
spiral flame
Yep, I've reported this before I believe
covert kernel
Okay
cinder crow
oh wait my god I need to learn to read
spiral flame
😉
rose solar
covert kernel
Same here
short jackal
Didn't get that problem myself but I saw others get it when bruteforcing with too many threads or just opening the site too early as the DB needs to start up
covert kernel
I waited for 20 min. Still same error
Removing blog.thm from /etc/hosts, makes it work normal. ( For me )
short jackal
Huh
This shouldn't affect the site
Opening it without the .thm redirect just broke the page because it couldn't load assets from that domain
vocal raptor
Bug in terms & conditions. Put the space between GDPR and the full version. ** TryHackMe adheres to GDPR(general data protection regulation) and are GDPR compliant when collecting and processing user information. **
orchid remnant
Wait, how the heck is Donuts losing?
contact me for more info
@rose solar Send it in an email to support@tryhackme.com 🙂
topaz venture
This is the same match I've brought up Muirl 😆
fresh tide
Wait, how the heck is Donuts losing?
@orchid remnant the machine was dying, ppl were killing his shells, no one was patching anything, didn't get to see his rootkit in action, planned resets and he was streaming it in the discord as well.
orchid remnant
I see
short jackal
@rose solar mind if I DM? I got it to work two times before but no more. seems to randomly display it for me when spectating things
short jackal
@topaz venture the IP should be sent only when the koth-private message is sent
undone nebula
any tips on lagging servers?, doing the linux privesc and it hangs after every command
pine quiver
@undone nebula room task evidence screenshots?
undone nebula
I am sorry. I don't follow the quesiton
pine quiver
Which room are you on. Which task are you on. Do you have screenshots of what’s going wrong
undone nebula
"Common Linux Privesc" I have my VPN setup and I ssh into the box but then it hangs, I have to wait for some kind of a time out or something before I can type anything.
I switched VPNs to EU and no difference, just wondering if there are known issues with that room
or is it the entire environment being laggy
pine quiver
I’ve never had an issue with it nor have I known anyone else to have an issue with it
Post a screenshot in #site-support of the issue
fresh tide
Even after koth reset it wont kick me out of the box...
fresh tide
Bug or a feature? 🤔
spiral flame
There's normally like 3mins or so
cold rapids
There is some kind of bug with the Streak. I definitely did not miss any days and the graph shows this, but today it just reset itself and now I'm back to 1??
spiral flame
You can have it reset without missing a day
it doesn't work on days
It works on 24 hour spans
cold rapids
Yeah, well it clearly says DAYS.
spiral flame
If you answer at 10am one day, then 2pm the next, you can lose the streak
because more than 24 hours have passed
PG13.
Calm down.
fresh tide
👀
spiral flame
it's being changed.
cold rapids
It's carnival mechanics where the rules aren't what you think they are.
spiral flame
Thanks for the feedback. It's being changed.
mystic agate
Ran into a problem with the Web Scanning DVWA room. I had to google since I could find any answer in the format from the list of alerts. Google got me to a write up for the right answer, but I kinda felt setup to fail.
mystic agate
It's on Dark's list
@spiral flame
spiral flame
Yes?
timber marten
Just a typo, but Alfred, Task 3, #2 says to enter load_incognito but it should be load incognito without the underscore
spiral flame
@orchid remnant
fresh tide
Weird, Now the koth machine is instantly kicking me out as i press the reset button.. was it fixed?
nocturne roost
Is there a bug in Alfred’s room? Specifically when priv escalating and not finding the flag where it is supposed to be?
spiral flame
No
There's a question that tells you something you need to do before you will see the flag.
Read the questions
nocturne roost
Weird, I am NT/Authority and went to the exact location and there is no root.txt, might redo some steps
Thanks tho 🙏🏻
spiral flame
No
You missed one
There's a whole question dedicated to it. Telling you what to do. It doesn't require an answer.
This is not a bug
This is user error.
If you need help, use the help channels.
nocturne roost
Probably, I escalated in my own way. I will follow along the steps then> You missed one
@spiral flame
Sure tho
timber marten
Hashing -Crypto 101, Task 4, #2 - example hash that is shown on hashcat.net is the "correct" answer. if possible, the example hash obtained by running hashcat -m 8100 --example-hashes should also be counted as a correct answer. The tool itself should be considered a more primary source than the website for the tool?
spiral flame
Hashing -Crypto 101, Task 4, #2 - example hash that is shown on hashcat.net is the "correct" answer. if possible, the example hash obtained by running
hashcat -m 8100 --example-hashesshould also be counted as a correct answer. The tool itself should be considered a more primary source than the website for the tool?
@timber marten You're told to use the website
spiral flame
I'll state it in the question for you then
timber marten
enjoying the room, btw
spiral flame
There's a sequel coming soon
topaz venture
spiral flame
in the hint, yes
@timber marten We've asked for more control over answers, I'll consider it when we can add multiple answers
spiral flame
I remember this. And I remember there being a fix. Give a sec to search
ZTHObscure WebVulns, task 14, public key not where it says it is
@pine quiver Try Curl
Or telnet/netcat
pine quiver
ok i tri
spiral flame
I agree it's probably a bug, but here's a workaround that might work
pine quiver
yea that worked, thanks @spiral flame maybe put that as a note in the room or something?
spiral flame
@covert kernel This one's on you
yea that worked, thanks @spiral flame maybe put that as a note in the room or something?
@pine quiver Curl or manually making the HTTP request with nc/telnet?
pine quiver
curl, ill try with nc and telnet too and let you know
pine quiver
idk how to do it with either telnet or nc lol so that doesnt work for me, but idk the syntax
spiral flame
You'd be making a HTTP request manually
I'm planning on making a room that covers this
pine quiver
worked with netcat
worked with telnet too
and i learned something new, so thanks ya
spiral flame
I'll bug Pars until he adds a note
pine quiver
@covert kernel also, the jwt-cracker you suggest to use requires npm to get it up and running, which was a pain the butt (at least for me). So I used this: https://github.com/brendan-rius/c-jwt-cracker instead, which worked for me and was easy to install
great room though, i learned a ton 🙂
brave reef
https://tryhackme.com/room/rpwebscanning
Don't know if this has been addressed
Task 2, Question 10:
Nikto scans can take a while to fully complete, which switch do we set in order to limit the scan to end at a certain time?
In the newer version of nikto, this is not an option in the manual, which I could find. I had to look through older versions of nikto (someone might have to check this as I might have just missed the option).
Task 3, Question 8:
What Alert does ZAP produce to let us know that this site is vulnerable to XSS?
After performing manual and automatic scans, nikto struggled to find the answer the room was asking for. I do not know if this is an issue for me only but I did have to go into write-ups to search for the answer.
spiral flame
The XSS alert, and the reason behind it are deprecated
That last one is on dark's list
brave reef
👍
spiral flame
I'll add the nikto one
fluid canopy
I can no longer use "Enter" to submit an answer on a question in a room 😮
brave reef
iPhone 8 calendar just doesn’t fit properly
short jackal
use android then, problem fixed
brave reef
fresh tide
Did the room said you need to open chrome?? You can see that Internet Explorer down there
spiral flame
Advent of Cyber, day 13: When I enter into the remote desktop, there is no Chrome application
@covert kernel not a bug.
tulip tiger
cinder crow
is that on a phone...
iron hollow
the Corp box has a bug, when trying to log in as Administrator with the decoded password it says that the password expired, i checked the writeups thinking that's a problem that i have but this guy is also having the same problem:
pine quiver
@iron hollow yes, known issue
iron hollow
well, can i get my flag xd i want the points
iron hollow
type C:\windows\admin that one
returns a permission denied
cuz lol im not administrator rights
oh wow
from CMD it gives an error
but from fileexplorer i can just double click it lol
pine quiver
did you check if that path exists
spiral flame
The room is on the list of things to be fixed
iron hollow
after i enterede administrator directory now it doesnt give me a permission denied
weird windows
yea okay, thank you
i asked cuz there is no bug in the "known issues"
spiral flame
Only the admins can add to known issues
So no one adds them
Because the admins are busy
iron hollow
😛
pine quiver
@iron hollow that returned permission denied as which user?
iron hollow
hold on
did yuou ever done this box?
if you done this box you know
you can log in as dark and fela
iron hollow
and on this user fela you have access denied BUT ONLY until something happends
let me show you
so you seen the picture right
now let me show you this
pine quiver
yea i couldnt remember if you start logged in as dark or fela. You should be able to ||read the flag as fela|| i just didnt remember
dont know why that doesnt work now
iron hollow
see
YEA
but you need to do that
with the fileexplorer
you needd to open to get rights or something
cuz if you try only with cmd it doesnt work
weird
pine quiver
worked for me in a regular cmd
iron hollow
for me not ;-;
pine quiver
Clearly my command line in better than yours
dense saddle
Not sure if this is where I should ask. I am trying to get everything setup. I downloaded the openvpn config file and ran it like the room said to. The access page shows that I am connected however when I click the http://machine_ip link It doesnt work
What am I doing wrong?
cinder crow
Have you deployed the machine in the room?
Also this belongs in #site-support as this is not a bug
dense saddle
Sorry, When I clicked the discord link for having trouble this was where it brought me. Also, I'm dumb I completely missed the deploy button. Thanks!
spiral flame
@frosty cape can you change the invite link to take people to #room-help or #site-support or something pelase?
pine quiver
UOPeasy, the last question, the password isn't in the password list provided
frosty cape
@frosty cape can you change the invite link to take people to #room-help or #site-support or something pelase?
@spiral flame Which invite link, the main THM on sign up one?
spiral flame
I'm assuming in the welcome room?
frosty cape
or all of them?
spiral flame
Sorry, When I clicked the discord link for having trouble this was where it brought me. Also, I'm dumb I completely missed the deploy button. Thanks!
preventing this
They really shouldn't drop people into this channel
olive drum
There seems to be no avatar for room https://tryhackme.com/room/convertmyvideo
sonic sail
Minor UI bug
CC: Pentesting room
Task 23 [Miscellaneous]: A note on privilege escalation
The 2nd link in 'Linux' has a opening bracket inside the link which instead should have been outside the link
mild breach
/upload still has the bug of saying "You are already uploading. Please wait for this upload to complete. If this is an error, click reset your upload." and clicking Reset Upload doesn't work - you need to log out and in first
orchid remnant
Just noticed that a few minutes ago too, can confirm
Even after upload is long finished, it's stuck on that message until the next time you sign out and back in -- and even then you still need to click reset afterwards
Clicking reset before logging out and back in does nothing
topaz venture
It takes a couple of clicks (within the region of 10~) to solve it for me
Sometimes I have to log out and log back in
Session handling?
mild breach
room: brainstorm
task: 1
question: 2
the answer it’s expecting is 6, however it should be 3
digital thorn
Can confirm
spiral flame
Flag got leaked by muir
orchid remnant
That is not a bug James!
spiral flame
It's a security flaw
orchid remnant
Do you want me to reset your progress and change it, will that make you happy?
spiral flame
The admins misplaced their trust
median sapphire
😮
orchid remnant
It is literally a placeholder
orchid remnant
I mean, if you really want me to change it 🤷♂️
spiral flame
I blanked it
orchid remnant
I mean, I can change it if you really want
spiral flame
nah this needs to be escalated to Skidy & ashu
orchid remnant
Otherwise, where's the bug 🤣
spiral flame
There's been a breach of trust
median sapphire
👀
orchid remnant
Hey, James?
spiral flame
I want bug-hunter for exploiting it!
median sapphire
😮
orchid remnant
No, I'm not throwing you into that pit 🤣
spiral flame
I found the weakness, which was muir, and exploited it!
orchid remnant
Although I will point you at #room-testers 🤣
spiral flame
I'll close you in a minute!
orchid remnant
🤣
short jackal
I'll close you in a minute!
@spiral flame may I know how?
spiral flame
I'm afraid that information is classified
acoustic saddle
i got the flag for jeff but it wont take it....
im putting it in the right way as well. still says its wrong
acoustic saddle
gotcha
covert kernel
https://tryhackme.com/room/xss
Node.js Server Buffer Overflow Crash
Submitting 251 or more characters into any input field that stores data server-side will cause the Node.js server running on port 80 to crash entirely. Fields affected are:
ip/ Registration Username Input Field
ip/ Registration Password Input Field
ip/stored Comment Input Field
Solution:
Limit input to 250 or less characters, or adjust logic to allow larger values
additional note: the script that the website gives you on the Keylogger section can easily trigger this crash, and unsuspecting new users may accidentally trigger this crash while attempting to use the keylogger for its intended purpose.
worldly pagoda
Just for me ?
rose granite
Hello is anyone else having problems with the premium in browser Kali machine constantly disconnecting?? Thanks
Like literally every few seconds
rose granite
I click full screen which automatically opens another tab
frosty cape
Yeah, so you can only have a single view. I'd recommend controlling the machine in the other tab.
rose granite
Ah so even though it says disconnected on the original (small screen) page, its not disconnecting on the large screen?
If I just stick with the full screen view?
frosty cape
Yes:)
Its because you can only control the machine from one view. Either in the new tab (recommended) or the my-machine page.
covert kernel
are you telling me that you don't do everything on a tiny 300x200 terminal window???
smh
short ermine
Hi All, I am facing following issue
Issue - Answer Key is not coming up
Room - Cross-site Scripting
Task - Task 8(Filter Evasion), Question 3
Payload - <h1 onclick="alert('Hello')">Sumit</h1> or <h1 onclick="let a = String.fromCharCode(72, 101, 108, 108, 111); alert(a)">Sumit</h1>
Expected Output - After alerting Hello, there should be key appearing
Tested Browser - Chrome, Firefox
Hello is showing properly, but answer key is not appearing after this
pine quiver
known issue
pine quiver
don't know, got the same issue as you. It's looking for something specific for the answer, but idk what that specific thing is
short ermine
I tried "Hello", 'hello' everything. But it's not working
@pine quiver Are you stuck at the same?
pine quiver
Yes, idk how to get the flag to appear for that one
covert kernel
Oh
DM me if you really want to know the specific input needed to trigger the flag
but there's a big hint on the Task for it
mint owl
I am new here, can anyone guide me from where to start?
pine quiver
can I dM @covert kernel
@mint owl if youre subscribed theres a complete beginner pathh 🙂
mint owl
I did not pay anything, where should I go and pay? I am really interested to learn
covert kernel
probably #site-bugs is the wrong place to ask for these kind of questions
mint owl
Thank you guys- appreciated
clear nexus
Hey,
i have found a bug in the XSS room, in the playground website. who can i disclose this to?
urban flame
I'm not too sure if this is a bug or a due to parsing but
Cross-Site Scripting - Task8 Q3 The word Hello is filtered. but '><img src=0 onerror=alert("Hello")> works as an empty dialog box is called and as the browser parses ok a new popup is displayed with the answer.
covert kernel
yeah, the room is very old
spiral flame
I'm looking into alternatives RN to possibly replace it
covert kernel
i'm actually sure a lot of these bugs are probably because these methods weren't as well known back then
spiral flame
Nah I think it was just naively programmed
covert kernel
that too
spiral flame
Looking for fixed payloads to a problem with a huge number of solutions
clear nexus
Task 3, Q2 in playground, the fixJS() fails and doesn't alert the answer to the question
it fails with Uncaught TypeError: Cannot read property '0' of null
I was only able to get the answer during debugging of the function.
urban flame
The "Hello" payload, an empty popup is display then parsed "ok" which displays the answer with another popup
spiral flame
No idea
subtle fox
Not so much a bug but admin password expired in room Corp. and it is not easy to change when using none us keyboard 🙂
spiral flame
Known issue, it's on the list of things to fix with Corp
violet gull
Splunk room task-2 q-31
"what is the website where you can find the Splunk forums at?" is changed
I searched wayback machine to find it
covert kernel
so what can we do when a box ended but still have access to it?
as in you terminated it, and the box instance is stull running
@covert kernel
as the box terminated by time ran out
and the box still running
even though the koth is done with i still have access to the machine
how long has it been since then?
5+ minutes
since is been done with
i know what happened
just don't want to share it in here
median sapphire
Is it a KoTH box?
median sapphire
It's a known bug in KoTH machines
covert kernel
i have full root access
how so @median sapphire
not the first time? by whom? you?
median sapphire
We are already aware of this bug
fresh tide
so what can we do when a box ended but still have access to it?
@covert kernel if there was a reset the box will remain up for an hour.. although it won't make any difference as you will not get any points as the game have ended already.
It's already been reported
tame quail
Just finished Blog, really enjoyed this box and learn't some new tricks. A big thank you to the creator of this box.
median sapphire
@tame quail Awesome, #522158404614225920 by the way 🙂
stiff wind
Hi! I don't known if it's really a bug but I think the answer shouldnt pass once I write xploit instead of exploit in blue room task
fresh tide
owasp room Task 17 Q#5 or the XXE room.
Its asking for 18 keys but showing 17 as the correct answer:
brave reef
Oh I had the same issue, the key starts on a weird Not line, Idk the word
wanton carbon
Webgramming room: Enum task - After trying for several hours the directory-list-2.3-medium.txt and a generated crunch wordlist, I got an answer from @short jackal telling me that this was a broken task
cinder crow
webgramming is.... I believe the person who made it left so nothing we can do about it I think
dire ferry
Any reason why the room "Blueprint" has such high ping and disconnecting issues?? Its the only Room I'm having issues with.
dire ferry
figured it out!
cinder crow
No have to tried switching vpn servers?
dire ferry
yep
covert kernel
For the OWASP Day 3 challenge, I entered the password hash of the admin user, accidentally submitting the hash without its initial value and it was still marked as Correct. Just thought I should let someone know I don't know to what extent you can omit characters before the string is marked Incorrect.
covert kernel
Oh okay fascinating
midnight urchin
ON Vulnversity on the question "What is the most likely operating system this machine is running". It says the operating system, and it's not windows, or Mac. However, when the OS LInux (which is what nmap shows) is entered it rejects it. (Yeah, I know what it's looking for -but that's not an OS, it's a brand name for a version of that OS). I think that question should be reworded since what it wants isn't the OS, but the version of the OS - just sayin! (Otherwise this is great education! I'm not a total downer here! 🙂 )
spiral flame
Specifically, distro
hasty rampart
Hey guys
I just did the XML OWASP challenge yesterday
I just come today and it looks like i dont do anything about the XML
I dont know why i can do the XML challenge yesterday and today
pine quiver
https://discordapp.com/channels/521382216299839518/522158539129618453/733511589545639988 @orchid remnant in introtox86/64 it says the cmpl instruction is comparing the value of eax with var_8h, when it's actually comparing it with var_4h
screenshot provided in the message link
green hare
Holy, no answer an is correct!! what
spiral flame
Ok that is broken
green hare
LOL, xD
covert kernel
Wait, which room is that?
spiral flame
@frosty cape Once you're awake, this is super weird
short jackal
uhh
covert kernel
that's some heavy answer tolerance right there
green hare
Yeah, answer tolerance
short jackal
yikes, subonly room
i'd test it on my alt if it wasn't sub
spiral flame
Same here
covert kernel
Same, was thinking about it but I already did the room
green hare
Also im having a issue rigth now
covert kernel
@green hare Is it still considered correct after refreshing, and are you allowed to input anything still?
short jackal
it should accept one of the answers. you might've been sending too much at once. the api bugs out if you send too many too quickly
green hare
I should deploy a machine for this task with a telent service but the machine i deploy it has nothing on it
short jackal
oh the input's locked?
median sapphire
🤔
green hare
@green hare It's still considered correct after refreshing, and are you allowed to input anything still?
@covert kernel let me se
short jackal
huh
green hare
oh the input's locked?
@short jackal Yes it's locked like if a alredy give it a response
covert kernel
interesting
short jackal
this is very weird
try disabling any extensions that modify the page and refresh
that could rule out any external causes
covert kernel
I'll see if I can find another room that has a 1 character answer and see if it works
Hmm, I can't replicate it on other 1 character answer questions
@green hare What extensions and browser are you using? I can tell you have one that modifies pages to a night-mode color scheme, if that might impact anything
spiral flame
Incognito.
short jackal
also could you open devtools, paste this in and send the response? I'm interested in what the result is
fetch('/api/tasks/networkservices').then(r=>r.json()).then(r=>console.log(r.data[5].tasksInfo[0]))
(this will get the api response for this specific question)
covert kernel
It could be some kind of error in the input parser/comparison logic that causes a blank input to turn into 1 somehow
that's the only thing I can think of
spiral flame
I definitely think Skidy should take a look once he's awake
Because it's super weird
covert kernel
Yeah, seems like a really weird issue
I wonder if other questions that have a correct answer of ||1|| could replicate this bug too
spiral flame
Give me a second and I can sort that for you
covert kernel
That would definitely prove that there's a error in the input parser/comparison logic for checking user input to the answer
spiral flame
(the room code is like that because the URL for managing rooms is /room/manage/roomcode)
So if you remove roomcode, it no longer 404s
Thanks to me
covert kernel
@green hare Could you try that room that James posted with the same browser?
I would also say to clone the networkservices room and check if that question has anything funky, but can't clone it 
short jackal
uyhh, i can't manage the manage room
green hare
@green hare Could you try that room that James posted with the same browser?
@covert kernel ok, give a sec i was answring some questions
short jackal
@spiral flame how tf does malware have points on it 
spiral flame
Lmao
green hare
I would also say to clone the networkservices room and check if that question has anything funky, but can't clone it :Pepehands:
@covert kernel can't clone it too
short jackal
why do I have points on it
median sapphire
👀
short jackal
pls fix
covert kernel
👀
spiral flame
Does it... Allocate points?
median sapphire
No
spiral flame
Eh, not my problem
median sapphire
No fix 
spiral flame
Click the join toom link
Try answering the question without entering anything
Like you did on network services
median sapphire
I have blood points on that box 🤔
green hare
This is what i get Uh-oh! Your answer is incorrect.
green hare
Did i broke something? Oh my!!
covert kernel
Probably
covert kernel
hello friends, I wonder if that's intentional but in the 'XSS Playground' room in the css keylogger tutorial if you just dully copy the snipet from http://$boxip/key-logger in to the recommended comment section (http://$boxip/stored') it crashes the webserver 🙂
brave reef
It crashes the web server?
brave reef
Oh well it’s already been addressed
covert kernel
my bad.
brave reef
Nw admins will sort it ;)
covert kernel
(I forgot to mention that another solution is to replace the room :^)
if i would recommend an extra step to a room where can i do that? sorry again for the wrong place asking it 🙂
Probably #522158404614225920
okay, thx and sorry for the duplicate
It's no problem, it hasn't been addressed yet anyways LMAO
covert kernel
Hello I have found a few moar 🙂 in the 'XSS Playground' room
During the /filter-evasion in challange 3
<img src="x:x" onerror="alert('Hello')">
shows nothing
and gives away the flag
is it really the intended behaviour ?
spiral flame
Honestly, just give up on that room
covert kernel
I am sorry, wouldn't mean to disturb u guys with it.
covert kernel
got it.
digital turtle
in my game no-body change king.txt and a problem is that king change count is two | is it a bug or its related to other things?
and please fix randomize | when i saw Most Recent Games there is four food machine from 5
spiral flame
That is how randomness works
digital turtle
spiral flame
Yes, randomness means the same VM can come up multiple times
spiral flame
Less random.
digital turtle
Yes, randomness means the same VM can come up multiple times
@spiral flame
yes, but its intersting for me that same machine will choose from 5 round and when there is 9 other machine
spiral flame
Yeah, but it's possible
There's a reasonably high change tbf
Or not a low chance
I can do the math(s) for you if you'd like, but what you're asking for is actually less randomness
digital turtle
I can do the math(s) for you if you'd like, but what you're asking for is actually less randomness
yes i know but its better than have 4 same machine in a same time for me
in my game no-body change king.txt and a problem is that king change count is two | is it a bug or its related to other things?
@digital turtle how about this @spiral flame
sorry for ping
spiral flame
I didn't answer that, because I don't know what you mean or if it's a bug
spiral flame
Could be the same thing. Who knows.
digital turtle
and about this??
Could be the same thing. Who knows.
@spiral flame but its better to check for it if it happend for three times
spiral flame
I didn't answer that, because I don't know what you mean or if it's a bug
@spiral flame
digital turtle
another food machine too
i'm filling intersting about that
And you need to remember that
@spiral flame remember wat??
midnight urchin
More a typo than a bug, but, on Introductory Researching, Task 4, Question #3 you mis-spelled Emacs as "VIM". You may want to correct that! 😋
spiral flame
Maybe try to avoid this kind of joke in #site-bugs
orchid remnant
(also, ew)
midnight urchin
We're not a glum lot, @spiral flame
spiral flame
I mean this channel is for bugs. Not really intended for jokes.
untold tide
hey, when i use the in browser kali machine the CAPS LOCK isnt working, can anyone help me with that?
topaz venture
Either close the tab and reopen, or use the Shift key
untold tide
oh K tnx
urban flame
I was looking at my badges and noticed my profile badge does not match, my ID says I have completed 191 rooms but my dashboard says I have completed 166 rooms - THM Badge has just been regenerated so it is up-to-date; My only thought is that private rooms do not count towards completed rooms but even if that were true the numbers are not accurate (having around 13 private rooms) 🤔
median sapphire
Is that the static badge or the dynamic one?
median sapphire
This is interesting, my badge says I've completed 173 rooms while I've actually completed 165 🤔
grand anvil
Just doing old OWASP 10 day challange and found this... On last line should be "marked" body and not element (OWASP Top 10; Task 15)
topaz venture
Interesting @urban flame @median sapphire
covert kernel
@grand anvil I noticed that too, but didn't bother me enough to point it out until I looked at it again
should look likebody element
digital turtle
Discord mods are discord mods.
@spiral flame so please tell to devs
short jackal
@urban flame some public rooms were privated recently so it might actually be the public/private thing
iron hollow
there are multiple just on the first step, the commands that are supposed to be run all of them give errors, in my console are the correct ones
cinder crow
@iron hollow user error re read the instructions and commands
lament geyser
Room: Crypto Challenges. Task 8. This task is unsolvable. No one has solved it. Change to "No answer needed" or amend the required answer input.
thin forge
TYPO in /rpmetasploit
[Task 3]/#10
Now that we've learned about to change the value of variables, how do we view them? There are technically several answers to this question, however, I'm looking for a specific three-letter command which is used to view the value of single variables.
Should be Now that we've learned about HOW to change the value variables, <...>
median sapphire
@orchid remnant When you're free, can you fix this ^
orchid remnant
If Dark doesn't murder me for it
topaz venture
I'd suggest it needs to be: "learnt about changing the value of variables"
would be my coin toss ^^
median sapphire
That sounds good too
thin forge
I try to offer a suggestion so that it becomes obvious what the problem is
topaz venture
Noted, your suggestion isn't wrong (:
thin forge
I do like how yours flows better tho
topaz venture
Just because it's been brought up
shell flame
Hi. There's something wrong with the machine in Room: Blaster https://tryhackme.com/room/blaster
Task 3, Question 1:
User's browser history was cleared
Task 3, Question 2:
The "file" was already restored from recycle bin.
Spent more than 20mins on Task 3, Question 1 thinking it was a challenge to look for other ways to see browser history. Got frustrated so i peeped on the writeups. All 5 writeups has a screenshot that has a browser history.
sleek harness
Hi all,
Does anyone know how to bypass cloudflare xss filter?
spiral flame
Wrong channel, and Rule 9.
spiral flame
This is the bugs channel for reporting bugs. Have a look at the channels on the side bar, familiarise yourself with the names and purposes, then go to #general
sleek harness
okay thanks, I will just post it in general.
round crag
The hyperlink used in the access text of Task 1 #1 on https://tryhackme.com/room/lordoftheroot is broken and leads to access instead of https://tryhackme.com/access
bleak wraith
I think there a bug on task6 of room powershell (Powershell Scripting)
correct answer can only be 10 or 11, I know, but it's doesn't match with my script..between 130 and 140 are only 11 port, tops, but no all of them are opened.
feral drum
Room: Web Scanning, Task 3, Q2. My ZAP session shows 'URL to explore', but answer to question is 'URL to attack'. Unsure if this is a recent change to ZAP / if this is the right place to post about this - but hopefully it helps!
olive drum
@orchid remnant could you fix that real quick ^
covert kernel
It's a recent change to ZAP iirc, since they added quick buttons to do active/passive scanning.
thorn osprey
Not sure if this is a bug but on Jack if you have user as jack you can get root flag just by doing ||cat /root/root.txt|| without having root privileges
digital thorn
@strong pumice
strong pumice
Jack isn't mine
strong pumice
orchid remnant
@feral drum @olive drum I'm going to leave that one to @rugged ermine in case he wants to add it into a hint or something for backwards compatibility
olive drum
👍 sounds good
shadow holly
hi gyes
covert kernel
Is it possible to send bug reports for rooms?
orchid remnant
Aye, just dump 'em in here
olive drum
you can send them here!
covert kernel
I just discussed https://tryhackme.com/room/xss with @spiral flame. He said this room is buggy. My issue is T3 Q4 . The question asks to change the title. I did this, but haven't got a flag. @spiral flame wrote that it requires a specific comment. So I'd suggest to update the description to reflect that requirement.
covert kernel
But wouldn't it good to improve the room, so that the issue disappears? I guess it would also be helpful for future users.
spiral flame
I mean, it's very unlikely to be improved
It's more likely to be replaced
It would need a complete rewrite, which is basically making a new version
covert kernel
OK.
spiral flame
fix vm OWASP xss
@orchid remnant can you fix this? it's reflected not reflective
It's also broken
Because I aint getting a flag
Typo on Q3 hint, should be IP not up
It also says Answer for question 1 in the room, and it's the answer for a later question
orchid remnant
Reflected right?
spiral flame
Also, the "Set the window title" is broken
I've done it twice
Two different payloads
The excuse Skidy/Ashu gave for not re-using existing content was because some of it was broken
I don't think there's any VM pubic that's more broken than the XSS playground
orchid remnant
God, it's not XSS playground??
pine quiver
damn tell that VM to shave
orchid remnant
Sheesh
spiral flame
@orchid remnant It is.
orchid remnant
Yeah, this ain't gonna end well...
ebon oyster
the reflected is throwing: Cannot read property 'includes' of undefined
orchid remnant
Well, Question 4 doesn't seem to be working at least
ebon oyster
spiral flame
Well, Question 4 doesn't seem to be working at least
@orchid remnant I have 3 payloads that are functional
But do not give me a flag
I'm very disappointed
orchid remnant
Yeah, that's my point
turbid osprey
Question 4 works for me, 5 and 6 doesn't 🤔
orchid remnant
I got 5 going
turbid osprey
I got Nr. 6 working
orchid remnant
So
celest edge
getting the same thing as @ebon oyster
topaz venture
Xss playground uh
ebon oyster
@celest edge if u go to /stored. then click reflected from the menu bar it works
celest edge
yeah I saw
ebon oyster
Q4 and 5 worked for me
orchid remnant
Strange
I've just added everything from titles, to a link to my own blog
How inconsistent
celest edge
Q4 I used a b tag
ebon oyster
i used h1
celest edge
Q5 the basic payload
ebon oyster
also Q5, there is a typo in the JS flag alert.
i didn't get the alert. but got it from my proxy
"username":"abcd","comment":"<img src=x onerror=alert(\"flag\"s);>"
Yeah, Q4 is saying it's the answer to Q1
ebon oyster
also the box got completed. I thought we are having 10 days of owasp challenges. 😐
covert kernel
ok
spiral flame
Don't just tag a moderator because you want help
bleak wraith
room closed.. it's ok? I mean, I finished all task and got the "congrats message"
bleak wraith
what about day 8?
spiral flame
It will be there tomorrow
bleak wraith
no problem then? I mean.. yesteday and the days before got a mesage "wait until 8PM to the next challenge"... today don't
floral vapor
no problem then? I mean.. yesteday and the days before got a mesage "wait until 8PM to the next challenge"... today don't
@bleak wraith Right, it seems that somebody forgot to add the disabled task for day 8
green hare
The XSS room has some misconfiguration
if you go here http://10.10.235.184/reflective (like the page said)
it wont work, go to main page and the select reflective
bleak wraith
@bleak wraith Right, it seems that somebody forgot to add the disabled task for day 8
@floral vapor Now It's ok.. thanks
floral vapor
Great
obtuse mulch
OWASP XSS(today). #3 Maybe not a 'bug' per-se, but maybe unintentionally ambiguous... I've had the JS trying to go off and query remote services for the client machine's IP address - maybe 'your VM's IP address?' would avoid an unintentional rabbit hole?
"'On the same reflective page, craft a reflected XSS payload that will cause a popup with your machines IP address."
zealous tapir
i found smth may be kind of bug on the platform but unable to fully testing it is there anyway of contact to check it
autumn wave
Email unsubscribe link errors out rather than visiting the customerioemail.com source
zealous tapir
Email unsubscribe link errors out rather than visiting the customerioemail.com source
@autumn wave sorry i do not understand
autumn wave
It's not really for you to understand. I'm reporting a bug
spiral flame
i found smth may be kind of bug on the platform but unable to fully testing it is there anyway of contact to check it
@zealous tapir Do you mean bug, or security issue? If it's just a bug, report it here. If it's a security issue, email hello@tryhackme.com
zealous tapir
It's not really for you to understand. I'm reporting a bug
@autumn wave
my apologies
zealous tapir
@zealous tapir Do you mean bug, or security issue? If it's just a bug, report it here. If it's a security issue, email hello@tryhackme.com
@spiral flame security issue I sent it thanks
weary verge
guys, i found something weird, whenever I try to submit an answer with " /etc/hosts " in it, I dont get the normal message <<Uh-oh! Your answer is incorrect.>>, I get this instead
weary verge
yup, I was going to add that, my bitdefender notified me for a RCE attempt on my end
spiral flame
Yeah, it's a bitdefender bug
It interferes when it shouldn't
Normally LFI/SSTI payloads
weary verge
ok thanks man, I spent the last hour trying to figure out who was attempting to RCE me....
spiral flame
I recommend using a VM
weary verge
I do, I am just submitting my answers on my host atm, ty anyway
spiral flame
ye, best bet is to just fullscreen the VM and use that
brittle juniper
Room for breaking out of docker (I am purposely not mentioning the exact name here.) is essentially empty and also rewards A badge.
@topaz venture Sorry for the ping, but after posting this here, IDK if this is time sensitive. People will grab the badge.
median sapphire
Yeah, that used to be a room, but it was removed by the creator
All of the tasks and questions of that room were removed
topaz venture
No worries for the ping, the room is empty as should be
brittle juniper
But, It still rewards the badge.
topaz venture
I'll look into if we can get that badge removed
brittle juniper
I just got one.
topaz venture
Good shout, thanks.
brittle juniper
🙂
fresh tide
||Name plz||
desert tulip
I'll look into if we can get that badge removed
@topaz ventureplsno
topaz venture
Well...there's gonna be an alternative to that room anyhow (:
topaz venture
@brittle juniper the award for the room in question has been pulled. Appreciate you letting us know
You now have a rare badge
brittle juniper
Damn, nice.
fresh tide
wait, is the badge been removed?
short jackal
it's unlisted
fresh tide
i can't see it in my profile anymore
short jackal
still on your profile but doesn't have a image/name so it doesn't show up on any page on the frontend
it's not obtainable anymore 😢
so there's now an elite club
fresh tide
i obtained that an hour ago
short jackal
it was removed from the room after that then
fresh tide
no longer here.
short jackal
still on your profile but doesn't have a image/name so it doesn't show up on any page on the frontend
it's still present on the list of badges that you get from the frontend
fresh tide
aah ok
topaz venture
Probably can’t be changed in live
short jackal
¯_(ツ)_/¯
brittle juniper
you now destroyed one of the easter eggs
@short jackal some tell me that I shouldve made an PoC of it and It couldve been one of the 3 bugs to get BUGHUNTER
brittle juniper
was it worth?
short jackal
i did have to find a few before i got the badge
brittle juniper
yeah IK my friend cryptonic found 3 criticals before the badge.
short jackal
¯_(ツ)_/¯
short jackal
uuuh
i got a payout for multiple message vulns that i found, the rest were usually minor
brittle juniper
tbh I don't care about the payout (i mean not expecting any), but that BUG HUNTER badge level
xD
short jackal
🤔
brittle juniper
¯_(ツ)_/¯
short jackal
it's not even a badge, just a level on site
brittle juniper
Yeah, that's what I meant. 🤦♂️
short jackal
I could live without it but the backend peaked my interest so much then that i'm still poking at it 
brittle juniper
Me too. The APIs are too interesting. (been on them the whole day)
short jackal
noice
arctic wolf
The question: Go to http://10.10.66.193/reflected and craft a reflected XSS payload that will cause a popup saying "Hello". appears to be broken. The workaround is to go to the ip, sign in and then click on reflected.
brave reef
It has been addressed many many times.
digital thorn
Also, no need to sign in
tired heath
The machine here is not working:
https://tryhackme.com/room/commonlinuxprivesc
spiral flame
ebon oyster
if u stroll to <ip>/admin without signing up. You can get the flag. Owasp10 #26
topaz venture
feature ^
ebon oyster
zealous tapir
Cross site scripting room does no alert last 3 flags
covert kernel
You can still trigger the flags- it requires pretty specific keywords though
Just keep looking for alternative methods (hint: you don't really need to use complicated obfuscation/encoding or anything like that)
bleak wraith
great work onDay8
just a little comment
zealous tapir
Just keep looking for alternative methods (hint: you don't really need to use complicated obfuscation/encoding or anything like that)
@covert kernel Thanks but i do not really care that much about flags 😂
topaz venture
Thanks for pointing that out @bleak wraith that's been updated now (:
dire ferry
Could just be me and my Craptop. But if you click the OWASP top 10 XSS question 2 link.. You will get an error. verses going to the IP and then clicking the website link.
dire ferry
perfecto ty
bleak wraith
I think there a bug on task6 of room powershell (Powershell Scripting)
correct answer can only be 10 or 11, I know, but it's doesn't match with my script..between 130 and 140 are only 11 port, tops, but no all of them are opened.
@bleak wraith @topaz venture BTW
stiff wind
@lunar pine did get the solution I'm having the same trouble
I'm having the same problem in simple ctf room, can someone help me?
stiff wind
@spiral flame thank you!
stiff wind
I was using US-East-Regular-1
spiral flame
Yep, it affects any VPN servers that aren't EU
digital turtle
update bot
when someone join it say #community-help but it need to say #room-help
i know it isnt a bug but it should be update
spiral flame
Discord bug
short jackal
But a bug
spiral flame
Best type of bug
short jackal
That's discord being discord
brittle juniper
xD OK.
short jackal
That's how it shows up as when a person leaves the discord and you don't have any shared