general

[crude stump]

Might be because I’m on the phone

[sand trench]

█ is fun

[crude stump]

Light mode ahh

[molten sky]

ew shadow uses light mode

[sand trench]

it is the full block char

it keeps same colour as text

[molten sky]

‎is better

[sinful moon]

Ugh today I had to yeild and start calling Azure AD "Entra ID". Was specially asked by the boss loosely "help what do for Azure permissions".

lol now we're plowing forward with Entra ID PIM to manage Azure roles/resources and Entra ID roles in one spot with a sort of privilege escalation for roles when needed

Was not about to juggle Azure vs Azure AD for a couple hours so fair I give up Microsoft, I didn't like this change but you win

[crude stump]

Have no idea what your talking about but interesting

[molten sky]

weird. who tf cares what you call it

[sand trench]

anyways shadow should try to sleep sloop to the beep boop while they meep moops again

[sinful moon]

This is unfortunately more clear despite the awful name

[molten sky]

i also rarely if ever said azure ad, lol

always aad

[mossy river]

Society

[molten sky]

society can..ya know what, nvm

[sinful moon]

Indeed lol, even the Entra ID urls still call it AAD internally

[crude stump]

Oh it’s a Active Directory

[sinful moon]

Azure Active Directory which is a seperate concept

and nowhere near as easy to manage as AD/GPOs lol

Azure AD is now called Entra ID formally

[molten sky]

it's one of those things where if they called it Entra ID from the start it would be perfectly fine, but it's because they set the standard

stop changing shit

[sinful moon]

Yeah for real

[crude stump]

Yk what I love about this server. Everyday I learn something new from it

[sinful moon]

I'm only just now adjusting to saying Microsoft 365 unless I have to use accronym like O365 lol

[molten sky]

O365 is still my go to

just automatic

[sinful moon]

fo sure

[molten sky]

even though it's actually different here

365 is 365 is 365

[sinful moon]

But I will admit my Skype to my boss explaining that Entra ID PIM was the best way forward would have been nearly unintelligible attempting to differentiate Azure AD from Azure roles and etc

[molten sky]

in a few years they're gonna change the name to Microsoft One

[molten sky]

lol, skype

[sinful moon]

Yes, unalive me now 🙃

[molten sky]

y'all are on 365, presumably bus prem, you have teams

makes no sense

[sinful moon]

Yep! We even administrate Teams for clients lol

[molten sky]

dumb af but okay

[sinful moon]

Don't ask me lol

Boss old reason was it was easy to dump chat transcripts out of Skype, but that hasn't been easy in years

There were attempts before my time to convince him of Slack or Teams but didn't work

[molten sky]

btw if y'all have 40 minutes to kill, just saw this good talk from one of the github cofounders https://youtu.be/aolI_Rz0ZqY
learned a couple things i'm actually gonna add to my own workflow

[sinful moon]

Nice, may have to check that out!

[molten sky]

as much as a hate microsoft, teams kinda just works

the new desktop app sucks tho

[sinful moon]

lol, common theme with Microsoft but yeah

[molten sky]

huh. bugcrowd recruiter just reached out -- interesting

[sinful moon]

Here's the new Outlook, aka OWA and missing tons of features! What? Oh we'll bring PST loading eventually lol

[molten sky]

oh my god, new outlook is the worst thing i've ever seen come out of microsoft

i actually didn't mind the previous one

hate to say it, but it was fine imo

the new one is terrible

i really really don't like praising microsoft but i actually found the previous version useful

[sinful moon]

Yeah I've seen old Outlook break in catastorphic ways but it was very rare and usually only limited functionality to a degree

But lol new one is just missing critical features indeed

I do daily have issues with Outlook, but that's probably our crappy internal infra more than anything else

[molten sky]

y'all manage any exchange servers?

[sinful moon]

lol don't you dare click on 67k unread messages "Logs to be Reviewed" folder in support inbox or expect to have Outlook hang so badly that it's significantly faster to kill it

[molten sky]

67k unread messages

ngl my personal email (practically a spam email at this point) is probably at like 18k rn

[sinful moon]

Yes, ugh, unfortunately. We're down to four, two at one client, one at one client and one internal

Everyone else is on O365. We're making pushes to migrate client with two Exchange servers

[molten sky]

Zoom Zoom Zoom

[sinful moon]

lol

Sounds like an old Mazda ad lol

[molten sky]

hm. one of my huntress people on linkedin shared something about an exchange IOC but i can't find it now

[sinful moon]

I want a creepy child to whisper "Zoom Zoom" when I connect to my Zoom room plz

[molten sky]

just trying to figure out which version of my resume i even applied with

[sinful moon]

Interesting, also I plan not to make a LinkedIn until I really need to lol

[molten sky]

the person was quick to reach out tho, just sent it earlier today

gonna assume it's the several month old version and not the new one

okay thank you linkedin

no header no menu

awesome

[umbral bay]

👋

[molten sky]

found it

[molten sky]

*wave*

🌊

[umbral bay]

Proper wave in blue.

[simple valve]

when devsecops path? 👀

[molten sky]

just canceled

[simple valve]

[sinful moon]

It’s like currently happening with all the devops rooms released recently, I need to catch up with them admittedly

I’m sure they’ll consolidate them all

[simple valve]

helo elizabeth

i have a problem

[sinful moon]

Heya!

[molten sky]

same tbh

[simple valve]

have you integrated mail servers with a third party bulk email provider

[umbral bay]

As always: soon.™️ 👀

[sinful moon]

lol having issues with new DKIM/SPF stuff for Google/Yahoo? I have not directly but help push some of those efforts.

We have an Email Security Gateway which is our main ingest/output. But typically we did have to log into the third party bulk email provers to properly test the successful DKIM/SPF and etc

[molten sky]

are y'all having dkim issues?

i haven't had anything pop up. just new requirements that it exists

( i think i misread )

[sinful moon]

Possibly but you're close on the mark, Mkunkn has some question about third party bulk email provdiers which my boss handled a bit more than I.

[crude stump]

Wait is the devops room the tickets?

[sinful moon]

wut

[crude stump]

Nvm

[sinful moon]

lol above they're clamoring for devops path, and we're seeing quite a few new rooms that align with such a vision

[molten sky]

unrelated but speaking of third party providers ffuuuuuuck sendgrid

[crude stump]

Im thinking about those tickets. The one where you wins stuff.

[sinful moon]

agreed lol

[molten sky]

such a pain in the ass to do anything with

bouta call them tomorrow and cause problems

[sinful moon]

see them among phishing senders plenty as well

[lusty lantern]

[crude stump]

Interesting name

[sinful moon]

although ironically *.onmicrosoft.com is getting to be among most prolific of the not great phishing we get

[molten sky]

weirdly more than gmail

[lusty lantern]

why cant i use my own emotes wtf

[crude stump]

Verify prolly

[lusty lantern]

sadge

[sharp citrus]

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Feb 14, 2024, 1:35 AM

[molten sky]

https://tenor.com/view/image-perms-flex-gif-22350600

[sinful moon]

Even weirder, when they spoof a Gmail address despite having *.onmicrosoft.com lol. Trying to throw off the scent

Just want people to block the first address they see, but also, lol these people aren't always using advanced phishing toolkits very well

[crude stump]

Popular opinion. Cranberry juice sucks

[lusty lantern]

fake

[sinful moon]

But I am more than glad to domain block Haskell28471.onmicrosoft.com or cooldentist.onmicrosoft.com in our systems lol (as theroretical examples)

[crude stump]

I have a scam blocker. It actually works hella good against bot calls

[molten sky]

ngl i don't see any reason to even allow *.onmicro

[sinful moon]

X-Effective-From: more or less leaving out our filtering solution's name. This header identifies the true sender and can often expose legit uses of *.onmicrisoft.com

[hot cairn]

You’d be suprised

[sinful moon]

So we'd get false positives if just blocked them all

[molten sky]

if a random company out of nebraska doesn't want to set up their email properly they can deal with the consequences

[sinful moon]

Same deal if I blocked all the awful AmazonSES phishing we got lol

[hot cairn]

I’ve seen it a lot for schools aswell

/ students

[molten sky]

eh who cares about the students

[sinful moon]

that would actually kill our EDR's alerting emails to us

[hot cairn]

Depends on the company I guess lol

[molten sky]

tf lmao

that's poor design

[sinful moon]

Nah I mean I can block individual AmazonSES fine, but you know how effective that is

but if you block AmazonSES globally, yeah you'll have tons and tons of false positives

[molten sky]

honestly you should be whitelisting trusted senders instead

so much safer

[sinful moon]

You possibly misunderstand just how much email we ingest lol

[molten sky]

nah they can wait

[sinful moon]

lol

[molten sky]

my fucking i key is sticky and takes me like 4 tries

every word with an i

[sinful moon]

tried and true messge of banging on the key a couple times to unstick, and hope there's no gross residue that's the actual cause lol

[molten sky]

the opposite, actually -- it catches on the way down and won't press all the way

like a ridge

[sinful moon]

Is this a mech keyboard?

[molten sky]

shitty old membrane dell from the basement cause my old keyboard broke

[sinful moon]

oh lol

[molten sky]

waiting til i has monies to buy a new one

[sinful moon]

probably plastic failing and or debris in membrane

[molten sky]

literally never used before 🤷‍♂️

just shitty dell

[sinful moon]

Meh I do have Dell tech that's holding up for 25 years now lol, but fair enough

[molten sky]

durable and refined are two different types of quality lol

[sinful moon]

Don't make me link my beautiful Pentium III machine again to proove a point lol

[molten sky]

https://tenor.com/view/intel-pentium-inside-cpu-processor-intel-inside-gif-17715599

[sinful moon]

Too bad I’m doing it anyways, original PSU, original a lot besides GPU, RAM and Storage. Dat legendary Intel 440BX chipset that everyone emulates for compat

Plus bonus pic of my cat

[molten sky]

surprised how not yellowed it is tbh

[sinful moon]

Yeah it lived in basements, although I had the SO get some black out curtians for the room it's now in

I can likely retrobrite if needed, but prefer not to

[molten sky]

was gonna say that's an unfortunate desk

but it kinda brings it all together

[sinful moon]

indeed lol

Well now it's crammed into home office, since we needed that as a spare bedroom after all lol

and now server lives under this desk, excuse excessively messy picture

speaking of, I gotta check iDRAC. lol that little blue display turned orange with a warning

[buoyant tree]

heya Ellie

[buoyant tree]

hmm Venture bros

[sinful moon]

10/10 series, do watch

[sinful moon]

Too many ECC errors on DIMM3, I'll keep an eye on it. No emergency

[boreal scarab]

https://youtube.com/shorts/gzj5-pr7Brc?si=LrD5XU46hbTIWx0E

100% sounds like me

[molten sky]

hey timtaylor you still lurking

[buoyant tree]

just found out yesterday timtaylor is a insane hacker

like top 220 on THM

[patent obsidian]

Hello, can someone help me with a phishing simulation?
I am studying Cybersecurity at university and they asked us to simulate a phishing attack using Microsoft's "Ethical Hacking Resources" application and I don't know what is wrong in my php code 😦

I'm from Mexico

[sinful moon]

Unfortunately we are not allowed to assist with school assignments, can always ask a classmate or official school channels for assistance! But no worries

[buoyant tree]

also Ellie mind sending a few more video game tracks my way

[sinful moon]

I’m getting a bit too sleepy tonight, maybe another time!

[buoyant tree]

ok

[sinful moon]

But here’s one more video game cover as a freebie, cover of an amazing into song on PS1: https://youtu.be/CiE8p5VjZgo

Just wait for the drop lol

[devout palm]

Morning fellows

[sick lance]

Hi there!

We don't help with school work. 🙂

[sick lance]

https://tenor.com/view/tim-allen-christmas-with-the-kranks-yeah-well-on-the-phone-gif-15530470

[buoyant tree]

listened to the entirety of super guitar bros

but good song

[graceful thistle]

what kind of music are you looking for

[buoyant tree]

eh instrumental video game tracks

or any scores

[graceful thistle]

ah okay

[buoyant tree]

preferred if violin's in there

[graceful thistle]

https://www.youtube.com/watch?v=EQ7fsaj-8jc&ab_channel=TaylorDavis

not sure if this is kinda what you're thinking. it's from an anime tho but still pretty sweet violin

[buoyant tree]

actually one of my favorite artists

playing her on shuffle atm

[graceful thistle]

nice

[buoyant tree]

yea love her music

if u got any artist like her lmk

[chilly veldt]

👀

Morning

[buoyant tree]

Alr listened to Mia Asano, Lindsey Stirling, the piano guys

[graceful thistle]

Hmm I don't really have too much violin going on in my library

Arcade Fire - Song On The Beach is a beautiful piano piece tho

[buoyant tree]

listened to it also

and I think the ads are getting too targetted

[graceful thistle]

basically any Debussy is nice but I'm sure you're already familiar then haha

Oh violin 💯

https://www.youtube.com/watch?v=DmQmepDPg6I&ab_channel=PatrickBennett

hella good show too btw

[chilly veldt]

Happy Valentine's

[sly flower]

https://tenor.com/view/heart-love-love-animation-kathal-happy-valentine's-day-gif-3682800382547626839

[naive violet]

@glass nest

[glass nest]

Very neat-looking 🙂

[naive violet]

Yes, a bit nicer than the last.
Some improvements to make but if it works properly then I'll publish it

[sick lance]

You get a chatbot!

You get a chatbot!

https://www.nvidia.com/en-us/ai-on-rtx/chat-with-rtx-generative-ai/

Chat bots for everyone!

[naive violet]

35gb download
smh

Spooky popped XSS on it already

[sick lance]

Why am not surprised?

[sick lance]

Have the wrote about it?

I used to follow their twitter, but I deleted it ages ago

[covert nacelle]

i can never stand debussy, the way he uses modality though i like his orchestration

oh, except maybe the flute, harp and viola sonata

[timid prism]

do i get the cat with it

[shell nova]

Lol

[grizzled crystal]

Uh oh

[rapid merlin]

What’s this for?

[naive violet]

Satellite stuff

[glass nest]

Just gotta mkae a box for it now

[rapid merlin]

What do you mean by satellite stuff?

[mental hound]

May I ask some questions from a Pentester here? 🙂

[sick lance]

Just ask, if somebody knows the answer, they'll answer.

[mental hound]

How long does it usually take to finish a pentest process?

I mean... when all the documentations are done and you're there to start to enumerate.

[sick lance]

Engagements can vary, probably written in the contract when you can start and finish.

[mental hound]

Right. But does it take a few hours or days?

You know I'm just doing these rooms and I can finish it in a few hours.

[glass nest]

From one of TCMs videos on external pentesting:

but it will depend on the scope

[sick lance]

The rooms were designed to be done in a few hours...

If you want a longer room,

I suggest either #holo-network or #red-team-capstone-challenge

[glass nest]

40hrs is.. well, 8hrs a day for 5 days.

[chilly veldt]

Yup

[mental hound]

I'm just curious how does it work in real life 🙂

[sick lance]

There is no standard.

You could spend x amount of hours doing this, that and the next thing.

[chilly veldt]

You do it in a 9-5 fashion if not stated otherwise for as long as the contract is stated

[grizzled crystal]

in my experience about a week, plus a report. it depends on the scope as scrubz said

[glass nest]

@mental hound -->https://www.youtube.com/watch?v=wDQ0KXR4D7A

[grizzled crystal]

but normally clients want the bare minimum

[naive violet]

It is a "bias tee" to power an "lnb"

[grizzled crystal]

90% of my projects are a week at most

[mental hound]

Thank you! I'll check it out

[twin ridge]

Gave +1 Rep to @glass nest (current: #19 - 386)

[glass nest]

james - obviously it'll work better when you attach those BNC plugs 😄

[mental hound]

And what if me as a "newbie" start a pentest and I'm unable to exploit the system, because you know... there aren't any writeups but someone else could easily?

[rapid merlin]

Oh nice, what did you use to design the pcb?

[grizzled crystal]

what do you mean?

[mental hound]

I mean if I'm not good enough...

If I miss something

[grizzled crystal]

if you can't do a pentest technically you can't be a pentester

[rapid merlin]

Practice makes perfect, don’t be so hard on yourself

[grizzled crystal]

Ah you'll normally be mentored by a senior colleague

[rapid merlin]

Just study more

[glass nest]

Well, You'd not be working in the industry if you couldnt, but pentests are done by teams. You'll have co-workers and stuff

[grizzled crystal]

They wont just push you into the deep end

[sick lance]

Unless there isn't a vulnerability.

[grizzled crystal]

As for missing stuff - you're only human. You should just do your best

[mental hound]

That sounds good 😄

[sick lance]

Sometimes I'm sure companies will have their stuff together.

Not looking at you SolarWinds123

[grizzled crystal]

And follow a methodology

If you have a checklist you're less likely to miss stuff

[glass nest]

Yes. No about 'Missing something' - Like Scrubz says, it might be a secure enough system. In your meeting with the client, you'd go through what you'll be looking for and your (or the companies) methodology would (or should) be set up in a way that will check for those.

Scrubz and Aquilo making my point while typing it.. I swear you are watching my computer...mutter mutter hackers

[mental hound]

😄

[sick lance]

As for write ups.

I don't think you'll get access to a previous scope and contract, I could be wrong, I'm sure the NDA would kick in though?

[grizzled crystal]

You can get access to the previous pentest report

[glass nest]

When I was in forensics, we basically had templates.

[grizzled crystal]

Doesn't exactly work as a writeup tho

What do you mean by writeup? @mental hound

[sick lance]

Nah, I didn't think it would.

[glass nest]

I'm sure pretty much every company does

[sick lance]

Unless they're treating a pentest as a CTF

[mental hound]

When I'm stuck in a room I'm looking for some help online.

[grizzled crystal]

Yep, at my place we generate our reports using a report tool and then fill in the blanks

[sick lance]

Did you ever see that thing about the "keylogger" that could predict what key was being pressed by the sound...

[glass nest]

Thats terrifying. Why you listening to me type?

[chilly veldt]

I have

[grizzled crystal]

Okay - so in the context of a pentest, if you're stuck on something you'd ask your coworkers for advice. But finding 0 vulnerabilities doesn't necessarily mean you're stuck

[glass nest]

Thats as mad as someone hacking a bios based on the sound of the fans on startup

[chilly veldt]

Just find a zero day smh

[sick lance]

Wdym?

The typing is a coincidence...

[grizzled crystal]

I mean you could but that'd be a fast zero day

[mental hound]

Thanks everyone helping me with your thoughts. You're legendary 😉

[glass nest]

bella - ---> found one

[grizzled crystal]

Sure thing

[grizzled crystal]

Boooo

[glass nest]

Scrubs, so one of these drones hovering outside my window is yours? Dammit

[mental hound]

Have a great day guys. I'm going back to learn 😉

[chilly veldt]

My friends found one doing a security test of a product

Didn't take longer than 3 days

[grizzled crystal]

That's fair it defo happens

[chilly veldt]

Yeee, it's also OT

[sick lance]

All the drones are belonging to us.

[grizzled crystal]

IOT stuff is fun

[glass nest]

oooh, that was ALMOST a classic interenet reference

[chilly veldt]

Yeah, IOT != OT though

[grizzled crystal]

What is OT?

[glass nest]

another IT acronym

Of things?

[grizzled crystal]

Ah operational technology

[grizzled crystal]

Curse them acronyms

[glass nest]

Oblong Table?

[grizzled crystal]

Osome Time?

[glass nest]

Ordinary Thing?

Osmosis Trend?

could be anything

[grizzled crystal]

Truly a mystery

[chilly veldt]

Yeah operational technology, such as big machinery etc

[sick lance]

Man, when members get muted, why do they always DM me to them un-muted.

[chilly veldt]

Cause they think you can scrub it off

[glass nest]

Like Hex? he is big machinery

[sick lance]

Hex puts monster truck tyres on for fun.

[chilly veldt]

I wanna do that, but my car is too low

[glass nest]

Hex wears a tractor tyre on his pinky finger as a ring.

( @silver sky I just 'Chuck Norris'd you )

[silver sky]

Oi oi

I am classed as heavy machinery

[brisk tree]

Hey

[primal surge]

Hi everyone, I have a question about John: Im giving it a hash to crack, and it sends me "No password hash loaded" and I dont understand why... (I use a Ubuntu VM), the command i used is john key.txt, here is the beggining of the hash :

key.txt:$sshng$1$16$6ABA7DE35CDB65070B92C1F760E2FE75$2352$22835bfc9d2ad8f779e84676de801a2712ef86e499d5cad1af838d19402729c471837fbdbe7eb172e8e9cd40ee52d959a3d772204241e305194ee7813ec99be3ced17455644ce550ad51edcb52b668bcb62e46b60a77e3cfc2e5bfe14c69db0d5d1be3c3f1d18867173d8f01ee7b00d5e88f62b3d91c81f740e14862548f318bfbf510bae62e9fae40d2bf15f36dd7d702400dfb74f9154e3d00454a049b599cb4c4070df59b18efd252d702a21a5f941f79731a70840e51608701396955798d946e01686edc557b350263e279f971eee37846e07d3594b8669d25a656c26f85046b05f44edf9529dea4ce1f8193469485640909d9dbfd4f9d45ab2ede8c6aca494a53674fb1e53bae5bcf02a6bacbea202bfc284db9d3ae446780aa8b431325948599c9ee32acb1137dcdbbe61cd555887a1642e0b4e7da972d1b32a188accf9e595a173ab64f065bfc8b23530dd0c4de3463a9b38694fb34d6101628847150f684af5f25719f8e958d34570da834bdb129482d4295768f01f4e3219d5db7c92d85a55f19c926954c84a0ba6bbe697b8655c5f98cb7441c2b8a0a3b569118ca8b14dc1a3f125857a1dab94a1513137b6d4a68f9e2d856ce66a39b5ba560e18b43517e718fd6de9b9fb4ef6fbec009ac86cc774ba4802a666bffd21c114e7adb455858d4251fef118d99b9b3607ccd130329a44da2f261526951422440b7703827e53bd05177e1e82249455ae177157256a563b28b7e0b317b99b5a6e6716c4cf3e53a79dd0ba266ad41148de21b2f305c5ba6d7e6cf

i got the hash using ssh2john.py

[pallid lotus]

In fairness there are some seriously dumb vulns around lmao

[heady nova]

Ello

[heady nova]

Use a hash identifier script to identify the hashing algo being used and add whatever you find as options to John so it'll have something to work with..

Also If this is for a room, use #room-help next time

[grizzled crystal]

LMAO yeah that's a good point

[gritty zephyr]

Me rawdogging every room, having no idea what to look for and spending 4 useless hours staring at my screen: 0-0

[grizzled crystal]

A room is very different vs a pentest

[gritty zephyr]

True that, but i still miss alot

[grizzled crystal]

You're trying to "solve" a room, not note down every vulnerability that exists

[grizzled crystal]

Hmm yeah itll get better! Recon is a skill

I still feel like my recon is terrible but it's way way better than it used to be

[gritty zephyr]

Yesterday i was going down a rabbit hole that led nowhere because i forgot -p-

Always fun to repeat those mistakes

[chilly veldt]

yup, some dude tried to get a CVE on DVWA once, that was fun 😄

[grizzled crystal]

I think muiri means that there are some silly-easy zero days to exploit out there

[chilly veldt]

yeah, that too

[grizzled crystal]

oopsie

[grizzled crystal]

taking notes while doing rooms helps a lot with this

you're more likely to get that 'wait wtf did i not check this?' moment

[chilly veldt]

Speaking about OT and 0days, this one was what I was talking about Aquilo CVE-2023-20235 😄

[grizzled crystal]

and it hopefully won't be 12 hours in 💀

Ohhh docker shenanigans!!

[chilly veldt]

yup

they got asked to test the switch for a customer and found that vuln

[grizzled crystal]

I want to try to get a CVE this year, need to start poking at different products

[heady nova]

Ello bella, poki long time.

[grizzled crystal]

Hi hi i remember you!

You're the JLPT guy?

[gritty zephyr]

Yeah im gonna make writeups and pentesting reports for each room to build up a portfolio for me last internship, should show some good initiative

[heady nova]

Haha yes

[jagged moon]

[grizzled crystal]

Ahh how's the JLPT journey going?

Hello fluff!!

[heady nova]

I hit alotta people thinking they were you XD

[grizzled crystal]

hell yeah

[grizzled crystal]

Hitting people is bad

[gritty zephyr]

Would show my thinking and that i have documentation down

[heady nova]

Was gonna go for N3 this year but Microsoft got a jump on me and now I gotta somehow prep for how to research malwares

[grizzled crystal]

Report writing is a great skill to have

[grizzled crystal]

That sounds exciting woah

I may pick N2 back up later this year..i want to start taking classes again, i've been really busy so no time

although i've forgotten a LOT

it's bad

[heady nova]

Hit em w a text like "you still retro gaming?" And they were like "What?"

[grizzled crystal]

That's not me i dont think

[heady nova]

Retro computing?

What was the term

[grizzled crystal]

You're thinking of ElizabethNoir

[heady nova]

Ah F

[grizzled crystal]

Hehehe

[jagged moon]

Oof

[gritty zephyr]

Can be skilled all i want, if im unable to write it down clearly and in simple speak itll be hard to convince a company to patch something

[heady nova]

We've had this convo before Haven't we

[grizzled crystal]

Yep

[grizzled crystal]

Yes somehow

It's very funny

[heady nova]

No wonder I keep failing robot checks. My memory got corrupted

But yeah I seem to have mixed info on a bunch of people

[sick lance]

foO

[grizzled crystal]

It's kind of hard when there's lots of people chatting

[heady nova]

Anyway. I atleast remember that you know Japanese

[grizzled crystal]

Know is a strong word

[heady nova]

And you went to a sushi shop that dolph visited

[grizzled crystal]

I am learning! (but it's been awhile LMAO)

[grizzled crystal]

I super did not

Not sure who that was

[jagged moon]

May i interest you in notes feature of discord

[sick lance]

That's what I was about to say...

[grizzled crystal]

LMAO

all you need to know

[heady nova]

Hi humans, I don't know who's who

[grizzled crystal]

It's okay buddy

You'll get it eventually

[gritty zephyr]

Am btw reading ghost in the wires, great book, really compelling read

[grizzled crystal]

Oooh cool

[gritty zephyr]

I still dont lmao

[sick lance]

Fluff is either not in Germany, or not Russian.

[heady nova]

I'll formally introduce myself then. I'm usually called Tank/Rinz. Been here for about 2 years but only been active for around 6 months. I think I met alotta people here or not so I don't remember who's who, my bad. I'm still a student who'll graduate in mid 2025 and now I know German and Italian too

Yup that's all

[grizzled crystal]

Cool! I'm Aquilo, I'm a pentester

I pop in and out so i'm not super active

[loud marlin]

u ar poki 🙂

[grizzled crystal]

yes i am poki

[loud marlin]

https://tenor.com/view/thumbs-up-double-thumbs-up-like-agreed-yup-gif-11663223

[heady nova]

Ello ralex

[loud marlin]

ello ello

[heady nova]

Oooh I'm still confused what I wanna be so I'm doing everything

[grizzled crystal]

I may change my thing too eventually

[heady nova]

Forensics, defense, offense, engineering, devsecops, cloud, hardware

[grizzled crystal]

It's good to experiment

Yes blue team seems fun

[mossy river]

🤢

[grizzled crystal]

but i'm leaning towards red team hard

[heady nova]

Nightmare level stuff

[grizzled crystal]

nightmare scary dream or nightmare binary exploitation course?

[grizzled crystal]

no u

[sick lance]

Oh I wondered where poki went.

Just a name change.

[heady nova]

Aren't both fun and scary

[mossy river]

I am a professional blue team hater

[grizzled crystal]

Yep it's still me haha

[grizzled crystal]

True!!

[grizzled crystal]

Why!!

[mossy river]

So boring

[grizzled crystal]

What

[heady nova]

I got the budget for 3d printer

Now comes space problem

[grizzled crystal]

What do you mean boring 😨

[mossy river]

It’s dead

[grizzled crystal]

What do you want to do jabba?

[loud marlin]

that's true yea. which one you think of to get

[mossy river]

#redteam5lyfe

[grizzled crystal]

Ah you want to get into red teaming?

[heady nova]

Contemplating. Dunno pros/cons to this stuff

[grizzled crystal]

evading edr and stuff i presume? actual red teaming or do you want to get into pentesting?

or are you just into the offensive stuff?

[heady nova]

Offensive jabba

[mossy river]

Pentesting but I’m not fully locked into anything yet

[grizzled crystal]

Ah okay

[loud marlin]

for weekend ill be free and can share some wisdom. kinda bussy atm

[grizzled crystal]

Pentesting is fun. I think you'd enjoy it

[sick lance]

Jabba is a closet blue teamer.

[grizzled crystal]

People tend to hate on the report-writing but it's a good time i swear

[mossy river]

I know where you live

[grizzled crystal]

I like writing reports

[heady nova]

I'll wait for that then. Prolly not gonna buy till July since I gotta move around alot this summer

[loud marlin]

ah. fair

[sick lance]

Bring merch.

[heady nova]

Gib tips

[heady nova]

Need that thm sticker fr

[grizzled crystal]

Generate reports based on a premade template, save 20 hours in formatting

[heady nova]

But I think you already got that don't you scrubz

[sick lance]

Not yet, I'm waiting.

[heady nova]

How many screenshots should it have and how professional sounding should it be?

[grizzled crystal]

a lot and as professional as you can make it sound?

This is a very vague question

[heady nova]

Indexing stuff at the start is good to have right?

[heady nova]

Hence the dilemma in alotta stuff

[grizzled crystal]

Like a table of contents?

[heady nova]

Yup

[scarlet mantle]

i hope everyone become good person in future and hapy

[heady nova]

When did you order it?

[grizzled crystal]

I mean you can kind of judge it for yourself when you finish the report. How quickly can an executive get the gist of what the report is?

[main kraken]

He

He

[heady nova]

So it depends on the complexity. And do you make the report along the way or after you're done?

[sick lance]

I haven't. Lol

[grizzled crystal]

You definitely want a ToC and an executive summary, but no matter what job you're doing i doubt you'll be making the report template

[heady nova]

Gotcha

Tanks poki

+rep @grizzled crystal

[twin ridge]

Gave +1 Rep to @grizzled crystal (current: #123 - 50)

[grizzled crystal]

So we use a tool for generating the report. I write out the findings while doing the pentest, and then i generate the docx file and add the specific company details at the end

or in the beginning of the report

but at the end of the pentest

[main kraken]

Scrubz. remember the problem i had yesterday? to ssh james the password for james was november16 right? when u tried to ssh in and it worked did u use password november16?

[heady nova]

So.. you won it?

[grizzled crystal]

Sure thing

[mossy river]

So tired 🥱

[heady nova]

Hmm alrighty that makes sense. Thanks again

[heady nova]

Sleep

[mossy river]

Gym time

[heady nova]

Nvm, grind it

[mossy river]

Need more redbull

[sick lance]

Les is redbull, more water

[grizzled crystal]

How are you still alive

[mossy river]

Redbull

I have a lucozade alert but it doesn’t hit the spot

[glass nest]

But Lara Croft drank that, and shes a Tomb Raider...

[solar thunder]

Hi!

[sick lance]

Hello!

[grizzled crystal]

a vicious cycle

[mossy river]

Redbull sponsor me

[chilly veldt]

I just finished my redbull

[solar thunder]

What is the she/them

[chilly veldt]

my pronouns

[gritty zephyr]

According to the pfp, id call you a rocket bunny then

[sick lance]

Doesn't have a pfp with red bull.

And a rabbit

[gritty zephyr]

No only the rabbit

Bunny?

Huh

My English brain left me

Theyre the same(right????)

[bold dawn]

same

so tired though

[mossy river]

Bunny rabbit

[gritty zephyr]

Rabbit bunny?

[sick lance]

I need to buy new running shoes.

[rapid merlin]

I have that problem too frequent :p

[jagged moon]

At least you have an English brain

[rapid merlin]

Yeah

[jagged moon]

[chilly veldt]

same, need to get some indoor shoes

[gritty zephyr]

Believe me my dutch brain is mostly inactive

[rapid merlin]

I had a 10 for English lissening test

[gritty zephyr]

I do almost anything in English

[rapid merlin]

My Dutch brain is dominating me

dominating

is that a word

[jagged moon]

That's impressive as our grades only went up to 5

[rapid merlin]

xD, lets say, all answers are correct

10 = 5 =A(+?)

[gritty zephyr]

We grade 1 through 10

[solar thunder]

what does it mean?

[rapid merlin]

Jester can i DM you?

[gritty zephyr]

Ayo wtf dont trigger my bad side like that

[gritty zephyr]

Of course

Im so confused?? Thanks?

[jagged moon]

My younger siblings studied in another country. And they were like
"what grade you had in English?"
"5"
"loser, i have 12"

[gritty zephyr]

XD

Thats awesome

[chilly veldt]

it means that I go by she/her and they/them when you talk about me

[gritty zephyr]

I find multiple pronouns have an ease of use so to speak, you have two to choose from

Bella do you have a preference?

[chilly veldt]

Sometimes I don't other times prefer she/her

[gritty zephyr]

Gotcha

[jagged moon]

Off for lunch

Behave!

[sick lance]

No promises!

[gritty zephyr]

Ill keep em in line

[glass nest]

(For a given value of 'line')

[rapid merlin]

We got 1-5, 1 being the best 😂

[bold dawn]

we got A+ through F

usually based on a 100 point system

some local school did 1-5 though. My wife’s school did that

[boreal scarab]

https://tenor.com/view/sleepy-boo-rubbing-eyes-monster-inc-gif-12486750

[bold dawn]

breaking in some new jeans at the gym today

[broken thorn]

thats crazy lmao

[bold dawn]

what do you mean?

it that not normal?

[night prairie]

sheesh

wasnt my name a diff colour

[broken thorn]

Normality is often described as what’s consistent and expected from a societal perspective - saying that, society is crazy nowadays so do whatever floats your boat, I guess, lmao

[bold dawn]

lol technically my gym has a sign saying not to wear jeans while working out

says it’s “intimidating”

well for me, it’s just convenient lol

[sick lance]

Levelled up?

2 rooms until 800.

[mossy river]

Are we seeing different numbers

[sick lance]

That's probably out too by a few thousand.

[sick lance]

Website states 798.

[mossy river]

Weird, unless three rooms were released within the last 24 hours

[mossy river]

The stats should be using the same API to get that information

[bold dawn]

How often does the bot update the number?

cause discord shows 795 still

[mossy river]

Every 24 hours

[bold dawn]

ah

why the facepalm? are you not also questioning it above?

[shell nova]

Unless the bot crashed

[chilly veldt]

AAAAAAAAAAAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH

[shell nova]

I don't think it's vulnerable to an overflow though

[chilly veldt]

my brain is though

[shell nova]

Oh that's another issue, sup?

[sick lance]

Why?

If anybody scans/tries to attack me.

THM will see it. 😎

[shell nova]

Also default Kali environments are pretty secure

[sick lance]

I know.

[chilly veldt]

hapyy thoughts flowing through my brain, cause I just had a phone call with some people about some project and they both are okay with me being autistic, and using they/them and she/her pronouns

[sick lance]

I'm not concerned with with my Kali being attacked, I don't use default creds either.

[shell nova]

Was making an observation 😉

[sick lance]

I know 😉

[shell nova]

Oh that's great news

[sharp citrus]

Pong!

API Latency

114ms

Client Ping

473ms

Feb 14, 2024, 12:38 PM

[mossy river]

Looks fine to me, it might have been rate limited

[devout palm]

Now i know that your password is not root toor 😄

[chilly veldt]

yes, aaaaaaand, it's such a cool project!!

[sick lance]

That was my assumption.

[shell nova]

I meant the stats bot

[grizzled crystal]

Huge!! Inclusive employers are the best

[chilly veldt]

I got called a SME 😎

[mossy river]

That is the stats bot

[shell nova]

I'm happy for you!

[chilly veldt]

can't say much about it, but it looks promising

[shell nova]

If you're running Kali as root you're doing it wrong

[devout palm]

why

i do that

[sick lance]

Why!?

[worn thorn]

[devout palm]

Because i like control

[shell nova]

You shouldn't be running anything as root unless it absolutely needs it, and even then

[mossy river]

I thought they didn’t use toor for the password in forever

[worn thorn]

do you like to get controlled?

[devout palm]

No, i like to control

[sick lance]

Although when I count on the website, I get 766.

76 pages of 10

one page of 6.

76 * 10 = 760 + 6 = 766.

Unless my Maths isn't mathing.

[mossy river]

There’s rooms that aren’t on that page that are included in the calculation

[worn thorn]

use it on demand not constantly. It's bad.

[sick lance]

Which could very well may be the case 🤓

[chilly veldt]

or just the unknown factors

[devout palm]

Why shouldn't i use root in a VM?

I don't care if anything happens to it

[mossy river]

Not only is it bad practice but it also breaks tools

Your goal should be to create good habits not bad ones

[devout palm]

Bad practice ok, how does it break tools

[chilly veldt]

permissions

[devout palm]

Elaborate?

[chilly veldt]

some tools set permissions based on the user that runs it, if root user runs the tool, it can break the permissions for other tools making them not work

[bold dawn]

hahaha

[bold latch]

From what I'd gather, tools have different users for services/daemons set up. If you install as root, your permissions will be above those and the installed tool will not be accessible by the service, for example.

[chilly veldt]

that too^

[finite tangle]

Hello mates,

I am a Intern student from INDIA and want to get monthly subscription of TryhackMe. When I try to subscribe its only allow credit card and paypal account that I don't have. Can anyone suggest, is there any other payment mode to get the subscription.

[sick lance]

sudo & su is best practice.

[daring gull]

Any book recommendations for digital forensics?

[devout palm]

Makes sense

Now

[sick lance]

I think India could have an issue with payment plans etc for subscription.

You may need to purchase a voucher.

Support can assist best.

[sharp citrus]

TryHackMe's Email

TryHackMe's support email address.

​

[e-mail]

TryHackMe Socials · Feb 14, 2024, 12:49 PM

[sick lance]

Have a look around #bookclub

[bold latch]

If you ever remotely use the user account rather than root, even for starting up your OS and logging into LightDM to enter your session, anything you do as root will likely not be accessible

Ie you open up dolphin to browse your folders. Whatever you made as root, you won't be able to see. The app manager launches dolphin with the privileges of the user which logged in to that DE session

[bold dawn]

FTK Imager is good for forensic imaging

[bold latch]

Or if you can see it, you likely don't have read/write permissions so nothing goes in or out that folder

[bold dawn]

oh boom

book

I read “tool”

my bad lol

[bold latch]

Unless you painstakingly open up a terminal, and run "sudo dolphin"

[finite tangle]

Thanks ! I'll connect with support team

[twin ridge]

Gave +1 Rep to @sharp citrus (current: #264 - 18)

[bold latch]

Speaking of "best practises" I should probably change my baremetal system's password from "root" sometime soon. Just freshly installed it and that's the placeholder until I've done all the initial installs I need

[sick lance]

I hope you're joking...

[bold latch]

I wish. I forgot this wasn't a test VM and rolled with it because its quicker to type out

I'm not installing anything outside of the trusted repos though, so unless someone's tampered with those I'm alright for the moment

[simple valve]

hey, dont call me out too

[scarlet mantle]

what would it take to be able to escalate from hacked vm to hacked host

a cia elite expert?

until then im safe if only my vm gets compromised right

[sick lance]

A 0day.

[scarlet mantle]

ah.

[sick lance]

And nobody is gonna burn one of them on a random.

[scarlet mantle]

thats hard to find right?

[rapid merlin]

hi

[bold latch]

Easier than you might think

[scarlet mantle]

LOOOOOOOOOL

[bold latch]

That's why I'm changing it soon

[scarlet mantle]

@rapid merlin i dont know this person and is harassin me

and scrubz cal me a random

help

MODS

[sick lance]

If it was that easy, you'd change it now...

[scarlet mantle]

@swift patios

[bold latch]

Yep, that's what I'm doing once I'm at the machine

Soon, because I am not physically there yet

[sick lance]

You just pinged a random user.

[scarlet mantle]

it says he is moderator

i only ping the nice mods

because when ill be in the the professional setting i want be prepared social setup and public relationship and not ask favours yet

[sick lance]

It's just a name.

[scarlet mantle]

i hav so many things to say

this is it for today

sight

[sick lance]

Uh, Ok.

[scarlet mantle]

is fine

[chilly veldt]

I have to start drafting a draft of a draft so I can send that to my manager to get that draft drafted properly, which I then can start drafting the final version

[sick lance]

You might be cold with all them drafts,

[chilly veldt]

yeah, I am wearing a hoodie to not drift away in the drafts

[sick lance]

Having more monitors is always a benefit.

Trust me, I have 5.

[crude stump]

5 all on your desk?

[sick lance]

3 on my desk, two on the wall.

[crude stump]

Damn

[sick lance]

Full SoC centre here.

[chilly veldt]

I got 3 monitors

planning on a 4th when I get a good paycheck and gotten all the other stuff I need

but first, a proper power supply for my pc 😄

[bold dawn]

I have 3 in total, but not dock lol

need a dock before I can add more

[rapid merlin]

Question is, do you use them all?

[main kraken]

How do i turn openvpn off to thm i did ctrl+c and closed terminal but im still connected

[sick lance]

All the time.

[main kraken]

What are you using 5 for?

[sick lance]

sudo killall openvpn

[main kraken]

okay

[rapid merlin]

And for instance, what have you opened on them? Terminals? Monitoring systems?

Spotify? Discord? 😛

[sick lance]

One for discord, one for 5 vm's

One for a main screen, other 2 for whatever

[rapid merlin]

five VM's? Interesting

For testing purposes or smth?

[sick lance]

Kali, AD and other things.

[rapid merlin]

Ah

Alright alright

[main kraken]

Dammm

I think i have a problem

[sick lance]

Just ignore that page.

[main kraken]

But i need to disconnect bc i think smth wrong i cant even ssh anymore

to thm challenges

[sick lance]

That page could be bugged

ip a | grep "tun"

[main kraken]

That worked

Ty!

[chilly veldt]

oh well, time to go home

[night prairie]

i had some blue colour, i think it was a temporary role from an event

How you been anyway? @sick lance

[sick lance]

Yeah, that was removed lol

[sick lance]

Can't complain, yourself?

[rapid merlin]

@lethal spruce

Go to learn

Then again learn

And choose one of the paths

I would recommend Pre Security

[lethal spruce]

ok thanks

this is not completely free I did few tutorials now its accessible for premium users only

Is it completely free

Alright

[chilly veldt]

92% of tryhackme is free, the paths just show some planned rooms together which is why some of them are paid rooms

If you go to the "search" feature you can see all rooms and will be able to sort out any paid rooms

If it's just something that doesn't work then it's just putting it in #room-bugs or #site-bugs if it's an actual security vulnerability, then you'll want to contact support

[lethal spruce]

Thanks a lot I will try it

[twin ridge]

Gave +1 Rep to @chilly veldt (current: #7 - 807)

[forest mortar]

beta root:root vs chad root:t00r
||joking||

[upper chasm]

anyone has an issue connecting via openvpn?

[worn thorn]

if you really need an attack box then just setup your own vm

[split compass]

Finally, car theft is over. The flipper zero, and any similar wireless spectrum computer board, I guess, need to find the language of the act, is banned. 😅

[shell nova]

rofl

[split compass]

I have some letters to write today to my MP.

[shell nova]

like that'll do anything

[shell nova]

glhf

[chilly veldt]

You sure that it's correct, what if you press ctrl+f5

[split compass]

Gonna tell them to be screwdrivers because they can be used to turn the ignition of a car.

Maybe wire cutters too that can be used to disconnect alarms. 😓

[shell nova]

don't forget a prybar, or a large rock

[split compass]

I guess they're not interested in things that can actually be used for the purpose

[chilly veldt]

Throw a mail to support then

[scarlet mantle]

i hate being rich i hate easy life and i hate fame and yesmen

biggest bait in the book

[sharp citrus]

TryHackMe's Email

TryHackMe's support email address.

​

[e-mail]

TryHackMe Socials · Feb 14, 2024, 2:35 PM

[shell nova]

I mean I did try a replay attack on my car with the flipper, it naturally failed

[zinc prism]

I heard that it's necessary to finagle in some other software and tools to get better functionality on the Flipper

[shell nova]

there is a bug bounty program

please report the issue to support

[sharp citrus]

The bug bounty program

Article Link

https://help.tryhackme.com/en/articles/6495946-the-bug-bounty-program

Feb 14, 2024, 2:46 PM

[sick lance]

Good luck

[shell nova]

be sure to be precise and detailed in your report

[twin ridge]

Gave +1 Rep to @shell nova (current: #12 - 542)

[shell nova]

you can finangle hardware as well

[zinc prism]

noice

[shell nova]

don't be stupid 😉

don't attack things without permission

[zinc prism]

if you don't have permission to do a thing, then it's illegal and you could face prosecution and all that entails

[shell nova]

generally explicit written permission from the true owner of the device/network

[zinc prism]

yeah

[shell nova]

attacking "your gmail address" for example, is illegal

IMO, there is none

grey hat is mostly vigilanteism, which is also illegal

we do not condone that sort of behaviour here, and doing so may result in you being removed from this server

bingo

[rapid merlin]

And because of them

ur not in jail

:))

That’s why labs exist like tryhackme and hackthebox

[shell nova]

just remember to stay in scope

[rapid merlin]

But thats also a fun part right?

And you can use a cloud PWNBOX or not?

Im not on HTB so idk

[shell nova]

I got started a few years back with an offline CTF

naw

internal corporate

[rapid merlin]

Attackbox ftw

Make a bug report then 😄

[shell nova]

attackbox is unlimited for subscribers

that's assuming they qualify the bug

[chilly veldt]

Up until 6 hours at a time*

[shell nova]

I mean you can always terminate and restart

[chilly veldt]

Yup

That's why I said at a time

[rapid merlin]

But lets be honest, your own VM is always better

Even as a subscriber

With one screen yeah

But still, when im on my laptop without external screen

And im using attackbox

Full screen mode

😄

[bold dawn]

HackThisSite

[shell nova]

I mean I use my VM over ssh so

[atomic aurora]

Hey guys, how are we all doing today? 😄

[shell nova]

I started learning stuff on RootMe

[rapid merlin]

I started on THM :p

[shell nova]

it's ancient

[bold dawn]

Real old

Outdated

[twin ridge]

Gave +1 Rep to @atomic aurora (current: #1995 - 1)

[chilly veldt]

Today has been an amazing day for me

[atomic aurora]

I'm good thanks! I was just reading your guys's conversation. Very interesting. It all sounds a bit like chinese for me still but I hope that within some months i'll be able to join you guys xp

[twin ridge]

Gave +1 Rep to @hasty star (current: #1995 - 1)

[rapid merlin]

Wait-

It is valentines day

Didnt know

[chilly veldt]

Yeah

[rapid merlin]

Single life ftw

[bold dawn]

I forgot and I'm married

[rapid merlin]

Watching Champions League and doing some THM this evening

[rapid merlin]

Oh no

[bold dawn]

never once have I celebrated V day

My wife doesn't like it

when I remembered this morning I texted her

plus our anniversary is 3 days after V day lmao

[atomic aurora]

every day should be v day in a relationship bro. Always love and spoil your wife

[chilly veldt]

My Valentine's Day is celebrated by going shopping for a new pair of running shoes and then going for a workout

[bold dawn]

I started mine with a workout lol

[chilly veldt]

I started mine with work

[grizzled crystal]

I have ordered pancakes for myself hehehe

[bold dawn]

I got my wife a gift for it, I just gave it to her 2 days early

[chilly veldt]

Just missing that out

[rapid merlin]

I started my day with an exam about economy

[grizzled crystal]

Ah nice! Very good very good

[bold dawn]

Got her one of the Cirkle flavored water bottles

[grizzled crystal]

Maybe you can bring home some chocolate

[chilly veldt]

I should also go grab myself a weight, so I can weigh myself

I'll add it to the shopping list

[bold dawn]

then had a nice date planned for sat (anniversary), but now we have a family funeral this weekend

[grizzled crystal]

Oh I'm sorry

[bold latch]

Hand stretch over keyboard to reach 0, too much effort

[bold dawn]

I got one that transmits the data to a phone app. It stresses me out more lol

it started telling me my weight in the color orange bc I'm overweight by BMI standards

[rapid merlin]

uhm is this a black hat or white hat server

[chilly veldt]

I am also grabbing one that can calculate BMI lol

[rapid merlin]

White

[chilly veldt]

White hat

Only

[rapid merlin]

ok

im white hat

Any black hat stuff will get you removed according to the rules 😄

[chilly veldt]

I need to get down under a certain BMI level, due to hormones

[rapid merlin]

guys what is the main difference to white hat and black hat hacking]

im new to this

[atomic aurora]

white is ethical

[rapid merlin]

White hat is legal, black isnt

[chilly veldt]

Legal vs illegal
Permission vs no permission

[bold latch]

Well, one's illegal and the other isn't

[rapid merlin]

but is writing the code different

[bold latch]

4 person explanation combo

[rapid merlin]

yeaa

[chilly veldt]

Yeah

[bold latch]

What?

[atomic aurora]

Oh i also didnt know this

[rapid merlin]

Im not very sure, but i think that no code thats writed is illegal. Only if published

[atomic aurora]

so based on if you have permission or not and what you do with your access dictates which one you are?

or are there other factors

[rapid merlin]

i only know the white hat hacker called malwaretech

[rapid merlin]

Yea basicly. According to what permissions you got

[atomic aurora]

Alright I get it now thanks!

[twin ridge]

Gave +1 Rep to @icy epoch (current: #687 - 5)

[rapid merlin]

No problem 😄

[atomic aurora]

Have any of you guys pentested a local company before?

[rapid merlin]

no

im new to this

[atomic aurora]

me too 🙂

[rapid merlin]

want to be friend

[atomic aurora]

hell yea

zen do you have any background in it?

studies or so?

[bold latch]

Yep, companies set engagements and give you a list of IPs, websites, etc with a range of domains and address ranges.

You then abide by that until the engagement's over, and give feedback to the employing company. That's white-hatting

[atomic aurora]

Aaaah! Interesting

[rapid merlin]

was lizard squad a white hat or black hat group

Black

ohhh

[atomic aurora]

Have you ever pentested a company before if I may ask @bold latch

[rapid merlin]

i thought sony hired them

But they didnt pentest sony themselves right?

Lizard Squad was a black hat hacking group, mainly known for their claims of distributed denial-of-service (DDoS) attacks[1] primarily to disrupt gaming-related services.

DDoS is ALWAYS black hat

https://en.wikipedia.org/wiki/Lizard_Squad

alr thx

[atomic aurora]

I swear im learning so much rn just by reading people's conversations lol

[rapid merlin]

same xd

which groups are known for good hacking

[rapid merlin]

Yeah you can learn very much from discord conversations

[bold latch]

I am unofficially pentesting the school I'm at for educational purposes, since I've been granted rights to do so by the Admins here.

I'm not quite the age nor experience for an official engagement like what I've described above, though

[mint palm]

„Unofficially pentesting” sounds really bad

[rapid merlin]

^^

[atomic aurora]

Ohh okay thanks!

[rapid merlin]

If you touch things you shouldnt you can get in real trouble

[lethal spruce]

Me too

[bold latch]

Yes. I say "unofficially" because the agreement was for the most part verbal, and I'm not under any contracts, though as it's been approved by multiple admins I am technically allowed to be doing it

We have also verbally agreed on scopes as well, but once again I am not contracted because I am not legally able to be yet

[rapid merlin]

guys is 4chan full of black hat hackers or some white hat too because i want to chat with the good guys

[atomic aurora]

I'd always make sure to have something on paper if I were you tho

[rapid merlin]

Like I said, watch out what ur doing. I would recomment to get a contract, because it is data about children

whats a grey hat

[atomic aurora]

verbal agreements mean nothing in court

Just saying

[rapid merlin]

Facts

[mint palm]

Yeah you should have everything on paper for your protection. There’s a lot of legal stuff behind a penetration test

Especially if you have no experience and are more likely to break things

[bold latch]

I am fully watching what I'm doing and in contact with the Admins constantly. I've also written a report or two for them

[atomic aurora]

I think I read somewhere in this chat that a grey hat is a form of vigilantism type hacking

[rapid merlin]

oh so they arent the best talking to then

[rapid merlin]

Grey hat hackers are people who are hacking for good purposes but dont have permission. It is still illegal like @rapid merlin said

[bold latch]

And I'm aware of techniques which can strain servers or damage systems, so I'm not doing anything of the sorts

[rapid merlin]

Alright alright, but watch yourself

[mint palm]

Even a simple nmap scan can break things, so it’s better to have legal protection

[bold latch]

Depends on the type of scan

[rapid merlin]

Yes they can

[bold latch]

A ping and service probe is basically unable to do anything. A vulnerability scan, on the other hand, sure as hell can

[rapid merlin]

No, also a port / service scan can break things

[mint palm]

A service scan can actually break things

[bold latch]

Good place to say though, cautious when nmapping sites you haven't been authorised to, for the new guys here

[rapid merlin]

Go ahead

[bold latch]

Eh? How exactly? Are they not just queries for the port's connection info/protocols, that first initial handshake?

[night prairie]

2 years into my cyber degree and I've lost motivation, not going well xd

[rapid merlin]

problem with cybersecurity is its hard to get noticed since so many people are applying for jobs requiring it

In my country, in fact, it isnt that hard

[atomic aurora]

I am new to cybersecurity with no IT background (studies) whatsoever. I recently decided to make a career change. I am now doing the Pre Security module on THM. Is everything you see/learn enough to start working in cyber sec? Or would you guys recommend other fundamentals? If so, do you guys know a course/website where I can learn these things? I'm just very interested in Cyber Sec. Thanks a lot in advance, you're helping me out a bunch

[mint palm]

Poorly configured systems might not withstand that amount of requests. IoT devices and printers can be taken down very easily sometimes

[sour otter]

aye, where is esqy , he there ?

[rapid merlin]

You could watch some youtube

[bold latch]

Nmap even has a safe-checks option to minimise said potential damage from a nmap scan

[atomic aurora]

I am doing this besides the THM modules actually

[rapid merlin]

Alright alright

[bold latch]

And I do specify ranges to lower server impact. I'm not just carelessly pelting every port on a device

[atomic aurora]

I like to self study and have learned a lot already

[mint palm]

Still, something could happen, you are not legally protected. Better be safe than sorry

[bold latch]

If it does, the teams here aren't going to sue me over it

[mint palm]

If you are only scanning a limited number of ports then it is not really a pentest, and gives a false sense of security

[rapid merlin]

whats a cryptographic failure

[bold dawn]

this is becoming an argument over ethics. let's stop

[bold latch]

Ain't meant to be a full pentest, and heurestic scans for common ports exist yknow

[wild rose]

already a spicy morning? or just simmering.

[sour otter]

guys did naughty leave the server

[bold dawn]

being sued or not doesn't make it okay. There are reasons that scopes exist, to protect items that may be damages or affected negatively.

If you want to practice, find a bug bounty program and scan that. MAKE SURE scanning is in scope

[bold latch]

Its less around the ethics more around the impacts of scans at this point. So, pretty interesting stuff, I'm still learning from this

[sick lance]

Well that's not good!

How long left?

[bold dawn]

I've seen a network pentest factory reset a network connected soundboard

just due to too many requests crashing it

[hollow pivot]

Hey, did you email support? Could you DM with your email? THanks 🙂

[twin ridge]

Gave +1 Rep to @hasty star (current: #1321 - 2)

[mint palm]

Yes, it’s still illegal

[hollow pivot]

I got that, but can you DM the email address you contacted support with?

[atomic aurora]

gulp

[rapid merlin]

Dark grey

[night prairie]

I'm in my final semester for this year, so just one more year + placement if i find one
final year should have some more interesting modules at least, we got reverse engineering and exploit dev modules next year

[sick lance]

Malware exploit and dev?

[night prairie]

This is a bit different since they changed the course after i joined, but I'll be having two separate modules on this

[bold dawn]

by legal standards, that is illegal

[proven quartz]

Burnout happens but you can find ways to manage it. Make sure you have other avenues to enjoy your time. Read non-college books, go walking, get exercise, join a club, go travelling, cook healthy food, have a holiday, speak to a counselor, hang out with your friends more... Find other ways to redirect your focus and know that you're making progress towards your goals

[night prairie]

Thanks for the advice, I'll definitely try that out

[twin ridge]

Gave +1 Rep to @proven quartz (current: #23 - 347)

[night prairie]

oh it shows position and total now

+rep @night prairie

[bold latch]

Right, I'll diffuse the convo here. Thanks for all the concern though, I still appreciated the conversation

[night prairie]

well that makes sense, i'll check what it is in the future ig

[rapid merlin]

+rep @night prairie

[twin ridge]

Gave +1 Rep to @night prairie (current: #100 - 62)

[rapid merlin]

here u go

[night prairie]

thanks

oo 100

[sick lance]

That's what I have this year.

[rapid merlin]

hi fbi agents

[rapid merlin]

Hi ||for legal reasons, im not a fed||

[night prairie]

we had an industry talk today about exploit dev, probably should have stayed for the full thing

[sick lance]

There is feds in this server.

[rapid merlin]

they taught us to not click links and dont use ur cred card

[mossy river]

Please ping a moderator and leave it

[mossy river]

Are

[atomic aurora]

thats exactly what a fed would say

KEKW

[rapid merlin]

xD

[mossy river]

@rapid merlin What you did was a crime and is not tolerated in this server.

[rapid merlin]

what who committed a crime

[mossy river]

Further discussion will result in a mute or removal 🙂

[night prairie]

it was that guy!!!

[mossy river]

@rapid merlin @atomic aurora @bold dawn this applies to you all too.