general

[shut hawk]

Encryption at rest: Customer data is encrypted at rest using AES-256. Customer data is encrypted when on Notion’s internal networks, at rest in Cloud storage, database tables, and backups.

[pliant cairn]

If you are so concerned then after done taking notes just gpg/pgp thats just an overkill. I have similar setup for my personal messaging app

[atomic aurora]

also ^

[pliant cairn]

"Client's concerns are our concern. Customer satisfaction is the key" says my manager. He is a good guy

[atomic aurora]

Anyways, it has been lovely chatting with you folks. Goodnight!

[shadow loom]

Have you considered a fully offline alternative?

[molten sky]

so...you buying?

haven't been out to many in recent months only really mcgoverns in newark and mcsorelys in ny

[atomic aurora]

I was looking into AnyType, didn’t form my opinion on this one quite yet, I still have to test it out.

[pliant cairn]

Opening links is always a thing that makes me concerned

[hazy sundial]

its .pdf file

got it from reddit

[sick lance]

Pdf can be malicious

[shadow loom]

CherryTree works well but may feel a little outdated

[boreal scarab]

Sure. If you're free Tuesday, hanging out with a friend from LPU at a bar

[hardy mica]

https://tenor.com/view/meme-gif-26179586

[atomic aurora]

I’ll look into it. Cheers

[shadow loom]

Anytime. I used it for my OSCP studying and exam

(As you can encrypt the data)

[hazy sundial]

yeah i deleted the message

[hardy mica]

good choice

im having some problems running Print Nightmere with an account without password

[atomic aurora]

Oh thats clever!

[shadow loom]

What problems?

[hardy mica]

like a storage server?

[pliant cairn]

Never download files dont open just by the name of it. I am not at my laptop now so i will have to check the headers, strings and capa before i open it. So i will dm you tomorrow.

[hardy mica]

seems like it didn't work, even becouse password is required in his compilation. I won't go into specifics

[hazy sundial]

its ok

[shadow loom]

Ah i thought you were asking for help getting the exploit to work

[hardy mica]

very good choice for 80 bucks tbh

[rapid merlin]

Hi Birb 👋🏻 !

[pliant cairn]

Thanks for understanding 😂 will do tomorrow.

[twin ridge]

Gave +1 Rep to @hazy sundial (current: #1397 - 2)

[hardy mica]

i can't since its for OSIRIS CTF and it's kinda long to explain , but yeah im trying figuring it out

[pliant cairn]

Anyways imma head out. Night night fellas. Good chat.

[shadow loom]

Hi. Sorry your name doesn't ring a bell 😅

[atomic aurora]

Night!

[hardy mica]

wait a sec , you have OSCP , im going for it. You surely know how to do it 😄

[shadow loom]

Ah ok

[rapid merlin]

Might does now?

[shadow loom]

No

[rapid merlin]

he is not a noob lol.

[shadow loom]

It's a fun exploit

[hazy sundial]

yooooo is there an expert in sql here who can teach me? i cant figure it out

[hardy mica]

we ll he has OSCP , he is not for sure

[rapid merlin]

Ex-Admin from other server 👀

[atomic aurora]

What is your question?

[hardy mica]

i know but everytime i run it nothing happen on this ctf , even if ive setup the smb server

surely interesting to understand it

[rapid merlin]

along ago talked to you in here and htb.

[shadow loom]

Ah, cool 😄 I've forgotten most names from HTB tbh... It's been so long that it was active

[hardy mica]

Even if he was not Admin , having OSCP means you are not at start for sure

[rapid merlin]

I'll dm lol.

[rapid merlin]

well, they were ex||htb|| admin!

[hardy mica]

well , just wow

ill go back crying for my OSCP

see you later

[rapid merlin]

Cya.

[hardy mica]

i have no SIEM bachelor

im going for it after i got JPT work

bachelor will be next step after OSCP

[rapid merlin]

being real, THM's Jr-Pentester path is better.

[hardy mica]

than eJPT?

for sure

[rapid merlin]

Yes.

[hardy mica]

but i got a junior penetration tester work

[rapid merlin]

btw, OSCP's prep is made easy by THM.

tbh!

[rapid merlin]

Hmm, PJPT or some other good cert?

choose wtv suits your job.

[hardy mica]

no 1 yeas and some months as SOC analyst

but i do this alld ay long

just an anxious subj

[shadow loom]

TFW my first InfoSec experience was OSCP

[rapid merlin]

pen200 study?

[rapid merlin]

SOC = Burn Outs
Me don't like burn outs.

[shadow loom]

Ye

I wanted to learn hacking so I asked my boss to pay for 3 month access.. 😂

[rapid merlin]

it was hard way? or good learning experiences?

[high mulch]

Just too much reading. lol

[hardy mica]

even before bachelors and any cert?

[hardy mica]

tbh was simpler than this

[rapid merlin]

yea ig.

[shadow loom]

Nah, I had been working professionally as a software dev and sys admin for a few years

[rapid merlin]

DevOps too?

[shadow loom]

I spend something like 4-6 hours on studying every day for two months lol

[shadow loom]

That's what I mean but usually people don't know what it is so I write sysadmin.. 😂 😂

@hardy mica I got a blog post for you if you wanna read about alternative ways to abuse printnightmare

[rapid merlin]

Birb, The dedication!

[shadow loom]

https://www.hackingarticles.in/windows-privilege-escalation-printnightmare/

I love the exploit 😂

[rapid merlin]

[shadow loom]

"Hey, trusted Domain Controller buddy?"
"Yeah?"
"I need you to print a document"
"Ok cool, here are my creds please authenticate and give me the stuff"
"Yep, you good. Thanks."

(Something like that... It's been a few years)

[high mulch]

But devops is the cultural and philosophical approach that emphasizes collaboration and automation to improve software development and deployment.
And Sysadmins is a spot inside devops.
Innit?

[rapid merlin]

[shadow loom]

Yup

In theory it doesn't make sense to have a DevOps team just like it doesn't make sense to have an Agile team

[high mulch]

Hmmm interesting...

[shadow loom]

Whst do you do? We do Agile! Uh.. Ok... What does that mean?
...Uhm. Like scrum n stuff

But companies use the term for teams that do pipelines and automation of releases and testing and hosting and..

[high mulch]

aah

[shadow loom]

It's a bit of a weird field - but pays well

[rapid merlin]

Birb, how to Deal with impostor syndrome?

for other folks.

@shadow loom ^^^

[high mulch]

I know of sysadmin, besides of THM, because of a blog from medium, from someone who said he's been happier just doing sysadmin, he was pentester, if I remember it right. He said his experience in cybersec was just horrible as pentester.
But once again, he clarifies in his first blog and second one, it might have been because of the companies he worked for. Since there were other people that didn't feel the same way about the field.

[shadow loom]

Help people in online communities to remind yourself that you know more than you think lol xD

[wide marten]

Companies limiting password length to anything under 48 characters should be fined. "your password is too long"

[rapid merlin]

Not me.

I was talking about @high mulch <<!

😭

[mossy river]

Probably because of their database model

[high mulch]

I had a hunch. lol

[dark lynx]

You can use Linux mint for your old laptop which is lightweight, as for which Linux is better that is a preference choice

[shadow loom]

What do you want to use it for? Just playing around?

[twin ridge]

Gave +1 Rep to @dark lynx (current: #636 - 6)

[shadow loom]

Yeah Mint is good I've heard. Ubuntu is a classic too

[dark lynx]

Ah forgot about Ubuntu great for starting out

[high mulch]

I've been pretty much dealing or coping with it just as a hobby, I guess. I started off programming, webapps or website related stuff... couple of basic CLI apps. Then jumped into cybersec stuff... maybe if I get a chance into the field I'd be more than pleased.

But I keep studying/practicing because I like it. I guess that's one of the things that make me cope with burn outs, also having dealt with it when I used to code more often.

If I'm yapping more than usual, is because I'm having beer. 😛

[dark lynx]

[cosmic pendant]

https://ca.news.yahoo.com/ai-writing-much-code-still-195744872.html

[dark lynx]

If you want to learn Linux Ubuntu is a great start

[high mulch]

TLDR.. yes you should still code/programm stuff.

[dark lynx]

Wondering if I should use pika, timeshift, or learn rsync for full system backup

Been wanting to take the entire os image into a brand new laptop, without having to configure from ground up again

[cosmic pendant]

Drivers?

[shut hawk]

NixOS being a prime example

[hardy mica]

ahs so you got a bachelor before

[shut hawk]

https://teejeetech.com/product/aptik/
I've had great experiences with this

[hardy mica]

already saw it , its the room that is a bit sus

[shut hawk]

Granted it costs money, but the author is the same person who made timeshift - which is free and has saved me a lot of time, so bought it

[dark lynx]

Sort of yes, but all the software, path, script I set up long ago which I don't remember much

[dark lynx]

Thanks I'll look into it

[twin ridge]

Gave +1 Rep to @shut hawk (current: #14 - 533)

[dark lynx]

Hmmm didn't know, I never really did a complete backup and restore

I usually just reinstall and reconfigure everything again

[shadow loom]

Yea

[rapid merlin]

0.d.a.y

[dark lynx]

@rapid merlin thanks I was considering that

I don't like windows as I use to

So was moving to a Linux with vmware

But I do want to backup my main Linux and my vm containers(since I don't know docker or use it before sad noises)

[high mulch]

I find windows a bit headachy sometimes, so I feel your pain. lol

[dark lynx]

My main laptop has windows 11 mainly for gaming and watching videos and doing simple things

[hardy mica]

make sense , so you was already well prepared for OSCP

[dark lynx]

My second laptop configuring it for ctf, programming and breaking stuff xD

[high mulch]

I'll probably do the same for my laptop. I have it sitting there, turning it on only for usual updates.
But I have family that uses it for stuff, so they'll probably get lost if they don't see the usual windows GUIs.

[shadow loom]

Well... Not really. I knew programming and I knew what a socket was

[hardy mica]

this kinda give me hopes

surely will be "hard 3 months"

[shadow loom]

Oscp is a whole lot of learning about tools and common techniques to use in different situations

[hardy mica]

my path was : Soc Analys (i got it with background) , eJPT , THM courses , TCM Security PEH course , Tiber3rius courses

and now going for OSCP next week

[shadow loom]

You do an nmap and find ports 21, 22, 80, 139, 445 and 3389 open. What do you do and where do you start? That kind of thing, mostly.

[hardy mica]

first thing i check what is hosted on port 80

then i go for SMB

smb let me think and AD is on the server

[tepid furnace]

we love port 22

hand over your public keys

[hardy mica]

i mostly can start with responder and then bloodhound

[tepid furnace]

[shadow loom]

All windows machines have public SMB by default

[hardy mica]

if i find something i can go with crackmapexec etc.

3389 is good for me too

maybe an rpc client?

port 21 is ftp too

can try an nmap for an anonymous connection

meanwhile ir un nikto on 80

if i find something a dirb or gobuster to enumerate more

then is situational

[shadow loom]

I check two things first here and take note of one odd thing which may be useful later. FTP and SMB can be scanned and checked really fast and you can maybe get a username that way. Or nothing. But it's fast. And SSH on windows? Hmmm..... Fun

[hardy mica]

thats very interesting

i usually go for 80 and SMB

[shadow loom]

After that, since RDP usually never is the way in first, I go to Web

[dark lynx]

Ooof that's a lot to learn for oscp

Which I'll be taking next year

[shadow loom]

And that's just the tip of the iceberg.. 😂

[dark lynx]

https://tenor.com/view/no-the-office-michael-scott-scream-gif-16929305

[high mulch]

So a bit off-topic... I find it headache free to just use formats like 01Jan2024, when dealing with teams formed by people from different parts of the world. lol

I just finished the video, lol... So, just get your own router. Gotcha lol
Yeah, I think I have ADHD, I don't like self-diagnosis. But anyways, I was jumping into searching for X then going back in to Z that happened a while back, and going back in to the video, and going few secs back to understand a few things. lol

[hardy mica]

its a good path tbh

ty man 🙂 @shadow loom

[twin ridge]

Gave +1 Rep to @shadow loom (current: #529 - 8)

[hardy mica]

im just afraid to not find everything

[high mulch]

https://media.discordapp.net/attachments/827277603353788427/966007590880419911/ezgif-2-5c8025bf76-1.gif

laters

[boreal scarab]

Fuck ISP router's. Any homelaber's or sec people will agree

[high mulch]

One of the reasons I got my own equipment

[mossy river]

It's not limited to ISP routers lol

https://cybersecuritynews.com/netgear-routers-bypass-authentication/

[boreal scarab]

Oh yah, not a fan of Netgear either. Asus all the way

[mossy river]

https://nvd.nist.gov/vuln/detail/CVE-2024-0401

[boreal scarab]

I quit....

Just give me a pen and paper

My router luckily isn't on that list

For now

Oh, just read the versions that are affected, 3.0.0.4 and before for the most post

[wide marten]

Was it netgear where backdoors were discovered years ago already?

2014: https://arstechnica.com/information-technology/2014/04/easter-egg-dsl-router-patch-merely-hides-backdoor-instead-of-closing-it/

[rapid merlin]

Hi!

[mossy river]

hello

[rapid merlin]

How are you?

[mossy river]

Tired 😄

Hby?

[rapid merlin]

Good trying to learn something new

[boreal scarab]

OSINT!

Learn osint!

[rapid merlin]

Whats that?

Sorry for asking

im new on all this

[boreal scarab]

Open source intelligence!

[rapid merlin]

hmm

[boreal scarab]

to summarize it... googling, in depth googling

More to it, but that's the really simplified version

[rapid merlin]

what is it about?

Im really confused..

[boreal scarab]

Finding information on subjects. For example, locations, people, addresses, companies

https://www.sans.org/blog/what-is-open-source-intelligence/

[sand trench]

where is the btrfs

[rapid merlin]

Isnt this like doxxing but the good way?

[boreal scarab]

On my OpenSUSE

[boreal scarab]

Nope. I'll answer that with this link:

https://www.hackthebox.com/blog/top-three-osint-myths

[mossy river]

Not necessarily to encourage harassment

[rapid merlin]

Ok This is interesting.

[mossy river]

Doxxing is just the act of releasing private information about people

[sand trench]

neat... how does it compare to ext4 for you???

[mossy river]

You can accidentally doxx people

i.e. reading out an email address on stream

[sand trench]

or by not turining off steam friend is playing notifications

[rapid merlin]

I Feel like a student

[boreal scarab]

Just from a desktop user POV, I don't see any difference. But I like this Pic

[sand trench]

copy on write writing mechanism

[boreal scarab]

COW!

[sand trench]

linux people love cows

🐮

[boreal scarab]

https://tenor.com/view/cow-mooo-gif-15482396

[sand trench]

seems super easy to do with timeshift

[mossy river]

That's not really doxxing

It's usually private information, i.e. someone's full name, address

[sand trench]

revealing someones private data
can lead to spammed friend requests
or other nasty stuff on steam

[mossy river]

It's not doxxing though

Your username shouldn't contain anything sensitive.

Set DMs to off and don't accept friend requests. You can also change it if need bne

[rapid merlin]

im a lil too much confused.

[mossy river]

No it's not doxxing at all.

If your username happens to link to a another account and that account has private information on it; A) that's on you and B) the information on that second account could be used to doxx, but it doesn't mean your username is doxxable information

[sand trench]

so then how is an email sensitive data

it should not include anything sensitive in the email address

[finite basalt]

It's the difference between protected information and sensitive information

A username is not considered under UK law to be protected or sensitive information iirc

No as in, there's a definition in law for protected and sensitive data

And what qualifies

[boreal scarab]

Look at this cute little Japanese coffee drink!

It looks like a coffee cup!

[sand trench]

coffee with milk

[mossy river]

It depends really.
If my email address is publically accessible, i.e. on my website, and someone got that email address and posted it, it wouldn't be doxxing necessarily.

But if someone got my private email address, it could be considered doxxing, especially if my email address has like my name, dob etc in it

[sand trench]

sounds like a your issue if your private email has sensitive name and dob in it

[finite basalt]

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/what-is-personal-information-a-guide/#:~:text=Personal data only includes information,in combination with other information.

[mossy river]

Not really. An email address should be easily rememberable.

If I'm at a business conference I wouldn't want to tell potential employers to contact me at [e-mail] lol

[sand trench]

goes to check if that is a real email address

[boreal scarab]

https://m.youtube.com/watch?v=ZSq63Mt2y-8

[shadow loom]

[e-mail]

[mossy river]

Huh?

[finite basalt]

There's a quick definition for yous, online identifiers refers to things like IP, MAC address, cookies etc. and it says about psuedonymised data which refers to it having the data associated with a pseudonym rather than further pii

[rapid merlin]

when im older ima study programming bc im nerdy asl

[boreal scarab]

[shadow loom]

Good choice

[mossy river]

Technically yes but you're not doxxing someone if you know they have a pintrest account

[finite basalt]

A username is only PII if it can be used to get other data, with steam discouraging putting that personal info on your profile it's not pii

[hardy mica]

https://tenor.com/view/corgi-smirk-dog-gif-6147330867794407822

[mossy river]

It's not a data leak either

How is it a data leak that someone reuses a username across multiple platforms? lol

[hardy mica]

if it's a "personal" data leak , it's doxxing

[mossy river]

It's just basic OSINT

[finite basalt]

If steam had a leak that username might be PII because of the other data they store but it's not pii if it's just the profile name in a screenshot

[sand trench]

for a lot of steam users you can see their entire game library.... yes including the smutty ones if you have their username

[hardy mica]

so you can download their same games and make new friends?

[finite basalt]

Still doesn't give you any pii from that, you just find out they're a bit spicy haha

[hardy mica]

ù

[shadow loom]

I think it's the whole "building up and publishing a profile of collected information" that triggers people, OSINT or not

[mossy river]

And what will you do with information that someone plays CSGO?

[sand trench]

blackmail

[mossy river]

Mhm I'm just trying to make sure that the correct terms are used

[hardy mica]

stop playing CSGO or i'll tell your mom?

[finite basalt]

Yeah but you'd have to do osint to get their pii

[shadow loom]

Which term would be correct though? Profiling?

[hardy mica]

i think "gaining information" suits better

[lavish star]

so I changed the screen on my Redmi 10 phone and after putting everyting back it won t boot up

[mossy river]

Blackmail what

"I know you play inappropriate games, I don't know anything about who you are or any of your friends who can also see your game library and probably know about your weird habits but I will publish this information to the world"

[hardy mica]

just need to specify what kind of inforrmations

[lavish star]

it does show the charge animation whenever I plug it in

anyone got a clue why?

[hardy mica]

maybe he should do his homework instead and you can blackmail him with his parents

and save his life from gaming addiction

[finite basalt]

Might need to charge for a bit, could be that it wants to recalibrate the battery and charge fully

[raven moth]

Heloooo, is black theme coming? My eyes are cooking up

[finite basalt]

If it's not charged and working in the next hour it could be a bad connection or broken

[lavish star]

it got to 50%

[sand trench]

blackmail what
shadow knows your personal email address and can tell your friends about your weird name or send you nasty messages

[mossy river]

Digital profiling yes

[finite basalt]

Might need to go to 100 for it to calibrate

[mossy river]

And where did you get their personal email address from?>

[lavish star]

let s hope it is that

[sand trench]

....

[hardy mica]

about nasty massage you can still block the person. Tell your friends about your weird name? srsly?

[lavish star]

otherwise I think is a piece that I might have damaged

[finite basalt]

Fingerprinting maybe

[lavish star]

and the phone won t boot up without it

[boreal scarab]

Let me summarize this.

OSINT is Ethical way, public and legal way of getting information.

Doxing is basically the Black Hat way of looking at it.

[sand trench]

thought it was [e-mail]

[finite basalt]

Can also try going into fastboot and then boot manually through thay

[shadow loom]

Mmh, I guess... Doxxing is a subset of this kind of profiling but profiling is not necessarily Doxxing

[mossy river]

I think fingerprinting is lesser the individual and more their device

[boreal scarab]

OSINT is NOT doxing

[finite basalt]

I'd argue doxxing is the malicious release of the data acquired and aggregated via osint

[mossy river]

wut?

[boreal scarab]

And same can be said with Ethical Hacking

[lavish star]

won t work

[hardy mica]

doxxing can't be related with OSINT

[wide marten]

Imagine you live in a conservative country and/or family, religious fundamentalists even, and somebody blackmails you with telling your parents that you play "adult" games on Steam. Easy to see how that would be bad.

[mossy river]

I would slightly change your argument and say it is typically malicious

[finite basalt]

Yeah but I thought there are also less techy definitions for it that are more akin to research

[mossy river]

How do you know their family?

[hardy mica]

before you should get his parents information

[wide marten]

Social Media

[hardy mica]

then , it's a massive spray and pray

[mossy river]

Incorrect. Doxxing can come from OSINT

[sand trench]

username reuse

[finite basalt]

Yeah I can agree with that, my reasoning was more from a legal perspective, the idea that if there's no motive behind it, it could be an accident and therefore would likely be treated by law differently but I get that side to and agree

[boreal scarab]

Let me quote HTB's post on doxing vs OSINT:

"So doxxing involves exposing information on targets you aren’t allowed access to. Posting someone’s credit card numbers and government identification numbers in a public forum is both illegal and immoral. It constitutes an information security attack, because confidentiality is a central pillar of the CIA Triad of infosec.

OSINT is finding information that you're allowed to have access to without breaking the law."

[wide marten]

People get blackmailed with such things "I'm gonna tell your family and friends" all the time. It's not theory it happens every day.

[sand trench]

could point you at all the people who have a twitter username with the same as their steam username

[mossy river]

It's not a data leak

[finite basalt]

Doxxing isn't exclusively information acquired by unlawful access to data

[sand trench]

or similar enough that it can be used

[mossy river]

There's too many conversations going on I can't remember which is which

[hardy mica]

how can be related? doxxing is illegal , OSINT it's "everything you are allowed to get"

[sand trench]

shadow scatter brain goes brrrrrr

[finite basalt]

Doxxing is more the release of aggregated of data from multiple sources, lawfully and otherwise

[boreal scarab]

Jabba, need a drink?

[sand trench]

give jabba a few cans of monster and they can finally keep up

[boreal scarab]

I'll post it again.

https://www.hackthebox.com/blog/top-three-osint-myths

[mossy river]

Just because you reuse a username on social media doesn't mean any data is being leaked or breached.

[shadow loom]

I think the point they're trying to make is that if you Google my username and publish my discord and twitter account together, it's not a dox

[finite basalt]

Depends how broad you want to go

[hardy mica]

yeah but that's not doxxing , we are talking about doxxing in OSINT

[shadow loom]

If you went from my username to my work email and the full name of my parents then yeah... 😂

[finite basalt]

No but if I went through your Google reviews, and used that to gauge your home city, got your name if your public profile and released that it would be

[shadow loom]

Yes absolutely

[boreal scarab]

OSINT is not doxxing

When I speak to other people who do OSINT in their everyday work, they tell me that outsiders think OSINT is doxxing! That’s a terrible myth, because doxxing is a cyber threat and often illegal.

Quoted from HTB link

[shadow loom]

You'd be getting information that you are arguably not supposed to have

[hardy mica]

but overall with doxxing , you mean : "sharing personal data that YOU ARE NOT ALLOWED TO DO"

can't be OSINT anyway

[finite basalt]

It would be completely legal for me to find all that data but the process of aggregating it and leaking it is the doxxing lart

[mossy river]

If I use publically available information about you and determine an address/ name/ other PII and publish it, it's doxxing.
Lets say I see a picture of you outside of a house and I track that house down, then I look at the housing information and find the owner's information etc.

If I then go and post that in Discord, that is doxxing.

[shadow loom]

Agreed

[boreal scarab]

All I said was learn OSINT.... I'm sorry @mossy river

[mossy river]

https://tenor.com/view/you-you-did-this-nice-going-your-fault-gif-13598257

[finite basalt]

It's public information obtained lawfully though, so because it's public, I should have access to it

[boreal scarab]

https://tenor.com/view/sorry-gif-18453366

[sand trench]

shadows point here is that usernames can definitely be sensitive data and linking it with all the data points of steam could be as bad or for some people even worse then their email address leakages

[mossy river]

No usernames are not sensitive data by any definition

[molten sky]

hey guys i know jabba's discord username if you wanna buy just lmk

[finite basalt]

If you can link two accounts and are in that sort of situation you have an opsec issue

[molten sky]

doxman

[mossy river]

The whole point of a username is to protect you; it being considered sensitive is obsurd.

[sand trench]

then neither are email addresses

[shadow loom]

If you hear your neighbours yell personal information it's all fine, but if you eavesdrop on purpose it's a felony

[finite basalt]

If you rely purely on a username for your data protection, you have an opsec jssue

[hardy mica]

ok , but how can doxxing be related to OSINT? i can't get it. OSINT means that everything you do is allowed to do . What you are talking about is a sort of "enumeration".
Public something that YOU ARE NOT ALLOWED to publish is doxxing

[molten sky]

that's an opsec issue not a pii issue

[sand trench]

as email addresses are just glorified usernames in todays society

[molten sky]

if i make this information public that's my choice

if i don't, that's also my choice

[hardy mica]

and you are a gossip girl too

[wide marten]

The UK government seems to disagree

[hardy mica]

that it's even worse

[finite basalt]

I believe the eavesdropping law is very different than you think it is, eavesdropping would refer to bugging or going up to someone's door and listening in, not just being quiet so you can hear every word

[wide marten]

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/what-is-personal-data/what-are-identifiers-and-related-factors/

[shadow loom]

That's exactly what I'm talking about

[boreal scarab]

[shadow loom]

One is fine because you so happened to come across the information

The other is a felony

[finite basalt]

But that's the difference between hacking into a server and looking into the profiles for any and all public info

[shadow loom]

You accidentally discovering that I live in ABC Town is fine, but you trying to find out and publishing that information is not

[finite basalt]

Not the difference between googling the accounts and listing the reviews the account has made

[molten sky]

that's not a great comparison. one has an expectation of privacy, the other is explicitly public info

[hardy mica]

nope , becouse in the first example you are subject of a random event happening to you. You are not taking action

[finite basalt]

Osint is completely legal as long as you're not using it to commit a crime

[shadow loom]

It's the conscious act of obtaining the knowledge that's a problem

(With the intention to publish it)

[finite basalt]

Both examples involve taking action though

[molten sky]

no, it's the fact that you're violating an area that is expected to be private versus not doing that

[hardy mica]

nope . If i accidentaly listen to my neighbourg im not legally taking any sort of action

[mossy river]

You took the context away.

What are online identifiers?

I don't see that article say that usernames are sensitive data, it says it's personal data.

[finite basalt]

The way I'll put it is, Google Dorking is not illegal, using it to commit a crime isn't illegal, the crime is illegal

[shadow loom]

Potato tomato?

I think we agree

[molten sky]

no we don't

[finite basalt]

I thought you referred to my examples

[hardy mica]

yeah but doxxing is not . Doxxing is "publish personal informations without consent"

[hardy mica]

nono Birb one

[shadow loom]

Fair enough, you're wrong then

[wide marten]

As personal data they are subject to the GDPR. You have to report to government agenices if you leak them for example. Whether that's "sensitive" is semantics, I'd say yes.

[finite basalt]

And that's what I've been saying it's the publishing not the aggregation of the data

[hardy mica]

Btw this is the most geek conversation ive ever seen

[finite basalt]

As long as you've not committed a crime to obtain the data, it's not a crime, releasing that data is

[boreal scarab]

Like, I have information about others because friends. Do I go around posting it to others? "Hey look, X lives here" FUCK NO.

If X doesn't post anything publicly, I ain't posting anything publicly. That's the ethical side.

OSINT is gathering information legally and within bounds, without publicly relasing any data.

[hardy mica]

with doxxing you are "publishing it too" . Active enumeration of data is illegal too anyway

[molten sky]

if i read your mail that's one thing, because there's an expectation of privacy. if i see that fedex is your courier of choice, that's another, cause they drive a truck with a giant logo on it and it's publicly visible with no expecation of privacy

[hardy mica]

without consent

[molten sky]

expectation of privacy is the focus

if you make information public, you're doing so knowing that the public space is by definition not a private space

[sand trench]

so sensitive data is the following
Real life name
Real life address
ID numbers for real life stuffs
debatable on phone numbers
debatable on emails

[finite basalt]

Active enumeration does not involve going onto websites and going through profiles though, that'd be things like interacting with the server itself

[hardy mica]

@finite basalt perfectly explained

[molten sky]

context matters ofc but that's more sensitive PII than usernames

[hardy mica]

if you are just collecting already PUBLIC informatons without sharing it. You are in the leagal part

[finite basalt]

And if you used apis to assist in osint it's completely fine as long as you're using the apj within the confines of the terms of service

[mossy river]

You are incorrect.

While usernames are considered personal data under GDPR, they are not classified as sensitive data unless they reveal or are linked to more protected categories of information. Reporting requirements for leaks depend on the specific circumstances and the nature of the data involved.

Did you read the article?

[molten sky]

https://tenor.com/view/winnie-the-pooh-i-cannot-read-gif-10549564367608169258

Did you read the article?

[pure frigate]

hello there tryhackme community

[sand trench]

ello ello

chat is busy today

[hardy mica]

that's very difficult to say. You can incurr in some sensitive data anyway

[finite basalt]

That's what I said, as long as you're not committing crimes to get the data and aren't releasing it, it's completely leg no matter how deep you scour the internet

[shadow loom]

I'm expecting my home address and full name to be private too, but if you happen to find it by googling long enough (I wish you good luck, but it's not impossible), that doesn't make it OK to publish even if it is freely available. Whether it's illegal everywhere I don't know, I'm not a lawyer, but I'm fairly certain it's not legal in my country

[sand trench]

is it considered animal abuse to capture a fly in a pet bottle

[pure frigate]

i see, thanks for the heads up

[twin ridge]

Gave +1 Rep to @sand trench (current: #4 - 1773)

[sharp parrot]

Hi

[molten sky]

you just moved the goalposts by a whole ass continent

[hardy mica]

sure , until you have consent or going for public infos and not sharing it , you are in the legal side. You can call OSINT

[finite basalt]

Doesn't matter if you're not using it to commit any crimes, although, if an API is returning sensitive data to the public then it's time for a responsible disclosure

[shadow loom]

The what?

[finite basalt]

Wdym

[mossy river]

https://tenor.com/view/mimi-mikey-brown-tabby-cat-kitty-gif-12705457075636275749

[finite basalt]

That's us law, I'm in the UK

[hardy mica]

sure , but world is strange sometimes. Anyway i think i just confused the person i was talking with at this point

[finite basalt]

Also that sounds more like their internal policy

[sand trench]

what is this mythical sleepy thingy???

[molten sky]

it's also not sensitive information to say "x owns a property at y" -- that information is often publicly available by default with things like tax maps

[mossy river]

car

[finite basalt]

Can you send me the source saying that?

[hardy mica]

if its public information you can

[mossy river]

ehhhh

[wide marten]

I read the GDPR. The EU one though, the article I linked referrs to the UK adaption.

[finite basalt]

What do you think shodan does?

[hardy mica]

?

[molten sky]

7/8 data brokers would disagree

[mossy river]

So why link to a source that you didn't read?

[finite basalt]

That's gdpr and is more for organisations

[mossy river]

Also I don't know what that screenshot adds to the conversation lol

[shadow loom]

If such a service exists, perhaps you're right. I don't think it does in my country (not from address to person, only person to address)

[molten sky]

if one direction exists, so does the other

[wide marten]

The UK GDPR is identical in text.

[boreal scarab]

Like, let's just use @molten sky for example here.
(I'm not actually doing any of this, this is all hypothetical example)

Say Productivity, I find information about his IRL name, address, phone number, stuff that's public. And I tell him "Hey, X was easy to find, might wanna fix that" privately, if Producitivy is fine with me disclosing that to him, fine, no issues.

But if I turn around, and give that information to say @finite basalt , that's doxxing.

[hardy mica]

they can disagree as much they want , if the information IS PUBLIC , you are licterally doing RESEARCH. No Active Enumeration , No doxxing . Perfectly in legal terms

[finite basalt]

Yeah it's gdpr and it applies to organisations for the protection of people's data

[mossy river]

I'm confused by your statement then?

[molten sky]

yeah no we agree i was responding to jabba's ehhh in hesitation to our stance

[shadow loom]

Mmmmh not sure...

[hardy mica]

tbh i don't know what Jabba ehhh means

[finite basalt]

GDPR is an international law created by the EU iirc

[wide marten]

The 1st source I gave was the UK government referring to the UK GDPR. The 2nd one the EU GDPR. They happen to be identical as of today.

[molten sky]

https://tenor.com/view/stalking-spying-peaking-peak-hiding-gif-14341063

[finite basalt]

They're the same legislation

[sand trench]

true and coppa is not an european union law... still both kinda apply everywhere

[molten sky]

all it takes is a data broker to get the data by querying known names then they sell the inverse searches

[finite basalt]

It wasn't created by the UK or US, it was adopted by them

[shadow loom]

If you saw me driving around in my car you could get my name by looking up my license plate, but you can't find my car by just knowing my name

[molten sky]

you can in many cases via data brokers doing exactly as mentioned

[shadow loom]

I'm talking about official registries, not companies selling data

[hardy mica]

i think we are going a bit too far

[sand trench]

the EU has the right to forget

which the usa does not have

or well the right to be forgotten

[boreal scarab]

https://tenor.com/view/popcorn-guy-relaxing-popcorm-popcorn-gif-26404903

[sand trench]

typos

[finite basalt]

The point is that aggregation of data as an individual is not illegal as long as it's done without committing other crimes and isn't used to commit a crime

[boreal scarab]

Me watching chat

[mossy river]

GDPR disagrees, it depends on what you're doing with the information but if you get a court case of stalking or harassment and they find a 7TB drive of information you're collecting on people, you're not going to have an easy time

[shadow loom]

Perhaps in you country... I wouldn't know. It's not possible where I live

[mossy river]

Okay? I still don't know how this adds to anything 🤣

[finite basalt]

Yeah data aggregation isn't a crime but could be used as evidence of another crime

[molten sky]

those companies are doing what we're talking about tho, collecting publicly available information, pairing it to individual identifiable people, and making that information publicly available as well

[hardy mica]

you are talking about a specific case where you already committed another crime. GDPR disagree if you taking data that go under "privacy" , that for sure is not a public data

[molten sky]

yeah laws vary widely ofc but generally speaking in most countries data brokerages are pretty well established

[finite basalt]

But that's referring to an organisation storing data

[boreal scarab]

https://tenor.com/view/eating-popcorn-hi-there-smile-gif-15569360

[shadow loom]

I think GDPR would make that too big of a nightmare for European countries tbh

[boreal scarab]

Chat is entertaining

[wide marten]

You said usernames were not sensitive data. I provided you with a source that disagrees. You went into semantics saying they're only "personal" not "sensitive'. I quoted GDPR showing you that it knows no such thing as "sensitive" data but "personal" data. Since you yourself stated usernames were personal data, all the rules of data collection, information requirements, agency notification in case of leaks etc. apply to usernames.

[hardy mica]

but in that case you are already an outlaw. This is out of context tbh

[sand trench]

configuring bat to use catppuccin color scheme

[finite basalt]

Nope, they just have to tell you where the datas being kept, what data, who they may sell to and your rights to get a copy or have that data deleted

[mossy river]

spy.pet collected Discord messages and they were technically in violation of GDPR. That's just one person collecting discord messages 🤔

[hardy mica]

wrong ping sorry , chat goes too fast

[hardy mica]

that are not public

you are licterally doing an Active enumeration of it

[wide marten]

If we assume you are correct with your assessment "usernames are considered personal data under GDPR", the rest of the message is as incorrect as it can be.

[finite basalt]

GDPR only applies to organisations though and refers to backend data storage

[molten sky]

I will say, my experience with this is pre GDPR, so that very well could be different now -- idk the first thing about that legislation

[wide marten]

The full text of the GDPR has 2 (two) occurances of "sensitive", 596 of "personal data". Everything you've ever heard of regarding the GDPR applies to "personal data". Which usernames are according to you @mossy river

[finite basalt]

GDPR has absolutely no implications for the aggregation of data or what determines PII when doing osint

[shadow loom]

It's the European Karen of the Digital Ages. I love it

[boreal scarab]

All I said was "Learn OSINT"

Now there's just an all out war

[wide marten]

Completely wrong. GDPR does apply to private individuals.

[hardy mica]

[sand trench]

yeah and they got shutdown hard and would be put on trial for gdpr violations if they were in the EU

[shadow loom]

If customer service piss you off, just slap a GDPR at them

[sand trench]

on top of all the other criminal charges

[hardy mica]

so its your fault

You just started a DDOS Discord Message Attack

[sand trench]

a DDOD

[boreal scarab]

https://tenor.com/view/alvin-and-the-chipmunks-alvin-whoops-my-bad-oops-gif-15512287650458333097

[sand trench]

distrituted denial of discord

[buoyant tree]

what have I joined

[sand trench]

fun times fun times fun times

[boreal scarab]

Let me end this argument with one sentence from someone in HTB chat:

OSINT==gathering, DOXING==disclosure

[wide marten]

That's the data protection act.

[mossy river]

The username is personal data if it distinguishes one individual from another regardless of whether it is possible to link the ‘online’ identity with a ‘real world’ named individual.

[hardy mica]

HAHHAHA you are between geeks , this won't end so fast

[finite basalt]

DPA 2018 Is the UK implementation of GDPR and specifically states that it only applies to government, businesses and organisations . The only reference to individuals is their data rights, righhts to be forgotten and get a copy of their data

[wide marten]

I can send you a list of private individuals who received GDPR fines for things like having CCTV cameras pointed at public streets.

[buoyant tree]

cough cough

[finite basalt]

That is GDPR in the UK, that is the specific implementation of it

Read the screenshot again

[finite basalt]

Completely legal unless your a business otherwise ring would have huge issues

[mossy river]

And you're not when you're combing through a user's Instagram/ Facebook/ Twitter?

[wide marten]

Which every username does. Which is why you had stated yourself that usernames are personal data. To which every GDPR regulation you've ever heard of applies.

[mossy river]

No it doesn't.

[wide marten]

If that's so in the UK, idk. Not in the EU.

[wide marten]

Why not?

[wide marten]

I've shown you that the GDPR knows no such category as "sensitive" data.

[hardy mica]

nope , becouse you are gaining public information. IF you go for Facebook chat , IG dm , etc. You are going for an active enumeration of it.
In that Discord messages there could be tons of personal informations that you are not allowed to see

[glossy zephyr]

salutations everyone

im back

[finite basalt]

You're allowed to film anything you can see from public property or from your private property in the UK, exceptions include through people's windows which could be determined to be a different thing like harassment or something similar

[clear jackal]

I like bagels

[glossy zephyr]

samd

same

[mossy river]

wut?

[wide marten]

https://www.enforcementtracker.com/ Filter "Controller/Processor" for "Private Individual"

[glossy zephyr]

1.NEVER CLICK ON LINKS

[clear jackal]

What's your favorite type of bagel

[wild rose]

https://tenor.com/view/bagel-bagels-cream-cheese-cheez-cheese-gif-6510511771958427450

Everything

[glossy zephyr]

Raisin Bagel or Regular Bagel

[wild rose]

and Blueberry

[glossy zephyr]

blueberry is also good

[umbral brook]

Everything bagel, jalapeno cream cheese

[wild rose]

yeah

[sand trench]

opium seed bagel

[finite basalt]

I can't see any private individuals under the uk

[sand trench]

ey @chilly veldt what is a fralla called in english???

[wide marten]

You said GDPR applied only to Orgs without specifying you mean UK only.

[wild rose]

eating too much of it can taint a drug test.

[clear jackal]

I like Asiago bagels

[finite basalt]

I thought that was clear when I sent the DPA and was talking about UK law earlier

[sand trench]

fine by shadow

so tasty

[wild rose]

Asiago is good too

[hardy mica]

Gaining discord chat , you are potentially gaining tons of personal informations you are not allowed to see. If i have a specific server with my friends where i shares infos , you can't see that ? right?
Same thing with IG dm or Facebook chat.
But if i go for : Your real name on facebook , it's licterally a public information

[sand trench]

the smolish cinnamon buns called gifflar is also a fire snack with coffee

[wide marten]

I'd still like to learn from you. You said usernames were "personal data". Then how come GDPR articles like 5 (Principles relating to processing of personal data), 13 (Information to be provided where personal data are collected from the data subject), 19 (Notification obligation regarding rectification or erasure of personal data or restriction of processing), 33 (Notification of a personal data breach to the supervisory authority), 34 (Communication of a personal data breach to the data subject) and several others don't apply to what you yourself claim is "personal data"?

[hardy mica]

shadow is starting with nosense thing

time to go to bed

[wild rose]

awww day I don't know of no coffee... 😦

[chilly veldt]

Fralla?

[mossy river]

https://www.privacy-regulation.eu/en/recital-26-GDPR.htm

Identifying a person means determining the identity of an individual using available information. Under GDPR, identification involves recognising or being able to single out an individual from others.

While a username alone might not identify someone, when combined with other data, it could. This is directly stated within retical 26.

[sand trench]

type of sandwich thingy

[wild rose]

Plz don't creep in my DMs okay thx.

[mossy river]

If a username is connected to other categories of data then you have to notify the relevant people. I already said this.

the username itself doesn't mean anything.

[finite basalt]

Active enumeration is more a pen testing thing and refers to things that directly interface with the server and it's services. By your definition osint is active enumeration which it is not

[hardy mica]

should be called fralla

[wild rose]

Looks like a cinnamon roll

looks tasty

[boreal scarab]

https://tenor.com/view/slideinherdmlike-gif-15502711

[sand trench]

no those are sandwiches

[wide marten]

An email address alone doesn't say anyhting. You believe a company first collecting and then leaking a list of email addresses is not subject to GDPR regulations? That makes no sense. And it's not true.

[wild rose]

No mean no on DMs plz

[wide marten]

The GDPR recitcals are not part of the law btw.

[hardy mica]

indeed , by my definition the first one is not OSINT , is an active enumeration.
Gaining public facebook name is not an active enumeration , it's a passive one

[boreal scarab]

ah ah ah ACHOO https://medium.com/@twistedcircuits/sherlock-the-osint-tool-to-discover-usernames-bdac2d82b431

[hardy mica]

ok shadow , time to wipidiwoop bed or whatever it is

[molten sky]

i'm not even that old and that slide looks like pain

[wide marten]

And you're grossly misinterpreting it.

[wild rose]

Sandwiches you say, what's in them?

[mossy river]

When did I say that? 😆

[finite basalt]

Joining a telegram chat or whatever would still be osint, same as combing profiles

[boreal scarab]

I'm old and my back is hurting watching that

[sand trench]

well anything you want...

also just found what they are called in english: https://en.wikipedia.org/wiki/Bread_roll

[hardy mica]

yeah , but taking chat and sharing it it's not

[mossy river]

Uhuh. Sure, I'm bored of this conversation, you are clearly not going to change your opinion 🙂

[wild rose]

so like a folded up calzone maybe type of thing.

[wide marten]

Your argument is that none of the whole GDPR stuff applies to usernames since "the username itself doesn't mean anything". That must then also be valid for email addresses alone.

[finite basalt]

No that's doxxing

[hardy mica]

we are saying the same thing

[wide marten]

That's because it's not a matter of opinion. And neither do you it appears.

[wild rose]

Shadow has made me hungry.

[mossy river]

Did I say that?>

I said that the username on it's own.

[sand trench]

can't... have been lying in bed for nearly 1 hour before decided to go back to pc

[finite basalt]

You don't word things very well 😭

[hardy mica]

it always happen then she disappear

[wild rose]

this is true

[chilly veldt]

Giflar?

[hardy mica]

becouse im not a english motherlanguage or whatever it's called

[finite basalt]

Right I'm going to sleep, I'm up in 5 hours and need to not get roped further into discussion, have a lovely night all 🫡

[sand trench]

no fralla... the sandwich thingy which is apparently called bread rolls outside of sweden

[wide marten]

I literally quoted you. Yes.

[finite basalt]

No worries mate, take care

[sand trench]

gifflar is just smolish cinnamon buns

[chilly veldt]

Hmmmidk I am drunk

[mossy river]

You are taking the context away which makes my argument sound different.

[hardy mica]

i have C1 , this is the real cringe shit

[sand trench]

drinking on a sunday.... shame on bella shame... you should not have hangovers on mondays

[wild rose]

I need to eat then go to bed

[finite basalt]

Wdym c1

[hardy mica]

Go make same relaxing herbal tea and try again

[wild rose]

Hangovers only apply if you get them.

[mossy river]

Your argument is that none of the whole GDPR stuff applies to usernames since "the username itself doesn't mean anything".

"While a username alone might not identify someone, when combined with other data, it could."

[boreal scarab]

OSINT Mayhem over?

[hardy mica]

it's "advanced english title" here

[sand trench]

the kettle would wake up the entire house

[finite basalt]

Ohh ok

[mossy river]

Crazy how when you add the context back I say that the GDPR does say that it can be applied to usernames, huh?

[chilly veldt]

I have vacation Monday

[finite basalt]

Is it a whistling kettle 😮

[hardy mica]

but i studied for 14 hours and im trying to translate italian into english

[shadow loom]

Go to bed you

[hardy mica]

becouse im a lazy fat ass

[hardy mica]

Lord , Shadow. Go count the sheepts

or like a real pentester

[sand trench]

1 sheep
2 sheep
3035 sheep
5527 sheep
1337 sheep

[hardy mica]

count the vulnerabilities

[blazing granite]

dimished not over I guess 😂

[wild rose]

everyone's having a good time in chat.

[hardy mica]

21 sheeps
22 sheeps
80 sheeps
445 sheeps

[buoyant tree]

Rex, did you see the vid I sent

[wild rose]

still want to talk about bagels though.

[hardy mica]

tbh i have a major depression black humor , but i can't write it.

Anyway , guys

[blazing granite]

you know my answer. Not a pizza 😛

[hardy mica]

good night

[mossy river]

Okay it's time for me to sleep 💤

[wild rose]

Goodnight Moon

[buoyant tree]

https://tenor.com/view/its-a-pizza-food-official-duck-studios-gif-14077633

[hardy mica]

You too Sun

ok this was the last bs

good night

[wide marten]

It doesn't matter whether the username alone can identify a person. It is nevertheless "personal data" which means aaaall the GDPR rules related to personal data apply. I quoted the most important. Remember "The username is personal data if it distinguishes one individual from another regardless of whether it is possible to link the ‘online’ identity with a ‘real world’ named individual.".
You're misunderstanding the most fundamental part of GDPR which is the definition of personal data
personal data’ means any information relating to an identified or identifiable natural person (‘data subject’);

Important here: It is NOT only then personal data if that very data enables identification of said natural person.

Any information, whether the specific piece of information allows identification or not.

[blazing granite]

got to Italy eat real pizza and then will talk 😉

[buoyant tree]

is there any real pizza outside of Italy?

[blazing granite]

there is, but not those monstrosities

[boreal scarab]

Don't wanna stay up for another OSINT conversation?

[finite basalt]

This argument is going round in circles with context being added, omitted and changed. GDPR defines pii for businesses not individuals now I'm heading off fr fr 🤣 gn

[sand trench]

but if jabba is sleeping who is gonna moderate chat from more deep discussions????

[hardy mica]

https://tenor.com/view/corgi-smirk-dog-gif-6147330867794407822

[wide marten]

As we had established, at least in the EU, the GDPR applies to businesses and private individuals alike. It also doesn't know the term "PII".

[buoyant tree]

Well people could sometimes behave so they dont' need moderation

[hardy mica]

when you'll go to hell , devil 'll be afraid of you

[sand trench]

ey this looks neat

[hardy mica]

https://tenor.com/view/hackerman-gif-22344136

im sending a TGT request to my dog

but he is not responding

[boreal scarab]

https://youtube.com/@an0n_ali?si=kvPVKmx-SMsQnzM4

This guy, even with the robotic voice has blown up recently, but been linking him since he was at 6k subs. I like the guy's vids

[hardy mica]

Why you should study Malwere Analysis?

hmm if he doesn't say "becouse you are a psyco" , not worth it

[boreal scarab]

Reverse Engineering!

[sand trench]

late night command setups

and zoxide set up

lets see how much this helps shadows workflow

[chilly veldt]

Shadow, you know the Swedish gay boat?

[sand trench]

???

vasa
????

[chilly veldt]

There's a part boat in Stockholm called Patricia which is like a common gay place

[sand trench]

huh okay then

anyways time for shadow to go meep moop to the beep boop for the sleep sloop

[crude stump]

Yall what websites are good blog websites.

[umbral bay]

Send a BGT instead, he'll respond.

[buoyant tree]

Tbh make your own, or if you want publicity then social media or medium

[molten sky]

your own

and ngl it's not too difficult

[hollow osprey]

why payment through paypal is not working? or its only me?

[sharp citrus]

TryHackMe's Email

TryHackMe's support email address.

​

[e-mail]

TryHackMe Socials · Jun 17, 2024, 1:53 AM

[buoyant tree]

@hollow osprey

[hollow osprey]

ty, i'll check it

[molten sky]

idk what people from Norway are called but we should start using Narwhals

[buoyant tree]

Norwegians

[molten sky]

that makes sense

[terse edge]

They are also sometimes called Vikings

If they are ones.

[feral ledge]

What login manager do you guys prefer most?

[tall veldt]

hello

let's play an easy KoTH on linux

https://tryhackme.com/games/koth/101174
this is my first KoTh ever!!

[chilly veldt]

Gdm

[molten sky]

personally, bitwarden. although i use keeper as well for some things. both good.

just don't use lastpass and you'll be good

[fallen burrow]

for a display manager or website password management?

[molten sky]

good question actually lol

[buoyant tree]

oi @molten sky u free atm, need some OSINT help

[molten sky]

mid game but will be after probably

okay whats up

not done yet but premoved the rest

where @buoyant tree go

[brisk tree]

hey

[fallen burrow]

I really enjoy OSint and research, just don't really know how to apply that passion and knowledge.

The simulated games online only go so far : (

[rapid merlin]

hey bro

[timid prism]

@gray sonnet integration started

[molten sky]

,-,

[naive violet]

@viral junco Please don't advertise here

[gray sonnet]

It's pretty easy ngl

[mint gorge]

guess whos back

https://tenor.com/view/transitions-kinemaster-black-guy-suit-tiktok-gif-25279479

[sick lance]

Can you please change your pronouns.

[mint gorge]

okayyyyyyyy

i want to say what im thinking but my lawyer has advised me not to

[mint gorge]

for legal reasons this is a joke

[sick lance]

That was a quick month

[hardy mica]

[midnight hazel]

how would one do binex/rev on a apple silicon device since its ARM

[shadow loom]

doesn't Ghidra support arm?

[midnight hazel]

yeah but how am i supposed to run the binaries

[shadow loom]

well, on an apple device I suppose

[cold jungle]

Can anyone explain how student discount work here on THM?

[sharp citrus]

Student Discount

Article Link

https://help.tryhackme.com/en/articles/6494960-student-discount

Jun 17, 2024, 9:44 AM

[simple valve]

@cold jungle ^

[hollow pivot]

Maybe something like this can work? https://azeria-labs.com/arm-on-x86-qemu-user/

Never tried it though

[lavish star]

guys I got a broken laptop

it won t turn on and I don t have the right charger for it

but I want to use some of its components to create a server

just wondering

how do you know if a specific component works

opened it up and everything looks allrgiht

not burned/bended/broken

[rapid merlin]

How long has it been sitting around without a charger?

I’m not sure how to check components but it sounds like if it has no charger and has been like that for a long time I would assume the battery is dead before assuming anything else is broken

[sick lance]

You sign up with with your edu account and get 20% off.

Unless you're required to email support if you're not allocated it

/docs student

[sharp citrus]

Student Discount

Article Link

https://help.tryhackme.com/en/articles/6494960-student-discount

Jun 17, 2024, 10:17 AM

[mortal sequoia]

hey all

[uneven oasis]

Can I just say, screw socat syntax

but can I also say, pretty damn nice functionality once I got it right so, praise socat

but mostly screw socat

[earnest gate]

Can someone with knowledge about ssrf send me a private message? I think I found a vulnerability, but I'm not sure, I have a question☝️

[leaden socket]

What's the protocol that everyone must follow or else company gonna make their own and claim it to be the fastest?

I forgot

Would be nice if someone could answer

[sick lance]

Are you doing a bug bounty?

[atomic aurora]

are those your pronouns in your bio?

[sick lance]

Change the pronouns please.

[mortal sequoia]

ya

[mortal sequoia]

they r mine

[sick lance]

We don't use the N word in this server at all, please change it, or I'll have to remove you from the community.

[mortal sequoia]

i am fine with leaving

i didnt learn anythin tho

[shut hawk]

What do you mean?

[leaden socket]

I remember going through try hack me

And reading something like

" Without this company will make their own and claim their to be the fastest"

" Which is something we don't want cause it would make computer cannot communicate with each other"

[shut hawk]

Can you try and find the room that said that, I'm not sure what it means without further context

[earnest gate]

yes, i try..

[leaden socket]

That's the only information I remember dude

I guess I find the answers later through time ig

[sick lance]

So interesting enough, "Recall" will catagorise your... videos watched for you...

That's... Handy.

[shut hawk]

Unfortunately can't help you then, sorry

On another note: LOL

[sick lance]

0mg, get that STRK tokens Jayy, before it's too late!

[shut hawk]

https://tenor.com/view/im-on-it-gif-18392687

[wintry garnet]

I got my first job finally

[sick lance]

Gz.

[wintry garnet]

im going to struggle with obfuscation tho

[sick lance]

Well, atleast you know what you need to read up on.

[shut hawk]

According to my research, your GitHub profile is eligible to claim 110 STRK tokens due to your contributions to the open source code on Github. Based on the current market value, these tokens are approximately worth $105.

rolling in the money 😎

[sick lance]

Ask 'em for the cash instead.

[shut hawk]

Congrats!

[south sonnet]

best summary for a writeup I've ever seen

[sick lance]

Well, they're not wrong.

[pliant cairn]

well its not wrong

[pliant cairn]

NICE. Enjoy it ❤️

[boreal scarab]

https://tenor.com/view/pusheen-animated-pusheen-bread-gif-13262229634868436649

[elder steeple]

Hello guys

No website for loading debit and credit cards

[sick lance]

Wdym?

[south sonnet]

pretty sure he's talking about breaking rule #4

[elder steeple]

Pls i need em

[sick lance]

You need what?

[elder steeple]

The website

[sick lance]

Which website?

Tryhackme?

[elder steeple]

I need website for loading cards

[sick lance]

So you're trying to do something illegal?

[elder steeple]

I know man

[sick lance]

Well, that would be illegal, and against our rules as such, we don't discuss it or help users with these sort of topics. This is a server that partners TryHackMe

[elder steeple]

Okay man

[sick lance]

@sleek swift we don't help with school work

[sleek swift]

ah okay , i was just looking for some people to survey

[sick lance]

Thank you for understanding, we don't allow these sort of things for the privacy and safety of our members.

[twin ridge]

Gave +1 Rep to @sleek swift (current: #2099 - 1)

[sick lance]

Please don't post accross multiple channels, allow time for some members to get back to you.

[pliant cairn]

selenium/beautifulsoup and thats it i guess

[sick lance]

I know, but the channel you originally posted in would have been better as that is what you're asking about.

No idea.

[pliant cairn]

i mean there is no one stopping. its not like there is no rule or anything

depends on the use case. if they want to test it they can

[chilly veldt]

Morning

[pliant cairn]

morning

[chilly veldt]

Well "morning" been awake since yesterday

[pliant cairn]

its actually evening here in India

[pliant cairn]

i have been not able to sleep properly. im getting windows api in my dreams lol

[chilly veldt]

It's 2 pm here, I just arrived back in my country after a weekend of CTF'ing and partying

[sick lance]

So would that not make it afternoon, and not morning?

[pliant cairn]

pretty sure selenium is the golden standard not only for bounty hunters even for devs. thats the only way you can run multiple test cases. in the firm i work they do most of the web app testing via selenium. im sure they use BS4 too somewhere

[twin ridge]

Gave +1 Rep to @pliant cairn (current: #857 - 4)

[pliant cairn]

i should take a break from windows api

[south sonnet]

It totally depends you use the best tool for your use case.
If there is no javascript involved in what you're trying to automate then, just plain requests and bs4 or regex library would suffice to get all the info.
but if you need a browser to render JS then you'll need some framework like selenium (there are alternatives too).

[pliant cairn]

nice. what CTF was that?

[chilly veldt]

Well, I slept on the planes back

[chilly veldt]

Midnight Sun

It was a conference and CTF in one

[pliant cairn]

Nice!

[mossy river]

Eeeek should I buy it https://www.razer.com/gb-en/gaming-headsets/razer-barracuda

My current headset is playing up

[south sonnet]

Hmm wireless. I guess for those gaming headsests might offer a benefit with lower latency. But i tend to get monitoring studio headphones instead. Usually offer better durability and audio quality

anything with "gaming" in the title try to mess with special audio and bass too much and ruin it for everything else

[mossy river]

I had a studio headset but I found it wasn't too great for competitive gaming

[atomic aurora]

What games do you play?

[sick lance]

Are you asking for permssion, or have you already bought them and would like some re-assurance

[mossy river]

Primarily Fortnite. Shooter games.
I play Rocket League, Minecraft, Valorant as well

And then Bo6 and GTA6 when they are release.

[mossy river]

Permission

[atomic aurora]

W

[sick lance]

Then yes, get them. 🙂

[south sonnet]

I usually only play Valo and I can make out all the sounds. But my DAC does add a tiny bit of latency not too bad. I'm assuming The processing for these wireless headphones would be even larger. But i don't see any mentions of latency on those razer ones

[mossy river]

Are you saying yes to make me feel better when I eventually buy them anyway regardless of how many signs I get not to buy them or do you genuinely think I should get them? 🤣

[atomic aurora]

I personally only play cs and league of legends

and minecraft hypixel skyblock

[sick lance]

No, I think you should get them.

[mossy river]

I mean I have a wireless mouse and I don't see any latency issues

[sick lance]

Although, my partner might not be happy with you when I buy them...

[rapid merlin]

good afternoon guys 🦾

[mossy river]

Oh no, that makes me a bad influence 😁

See, the Pro are £150 more....

[rapid merlin]

guys youtube shorts is just AI shorts now

[shut hawk]

love me steel series headset 😉

[sick lance]

https://www.amazon.com/Ear-Force-Dolby-Digital-Wireless-Headphones/dp/B000V7N54A

I used to use these bad boys, they were amazing for CoD4.

[rapid merlin]

look at the ai edits you see while doom scrolling 👀 https://youtube.com/shorts/eELXq5Mb5Kg

[mossy river]

If I had to wear a steel series headset for 2 seconds just to save the world

https://tenor.com/view/earth-globe-explode-gif-14366757

[rapid merlin]

Do headphones matter thta much?

They all sound the same to me

[clear jackal]

I use Bose QC25

[sick lance]

Yes.

Right now I have a crappy pair of Turtlebeach

[clear jackal]

If you spend more than $15-20, yes, yes they do sound different

[shut hawk]

I am 90% sure that was a joke

lol

[rapid merlin]

it wasn't 👁️

[sick lance]

This is what I use right now.

[rapid merlin]

I always buy chinese headphones when my headphones break

I dont even have headphones rn lol

[shut hawk]

oh? I thought you were joking when you said "they all sound the same to me"

[sick lance]

I spend more on gaming headsets than I do with music ones.

[rapid merlin]

I just listen trough my laptop

[rapid merlin]

sorry I'm not 😭

[sick lance]

Although, the most expensive music ones I bought was Shockz.

[shut hawk]

its ok, is my bad

[mossy river]

Good headsets can give you a big advantage in competitive shooters

[sick lance]

When playig CoD you know when somebody is sneaking up behind you.

[rapid merlin]

I dont really play any games

[sick lance]

Usefull if you're being a sniper camping.

[rapid merlin]

I just listen to spotify and youtube

[sick lance]

I used to use these, but I uh.. Can't find the USB dongle

[mossy river]

@sick lance 🥴

[sick lance]

I'll need to check if they work the PS4.

[crude stump]

Wireless is a hassle

[mossy river]

skill issue

[crude stump]

[mossy river]

You probably want the one with the boom microphone. It's £50 cheaper

barracuda X

I bought a Razer Kraken V3 (wired) for my PS4 and I loved it

I still use it right now

[sick lance]

I rarely chat.

Mostly to my children when I game with them.

[crude stump]

You don’t trash talk?

[sick lance]

Not at all.

[crude stump]

Missing out

[loud marlin]

broke it in no time

[south sonnet]

IDK i've had really bad luck all razer products. 3/3 items i've used generally have broken aroundd the 2 year mark

[sick lance]

2 years is decent for average use.

[clear jackal]

Not really, especially when all these companies are recording you now for "safety"

[mossy river]

I've had a headset that I use for daily use, 8+ hours a day and it has worked great. Especially for only £50.

I also had a keyboard for around 3 years. It still works but I accidentally shorted some of the LEDs by spilling water on it. It still works but I decided to upgrade because the volume controls were broken and I use them a lot

[wide marten]

Studio headphones ftw. Also last 10+ years if taken care of.

[crude stump]

As long as long as you don’t cuss or say anything very bad a lil trash talk is ok

[sick lance]

Still would rather my voice wasn't being recorded.

[south sonnet]

my ath m50x still works 7years in broken clips due to cheap plastic construction. Have a hacky fix for when I need a second pair.

DT 770 pro Going strong for 3.5 years. Just need to change the ear muffs on them soon

[mossy river]

I was going to buy a DT 770 pro but I went for a different brand

[sick lance]

I'm hoping my USB dongle is behind the drawers, I just CBA moving it, and we're moving soon so I'll wait.

Just persevere with the crappy pair right now

[south sonnet]

It's really really good. But I hate the fact that it doesn't have detachable cables like the m50x does.

[clear jackal]

It's not because you're being recorded, in your own home, 100% of the time the game is on. So any background, while actually in the game or idling is going to be recorded.

[crude stump]

Crazy

How is that allowed

[loud marlin]

@hollow pivot when you read this... You also have Flint 2 router ?

[chilly veldt]

First thing I had to do when I got home was moving my motorcycle cause I got an email from my landlord about it being parked next to my apartment and not one of the parking spaces semi far away

[hollow pivot]

Hey, yes I do

[loud marlin]

can i DM question. is not so much for public =/

or whenyou have time

[loud marlin]

got some issues with port's and not sure of how to deal with it =/

[clear jackal]

"Protection of Children," when they're playing M rated games, lax privacy regulations, and people outside the space being like "you agreed to the EULA."

[crude stump]

Bruh

[hollow pivot]

sure, will get back to you as soon as can

[south sonnet]

also don't forget the no arbitration clause stuffed into EULA

[mossy river]

You should hardware mute whenever you're not actively using your microphone tbh. Even if you're not in a video game

[clear jackal]

Yes, I do, but that doesn't work when the controllers have microphones ie Playstation

[sick lance]

They can be turned off.

[clear jackal]

Through software

Or is there a hardware switch

[sick lance]

There's a button on the controller

[clear jackal]

I see I see

[mossy river]

And I am happy with games using my microphone if I have in-game chat enabled.

Fortnite records party chat, which I think is fair when some people can be inappropriate.
If you're not in the party, it's not recorded.

[sick lance]

The controller has an orange light for mute. blue for active.

[clear jackal]

I guess my question would be is that an actual hardware mute or can you go into the console and re-enable it through a menu?

[sick lance]

You can use a menu to unmute if you wish.

But you receive a notification and the light changes colour, you'll also lose the muted icon on the menu when you press the Ps button.

[timid prism]

just talk in mixed language

[crude stump]

Wouldn’t be surprised if they got translators

[sick lance]

I'm not learning a second language to have a conversation on the Playstation.

[timid prism]

do they sit in front of the screen listening the whole day

or its computerised

[crude stump]

We may never know

[mossy river]

usually it's only checked when someone makes a report.

[sick lance]

^

I'm sure there will be certain keywords that get flagged.

But that could be false positives depending on the game that is being discussed.

[timid prism]

when my friends play they use 3 4 languages so it doesnt really matter unless that listener is native

i hvnt played any games so idk

[sick lance]

If only there was translation apps that can do it faster... 🤔

[loud marlin]

https://tenor.com/view/paperclip-gif-5149817

[timid prism]

u really cant translate when u use 3 4 languages with 0 care about the pronounciation and accents

i tried it was such a mess 😂

the same line in english and same line in any native language can mean completely different

if they try to translate

[sudden whale]

Hello! Is there anybody in here familiar with salesforce apps?

[sick lance]

You could get an answer faster, if you just ask.

[sudden whale]

first pentest against this type of app, what should I look for?

any ideas

[sick lance]

Do you have permission?

[sudden whale]

Im doing a pentest

of course bro

[sick lance]

So you can submit it to our admin team, before we can answer?

As in, proof of the contract.

[sudden whale]

Are you familiar with this type of app?

[sick lance]

Yes.

[sick lance]

Please ask before you dm's.

And as this is work related, we cannot help you.

[sudden whale]

do you have at least a resource I can look into

[gray sonnet]

Morning THM 👋

[shrewd trench]

guys i need help from someone

[crude stump]

What

[shrewd trench]

who can read an ip adress of someone who hacked my facebook account

[mossy river]

That is unethical and against our community rules @shrewd trench

[wide marten]

We can't.

[shrewd trench]

i wanna know at least from where he could break into my facebook account

[mossy river]

You need to contact facebook support

[sick lance]

Please contact facebook or meta for support in account recovery

[shrewd trench]

i will thanks

i have a pretty sofisticated password so, it was a big surprise that he could get into my account

gg

[crude stump]

Did you click on something

[shrewd trench]

nope

i am the type of guy who double checks every link before clicking

even the https and .com ones:)))

[split pasture]

did another person use your device

[pliant cairn]

social engineering - typical fraud or phishing many vectors. Contact FB support. they will help you

[shrewd trench]

no one besides me has acces to my accounts nor devices

[shrewd trench]

okay