general

[half relic]

probably sounds silly but i put it on a laptop

i got a cheap notebook just for that

[sinful moon]

Nothing wrong with that if you’re using it as intended indeed

[orchid dome]

Congrats on finishing the networking, that was fast 🤔

[sinful moon]

I can’t tell you how often I used to get questions back in a Linux discord about “how 2 install steam on Kali”… wait no no, please don’t do that

[pliant onyx]

I'm pretty sure it will take me more than 60 seconds to understand Arch

[sinful moon]

or I saw some absolute horror stories

[half relic]

steam probably wouldn't fit anyway lol

[grizzled void]

imma do this now

[half relic]

like what

[sinful moon]

“my friend helped me install kali on Arch, but it’s broke now please help.” Um what does that even mean “oh he installed apt and used a script to install all the kali tools”

[strange current]

it didnt feel fast, i didn't understand a single thing so went and read a bunch of other stuff, still struggling to keep info in my head. So now I'm just making sure I go over the notes constantly

[pliant onyx]

Nvm he explained it pretty well

[half relic]

that's what i was wondering when i read the first sentence lol

[orchid dome]

After completing cryptography, do a revision of everything you have done so far

[sinful moon]

Yeah that was an absolutely borked Arch install after that lol, unsurprisingly

[strange current]

definitely needed, idk why but 40% of the networking stuff its just white noise to me.

[sinful moon]

sad it’s insanely interesting but fair enough

[onyx timber]

Guyz whats the most evil thing you have done

[orchid dome]

The stuff I do on THM, I repeat it on HTB after a week or so, it helps me remember

[strange current]

I've yet to even look at HTB yet, think its worth jumping into early?

[half relic]

how is htb compared to thm

[sinful moon]

Erm maybe not the best conversation to have in this channel lol. Unless you’re specifying completely legal means on your own systems

[orchid dome]

Not worth paying this early but worth it if you just explore the free content

[onyx timber]

Ya

[rapid merlin]

you might love a channel more focused on the philosophical study of moral phenomena

[sinful bobcat]

THM people, good morning

[sinful moon]

HTB is very CTF focused but they do have a supplemental University feature which is learning focused like THM. Realistically, it’s best to just stick to THM until you’re ready for the easy CTF challenges at HTB

plus, erm, the community is not anywhere near as welcoming if I’ll be frank

[orchid dome]

He is talking about Academy, since labs and academy are separated there

[half relic]

makes sense

[sinful moon]

Even then

[strange current]

That's what I was thinking, I'm no where close to being able to do any CTFs properly without someone holding my hand

[sinful moon]

and my bad if it’s Academy instead of Univiserity lol

[orchid dome]

And requires separate payment 🙃

[grizzled void]

any opinions on blackarch? Feel like playing around with it since I haven't yet

[sinful moon]

But yeah even with these concerns, just do the HTB Academy stuff that’s not covered on THM. You’re already kind of set with THM for the learning portion

[sinful moon]

meh

If you like arch and want a pentesting system, just roll your own? It’s trivial if like me you just want a headless server

[grizzled void]

I haven't touched Arch lol

[sinful moon]

If you need a pentesting toolkit out of the box, probably best to look elsewhere

[carmine tinsel]

hmmm my favorite thm things to learn are networks and web exploitation 🙃

[grizzled void]

Normally just use Kali for everything Pentest related. Not a big fan of Parrot.

[half relic]

youre making me want to install arch again but i want to focus on this one thing for a while

[sinful moon]

isn’t Parrot… fair enough

[half relic]

i have young kids too so it don't have a ton of time for a lot of different things

[eternal timber]

XSS?

[carmine tinsel]

rn im focusing on sqli

me and sqli started off enemies but now we are enemies with benefits

[eternal timber]

We’re still enemies

[carmine tinsel]

XSS seems interesting but im just a newbie at it

[rapid merlin]

there is a fun THM room on that 🙂

[carmine tinsel]

which one

[naive violet]

Cool thing is sqli is not dead

[sinful moon]

for me network exploitation >>> web exploits but I’m kind of old school and stuck in my ways. I’m decent with web exploitation but I do need to get better

[carmine tinsel]

i'm during sql injection lab rn, they definitely lied about it being a 45 min room 🤣

[eternal timber]

I like network architecture

[naive violet]

It absolutely should be, we know how to fix it and half the time it's easier to do it safely... But devs still make the mistakes

[eternal timber]

They often do

It depends on the person

[rapid merlin]

the times can really vary for each of us afaik

[eternal timber]

Kinda sleepy

[half relic]

is there anywhere that has labs with a lot of hosts that resembles a whole office or some kind of organization

[grizzled void]

James, you happen to know what time the announcement will be made for the certification?

[sinful moon]

The TryHackMe Networks

[half relic]

interesting

maybe i can try that soon

[sinful moon]

that and or spinning up your own labs (often prebuilt) on a VM host

[half relic]

where do you get prebuilt labs

[grizzled void]

GOAD if you want an AD network

[sinful moon]

I can’t remember the prebuilt labs off the top of my head but they more than exist

[half relic]

i will remember that

[sinful moon]

but yeah eaiser to just quality for an do the THM ones

[half relic]

hmm okay

[naive violet]

I'm not THM staff

[sinful moon]

lol everyone’s way too excited for a certificate which will realistically mean nothing

[eternal timber]

Hey that’s mean

[grizzled void]

I know about I was hoping you would have some secret knowledge

[naive violet]

If it was secret...

[rapid merlin]

I am always happy to see new THM content, moving forward with new things regardless

[sinful moon]

lol there’s a reason I don’t answer “do you have any certs” by listing all my THM certs as nice of a concept as they are

[carmine tinsel]

nah bro presecurity cert is going to get me a red teamer job just watch

[eternal timber]

I thought they were aiming to give the new certification some use

[eternal timber]

Mashallah

[carmine tinsel]

the only red team im ever joining is the ready to get unemployed team

[sinful moon]

I mean you’ll have to take that up with HR managers world wide if they’ll recognize it as such lol

[eternal timber]

I read somewhere that they were talking to some people

Idk tho

[eternal timber]

Preach

[celest torrent]

As an Arch user, I'd rather use Kali or parrot

[rapid merlin]

I believe red teaming teaches a lot towards understanding risk

[naive violet]

Eh I wouldn't say that

[rapid merlin]

no? how would you say it?

[sinful moon]

Agreed, otherwise just like roll your own as I mentioned

[naive violet]

I'd say reaching the stage in your career where you're doing actual red teaming means you need to be able to talk risk

The red teaming itself isn't really risk related

[sinful moon]

same kind of vibe with arch in general, I like to know why I need a specific tool instead of just “oh I guess this already came with this” when doing this in a learning capacity

[rapid merlin]

interesting way to say that

[sinful moon]

and going out to install that tool is a bit more effective than just “oh it’s already hre”

[drifting violet]

hi guys, i wanted to ask for a advice

is raspberry pi 5 worth it?

[celest torrent]

Although, I would say throw blackarch on a VM or USB and test it out, I encourage ppl to try diff distros and such, get a lay of the land, make your own mind up

[naive violet]

Red teaming is generally a senior or beyond role.
Pentesters should learn risk and the business context of how they fit in, especially as they progress through their career.
It helps them deliver better advice and build a holistic view of security

[sinful moon]

As a fun project for two weeks before collecting dust? Sure. As a server for small services you want? Sure. As a desktop environment, just barely. Really depends on what you want to do with it

[drifting violet]

oh, okay thanks for advice

[twin ridge]

Gave +1 Rep to @sinful moon (current: #32 - 287)

[eternal timber]

What services would you host on it

[grizzled void]

I use mine for DNS

[sinful moon]

No problem. I can’t help myself from buying them but I mostly fall into the first catagory of “fun project” that collects dust.

[wicked mulch]

sup guys

[sinful moon]

I have a big iron server for selfhosting and homelab

[drifting violet]

i want to run scripts and probably try to make a server and all and play with it

[celest torrent]

thats one of my next project, self-hosted DNS tiny server

[sinful moon]

Then sure, why not, they’re cheap and you’ll get what you paid for even if you don’t use it long term

[grizzled void]

I'm only using it as such for now as I have 2 servers and all my networking devices sitting next to the rack. Nothing is currently setup q-q

[sinful moon]

meanwhile I have this beast

https://media.discordapp.net/attachments/680459914828972076/1290479311358398514/dell-pet-430v4.png?ex=67be6883&is=67bd1703&hm=a8c9a6d215312e44b7ef446edd2e8550560be672b77c0a3d142ccadc95633439&

[celest torrent]

jealousy rating 10/10

[sinful moon]

lol if it helps it’s about a decade old now

[grizzled void]

My one server is quite bright

[sinful moon]

still can’t complain with dual Xeon CPUs, 256GB of ECC DDR4 RAM, 64TB storage, etc

[grizzled void]

not my photo but this is what my bright server looks like

[celest torrent]

every one of my ~3dz computers is about a decade or older except 2 lol

[sinful moon]

lol those rebranded PowerEdges are wild

[grizzled void]

true but I love it

[sinful moon]

mhmm. I’ve got PowerEdge T430 above

do you got dat iDRAC in it?

[grizzled void]

yeee

[sinful moon]

awesome! yeah that’s a large reason why I went this way

[rapid merlin]

I don't know why but that makes me want to eat Cheerios cereal now 😄

[sinful moon]

For everyone else, it’s a lights out management computer that stays on even when the server is off, provides remote administration and console access and more

[half relic]

like ipmi lol

[sinful moon]

yes literally

iDRAC is just the Dell proprietary solution

And they’re cute little guys

[half relic]

tiny

[rapid merlin]

awww

[eternal timber]

It has a good personality

[sinful moon]

one thing I enjoy is the SD card you insert can be the virtual disc image you use to install the OS and more

[celest torrent]

that's a nice feature

[sinful moon]

upload the ISO via the iDRAC web UI and you’re set, launch the console and install without even touching the server

need a recovery image? Well that ISO is always there lol

[olive lake]

3.93.13.100 im very new to CTF and Im trying to figure out these basic problems can anyone help

[half relic]

there is a room-help channel

[olive lake]

it's not a room

[sinful moon]

If it’s not on THM then you’ll have to state what this is for, for us to determine if we are even able to help you

it’s best to use the resources for that specific service or academic learning

[half relic]

oh that's an ip

[sinful moon]

yeah which is generally inadvisable but whatever

[rapid merlin]

best way to initially get help here is to register your discord

with THM etc.

[sinful moon]

That is an AWS server in Ashburn Virgina if anyone is curious lol

so yep, not THM or HTB

[celest torrent]

I was curious and got the same result lol

[sinful moon]

Anyways sounds like this is potentially academic which we can’t help with or some third party CTF which we can only struggle to help with. Best to ask in the communities and review the resources designed for this challenge

If you don’t know even to even start a CTF, then let me recommend a service called TryHackMe where you can learn that info c:

[rapid merlin]

that is a great reminder for me as I drink diuretic coffee ☕

[sinful moon]

Um coffee already is one?

[rapid merlin]

yes exactly

[sinful moon]

fair enough

[rapid merlin]

I try to drink water to stay hydrated

[celest torrent]

Ahh caffeine, must be calling my name gonna go get a poor mans Jolt

[eternal timber]

Energy drink and iced water for me

[carmine tinsel]

I’m a tea and water drinker

[rapid merlin]

what kind of tea do you enjoy?

[celest torrent]

hot or cold tea

[sinful moon]

beer and water drinker myself

[carmine tinsel]

Any tea but my favorite type of tea is chamomile

Lavender tea is good too

[eternal timber]

I love Arizona tea

[carmine tinsel]

Oooh ooh and I love green tea

[eternal timber]

Ice cold peach flavor

[carmine tinsel]

diabetes in a can

[eternal timber]

Idc

[sinful moon]

diabeetus

https://youtu.be/Lg6tWLPl5Z0

[celest torrent]

goold 'ol Wilfred

[rapid merlin]

the most suspicious payment invoice ever sent by tryhackme themselves

[celest torrent]

Wilford apparently

[sinful moon]

I spy a Gmail account, get gud

I half kid

[celest torrent]

narrows it down to platform

[grizzled void]

AWS branded server? 😮

[sinful moon]

Currently Proton Mail is my provider and I use Thunderbird as my client. Which yes, a dedicated desktop mail client is still useful

[sinful moon]

What? It was just the ASN for the IP

[half relic]

i use tuta

[eternal timber]

That sounds like a hassle

[sturdy pike]

Oh, just in uni doing cloud and stuff

[grizzled void]

oh i thought you were saying you saw/found a listing lmao my bad

[sinful moon]

ASN 14618 AMAZON-AES, US

[rapid merlin]

privacy oriented email providers 🙂

[sturdy pike]

How are you KGB?

[eternal timber]

Who is cloud

[sturdy pike]

You're taking it too far my friend, deal in 30.

[carmine tinsel]

dafuq you mean who

[sinful moon]

Depends on how much you enjoy Google controlling and monitoring your email and your life

and reselling that data to ad partners

[half relic]

that's why i stopped using them

they are too creepy

[rapid merlin]

22m yay

[eternal timber]

Idc much

[sturdy pike]

You really wanna know?

[eternal timber]

https://tenor.com/view/cloud-gif-19479771

[sinful moon]

cloud is just another companies computer

[eternal timber]

Why are you doing him

[sinful moon]

well that too

[fringe nacelle]

Nice, I remember struggling with cloud vs general IT stuff, I gotta eventually focus up on it one of these months.

[half relic]

i have an android so they probably know everything about me anyway

[sturdy pike]

who said "him"?

[half relic]

i don't knwo if turning location off does any good

[eternal timber]

That’s cloud

[celest torrent]

sadly, most likely

[sinful moon]

You can de-google yourself pretty effectively on Android depending on how far you want to go

[sturdy pike]

Oh it's just uni stuff, I'm prepping for Sec+

[carmine tinsel]

They gotta do cloud before trygoonme server can

[sturdy pike]

Heya Eliz

[sinful moon]

Heya

[rapid merlin]

GrapheneOS?

[sturdy pike]

It's not "Him".

[rapid merlin]

proton

yuck

[sinful moon]

Sure or Lineage

[eternal timber]

Goonthebox

[sturdy pike]

How are you?

[eternal timber]

[rapid merlin]

I regret reading this

[sinful moon]

What’s your choice? And is your decision regarding their recent GOP support because lol every tech company is doing so to avoid the wrath of this current administration

[fringe nacelle]

Good luck with it. I got another interview lined up, so hopefully that does well.

[eternal timber]

GoonerOne

[rapid merlin]

gov managed

[sinful moon]

it’s not

[rapid merlin]

it id

is

[sturdy pike]

I'm not gonna say anymore,
command failed: server down this script will be reported to the valid authorities

[rapid merlin]

• i do email routing

[sinful moon]

They’re literally hosted in a country where they routinely refuse government requests

[sturdy pike]

All the best! Ace it well

https://tenor.com/view/ace-ace-one-piece-one-piece-ace-one-piece-one-piece-wano-gif-24525860

[eternal timber]

We know how that ended

[sinful moon]

I would not be too worried about a host in Switzerland compared to the US these days lol

and they are far from a Swiss goverment run org

[sturdy pike]

Shh, they're gonna be saved by Sabo! And before you say, it's my headcanon.

[rapid merlin]

some companies have a lot of GDPR fines 😮

[eternal timber]

Who’s gonna be saved?

[static acorn]

🍪

[sinful moon]

Related how? You can get your GDPR data dump from Proton fine

[eternal timber]

Why am I feeling so tired at 2 am

I’ve grown weak

[strange current]

are you a tech startup in northern europe, bc you got fine written all over you

[sturdy pike]

Bro, just let them have their interview, or I'll stuff you with cookies.

[rapid merlin]

https://en.wikipedia.org/wiki/GDPR_fines_and_notices

[rapid merlin]

Just stop.

[sturdy pike]

🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪 🍪

[carmine tinsel]

Leveled up in thm but my new tier name is looking a bit weird, is this normal

[eternal timber]

MrGooner

[sturdy pike]

How many cookies?

[naive trellis]

Good morning

[fringe nacelle]

🐔 👍

[rapid merlin]

weird.

[sinful moon]

I’m familiar with the GDPR, but what are you trying to say about Proton?

[eternal timber]

Don’t threaten me with a good time

[static acorn]

cookie overdose

[sinful moon]

Ctrl+F brings up nothing for “Proton”

[celest torrent]

64

[eternal timber]

Cross site gooning

[rapid merlin]

lo

[rapid merlin]

that they are privacy oriented, and not on that list

[sturdy pike]

https://tenor.com/view/tyler-hynes-hynies-always-amore-i-absolutely-will-oh-i-will-gif-25294894

[sturdy pike]

Cheat Day!!!

[sinful moon]

Yes so good stuff, they follow the law, which is consumer data disclosure, not government

[carmine tinsel]

This is what i tell myself every day before eating 700g of sugar

[sturdy pike]

Sandwich!

I ate a potato sandwich today!

[sturdy pike]

You rawdog it?

[sinful moon]

So to bring this all around, what part of Proton is managed by any government?

[carmine tinsel]

Bro I’m an emerald edger in thm not a ruby rawdogger

[fringe nacelle]

White chocolate macadamia nut is my favorite cookie. How about yahs

[sturdy pike]

Now you're promoted to Ruby Rawdogger, rawdog it to the core now.

[celest torrent]

that's a good cookie

[sturdy pike]

I just imagine what I want

[slow cloud]

mornin

[sturdy pike]

Hey T1MOO

[carmine tinsel]

anyway I’m going to sneak in one more thm room before I go to bed

[sturdy pike]

Damn

I gotta do "blitzfire"

[rapid merlin]

proton has many times said they comply whenever confronted with a legitimate warrant

[fringe nacelle]

Cookie stonks on the rise

[dark frost]

I am watching the Zero day serie on netflix , cool show

[static acorn]

NO CHEAT

[eternal timber]

Imagine sleeping

[dark frost]

Very unrealistic

[carmine tinsel]

Is zero day like a hacking show or smth

[rapid merlin]

https://proton.me/legal/law-enforcement

[carmine tinsel]

How many firewalls did they launch cyber nukes at

[sturdy pike]

Past Trauma? Yum yum yum?

[rapid merlin]

did u guys see the 1.3b heist this month

[celest torrent]

Lazarus group did it apparently

[sinful moon]

It’s clear you have not actually done research on them actually bending to these requests nor about law enforcement in Switzerland

[rapid merlin]

this? https://www.reuters.com/technology/cybersecurity/cryptos-biggest-hacks-heists-after-15-billion-theft-bybit-2025-02-24/

[sinful moon]

But also like, even if they just blindly answered every government request, who would you rather have as a country to administrate this?

[rapid merlin]

It does not protect people from breaking the law and they are obliged to obey court orders from Swiss authorities. Every provider, whether protonmail, tuta, mailbox, etc., must comply with the law. They won't risk closing down the entire company for one random guy on the internet who broke the law.

[sinful moon]

While this is true, see the above, and realistically what are you expecting?

[rapid merlin]

Proton provides privacy but not anonymity

[sinful moon]

Then I guess just never use email? lol

What is your provider if you’re 100% against this?

[rapid merlin]

i route my emails

[sinful moon]

aka you’re self hosting and using an SMTP relay or something? Seems less secure

like just explain further what you mean lol

[rapid merlin]

i said i route it

its encrypted

and only i have the secret key to decrypt it

[eternal timber]

What encryption do you use

[sinful moon]

From what I remember this is encrypted at rest as well

[celest torrent]

DES

[rapid merlin]

aes256

[carmine tinsel]

can you tell me your secret key i pinky promise i wont do anything sus with it 😍

[eternal timber]

Nice

[sinful moon]

even to use a third party client you need to use a bridge application to decrypt it

[carmine tinsel]

#social engineering

[rapid merlin]

proton?

[sinful moon]

for the in transit encryption

yes

[eternal timber]

Go to sleep, car

[queen flare]

@cloud quiver got any more recommendations once im done with vulnversity?

[rapid merlin]

recovery email, phone number, ip address, recipient and sender

[fringe nacelle]

I would of said "Wow that's really cool mister ;3 can we dm and stuff? I'd love to know how this really works.."

[carmine tinsel]

its always the DM mfs

[shadow belfry]

It's always "what's the name of your first pet" and never "how are you doing" 😞😞

[sinful moon]

Sure but that’s far better than Google using my emails for ad revenue. I am not doing anything illegal. If I were my opsec would be better than this

so idk what you’re on about

[eternal timber]

Yooo it’s Oong

[queen flare]

if anyone else also have any recommendation feel free to share
just know that i have only done cybersecurity101 like 70% and don't know much about anything else
so please keep the recommendations in par with my current skill level

[fringe nacelle]

[celest torrent]

What is the seventh letter of your third-grade friend's middle name

[shadow belfry]

Close enough, give him CISSP

[grizzled void]

I'm curious at what point does it become encrypted because isn't it sent unencrypted by the companies you use, like THM for example. So there would be a trail. THM to mailbox1, mailbox1 encrypts then sends to mailbox2. Also to send to your mailbox wouldn't you have a public facing domain name for your web server. So the domain name is linked to you. I believe this still doesn't give you anonymity.

[dark frost]

It get harder to trust email providers

[sinful moon]

But like even then Proton regularly fights the swiss goverment telling them we can’t hand over this info

[rapid merlin]

that has a great story regarding differential cryptanalysis 🤓

[carmine tinsel]

des what

[sinful moon]

DES-awfully insecure you could say

awful joke, I tried

[carmine tinsel]

des nuts

[cloud quiver]

What are you looking for 🙂 ?

[eternal timber]

Fascinating topic

[queen flare]

i enjoyed all the previous rooms you recommended
so whichever challange room you wanna recommend, as long as its in par with my noob skill level

[cloud quiver]

Does it have to be free ?

[sinful moon]

Anyways I still remain unconvinced, the initial premise was Gmail vs Proton which is already an order of magnitude better before going full on paranoid as bitey is

[queen flare]

nah
i got subscription

[sinful moon]

Oh no the Swiss government could ask them to give up account details, but lol Proton usually fights these requests

[queen flare]

@cloud quiver

[sinful moon]

also lol there’s a reason “Swiss bank account” goes hand in hand with I registered by business in the Camen Islands

[queen flare]

proton offers a free vpn with no bandwidth limit

that kind of seems weird to me
because that's no business model

[sinful moon]

I’m sure its to sell you on their full suite

[eternal timber]

opening one in a few years

[sinful moon]

Proton VPN while being a decently large player doesn’t have the brand recognition of all the YT sponsor spammed ones

[cloud quiver]

This one's good 🙂
https://tryhackme.com/room/silverplatter

[sinful moon]

If they can even sell you on just Proton Mail then they have made their money back

[eternal timber]

They literally advertise NordVpn as a magic wall that defends you against hackers

[celest torrent]

9/10th of all VPN ads are NordVPN ads

[sinful moon]

Yeah lol, and most show off legally grey ares of using VPNs to bypass GeoIP restrictions

It’s all NordVPN or Surfshark from what I’ve seen

[celest torrent]

I've seen Surfshark a few times here and there as well

[sinful moon]

quite a bit in my channels in the past two years but yeah

[wooden totem]

Like they say, marketing is 80% of a business

[celest torrent]

best option: roll your own vpn

[sinful moon]

Mhmm

[celest torrent]

VPS are cheap

[sinful moon]

But also this is a good way to scare customers like me who actually know something, away

[celest torrent]

monitor your own traffic

[cloud quiver]

In my case it is surfshark

🤣

[sinful moon]

yeah my VPS tunnel is basically a VPN at this point. But I should get around to properly making that Wireguard eventually

[eternal timber]

Idk enough to do that

[fringe nacelle]

Everytime I see anything about NordVPN it's usually something with hacked accounts.

[sinful moon]

and hey neat thing, my new Unifi Gateway actually can be a Wireguard server/client natively

[eternal timber]

Idk what that means

[queen flare]

thanks

[twin ridge]

Gave +1 Rep to @cloud quiver (current: #1 - 3493)

[sinful moon]

Wireguard is a newer VPN protocol which is significantly more lightweight and performant compared to OpenVPN

[shut hawk]

New Nothing phone design is very....unique

[dark frost]

Since i hosted my own openvpn server , i don't trust any vpn provider

[naive violet]

Just buy a fairphone, transparent version isn't faked etc

[sinful moon]

something something it’s just a mutated OnePlus device lol

but fair Nothing’s design is top notch

[eternal timber]

Oh I see. Thanks for the info

[twin ridge]

Gave +1 Rep to @sinful moon (current: #32 - 288)

[fringe nacelle]

Is this an actual phone brand?

[shut hawk]

Yes

[mellow sky]

#announcements message

has this been released yet?

[shut hawk]

Bit too expensive for me personally

I do like the idea though

[naive violet]

And a nothing phone isn't?

[sinful moon]

Yeah Nothing phone is significantly more affordable

[naive violet]

Cost of slave labour in the supply chain...

[shut hawk]

It's more cheaper to buy

[queen flare]

british phone brand

even i had to google

[static acorn]

hi gooper

[sinful moon]

Going to have to work extremely hard to find something that wasn’t manufactured in China or the far east unfortunately

So fair if you want an open source phone and pay the premium for the privilege, yes you may just have that

[fringe nacelle]

Ahhh was about to say I only know Galaxies, iPhones and Moto lol. Also obsidian phones.

[naive violet]

It's still manufactured in China, but without Foxxcon grade living conditions

[sinful moon]

Obsidian phones?

[fringe nacelle]

Sup bud, how's your journey going?

[static acorn]

not too shabby. youself?

[fringe nacelle]

Yee it's some stripped phone that's stupidly expensive. Lemme find their brand name

[queen flare]

obsidian phones?

[sinful moon]

lol as expected, all results are the app

[chilly veldt]

It's probably released in a couple of hours, it's early morning in the UK

[eternal timber]

Pixel obsidian?

[sinful moon]

I don’t know if I could say that is without issue without a full review of the supply chain however, if I’m being honest

[naive violet]

They publish that information

Because they're confident

[sinful moon]

Good because yeah China is infamous about exploiting that western minority group and it’s awful

Fair enough

[naive violet]

Besides, don't let perfect be the enemy of good. "Better than the others" is still major progress in a race to the bottom system

[nimble charm]

I want some one have experience in video animation

[dark frost]

I wish to be able to move the batterie of my phone again ^^

[mellow sky]

yeah not even 9am yet, wondering if it'll be a soc cert or a pen cert

[chilly veldt]

It's a blue team cert

[sinful moon]

You’re not wrong, but “voting with your wallet” realistically has a very minute impact despite what some would like to think about net benefits

[shadow belfry]

I'm excited but it's def gonna be like soc 3 lol

[mellow sky]

this is their first cert right?

[chilly veldt]

Yes

[mellow sky]

which do you guys prefer htb or thm

[shadow belfry]

Might be something like left field like Certified AWS Analyst

[chilly veldt]

I don't care, learning is learning

[shadow belfry]

Haven't tried HTB lol

[sinful moon]

They should be reviewed on their own merits

that too (what kyooty said)

[eternal timber]

I might have learnt too much and fried my brain

[mellow sky]

I used to just go with thm only, but since I've been trying HTB I really enjoy it, I will say it less CTFy

[fringe nacelle]

I remember it now, it was called the "Obelisk One" made or atleast sold by Obsidian intelligence group

[queen flare]

intelligence group?

[fringe nacelle]

I'm alright just kicking rocks at work

[queen flare]

thats a scary name for a smartphone company innit

[sinful moon]

HTB is all CTFs unless you mean the separate HTB Academy program

[grizzled void]

i would disagree with this statement

[fringe nacelle]

Just look it up lol it's an expensive ass phone

[static acorn]

sending excitement and non boring vibes

[mellow sky]

when I mean CTFy I'm meaning that I believe THM has more rabbit hole style challenges and HTB has a more realistic approach

obviously they are both CTFs

[orchid dome]

Tyler Ramsey says the same

[queen flare]

DoD partner making an expensive secure phone

interesting to say the least

[mellow sky]

yeah because it's true lol

[celest torrent]

That's a good comparison, whichever style you prefer and can learn better would perhaps be the best choice

[sinful moon]

THM primarily has educational guided experiences but also features CTFs which are off the beaten path, where as HTB is all CTFs where the learning material is off the beaten path I’d say

Yeah best to do both when you are ready

it’s not a one or the other

[fringe nacelle]

Yeah idk how reliable it is, but I remember hearing about it.

[mellow sky]

I personally hate cryptography challenges, but ik some people love them so that's where THM shines in that area

[eternal timber]

what do mean by rabbit hole style

[shadow belfry]

Yeah I heard THM is better overall for total beginner zero-to-hero learning

[sinful moon]

I just find most people have experience starting with THM and then getting into HTB when they’re ready

that’s the approach I took and no regrets there. I’m a sub to both

[mellow sky]

type of stuff where you gotta decode an image to get a hash that you then have to brute force against rockyou.txt to then convert into base 64 for a flag

[fringe nacelle]

At the end of the day THM is meant for beginners and newbies. HTB is medium to Intermediate level.

[mellow sky]

obviously thats a joke but that kind of style

[fringe nacelle]

Yup, I'm doing their academy as of now and got with my group through HTB. But started off with THM

[static acorn]

unfortuanatly i found hackthebox first and tought that i wouldsuck forever. then i found tryhackme. which breaks things down into byte sized peices.

[eternal timber]

I think I had to do this exact same thing on some platform

[celest torrent]

They're teaching you to think like a hacker, it is very challenging at times

[mellow sky]

yeah but it's completely unrealistic

and at times it feels guessy

[celest torrent]

self research is a key component of just about any infosec job

[shut hawk]

You'll get that often with many CTFs

[sinful moon]

I mean that applies to HTB CTFs on a easy to medium level in general. They basically spell out how to exploit this just with common knowledge

[queen flare]

do whatever as long as you enjoy doing it and getting something out of it

[mellow sky]

THM is much better for beginners though

has a better price plan

[shut hawk]

Over time your intuition will get better and it will be easier to know whether you're on the right track or not

[swift gale]

Guys. Hello. I have a little questiong about the XSS and payloads in Burp Suite. In which tab I can make a discussion?

[sinful moon]

easy CTFs are like nmap > expoitDB > profit???

[shut hawk]

> gtfobins

[mellow sky]

a few are like that won't argue with that

[sinful moon]

If it’s TryHackMe related we have #room-help just for that!

[fringe nacelle]

If you have an active student email, use it on HTB. Insane value

[swift gale]

thx a lot

[twin ridge]

Gave +1 Rep to @sinful moon (current: #32 - 289)

[oak river]

I'm waiting for the cert today

They better not lie

[sinful moon]

lol idk why everyone is so excited

[oak river]

[mellow sky]

the pen tester path way is amazing

[celest torrent]

Gonna go focus on a room or 2, have a hacktastic day all!

[shadow belfry]

THM Certified "Fell For It" Analyst

[oak river]

And why shouldn't we be?

[sinful moon]

Try telling the HR manager of another company how important and industry recognized this new cert is

[oak river]

Don't you worry

[sinful moon]

while you’re being hired based on certs they have no idea about

[mellow sky]

be excited for 5 years when the cert is recognized

[finite prairie]

fr

[fringe nacelle]

I mean sure it's not going to recognized for now. But it's still a huge stepping stone for THM, I'm interested to see what they do with it and how future certs will be

[sinful moon]

I’ll believe it when I see it which doesn’t help with THM polluting the water with “nothing” certs that nobody recognizes as it is

[shadow belfry]

I mean I realistically just like the ecosystem and the company and I'm hoping this is relatively well priced compared to sec+

Or others

Just to learn off

[sinful moon]

lol I must have missed this communication from them but realistically we shall see

[fringe nacelle]

Im curious on how well the material will be and how they present it.

[mellow sky]

I wonder if this will be a soc cert to pair with their new soc sim

[sinful moon]

Yeah my latest THM email doesn’t say anything about a cert

[fringe nacelle]

I believe it is a soc cert, just search through the owners message logs.

[grizzled void]

MartaS was talking about it a few weeks ago and they made a post on a social media platform but I dont remember which

[eternal timber]

This looks fun

https://wargames.ret2.systems/deusx64

[mellow sky]

does this mean there will be more scenarios? for the soc sim

[arctic coral]

Where's the cert guys? 👀

[grizzled void]

its a blue team cert

[arctic coral]

i see

[grizzled void]

will be related or use the new soc simulator most likely

[fringe nacelle]

^

[shadow belfry]

Btw, has anyone working as an analyst tried the sim? How does it compare to your real workflow?

[sinful moon]

which iirc comes at a premium already

[arctic coral]

When will be the cert released btw?

[sinful moon]

psh, what do I need with an SOC simulator when I’m the SOC manager :p

[arctic coral]

was not 25 the date?

[sinful moon]

I only half kid, I just manage our… managed SOC

95% of the time I have to reverse their decisions lol

[fringe nacelle]

Well if it's releasing today it'll be at a set time

[arctic coral]

hmm makes sense..........let's wait and watch...........

[fringe nacelle]

That sounds painful

[sinful moon]

I’m sorry Sid Meier’s Civilization III is not a True Positive

lol one head of a company likes his strategy games

[rapid merlin]

Morning 🙂

[queen flare]

morning

[sinful moon]

Got another one for Anno 1800 the other day for the same user

[rapid merlin]

they like their strat games 🙂

[sinful moon]

come on SOC, it’s launched from common Steam directories, signed by Ubisoft and more

mhmm

[rapid merlin]

https://www.bleepingcomputer.com/news/security/piratefi-game-on-steam-caught-installing-password-stealing-malware/

[sinful moon]

lol as a gamer myself, I understand his plight and I resolve the issues

yes we have heard

I would not unquarantine and allow a random ass game like that lol

[fringe nacelle]

Time to make a game where I give the users my password and they go on a scavenger hunt to find which accounts they belong to.

[grizzled void]

to be fair this game isn't sign by a triple AAA video game publisher so it is more likely to be accepted as a false positive imo

[sinful moon]

erm “more likely” but yes

[grizzled void]

however the issue this topic raises is what if they are using mods as mods have been used for malicious purposes time and time again

[sinful moon]

Yeah I just specifically know the person I’m dealing with detection wise and he only plays AAA strat games that don’t have risky mods

[grizzled void]

sorry i decided to switch my sentence wording up at the end and didnt correct it

[fringe nacelle]

Yup especially when that mod is thrown into a mod pack and it gets spread further

[sinful moon]

lol no worries

But yeah when you have your name in the firm’s company name, yes you deserve to play games on your work computer if you wish lol. I wouldn’t recommend that otherwise. But yeah I quickly allow list them because it kinda sucks if you paid for a game and randomly can’t play it

Just a client of ours who works in the financial sector

[fringe nacelle]

Well that's nice of you

[sinful moon]

but yeah also an odd MSP vs client relationship lol. We can’t tell the CEO of a company “don’t play games on your work computer”, which besides he’s doing it right just with legal purchases on Steam

[rapid merlin]

I wonder how much single vs multiplayer gaming they do

with the strat games

[sinful moon]

I think by and large it’s single player from what I’ve seen

[shadow belfry]

Certs up

SAL1

[sinful moon]

I’ll check it out later today, I’m in no rush unlike everyone else here lol

but fair I am gainfully employed in infosec atm

[shadow belfry]

Entry level SOC cert looks like

[mellow sky]

damn

[grizzled void]

the blog has been up for a minute I just hadn't taken the time to click on it and see that was what it was lmao

[mellow sky]

did u guys know among us 3d is now out

[naive trellis]

why is cryptography such a pain in the ass

[sinful moon]

Back in my day we had 3D among us, it was called Trouble in Terrorist Town and we loved it lol

[naive trellis]

Yea ttt was amazing

[mellow sky]

murder mystery too

[sinful moon]

skill issue, get good fam. But I kid, yes there’s a lot to learn but once you have that learning down it’s no problem

[grizzled void]

Link for cert https://tryhackme.com/certification/security-analyst-level-1?ref=blog.tryhackme.com for those interested

[shadow belfry]

Shout-out that one Minecraft map with the lighthouse that every TTT server was hard stuck on

[naive trellis]

Yee im in that phase now

[sinful moon]

base64 should be trivial to just recognize by sight tbh, and more

[naive trellis]

It is a skill issue. For now...

[sinful moon]

fair enough

CyberChef and friends are, um, your friends lol

[naive trellis]

Who's cyberchef

[static acorn]

my dad

[sinful moon]

You’re not even kidding are you

[naive trellis]

Nah I'm not I'm really new to all this

[rapid merlin]

https://gchq.github.io/CyberChef/

[static acorn]

DAD

[sinful moon]

This is the GCHQ’s… nah they beat me to it

[mellow sky]

£255

[grizzled void]

?

[sinful moon]

But yeah with CyberChef you can encrypt/decrypt so so so much

[mellow sky]

it's pretty standard price

compared HTBs certs

[sinful moon]

just know that CyberChef is open source so you don’t have to use the GCHQ’s instance if you don’t trust that understandably

[static acorn]

i love cyberchef. cyberchef is love cyber chef is life

[naive trellis]

That part I can get done but I'm trying to understand different algorithms at a fundamental level

This part is a pain in the ass

[sinful moon]

Then yep, that’s more just raw studying

Note taking helps, but don’t go overboard

imho notes are best kept to just what you need to spark your memory

instead of writing articles

[naive trellis]

Honestly just the act of taking notes helps me remember things much better

[sinful moon]

mhmm for sure

[grizzled void]

the one thing i wish cyberchef had was translation between languages

[static acorn]

physical notes is the shit

[sinful moon]

Obsidian is what I use myself and what many others here uses for note taking

[naive trellis]

Damn and here I am with pen and paper

[sinful moon]

but software choice much like note taking methodology high varies

[naive trellis]

I'll look into that

[static acorn]

bro. your cooking rn holy

[loud marlin]

@sinful moon by any chance you use LUKS for main os or so ?

[sinful moon]

I have used it in the past but I am not extremely experienced it with it, why?

[grizzled void]

I only want it as I'm constantly swapping back and forth between google translate and cyberchef while working

[naive trellis]

Why?

[grizzled void]

i work with content with a ton of foreign language that i cannot read

[naive trellis]

Ahh ok

Sounds fun

[loud marlin]

oh. well. yesterday in morning luks was ok. later that day it wont accept password. even ubuntu live wont decrypt with guy and with cryptsetup open won't

[sinful moon]

I mean there’s also PhishTool which is a great help for email specifically, won’t help with translation tho

[static acorn]

i was curious but didnt ask lol so im glad they did

[loud marlin]

hashDump show keyslot there

[grizzled void]

that is used as well

[loud marlin]

and ofc i can't add or so key =/

[sinful moon]

uh that’s fricked. I’ve never experienced that

[queen flare]

just assume that the foreign emails are bad

reduces work

[loud marlin]

yea... fracking hell heh

[sinful moon]

sorry Alexander, I unfortunately don’t think I can support you there

it always just werked for me, and I have too small of a sample size (1) to say otherwise

[loud marlin]

yea. well ill just cry in silent then eheheh

[sinful moon]

lol yeah just continue with your searching, I’m sure you will come across something

Just never heard of this straight up refusing to accept your key

[loud marlin]

i found some. but they are able to decrypt in with live usb. for me not so much

[sinful moon]

Yeah and that part is very odd to me

[queen flare]

so what i understand is that you have an encrypted drive with currently no way to decrypt it?

💀

[sinful moon]

correct, with LUKS encryption

[loud marlin]

ludksdump show key be there. ubunu live wont decrypt. even with gui with show password field. and is 100% correct one i use

[snow palm]

hello everyone, i have a question for the more experienced of you:

recently, i have been contacted by a top tier bug bounty hunter on hackerone on youtube because he saw a stream of mine playing that wargame stuff online. he told me to quit it and directly join hackerone and if needed, fill my lack of knowledge by using chatGPT. he said that multiple times on my stream to the point of even annoying me slightly.

after waking up today i decided to join however i'm still a little overwhelmed by the stuff hosted on the page there. what's your take on this and what would be your recommendations using tryhackme or hackthebox to get to a point where i can reliably make some decent amount of bucks on the site?

[sinful moon]

oh dear. ChatGPT does not a bug bounty hunter make. You do need practical experience and knowledge, even if just to check behind what ChatGPT is saying, not the least of which is ChatGPT will refuse to answer many of your offensive infosec questions.

Realistically fill your lack of knowledge with idk actual human curated knowledge with TryHackMe for which yeah we do have a website for as you know. TryHackMe starts at the very very basics so that anyone can get up to speed

[grizzled void]

I'm interested in learning what this wargame thing is.

[snow palm]

overthewire[.]org

[grizzled void]

ahh i know of this already

[snow palm]

thanks!

[twin ridge]

Gave +1 Rep to @sinful moon (current: #32 - 290)

[sinful moon]

To continue on that since you asked about HTB, that’s a great service too, but imho it’s best to use in combination with THM once you get the basics down enough to do easy CTF challenges.

[rapid merlin]

found it

[snow palm]

will do!

[naive trellis]

Yea I tried HTB and found it a bit too much. Now that I've been doing THM for a little while, when going back to those same HTB modules I find that I understand them way more on a fundamental level

HTB just expects you to get it 💀

[grizzled void]

Fun Fact: An ostrich eye is bigger than it's brain!

[static acorn]

me asf

[sturdy pike]

Explains the name of one of my friends

[mellow narwhal]

To be honest, it's useful for validation purposes

[sinful moon]

Yes but not if you don’t know how to check behind the output for your own sanity checks

[mellow narwhal]

Like it'd be stupid to ask it "here's https://target.com, go find something in it", but it's helpful when you ask it things like "I found x, how can this be escalated further, can it be remediated by fixing x function", etc

[sinful moon]

You need to know at least enough to know when it’s feeding you bs

[mellow narwhal]

Yeah this is true lol

[static acorn]

guys i need a motivational quote so i can get done with active directory.

[sinful moon]

“Learn Active Directory so you can better apply Group Policy to your org” - Plato 422 BC

[loud marlin]

i rly do not get how luks can change its behavior for no reason =/

[static acorn]

damn bc? plato wilden

[mellow narwhal]

Privilege escalation, rights to exploit,
Kerberos, Bloodhound - own the AD joint!

(cheerleader cheer )

[sinful moon]

Also yeah if you do have an AD enviroment, just run PingCastle on it and whew you’ll find things wrong with even default configs

that will help with learning concepts a good bit

[ruby flax]

how do i make my sideloads last longer

[sinful moon]

On iOS? You don’t, you need to check in once every 7 days

[drifting stratus]

can someone help with the tasks in the tryhackme site

it's our activity

[upper knoll]

#room-help

[queen flare]

now if you can give me some general motivation

[sturdy pike]

https://tenor.com/view/daddy-noel-sus-caught-in4k-meme-gif-25951399

[sinful moon]

How is that motivating?

[sturdy pike]

Their pictures are being clicked because they're popular

[sinful moon]

How is that motivating? Because we’re aiming to be popular? lol

May be in the wrong field for that lol

[sturdy pike]

Let me think

[sinful moon]

lol

[sturdy pike]

lmao

[sinful moon]

I’m mostly just being difficult since I hate gif replies

[wooden totem]

You can die at any moment

[sinful moon]

especially rando ones

[sturdy pike]

I got that lol

[sinful moon]

To me gif replies mean boomer or gen-xer has entered the chat.. But I’m not one to talk when my Millenial gen spams them tons too

[sturdy pike]

It's good to be aware... and self aware(?) lol

[sinful moon]

lol I never use them but yes fair enough

[sturdy pike]

This too shall pass soon

ah no

[sinful moon]

I’m more apt to use text mode emoji than I am similar millennial tropes

[grizzled void]

"The secret of getting ahead is getting started." — Mark Twain

[sinful moon]

c:

[sturdy pike]

Teach me your ways sensei

[sinful moon]

oh here’s the real deal

= ^ . ^ =

whew

[sturdy pike]

(╯°□°)╯︵ ┻━┻

[sturdy pike]

I need More

[sinful moon]

to be clear we didn’t use Japanese character sets back then lol

[grizzled void]

this is a classic and I appreciate seeing it

[sturdy pike]

(* _ *)

[sinful moon]

let me do the dreaded one

:3

[sturdy pike]

Tableflip is Japanese?

[sinful moon]

yes

it requires Japanese characters to function

[grizzled void]

you forgot to add raWr xD

[sinful moon]

lol

[sturdy pike]

raWr

rofl

yeah I remember some of them

[loud marlin]

well eliz i thing i need do install again =/

[sturdy pike]

good to know, damn

[sinful moon]

Sorry to hear that :/

Backups hopefully?

[sturdy pike]

:?

What am I doing

I was preparing sec+

[loud marlin]

i have that. just not so latest. last one was in last monday. but not so much changed

[sinful moon]

Yeah honestly that’s not doing bad at all

so meh, you learn and grow and move on then

I just uh, have no idea why your LUKS randomly failed which is quite unusual

typically it’s as solid as Bitlocker

[sturdy pike]

Coding in solitude is confusing

[sinful moon]

what do you mean, you have all of StackExchange helping lol

[loud marlin]

the only i can think of is that i tottaly forget pass, but i have it in my hands and written it down for sure

[sinful moon]

yeah really weird

[sturdy pike]

We had a test today, a surprise one, barely made it today

As I'm not focusing on that currently, but knew enough to do it

[sinful moon]

mhmm sometimes you will have to code for yourself

lol

[sturdy pike]

Lmao

it's not that I can't, I know the learning curve of coding haha

[sinful moon]

but yeah those examples on StackExhange and etc should at least be helping you grow and learn instead of the copy paste

[sturdy pike]

Make Function
loop
function
loop
function
...```

[sinful moon]

lol there you go

[sturdy pike]

I don't like copy pasting, I want to understand how it works, the "How" is what motivates me

[sinful moon]

mhmm

[sturdy pike]

That's basically coding in a nutshell, until you're advanced level

But I guess it helps being jack of all trades in coding for cybersec

[sinful moon]

You never know though, sometimes you need the StackExchange keyboard lol

https://cdn.stackoverflow.co/images/jo7n4k8s/production/e53da7968091b70a882a23fb4a711aeaa72eeed2-1200x630.png?w=1200&h=630&auto=format&dpr=2

[sturdy pike]

Did they change the name? I remember it being stackoverflow

[sinful moon]

indeed but realistically, depending on how you specialize, just enough python to get you by will often save the day

[sinful moon]

I’m confusing their 100+ sub sites is why

Majority of them are formatted as SubjectMatterExchange

[sturdy pike]

I'm having too many sources lately, Python, Sec+, THM and gotta start HTB and Portswigger, but yeah I get what you mean, I'll be sure to tame python

[neat python]

Hi

[sinful moon]

Mhmm good stuff. Black Hat Python is also a great resource but needs some updating which anyone with decent Python knolwedge can do themselves

[sturdy pike]

Damn, they're bigger than I thought

[sinful moon]

Welcome @neat python

Yeah there’s like UnixExchange and much more

[neat python]

@sinful moon yeah

[sinful moon]

What’s up?

[sturdy pike]

Ah I see, didn't know, but imagine how advanced you must have to be to search out that many lol

I mean not imagine, only I have to imagine

[sinful moon]

eh they just come up naturally in search results when you get into those other subject matters

[errant fossil]

Morning

[sturdy pike]

I've been told to learn from the "How to automate boring stuff with python" book, not sure how good it is, python community suggested that, this one suggested something else

[neat python]

@sinful moon actually I am hunting on a big target and this is my coffee time so I saw this group and connecting with techies

🤗

[sturdy pike]

You have to be experienced enough to search those subject matters, yes?

[sinful moon]

Depends on how much Python you already know I guess, or just scripting languages in general, Python is kind of easy but advanced topics can get wild

[sinful moon]

uh no, just like search some random question and yeah there’s usually something that comes up. Linux and *nix stuff is a good example

[sturdy pike]

I just know everything till functions in python, have to progress more but the learning curve is hard for me to adapt as I'm either on THM the whole day, portswigger or mathematics just to get my brain engines running

[sinful moon]

idk I just run into offshoots of StackEchange all the time

[sinful moon]

What question to do have about how functions work in Python? It’s just a predefined bit of code that you specify what the function returns values for

[sinful moon]

Nice congrats. Are you new to TryHackMe?

[sturdy pike]

Gotcha, they may have come up when i was in crysis related to linux too lol, didn't pay much mind as I was always going to reddit, still sad by the fact that they killed Reddit

[neat python]

@sinful moon yes in this group I am new

[sinful moon]

Awesome, well welcome again. Do keep in mind we’re the community for the infosec learning site tryhackme.com but yep we welcome all

[sturdy pike]

I do it when I'm doing python, I'm almost always encountering errors because I type it in from my memory and bash script runs through the brain most of the times lol

[neat python]

I appreciate it

[sinful moon]

yeah lol gotta keep those different scripting languages somewhat segmented in your mind lol

with facts like… shutters Lua arrays start at 1….

[sturdy pike]

Let's pick up python again, there are byte sized videos out there I'll just do them, reach intermediate level and then be comfortable with it, I need to do it

[sinful moon]

lol I have never ever wanted to seek out a video to teach me a purely text based programming language

but to each their own

[rapid merlin]

Some random added me

[sturdy pike]

I didn't even learn bash, it just started forming up synapses in my brain from when I used to be active on github, google shutting down my old account sucked big time

[rapid merlin]

Member since jan

[sinful moon]

lol happens to me all the time

[rapid merlin]

Ofc

if you have the logic there then you can learn a new langauge in a few weeks, just the syntax really that needs learning

[sturdy pike]

I'll learn from book, already doing maths from videos

[rapid merlin]

So annoying, it’s always a new account

And someone I’ve not spoken to

the internet for you it's full of creeps.

[sinful moon]

lol new or old, people will randomly add me from any server I’m in because female sounding username lol

which yes I am a girl but that’s besides the point lol

[sturdy pike]

LMao

[rapid merlin]

Mines gender neutral though 🥲

[fringe relic]

There are no girls on the internet!

[sinful moon]

I guess they just really wanted some of that Sweet and Salty

[rapid merlin]

😅

[sturdy pike]

How does mine sound?

[rapid merlin]

Fr

[rapid merlin]

https://tenor.com/view/cookies-gif-5819392349926461652

[sinful moon]

my dude we have moved on from this 00s era meme, I hate to break it to you

[rapid merlin]

I read that on “Rules of the internet”

We need an update on rules of the internet

[vague herald]

Hi , can somoane tell me how i can get access to my social media accounts without password. Pls i need help

?

[rapid merlin]

click forgotten password and go through the procedure

[loud marlin]

nop.

[sturdy pike]

hidden achievement: Nom Nom Nom Unlocked!

[sinful moon]

Contact the actual company who is hosting these servers and go though the account recovery process as anyone would normally

[rapid merlin]

Little do they know, they’ll only get the salt

[vague herald]

Nah, ive tried all these

[sturdy pike]

Are you going to cry?

[loud marlin]

try harder

[rapid merlin]

No but they will

😂

[vague herald]

Ive called the companies. Also tried everything

[sinful moon]

Then any other means will not be something we can help you with

[vague herald]

Nothing works

[rapid merlin]

I’m not nice to randoms rolling up into my DMs

[sturdy pike]

Tears of Joy!

[loud marlin]

like. they wont help or what ?

[rapid merlin]

then contact the social media team and see what they say, if they can't help then its a lost cause because you wont find help here on how to brute force into an account (which is almost impossible anyway)

[sturdy pike]

I'll jump in your DM, have a cookie 🍪 /s

[rapid merlin]

Unfortunately that’s the only way, either password recovery or to message support

[sturdy pike]

Not impossible if you know the password.

[rapid merlin]

Touché

[sinful moon]

That doesn’t account for MFA

anyways

[sturdy pike]

Who said the password for the social media account itself?

[rapid merlin]

thats why in todays day and age you use a password manager 😛

[sinful moon]

we are not supposed to assist with these

[loud marlin]

i guss i need mode deep dive into luks backup/restore and so things after this crap...

[rapid merlin]

Or a book

[vague herald]

Wait. And how, should i dm the insta help?

[rapid merlin]

easier to get into a book vs a password manager ;P

[sinful moon]

OMG yes just contact Instragram via whatever means you have lol

If you can’t recover your account via normal means, then yes contact support

[rapid merlin]

Yeah password managers can be hacked and if they’re in a system they can be corrupted. Just keep a book

[sinful moon]

um password managers (not bs browser ones) are all encrypted so…

that foils most password stealer malware

[rapid merlin]

https://tenor.com/view/doki-doki-precure-hishikawa-rikka-reading-starry-eyes-anime-gif-20995817

[loud marlin]

btw eliz does have LVM can affect luks. just no idea what elese can be 🙂

[rapid merlin]

Me looking for the right password

[sinful moon]

a book is not encrypted but yeah different attack vectors lol

[rapid merlin]

You can also be redirected to malicious copy pages so I don’t trust it

[sturdy pike]

I keep the password to my idle games in a salted hash written in a book which is kept in a safe in a bunker who's location is unknown.

[rapid merlin]

I don’t trust computers

😅

maybe thats why they're in your dm's trying to social engineer into your password book haha

[sinful moon]

Yes LVM and LUKS often go hand in hand

it’s not common for them not to be paired

[loud marlin]

fair

[sturdy pike]

My uni provides us with a 30% discount on CCNA

[sinful moon]

anyways just use a password managers, ya dinguses

Bitwarden is my personal fave for personal use and pretty decent for professional

[rapid merlin]

+1

[sturdy pike]

Yes

[rapid merlin]

If they can read my handwriting then touche

[sinful moon]

that’s a lot of emoji lol

but yeah we are a Bitwarden partner at work because of me

[sturdy pike]

I'm agreeing with you to the core

[sturdy pike]

Whaaaa..

[sinful moon]

what part of that is suprising, Bitwarden has Enterprise licenses

[rapid merlin]

they use 1password where I am but I'm a sucker for bitwarden been using it for years

[sinful moon]

Yeah 1Password is also pretty solid

Not as familiar but yeah has a nice UI

[sturdy pike]

Well the fact that I don't research a lot so I didn't know, thanks for the info tho! I'll get Bitwarden too for whatever company I go in

[twin ridge]

Gave +1 Rep to @sinful moon (current: #32 - 291)

[sinful moon]

Yep no problem, it is great. If you do resell Bitwarden as part of your org, each user gets 5 free Family licenses each

[rapid merlin]

My brain rn is stuck on putting windows defender on a eks cluster running bottlerocket but it seems IMPOSSIBLE

[sturdy pike]

Whaaaa... that's really cool, I'll have them go for it, only problem is, where should I work now.

[sinful moon]

lol fair enough

[sturdy pike]

https://tenor.com/view/kingsman-gun-statesman-fight-spy-gif-18252686

Hey man
Hey-
Hey Man!

[sinful moon]

Um maybe something a bit more k8s friendly? I don’t have direct experience beyond fiddling with k8s, but many EDRs I’ve used have k8s clients. Is this for personal or business?

So I guess MS wise do you mean Defender or Defender for Endpoint, not that I’m able to help much there beyond clarify

[rapid merlin]

defender for servers

[sturdy pike]

I'm gonna shut off my laptop as I'm done for now, nice talk guys! See ya later

As you can see, I need a coffee

[sinful moon]

okay so proper enterpise grade, you should be all set? But yeah good luck with the MS docs indeed

[rapid merlin]

but I'm looking for alternatives, guardduty is the closest I've got but don't cover as much as defender for servers

[sinful moon]

SentinelOne and other EDR solutions do have K8s agents, but if your org is commited to Defender then I’m not sure you can really change that

[rapid merlin]

it's where my heads been burried for the last 12 hours, needed a break and jumped in here to see whats happening

[sinful moon]

totally fair

[rapid merlin]

Not my ORG unfortunately, a customer of ours so we don't have access to their infastructure just have to advise them and create docs ect so they can get online with the cover they need

[sinful moon]

oh weird, fair enough

[rapid merlin]

anyway best get back too it, have a good day 😛

[sinful moon]

Sounds good, you too and good luck!

oh hey, my random chatting for 6 hours is over. I can access my silly MMO again after scheduled maintaince. I’ll be around but less active lol

[loud marlin]

fresh arch is back lol

[tepid citrus]

In a realworld scenario, what’s the best way to safely transfer a suspicious binary from an employee’s workstation to a sandbox for analysis? Let’s assume I have a REMnux setup either in the cloud or on-prem.

[sinful moon]

compress it with the password infected

do of the rest what you will file transfer infrastructure wise, you kinda solved the main issue. Just whatever is most segmented

USB would obviously not be ideal even if anything extra wouldn’t execute on Linux, but as far as I know many shops which have dedicated machines for analysis also have forensic USB analysis devices, in which case that would actually be rad and more helpful if the malware did try to write to the USB besides your compressed file

you’d just get extra IOCs for free

But yeah even with the Windows to Linux divide, I wouldn’t risk it without a USB forensic imaging device

[rapid merlin]

idk if its just on my side but im doing a room in tryhackme and the whole page is just flickering with artifacts, only does it on tryhackme

[sinful moon]

What browser, which OS and what GPU?

[quaint falcon]

hi yall newcomer here

[rapid merlin]

firefox windows 10 rtx 3060

[sinful moon]

Completely normal then, it is just you lol. But does it persist after completely closing out of your browser session to the point task manger confirms there’s no more Firefox?

And eh starting it again obviously

[rapid merlin]

no its onlt when tryhackme is open

[sinful moon]

Is it in any THM page or only when the AttackBox/split view is open?

[rapid merlin]

yeah it sin any page, without opening any split view or attackbox

im gonna try a different browser

[sinful moon]

Alright I’d recommend messaging this issue (with the context you gave me) in #site-support. THM more than works normally in Windows with Nvidia and more so no reason why you should be having issues beyond an extreme edge case

Different browser may help but don’t let that make you give up on the lovely Firefox

I hate to say it though but beyond extreme edge cases this may be an issue specific to you

[shy lion]

Fox is amazing

[rapid merlin]

yeah thought so too, im on brave now and its not doing it anymore

still love firefox

[sinful moon]

Brave is Blink based, aka Chrome so yeah different rendering engine

If you do post on site support, do update your graphics drivers before someone else asks you to

[rapid merlin]

will do

[sinful moon]

Make sure you’re using the ones from the Nvidia site vs just Windows Update

[rapid merlin]

thank you

[twin ridge]

Gave +1 Rep to @sinful moon (current: #32 - 292)

[boreal scarab]

It was thee

[cosmic pendant]

GM THM

Berries

[grizzled void]

[loud marlin]

@boreal scarab guess who had to re install arch. my LUKS decide to not work for no reason at all. =/

[sinful moon]

Brave little toaster has a scarf

cute

[boreal scarab]

Fuuuuuuuuuuuuuu

[sinful moon]

still never seen that movie lol

(just incidentally thinking about toaster things lol)

[loud marlin]

i try live boot ubuntu, cryptsetup open, nothing

[sinful moon]

Yeah unfortunately I only had very limited experience there, but I’m not sure what you could have done to recover anyways. Really wild

[loud marlin]

just weird heh

[sinful moon]

Yeah I’ve only gone as far to trust it about twice thus far. I’m still kind of new to using LVM its self, mostly thanks to my homelab now being back to Proxmox

[loud marlin]

lol. now all alert login on email 🙂

firefox, bitwarden, ...

[sinful moon]

no LUKS on that obvs, but I never really had a reason for LVM until spanning hardware RAID setup and more

[river linden]

can anyone help me what to do here, i cant see contents inside the access.log...it is saying permission denied (in linux fundamentals part 3 task 8)

[fringe nacelle]

have you tried sudo

[river linden]

is that correct..??😑

[river linden]

can you tell me how

[fringe nacelle]

just add sudo infront of your command

sudo cat /var/log/apache2/access.log

[sinful moon]

Great article: https://icode4.coffee/?p=1047

lol sorry to interrupt

[tepid citrus]

Let’s say I have a dedicated machine and I do rtr into the compromise system with the file… How do I get the file to the dedicated machine since I don’t have physical access to the computer

[rapid merlin]

What is the shared hard drives setting for on a router ?

[river linden]

it is asking paswword and i tried tryhackme..now its showing incident will be reported🥲

[sinful moon]

Some routers san expose drives as network shares usually via Samba/SMB

[fringe nacelle]

might be best to ask in the room or module chat. Does anyone know the # for it?

[sinful moon]

Which RTR do you mean in this context? I see some information about RAM dumps and etc. Just curious about that before proceeding

[river linden]

okay and thanks for the reply

[twin ridge]

Gave +1 Rep to @fringe nacelle (current: #422 - 14)

[sinful moon]

This incident has been reported and now the sysadmins know!

lol but yeah that’s the standard message and it just logs to a file. There’s some handy apps Linux admins use which does easily expose that info but it’s not common and no one cares obviously on THM rooms lol.

logwatch is one I quite enjoy, here’s an article about it: https://wiki.archlinux.org/title/Logwatch

[brazen siren]

have you tried using less instead of cat?

[rapid merlin]

It keeps turning back on at this address so… I’m trying to figure what uses it has

Access to network courses are everywhere, are there any on routers ?

[brazen siren]

also the room support is #room-help

[rapid merlin]

Understanding the different tabs eg

[sinful moon]

I’m not sure what you mean by that lol

[sinful moon]

I hate to be so obvious but it’s called the user’s manual c:

[river linden]

i dont about less..but i tried still it is saying permission denied

[sinful moon]

#room-help would be the best venue for this c:

as said above lol

[rapid merlin]

I’m at one of the addresses I live at. On the router there is an option for hard drives sharing and printer to printer sharing. I keep disabling them but they keep turning back on in the router.

[sinful moon]

lol I thought you meant a local IP or something

[rapid merlin]

No physical addressing

[mellow narwhal]

I would try leveraging SUID permissions to read the file

oops, if its room help go to #room-help

[sinful moon]

Anyways I have no idea of what your router’s settings for this kind of sharing refer to if they have like no UI or info. I’d just check the manual tbh

because don’t make me share my beautiful Unifi UI again because that is lovely c:

[tepid citrus]

Terminal session. It’s a way to respond to a compromised endpoint via the terminal

[brazen siren]

About to echo what @sinful moon is saying, what router do you have? Curious if there's a possibility to find this info in the manufacturers manual.

[rapid merlin]

For maximum security on networks, what would you recommend I have when it comes to physical security. Also I wanna see your unifi ui ☺️

[jagged yarrow]

Anyone notice anything new on THM

[sinful bobcat]

YES

[brazen siren]

Yup

[mellow gull]

Indeed

[sinful bobcat]

What's the thing for the first 100th persons ?

[rapid merlin]

Just a standard one, I’ve already tried to convince her to get an upgrade but she refuses 😒

Basically her moto is, if it doesn’t affect her it’s not her business

[sinful moon]

As I said previously, the more segmented from your machine as you can make it, the better ideally. I wouldn’t normally suggest a program on the compromised computer but after compressing the malware in a file with the password infected you could use wormhole to transfer the file potentially: https://github.com/magic-wormhole/magic-wormhole

[rapid merlin]

What’s happened

[jagged yarrow]

The first 100 people to pass get a mystery gift (package sent to you - more details coming soon...)

[jagged yarrow]

Go to THM and see!

[sinful bobcat]

[rapid merlin]

Okay I’m on my way 🏃‍♀️

[sinful bobcat]

Damn

I was curious, now you have my attention

[rustic plinth]

Hey all, quick question. I have completed the Complete beginners track, would it be a good idea to do the Cyber Security 101 aswell?

[sinful moon]

alas, too busy with work to ever win any of those lol. Not that I’m all too worried

[mellow narwhal]

I got it!!

Or rather, I got whats new

[sinful moon]

Sure why not, I believe there’s an even more clear path on the THM website that shows the suggested progression

[manic cedar]

Is there a way we can download from attackbox to our main system

[sinful bobcat]

Not that I know of

[rustic plinth]

i completed the pre-sec and the complete beginners before the 101 was released and this is next on the learning track so might aswell

[rapid merlin]

Ohh I’ve just seen the defence cert too

[sinful moon]

Not without an internet connection. That’s why many move on to using local or remote VMs as a solution instead, then you can just host updog in a directory real quick for easy file stuff

[manic cedar]

I use Kali as main os and there is high latency in attack box

[sinful bobcat]

Not even 300 euro is tempting me

[sinful moon]

Sure, depends on where you’re at in your learning as well, but honestly if you’re anything like me, you kinda just want to have those completion circles filled in anyways lol

sometimes is just fun to breeze through easy lessons

[jagged yarrow]

Great value! We want SAL1 to be affordable and accessible.

[rapid merlin]

That’s nice is it a certificate or a certification

[mellow narwhal]

I heavily appreciate your INR price

[jagged yarrow]

We spoke to users about this - you can see how it all come to be here: https://tryhackme.com/resources/blog/creating-sal1