general

[twin ridge]

Gave +1 Rep to @carmine tinsel (current: #666 - 8)

[carmine tinsel]

For challenge rooms, light involves simple sql injection and SQHell involves hair tearing sql injection

[whole gazelle]

w8 wha'ts "hair tearing sql injection" never heard of it

[carmine tinsel]

No I mean like sqli that makes me wanna tear my hair out

I swear I didn’t invent a new type of sqli lol

I got like 2/5 flags before I started raging, will come back to it this week tho

[static acorn]

🍪

hi cooooki

[whole gazelle]

okay mb mb

lmao

[rapid merlin]

Morning

[upper knoll]

Sqlimap

Super useful

Same with nosql map

[carmine tinsel]

lol yes I should probably do the sqlmap room instead of trying to do things manual

I just wanna fully understand the logic of how they work yk

[upper knoll]

No that’s a tool

And payload all the things has a great chat sheet

[carmine tinsel]

I see, gotta look at it

[upper knoll]

It will help a lot

It explains things too

[carmine tinsel]

I’m a portswigger cheat sheet user already so it will be a good addition 🙂

[upper knoll]

I love payload all the things

[jolly iron]

Hello is there a room for FUFF?

[cloud quiver]

There is 🙂
https://tryhackme.com/room/ffuf

[jolly iron]

Thank you

[twin ridge]

Gave +1 Rep to @cloud quiver (current: #1 - 3678)

[sturdy pike]

KGB is cookie color, nice!

[sinful bobcat]

Yooo fr

I just noticed

[sturdy pike]

[cloud quiver]

🍪 🙂

[whole gazelle]

cookie eaters!

[rapid merlin]

PHPSESSID=cookieeaters

[sinful bobcat]

Nah man fr congrats for the new role, and the color is looking good

[tardy finch]

A group of us are working to pass our pnpt. If you would like to join us. Dm me

[cloud quiver]

Thank you 🙂

[twin ridge]

Gave +1 Rep to @sinful bobcat (current: #492 - 12)

[sick lance]

Everybody uses cheat sheet, that's why we have 'em.

Can't be expected to remember everything.

[sturdy pike]

Yayyyy, congratulations KGB! That's really impressive

[sturdy pike]

Yessss!!!

[sturdy pike]

Yo Steammmmmm

[slate wing]

You sure it is good enough? I also want it for my small buisesses

And personal storage also

Practicing cybersec and system administratation too

[sick lance]

@chilly veldt You getting Sal1 via BTL1?

[chilly veldt]

Should be plenty, if you're not making proper money on it, a server server is way too expensive in power usage and makes too much noise tbh

[chilly veldt]

Possibly, haven't reached out yet

[slate wing]

will it be exactly like a server?

Also did u manage a server before?

[cloud quiver]

Thank you 🙂

[twin ridge]

Gave +1 Rep to @sturdy pike (current: #117 - 68)

[slate wing]

I think it is great idea if I wanted to practice but I also want it for buisness like hosting my site instead of paying a hosting company, making my own mail server, file share server ect

So maybe one with no noise will be great

[sick lance]

Waiting on SecOnion installing is pain.

I need to find a ready made image.

[chilly veldt]

I work as an infrastructure engineer, I manage servers daily 😅

[chilly veldt]

You can do that with an old desktop as well, you can install a hypervisor on it too, just make sure to get extra harddisks, an old desktop doesn't use as much power, which also has a more silent psu/cooling

[rapid merlin]

Feeling so lazy but I gotta clean up, I’m out of energy

Need elixir

[sturdy pike]

Metasploit machine in task 6 is just for listening? Do I need to start attackbox for it?

[silver sky]

The trader sells energy elixirs. Go see your local trader

[sturdy pike]

Meatexploit is hard

[sturdy pike]

Heya!

[silver sky]

Hello!

[sturdy pike]

How are you?

[gray sonnet]

Hex! Hai :D

[rapid merlin]

Those elixers are too strong for me wee heart

I’ll start body popping

No fr though I can’t drink them anymore.

Ironically my mum would moan a lot about them and then one day I had one and thought I was having a heart attack.

[silver sky]

Have you tried the bean brewing method?

[sturdy pike]

References going over my head, I'll just eat a cookie and black coffee instead.

[compact mango]

Good morning

[sturdy pike]

Good morning

Hey hey! I understand it now, metasploit is actually easy!

[rapid merlin]

Yeah makes me feel kinda on edge

You know I used to drink coffee all day and it had no effect but now I can’t even have a sip

[wet marlin]

new day new me

[wet marlin]

welcome to powershell-empire '

[upper knoll]

Matcha is my fuel!

[wooden totem]

Matcha people don't exist

Same with mint ice cream

[stone basin]

I feel like Matcha is more about the experience then the drink itself.

[rapid merlin]

hello everyone

[stone basin]

hey

[dreamy forge]

hi guys

[broken horizon]

you're learning metasploit now?

[upper knoll]

I actually do like mint ice cream

[shut hawk]

hi sigma lord

[wooden totem]

That confirms that you aren't real

[upper knoll]

Mb I guess I’m a bot

[silver sky]

Beep boop

[upper knoll]

Boop beep?

[silver sky]

Bot confirmed

[upper knoll]

[sturdy pike]

I do thm along with portswigger, want to do CPTS but i think I'll do Sec+ first, THM plus HTB academy will just get overwhelming

[wooden totem]

You would probably like the taste of metal shavings as well

[upper knoll]

I really do not

I go out of my way not to eat metal

I do love Asian cuisine

[silver sky]

That is what a bot would say

A LLM

[sturdy pike]

Agree

[upper knoll]

I’ve been programmed to weeb

[shut hawk]

[wooden totem]

I clearly hit a defense mechanism of the bot and now it redirected itself to appear more normal by mentioning asian cuisine

[sturdy pike]

https://tenor.com/view/ichigo-bleach-hollow-shinigami-gif-22298807

[upper knoll]

Second anime I ever watched

[sturdy pike]

Same lol

My first was Parasyte the Maxim

[upper knoll]

Mine was Naruto

[shut hawk]

ive only watched 1 anime, guess which one?

[sturdy pike]

One piece?

[shut hawk]

nope

[whole gazelle]

pokemon!

or naruto

[dark mason]

Hi chat

[upper knoll]

Wassup

[dark mason]

How is everyone?

[sturdy pike]

I couldn't watch it, left it on S3, it got boring

[whole gazelle]

heyloooo!

[dark mason]

Hi hi, hru

[sturdy pike]

But then I was told to skip fillers

[upper knoll]

Yer it was a lot

[shut hawk]

oh actully make that 2. i loved watching pokemon as a kid

[broken horizon]

yeah ur doing well , don't worry about it

[sturdy pike]

Thief! Catch him!

[upper knoll]

Pokemon was great

[shut hawk]

the other was jojos bizzare adventures

[dark mason]

Shit

https://tenor.com/view/let-me-borrow-gif-5425271752307681658

[whole gazelle]

AYEEEEE pokemon for the win!!!

[broken horizon]

its easy and u can do it later whole CPTS

[sturdy pike]

I'll pick it up later One piece was my 17th anime

And the latest I watched

[whole gazelle]

i'm goood af thanks for asking homie!

[twin ridge]

Gave +1 Rep to @dark mason (current: #365 - 17)

[upper knoll]

One piece was too much for me

[sturdy pike]

https://tenor.com/view/thanks-guys-i-got-it-from-here-brooklyn-nine-n-ine-cops-arrest-steal-gif-13813254

[upper knoll]

Watched a lot of fairy tail

After that I was burnt out for long anime’s

[wooden totem]

have you ever tried matcha tea/drink or mint chocolate chip ice cream?

[sturdy pike]

Thanks!

[twin ridge]

Gave +1 Rep to @broken horizon (current: #1772 - 2)

[dark mason]

When I get home I will do my math homework and start learning steganography

[sturdy pike]

CPTS is easy? I was told its equivalent to OSCP

[dark mason]

@whole gazelle may I ask you something?

[dark mason]

Nope

I don't like ice cream that much

[wooden totem]

good for you, you're not missing out

[whole gazelle]

sure go ahead!

[dark mason]

Do you know binary exploitation? (Pwn)

[sturdy pike]

I just don't get much time for now and as one piece is on a break along with bleach, I'll watch others after finishing them

[whole gazelle]

i don't tbh, that's thing on my todo list for this year

[dark mason]

Ah, alr

I wanna know if it is possible to learn the basics in 2 weeks

[whole gazelle]

sounds doable imo

[dark mason]

I am think I am going to skip crypto and pwn this year

[whole gazelle]

so what u gonna do instead?

[tawdry blade]

How can i ask to change my email on THM support

The bot doesn't give me the option.

[silver sky]

THM support?

[tawdry blade]

@sick lance Do you know how i can do it

[silver sky]

You mean on your account?

[tawdry blade]

Yeah

Yep

On my THM account

I cannot change it

[sick lance]

Are you google

[tawdry blade]

gmail.com

I want to change it to outlook

[upper minnow]

Cant you just change it

[tawdry blade]

No

[silver sky]

You should be able to change it via your profile

[tawdry blade]

It doesn't want to

[upper minnow]

I remember it being pretty easy to change

[tawdry blade]

I can't

The box is gre

grey

[silver sky]

Email support then

[sharp citrus]

TryHackMe's Email

TryHackMe's support email address.

​

[e-mail]

TryHackMe Socials · Mar 4, 2025, 12:39 PM

[tawdry blade]

Thanks

@silver sky

See?

[silver sky]

Not really, I dunno what it normally looks like

[sick lance]

Ah, because of how you created you THM account, you can't change it, I don't even know if support can do it.

[tawdry blade]

I create it with an email

[sick lance]

Google SSO is different from a normal account creation.

[tawdry blade]

I don't remember

[silver sky]

Ahhhhhh

[tawdry blade]

Naa

I didn't create my account with GOOGLE SSO

[sick lance]

Then what you've been told, doesn't change.

You'll need to contact support.

[near sapphire]

i asked support, they confirmed that even they are unable to change it for that case

but feel free to try, maybe something changed since I last asked

[rapid merlin]

Hey guys im close to completing pre security now and im heading onto cyber security 101 and I was just wondering after that what's the best thing to get into I like protecting stuff and systems and want to work for the government doing that stuff but I also like messing with things and bypassing and breaking it aswell what would be best

[cloud quiver]

Maybe soc1 and 2

[rapid merlin]

Do they have a bit of both

[cloud quiver]

They're focused on defense 🙂

[rapid merlin]

Anything with a bit of both?

What do you recommend is best to get into

[cloud quiver]

Then try to do a bit of jr.pentester path also 🙂

[desert shuttle]

KGB the goat

[main meadow]

i wanna try a new web browser... Arc or Zen ?

[polar holly]

Was trying to attack a sandbox system and currently falling short. It's behind a red-Node and nothing I've tried worked so far. I found various pages linked to the main IP page.

[queen flare]

what's the room tester role?

[sick lance]

Community members who help test out the rooms after they reach UAT stage.

[queen flare]

uat?

[sick lance]

User Acceptance Testing.

This is the final phase of THM's QA department.

[queen flare]

now what is qa department

[shut hawk]

i like arc

[sick lance]

The Quality Assurance departmed of TryHackMe, in which timtaylor is the manager of.

[shut hawk]

✨ quality assurance ✨

[sick lance]

What do you mean by this?

[shut hawk]

qa is to ensure it meets standards, stars are usually good standards

[silver sky]

https://tenor.com/view/creed-the-office-quabity-gif-25033401

[rapid merlin]

What do you guys do

[slate wing]

Oh wow okie, I will do reaserch or that ty for so much for the idea!

[twin ridge]

Gave +1 Rep to @chilly veldt (current: #8 - 967)

[rapid merlin]

I don't even know what to learn

[blissful snow]

hi

[blissful snow]

I made a road map to follow

[rapid merlin]

What do you do tho

[blissful snow]

I mostly do web hacking

I also practice or things

[rapid merlin]

You got a job?

[rapid merlin]

What thm stuff have you done

[blissful snow]

idk

mostly web

[rapid merlin]

Oh

You got a job?

[blissful snow]

not yet to young

[main tiger]

Best review so far on SAL1, not biased but neutral: https://www.youtube.com/watch?v=bo1jRcLdUpY

[lone thistle]

👋 hello thm

hope we're all having a great day so far

[blissful snow]

should ruins 60% of my dad

day*

[lone thistle]

we can all but try right 😄

[oblique furnace]

Day 32

[near sapphire]

hey ben

[near sapphire]

took a break from hacking and went coding instead today

[chilly veldt]

you're welcome

[lone thistle]

nice nice 🙌 breaks are always good

[cold veldt]

what was your first learning path in port swigger?

[near sapphire]

got burnt out cause i've been grinding on a ctf challenge for 8 days non stop

[blissful snow]

what are yuo coding

[near sapphire]

a eccomerce simulation

nothing fancy really just basic oop

[pliant onyx]

I cast: unconserves your angular momentum

https://tenor.com/view/physics-ia-physics-innovation-academy-ap-physics-conservation-of-momentum-gif-14015438521599767977

[blissful snow]

ooh

[oblique furnace]

sql injection
id probably recommend server side vulnerabilities tho

[whole gazelle]

yo u rockin kali as your main os?

respect

[hollow nebula]

anyone know where windows ISO's could be found for use as a lab? evaluation copies are fine. i got the windows server iso running but can't get a user station running

[dark frost]

https://cdn.discordapp.com/emojis/1328688384310251520.gif?quality=lossless&name=wave&size=48

[oblique furnace]

i quadboot my system

arch+kali+win11+sequoia

thinkpad t480 my beloved

500gb for each os

[dark frost]

Anyone know about IBM ? And the Cobol programming ?

[blissful snow]

D:

[sick lance]

COBOL, wow that takes me back.

[sick lance]

Are you a student?

[dark frost]

You know cobol 👀?

What takes you back ? You in the twenties , you talk like an old man

[oblique furnace]

y are u sad

[pliant onyx]

Chat can yall review my small code

[blissful snow]

I'm not sad im just suprised

[pliant onyx]

public class Rough                        {
public static void main(String[] args)    {
System.out.println("Hello, World!")       ;
                                          }
                                          }

[sick lance]

Am I?

[blissful snow]

why "," in hello world

[whole gazelle]

that's the most cursed java i have ever seen

[pliant onyx]

That's the sweetest thing anyone has ever said to me

[whole gazelle]

yoo this is sick!

[pliant onyx]

That used to be my ideal config dream

[dark frost]

Learning java i see

[whole gazelle]

sorry to hear that

[pliant onyx]

Why not

[pliant onyx]

Am I doing a good job

A friend was also learning

His logic is incorrect though

[dark frost]

Good start

[whole gazelle]

that's some gui driven development

[dark frost]

https://cdn.discordapp.com/emojis/1195849123606298634.gif?size=48&animated=true&name=OMEGADANCEBUTFAST

[blissful snow]

the school wifi is so laggy today 😭

[dark frost]

Someone hacking

[blissful snow]

?

nah I think the band width is just horrible

[polar wraith]

hi

[dark frost]

https://cdn.discordapp.com/attachments/227912785290330113/1298265337938055188/togif-12.gif

[polar wraith]

how do i change my email on tryhackme

[rapid merlin]

I guess through support

[silver sky]

On the website on your profile.

Unless you've used SSO

[polar wraith]

havent used sso

cant change it tho

[tribal lion]

hello guys

for somereason i can't access ssh while solving a machine

i tried multiple vpn files but it didn't work

[polar wraith]

what does it show

[tribal lion]

ssh just doesn't reach

[polar wraith]

also go #room-help

[tribal lion]

got it

[oblique furnace]

are u on the vpn?

[tribal lion]

i am

[cursive crag]

this is the first meme i. seen today and i like lmfao

[pseudo egret]

use ping command to see if you are connected with the machine

[tribal lion]

i did

[pseudo egret]

what did it show ?

[tribal lion]

its just like a udp connection thus ssh dont connect

[tribal lion]

its pinging

[pseudo egret]

is the ssh port open on the target ?

[tribal lion]

yea it is

it was working yaster day

im super confused why it is not working

[polar wraith]

does it show port unreachable?

[tribal lion]

it shows that something is unreachable in the vpn connection
lemme check

[lime belfry]

just to make sure I understand right When I but the SAL1 cert it doesn't come with premium or training I have to but it separately right?

[pseudo egret]

didnt get you

[polar wraith]

u get premium with it

[lime belfry]

ok that is amazing thanks

[twin ridge]

Gave +1 Rep to @polar wraith (current: #277 - 25)

[pseudo egret]

check the machine have ran out of time

[hollow nebula]

i mean aren't we all students in this school called life? - no not a student. transitioning into a new career field

[tribal lion]

sorry my network connection lagged

any way it says this
2025-03-04 09:28:42 read UDPv4 [ENETUNREACH]: Network is unreachable (fd=3,code=101)

[polar wraith]

thats an openvpn problem

[tribal lion]

it is up

[tribal lion]

how to solve it then

[polar wraith]

use tcp

[tribal lion]

ok how 😅

what i do is downlaoding the vpn file and open it using openvpn

@polar wraith

[polar wraith]

open the ovpn file

in a text editor

what do u see next to "proto"?

[tribal lion]

tried it

but the vpn didn't work

[polar wraith]

i mean

open the vpn file

using a text editor

[tribal lion]

i did
i changed it to proto tcp is this what do you mean

[polar wraith]

nano <name>.ovpn

ah ok

didnt work?

[tribal lion]

no

[polar wraith]

idk then

whenevr ive ssh issues i switch to tcp

[rugged marsh]

hello im having trouble adding my write up to a box:
tittle==>ColddBox-Easy THM Write-Up
link==>https://medium.com/@collinsswah/colddbox-easy-thm-write-up-873a40180554

why do i get an invalid URL error

[tribal lion]

thx

[polar wraith]

starts workin ¯_(ツ)_/¯

[tribal lion]

i will try again may it works this time

[cedar shuttle]

Telnet ☝🏼

[tribal lion]

HTB is better they make a file for each protocol

[cedar shuttle]

WHAT IS TLS RAAAHHHH 🦅 🦅 🇺🇸

[sick lance]

Are you an academic student.

[blissful snow]

traider

[hollow nebula]

no. not a student.

[sick lance]

Ah, I was to say to can get them from Azure.

[sick lance]

It's the @ the box doesn't like it.

[sick lance]

THM VPN?

[hollow nebula]

yeah i thought of that but can't. ive been using boxes from thm or thm but i was trying to make an offline

even if i could get some old windows boxes from vulnhub but havent been able to find anything that wasn't zany

[sick lance]

Yeah, I'd imaghine they were all custom made.

you could try creating an Azure account, you may be able to download them from there, If not I'm sure Microsoft give 180 evaluation licenses.

[pseudo egret]

what is this evaluvation licenses ?

[sick lance]

A fancy way of saying trial.

[hollow nebula]

that's worth a try. i was even trying to follow the john hammond AD videos just to gain basic keyboard skills for normal AD activity - and all the set up is now not working via windows evaluation vms

[cedar shuttle]

Last I think it was 2 weeks free, but I’m not sure if they changed it

[sick lance]

Virtualiztion?

Which hypervisor?

[hollow nebula]

i mainly use oracle but i'm ambidextrous

[sick lance]

And in what way are they not working?

Fuck off Vbox

[hollow nebula]

Like i was just getting a hanging black screen after a successful install and reboot of my system. why did the change the logo? it look's like a new jersey surf brand now

[hollow nebula]

i didn't think it would've made that much of a difference - maybe i''d do the whole thing again in vmware

[sick lance]

Vbox, sounds like there isn't enough resources assigned.

Vmware is better

[hollow nebula]

"If you fail to activate this evaluation after installation, or if your evaluation period expires, the desktop background will turn black" is on the evaluation page - but i never had a chance to even activate it. so who knows. i'll do the whole thing again in vmware. i just wanna get the skills to pay the bills , and the lord is put obstacles infront of his toughest soldier

[sick lance]

Oh, that's just WIndows being WIndows, you need to get a key.

[hollow nebula]

yeah but i didnt even get to a place to fill in the key

[grizzled wing]

@sick lance got a silly question, i think i already know the answer , but, doing the SOC 1 & 2 is best way to prepare for this SAL 1 ?

[sick lance]

Yeah. 🙂

[grizzled wing]

okay, cool 🫘

[sick lance]

https://tryhackme.com/certification/security-analyst-level-1/details

Recommended learning tab.

[grizzled wing]

good to know

[pseudo egret]

guys ever heard of athena os ??

[hollow nebula]

zues...athena..i'm sensing a theme

[obtuse star]

Hello, i just joined this great community. my name is ijego and i am a cyber security Analyst. I am excited to be part of this great community

[pseudo egret]

there is a os named athena for pentesting

[main meadow]

yes there is apparently, but its lightweight and has not much stuff preinstalled

[red idol]

Did anyone-by any chance- take the CI/CD security? Did that lab work for you at all?

[dark mason]

Hello everyone

[rapid merlin]

Hello there

[pseudo egret]

i am going to use my daughters os for pentesting 😂

[rugged kayak]

@sick lance you have many vms, how do i optimize windows vm a bit

do you debloat them

or how do you set windows vms up in general

[sick lance]

Just set them up normally,

What do you mean optimise?

[lethal pike]

Can someone help me with something that is not exactly legal?

[upper knoll]

@sick lance @mossy river

[mossy river]

No, that would be against our community #rules.

[rugged kayak]

well i am bit scarce with resources, do you idk run some debloating scripts or something like that

[lethal pike]

I understand, I didn't know that, thank you

[twin ridge]

Gave +1 Rep to @mossy river (current: #6 - 1511)

[grizzled wing]

so anyone that goes to the SAL 1 link will get a email saying "we've noticed you've been exploring the SAL1 certification;"
very fun

[polar wraith]

is there no rule against minimoddign anymore?

[sturdy pike]

Meterpreter

This metasploit hell is neverending

[jolly iron]

Hello

[rough wagon]

hello ladies and gentlemen and just wonderful people! I hope you all doing well!

[shut hawk]

ayo tf is that new logo

💀

[main tiger]

when u update it yeah. I have not updated by vbox in ages

[hoary pasture]

https://tenor.com/view/first-time-meme-first-time-the-ballad-of-buster-scruggs-gif-24656975

[mystic stone]

is the platform ok? it says my credentials are invalid even though i logged in a couple minutes ago

[wooden totem]

logged in just fine

[sturdy pike]

Helloooo

[cedar shuttle]

Had it this morning, 5th attempt worked for some reason

[sturdy pike]

Should I take notes for meterpreter?

I don't wanna

[sand trench]

https://ericmigi.com/blog/february-shenzhen-trip-update

YAY YAY YAY

[hollow nebula]

have you noticed it's starting to take the shape of that vmare X?

i'm having a hell of time doing this. ill be ready for nmapping by midnight. just had the second blackout of electricty of the day

[sand trench]

Wallpaper of the day:

[hollow nebula]

soon as i get back to the US, i'll turn my rasppi into a windows box and attack that. that'll show'em

[blazing granite]

so don't 😂

[proud needle]

kinda off topic but do yall use windows or linux?

[shut hawk]

🪟

[blazing granite]

Linux all the way

[sturdy pike]

But it'll help my future self

so I will

[blazing granite]

so do 😂

[pliant onyx]

One great thing about meterpreter (among many others) is the post exploit module

There's a post exploit vulnerability scanner that I often use

[unkempt breach]

both 😎

[rugged kayak]

this looks lovely, what resolution is this

[sturdy pike]

copypasta! last pasta!

[blazing granite]

I did dual boot for a while then I realise that I hadn't booted in windows for 10 month so it was a waste of space 😂

[wooden totem]

Wait hold on, I gotta check something
How many hours do yall sleep without an alarm?

[hollow nebula]

nice try diddy

[blazing granite]

depends on the day, sometimes I wake up before the alarm, sometimes I hit the snooze a few times

[shut hawk]

I don't sleep with an alarm, i just let myself wake up whenever

[hollow nebula]

you guys ever seen any labs or vm's based on IT/OT systems ? or specifically medical field stuff which i guess is like It/OT/and iotot?

[wooden totem]

how many hours tho

[shut hawk]

~9/10 hours

[wooden totem]

interesting

[cosmic pendant]

No

2 big reasons, alot of it is hardware, and licensing

They don't want people looking at, REing or testing their stuff

[hollow nebula]

i mean i guess alot of it could be mimick'ed with conpots and a couple windows boxes..pfsense, etc

[silver sky]

That must be nice

[blazing granite]

I don't use alarms on weekends and bank holiday, but yet again it depends on the day, some weekend I wake up at the same time of the alarm, some times earlier, and some time way after, my body is kind of crazy like me 😂

[shut hawk]

haha uni life rn

[cosmic pendant]

not really, because the details that you want to test are in the actual implementation

That's like saying finding a flaw in a cisco router, works on junipers almost

[weak flume]

will barrow this

[hollow nebula]

you mean like specific communication with name brand plcs?

[cosmic pendant]

Yeah that's a good example

[naive violet]

There's some DICOM software you can play with, I haven't seen much other stuff tho.
Not prebuilt VMs but some foss software to poke at

[cosmic pendant]

I have a raspberry pi that's a traffic signal

[naive violet]

Some of the OT stuff is architecture at least

[hollow nebula]

ah i was thinking more big picture baby steps. modbus coms, mitm fuzzing, etc.

[cosmic pendant]

that setence broke my brain

[hollow nebula]

do you have a write up? i would love to check it out

[cosmic pendant]

I do not.

[hollow nebula]

i've done a few conpots to play with protocols, but would love to do some maritime themed labs - or more realistic set ups. been learning lader logic etc.

[blazing granite]

the big picture, baby steps killed me, oxymoron in the making 😂

[cosmic pendant]

Look up ADSB and...................... the boat version... it's almost the same thing......... ghahhhhhhhhhh

Also MILSTD-1553

good read

There is also a boat version of that....

[naive violet]

Build the lab

[hollow nebula]

ICS/scada/iot are my main interests in the word of cyber. check my medium https://medium.com/@BadDog

[naive violet]

AIS?

[cosmic pendant]

THat's it

[hollow nebula]

i'm definitely not a pro but i hav interest

[hollow nebula]

ths is the idea eventually. but i dont know - what i need to know - to build the lab via a VM

[naive violet]

It's OT
A lot of it is hardware

[hollow nebula]

The macyste is super interesting but i havent been able to get to working yet

https://crack-mcr.github.io/MaCySTe/

i've messaged giacomo and russo before, they answered back. cool dudes

[ancient mirage]

i find this in every fruit drink i don't understand why... https://en.wikipedia.org/wiki/Acesulfame_potassium

it's always too gooddamn sweet bro

[sick lance]

SCADA hacking 🤢

[hollow nebula]

I can immitate the bridge system easily enough - it that most maritime vessels claim air gapping in OT and IT - so unless there is a USB attack- you are left doing AIS spoofing, mitm ecdis updates, SAT and COMMS mitm

[naive violet]

From my professional life, and playing by Chatham house rules, you'd be amazed at the differences between what (OT, IT, Maritime) vendors claim and reality.

Sat being satellite? Vsat etc? They're awful but should be segmented
Architecture.

[hollow nebula]

i mean i have 10 years on cargo ships - but yeah i've never had the ability to crack in and look for myself lol

[hollow nebula]

there are large companies still using satcoms with hardcoded creds

[naive violet]

Yeah VSAT terminals are stuck in 2007

Rare to find them internet exposed though, dutch gov had one a few years ago that went famous

[rustic plume]

Hi All, I submitted the survey form yesterday evening as I have btl1 , I am just wondering if people have received the voucher already for SAL1

[hollow nebula]

maritime industry is even slower than normal ics because they'll just sell a ship - and the vuln gets passed on

[sick lance]

Replies state theh should be within 24 hours, but I'd imagine it may take slightly longer or shorter, depending on the replies.

[hollow nebula]

Ais spoofing ( and other vectors) are also applicable to airports and other spots. that'd be a fun box

[naive violet]

Ais ain't for planes, 'tis boats.
ADS-B for planes

Some interesting talks out of Defcon etc on ads-b spoofing and spoofing immunity

[earnest fog]

welp, it's official, sent resume to national guards cyberdefense unit. Also, hi everyone. have a great day.

[naive violet]

Good luck

[hollow nebula]

yes ! ads-b

[cloud quiver]

@sick lance

[grim sparrow]

Done!

[blissful snow]

when you run banspam does it clear all spam with regex or do you have to put a user

[dark frost]

i love this word regex

[blissful snow]

same lol

[hollow nebula]

i have a nerd fantasy about making a framework that's a mix between recon-ng and a metasploit thats strictly for ICS systems - so you could OSINT and store it in a database- then find the structures--and lock and load the exploit or coms

[blissful snow]

what is ics again

[hollow nebula]

industrial control systems

[blissful snow]

ah

[sand trench]

1080p

[blissful snow]

I'm bored can someone give me an idea again

[dark frost]

have you draw the software architecture for it already?

[blissful snow]

where do you get your wallapers

mines are blurry and pretty bad 😭

[sand trench]

a lot of sources..

but most recently from the catppuccin discords wallpaper forum channel

[blissful snow]

ohh

[blissful snow]

could you dm the link

[sand trench]

sure

[blissful snow]

thankss

[dark frost]

shadow has the best servers discord list

[hollow nebula]

i have zero knowledge on how i would even start. I started using dev.boot everyday to learn some basics. please fill me in

[sick lance]

Banspam removed the user and their messages.

[hollow nebula]

like i imagine alot of it could be done via api's and it would really just be a database holding the information

[sand trench]

and sent

[sick lance]

I mean, that wouldn't be too hard.

[blissful snow]

i meant does it clear all spam in the server

[sick lance]

I'm actually working on one right now.

[sick lance]

Only messages from that user.

[rugged kayak]

is there a maybe 2k or 4k version of it

[hollow nebula]

well where do i start to learn about how i could make one? like i don't even know the vocabulary to search besides " framework" - which i found there are libraries for making frameworks which is awesome

[sand trench]

not in shadows wallpapers folder but maybe if you search the internets ¯_(ツ)_/¯

[sick lance]

Just look up well known vulnerabilities and stuff, it's usually the same culprits.

[hollow nebula]

wait huh? i'm not looking for vulns - i'm talking about creating a shareable framework similar to recon-ng and metasploit

[naive violet]

Bans user and purges thier messages, sends a specific appeal message too

[sick lance]

Er, what does Metasploit do?

Swiss army knife of hacking tools.

[wooden totem]

(it's AI)

[naive violet]

Honestly I'd just extend MSF

[sick lance]

I'd certainly easier at this point.

[hollow nebula]

like an additional module

[sick lance]

Yeah.

SecOnion takes too long to install.

[sick lance]

You ever done the ICS Chemplant?

[hollow nebula]

i mean - recon-ng is just using the api keys like shodan etc, and holding the data. if i could input the api keys in metasploit, and have an additional room on the init_db to hold the recon'ed osint info. i mean there is already a LOOT option right?

[sick lance]

How would you deal with the devices that aren't connected publicly?

[hollow nebula]

the fortiphyd one? yeah

i actually learned alot about networking setting up the visual ones..also the dude thiag alves

his labs and plc stuff is great. my linkedin has all the ics labs i've put together . the visual ones in ignition are fun

[sick lance]

https://github.com/hslatman/awesome-industrial-control-system-security

[hollow nebula]

ahh i'll have to take a look. armitage always struck me as a cool idea also but i could never get it working

[sick lance]

Armitage is no longer supported.

[hollow nebula]

ahh thanks

have you done the free CISA ics courses? grassmarlin heavy

[sick lance]

Grassmarlin was annoying, worked when it wanted to 😂

[hollow nebula]

this is why i need to cruise teh darkweb more - i feel like there is the leader of a the foot clan teaching people to do the stuff i'm trying to learn lol

[cosmic pendant]

OHh, that's cool, I dind't know that was public

LOLOL

[hollow nebula]

yeah grassmarlin was no the coolest - but i like the idea of it being passive

[sick lance]

What's public?

[cosmic pendant]

grassmarlin

[sick lance]

They usually copy alot of the Emails yeah.

[hollow nebula]

check out the phishing room

[dark frost]

Foot clan ?

[sick lance]

It's not supposed to be? 😅

[cosmic pendant]

No, it is 😄

[blissful snow]

isn't that paid for?

[hollow nebula]

go ninja go ninja go ninja go

[sick lance]

You're either being sarcastic, or not giving enough context... 🤔

https://tenor.com/view/shredders-revenge-funny-dnopls-splinter-throw-gif-26053497

[blissful snow]

read it again

[sick lance]

However, I don't think we should discuss how criminals commit crimes. 👀

[blissful snow]

kk

ima delete it

[sick lance]

From an analysis PoV, yes. They try and immitate the E-mail as much as they can.

[cedar shuttle]

Anyone here went to WGU? Considering transferring there

[dark frost]

WGU ?

[blissful snow]

I'm mostly wondering about the no-reply part

[hollow nebula]

i'm completing the last of my COMPTIAS before i enroll to cop the bachelors

[sick lance]

There is, but I'll let them announce it.

[cedar shuttle]

The floodgates are open haha

[sick lance]

Fortiphyd was part of my BsC. 😅

[dark frost]

What is WGU?

[cedar shuttle]

I have my GISF/GFACT maybe they’ll waive some of the courses

[dark frost]

You got your bachelor 👀 i though you started it recently

[sick lance]

oh no, I'm on my last 7 weeks.

Gosh.

The last push is the worst.

[dark frost]

Hard working i see 💪

[sick lance]

Right now, as part of my project, I'm installing Sec Onion, to impliment in an ICS testbed.

[dark frost]

I have no idea what that mean

Good luck 😊

[sick lance]

My Uni has a test bed for a level crossing (car crossing train tracks).

[cedar shuttle]

School

SANS is too expensive, wgu i can apply for fafsa

[dark frost]

So you installing a secured infrastucture to monitor and control Train passing tracks ?

[hollow nebula]

i had this book marked but havent had the time to really go through it well - i also found a pdf of 'pentesting ics' by paul smith that looked great but need again - to make working labs

[dark frost]

Touching some Scada ICS?

[dark frost]

Where are those schools?

[sinful bobcat]

[hollow nebula]

ahh excellent! i'm talking to the right person then. you seen that dude c fox do his set up with grfics?

[lost skiff]

online

[cedar shuttle]

Both

[dark frost]

Technology
COMPARE
Cybersecurity and Information Assurance – B.S.

VIEW DEGREE
Protect your career and earning potential with this degree.

MORE DETAILS
APPLY NOW
Time: 60% of graduates finish within 29 months.
Tuition: $4,365 per 6-month term.
Courses: 34 total courses in this program.
Certifications included in this program at no extra cost include:

Certified Cloud Security Professional (CCSP) - Associate of (ISC)2 designation
Systems Security Certified Practitioner (SSCP) - Associate of (ISC)2 designation
ITIL® Foundation Certification
CompTIA A+
CompTIA Cybersecurity Analyst Certification (CySA+)
CompTIA IT Operations Specialist
CompTIA Network+
CompTIA Network Vulnerability Assessment Professional
CompTIA Network Security Professional
CompTIA PenTest+
CompTIA Project+
CompTIA Secure Infrastructure Specialist
CompTIA Security+
CompTIA Security Analytics Professional

Incredible , and expensif but seem worth it

[hollow nebula]

some of those are stacked certs

[eager marsh]

For the love of god I dont care who the IRS sends, I'm not taking your cert THM

[eager marsh]

All of these certs are comptia

Almost all of them are anyway

[tardy crater]

Heyy, i was wondering, do you have any recommendation or know about some quality universities that have a programme in computer networks, in Europe? Something close to that or simmilair?

[sick lance]

I did not, no.

[blissful snow]

i forgot i could get domains like this

[sturdy pike]

Good night everyone

[blissful snow]

good night

[sturdy pike]

Don't say the word of the module I'm doing and I'll have sweet dreams

[sturdy pike]

Have a cookie 🍪

[blissful snow]

waitttt

yay nvm

[sturdy pike]

wasn't gonna go without giving cookies lol

[blissful snow]

😮 🫢 😋 👍

[blissful snow]

lol

[mellow narwhal]

active directory something

[sturdy pike]

actually started loving it haha so not that

[wooden totem]

I just realized that stars you see at night are stars

[cedar shuttle]

Impossible

[polar spoke]

https://tenor.com/view/the-universe-tim-and-eric-mind-blown-mind-blown-meme-mind-explosion-mind-explosion-meme-gif-18002878

[wooden totem]

I never really gave it a thought, just "yeah thats that, stars in the sky", but like no, it's cooler than that, they are stars as in giant fucking plasma balls in space light years away

[wooden totem]

and there is so many, visible, so far away, you're in the middle of the universe, empty space

[blissful snow]

https://tenor.com/view/running-quick-fast-running-fast-sprint-gif-11390031044419433068

[cedar shuttle]

Some people said I work in the backrooms

[blissful snow]

you do

[cedar shuttle]

Best part what you’re seeing is the past, the time it took for that light to get to you could be millions of years ago

[blissful snow]

mail.com

i don't actually have because I think mail.com isn't really the best

nah you good

i do have one

[blazing granite]

https://tenor.com/view/nick-jonas-thats-really-deep-gif-11839843

[blissful snow]

nice

the only reason i know about this is because i need a temp mail and also phishing simulation

yeah

[half girder]

the only reason for nice domain names i can think of is for making funny vhosts for irc bouncers

[hollow nebula]

https://www.youtube.com/@shaunnasworkshop had a interesting set up - and the first i heard about openplc which really helped alo....seafoxc https://www.youtube.com/@seafoxc there's a playlist of newbie friendly ics stuff if anyone else is interesting, https://www.youtube.com/watch?v=CCIrntyqe64&list=PLbYkEkKTCOE1f2CmievGpCyht73_39DeO

[hollow nebula]

sorry that took forever - i couldnt find his youtube

[sick lance]

It's ok, I'll check it out, thanks.

[twin ridge]

Gave +1 Rep to @hollow nebula (current: #2712 - 1)

[blissful snow]

ngl it's pretty dangerous

i already took it and gavef it a random password and logged out

[sick lance]

Netcat is watching me.

[sand trench]

pet netcat

[blissful snow]

lol

$0.00

its all free

[sick lance]

Don't mind me...

[half girder]

looks like grumpy cat

[blissful snow]

*cat bans everyone

[sick lance]

[naive violet]

How is the picture of the cat in the background of the same picture?

Magic

[languid torrent]

Hello I had a question I am doing the course on Nmap my question is nmap is only used to see which port is open / closed or filtered?

[naive violet]

It can do vulnerability checks too

[sick lance]

I deleted that image 😄

[naive violet]

And you often use it for host discovery as well

[rough dome]

service enumeration

[naive violet]

I'd prefer the droste effect but ehhhhh

[wooden totem]

nvm image is smudged

[spark crown]

Team, I used THM few months ago and have completed few learning modules but I wanted to re-do them again but as those modules are completed already, I couldn't be able to practice them again. Is there a way that THM clear the modules I did so that I can practice again.

[carmine tinsel]

You can reset your progress

[spark crown]

Great. Could you please let me know how to reset the progress

[dark frost]

When you open the module , on top they are settings

[carmine tinsel]

Click room options

[spark crown]

I see it!

THanks much team!

[dark frost]

[spark crown]

It looks like I can reset the room but not the whole module like Presecurity path or introduction to cyber security

[crisp creek]

Yep, you have to visit every room

[languid torrent]

does it list all the ports that are available on the network?

[spark crown]

That sounds like a big task! I will try to reach support team THM.

[dark frost]

You talk about nmap?

[languid torrent]

yes

[west ingot]

So, my friends are organising a talk on pentesting tools for our juniors in my college and invited me to give a talk on that topic as a whole.
Now, I may not be very good when compared to seasonal CTF players and other pentesters but I do know quite a few things which I believe could be useful for my juniors and would give them a head start.
I would like to get a few suggestions on what to actually talk about. I’m thinking of talking about categories such as website enumeration, brute forcing through passwords, logon crackers. The target audience is people who are familiar with programming and computers but not security related topics.
So anything..? (Sorry for the message dump T_T)

[dark frost]

It map the open port for an IP you gave

Yes it does map all the ports if you give the right argument

By default only mainstream used port are tested , as it take lot of time

[brittle lynx]

Hello

Does anyone use vmware ?

[naive violet]

Ports belong to an IP, a system

[sick lance]

Yes.

[languid torrent]

just to see the open ports? but what is the use of that to me after knowing

[naive violet]

You identify services

[brittle lynx]

do u know how to connect my Kali and Windows VM on here so that they share the VPN

[sick lance]

Support can't reset.

[naive violet]

Which you can then interact further with

[sick lance]

Which VPN?

[brittle lynx]

The tryhackme openvpn for ADenumeration network

[naive violet]

Without doing some dodgy NAT and routing stuff that's not very possible

[dark frost]

If you see an open port like , 80 or 443 you can find a Http service for example , it's a webpage

[sick lance]

Yeah, I'd suggest just sticking the VPN in one envrioment, why do you need it in Windows?

[inner goblet]

I’m doing a room and it says “what is the user flag?” How do I see what the flag is?

[languid torrent]

hoooo

[sick lance]

It's the flag you get when you foothold/user

[inner goblet]

Into my own Kali Linux?

[brittle lynx]

The ad enumeration room said to use it to do attacks that u cant do on kali.

The red team pathway says to use a windows attack VM

[languid torrent]

I marked this in my summary and therefore let's admit port 96 is open how do I know the company's IP for example?

[sick lance]

No, the machine you're attacking.

[brittle lynx]

And overall I need to learn how to do that

[sick lance]

Can you link the room?

[blissful snow]

if i were to go for a cret which one should i get first for offensive security

[inner goblet]

Oh I didn’t see it because it said I can only deploy one a day. That sucks😂🤦🏽‍♂️

[dark frost]

Uhm you need to know the IP before beeing able to nmap the ports

[sick lance]

No, that's the attackbox

Attackbox != Target machine

[brittle lynx]

https://tryhackme.com/room/adenumeration

[languid torrent]

and how i can have the ip im new on cyber

[blissful snow]

one a day isn't that hackthebox thing

[brittle lynx]

Are u sure that vmware doesnt have a solution to doing it ?

[sick lance]

Ok, for this ideally you'd use the VPN on your Windows machine, however, I would not suggest stickign your host machine on the VPN

[sick lance]

Which room are you doing?

[dark frost]

You can do a dns resolve on the Domain name of the compagnie website 🙄

[languid torrent]

ohhhhh thx bro for help

[twin ridge]

Gave +1 Rep to @dark frost (current: #277 - 25)

[dark frost]

Dns is the service that traduct
A domain name to an IP adresse

[languid torrent]

so hackers in general first look for the DNS to get the IP?

[sick lance]

Uh, what are you doing?

[dark frost]

Uhm yeah somehow 🙄

[inner goblet]

I forgot the name of it but it had a ip address and machine but the machine didn’t load. It only displayed “Target ip lookup” so I was very confused. I refreshed and tried the basic one.

[languid torrent]

I'm just trying to understand because I'm learning lots of stuff on tryhackme but I feel like I don't see the basics of the tools

[sick lance]

Yeah, that's the ip you interact with from your VM or Attackbox.

[sick lance]

The basics of the tools is good, but looking at this conversation from the outside, you're looking like you want to find the IP of websites to hack them.

[inner goblet]

Ohhhhhh. I’m like how do I do this?🤣🤣

[sick lance]

If you want to use Windows, I suggest using a VM, and connecting to the VPN that way.

[inner goblet]

@sick lance I will do it through Kali Linux. I can set it up on the Kali I normally use? It’s just 1

[sinful moon]

Yep that's just fine

[languid torrent]

no just that I'm learning nmap and I told myself that it didn't make sense because later I would have to find ip to have access to the port

[sinful moon]

VMware Workstation Pro is also now free, if you can stand jumping through Broadcomm's awful website

[crisp creek]

https://tenor.com/view/fine-this-is-fine-dumpster-fire-everthing-is-fine-everything's-fine-gif-3293785927797514322

[sick lance]

Kali is good.

[blazing granite]

he'll need a map and a compass 😉 😂

[brittle lynx]

I understand that but my question is how do I make my VPN connect to both my Kali and my Windows VM .....

[sinful moon]

You don't need to, just connect with your VM

[boreal scarab]

Puts cayenne on my sandwich
Doge walks under me where some cayenne flakes fell on the ground
Doge licks it up
Doge rushes to doge's waterbowl

[flat steppe]

Hey, I recently got the voucher for the SAL1, and my skills revolving around blue team and defense are incredibly lacking compared to the red teaming side of security.

Anyone have recommendations on how i can get to the skill level needed to pass this exam by the end of the month?

[languid torrent]

and if i have understand nmap for port and gobuster for files ?

[crisp creek]

SOC Level 1 Path and the SOC Simulator

[sinful moon]

I thought you meant "and my Widnows host" but saying you need this in a Windows VM as well is more puzzling. Generally however you can to 99% of THM just with a Linux VM connected to the OpenVPN

[flat steppe]

Can the SOC level 1 path and SOC simulator be completed by the deadline of the end of the month do you think?

[boreal scarab]

Spicy food is spicy

[brittle lynx]

Do u know how to do it

[sinful moon]

I've never had a need to run the OpenVPN connection with two VMs at the same time. Can you explain why you need this?

If you're on a Windows host and have a Windows and Linux VM... what the heck is the Windows VM for?

[blazing granite]

usually the clue is in the name 😉 😂

[inner goblet]

I’m getting a “error opening config file”

[sand trench]

depends on how much time you put in every day

but technically yes

[brittle lynx]

Because the red teaming pathway said I cant do all attacks of red teaming on a linux.

Thats why the CRTO u do it on Windows

[whole gazelle]

i program computers!

[crisp creek]

if you dedicate more than 20 hours per week probably yes

[sick lance]

NOt easily, isn't worth it.

[sinful moon]

That's only somewhat true, but for the times you do need a Windows VM, you don't need the OpenVPN connected to both VMs at the same time anyways

[flat steppe]

thats actually pretty manageable

[sinful moon]

You probably dont' want to waste RAM running both the Windows and Linux attack VMs at the same time all the time anyways

[flat steppe]

wheres the line of people that will hire me after i pass this certification?

[sinful moon]

You may need #site-support unless it's something as simple as you not using sudo openvpn whatever.ovpn on your *nix VM

[crisp creek]

https://tenor.com/view/empty-shelves-john-travolta-confused-where-huh-gif-16456244

[sinful moon]

and or just regenerate your openvpn file if it's actually borked. That's about all I can say here

[flat steppe]

https://tenor.com/view/i-hate-it-here-gif-24977099

[sinful moon]

Typically the OpenVPN just werks

[flat steppe]

oh the joys of the cybersecurity job market.

[wooden totem]

you become the line

[whole gazelle]

yeah

with bunch of other ppl who got certs

[inner goblet]

I did and it brings up everything

[flat steppe]

at least i get a chance to fill a large skill gap

[sinful moon]

"everything"?

[flat steppe]

i have been preparing for the OSCP and really neglected defense.

[sinful moon]

If it's a long bit of terminal output and successful stuff, that's a good sign

just leave it running

[blissful snow]

are tryhackme giving out oscp any time in the future in ctf?

I just read something about them doing that

[sick lance]

They might do.

They gave away OSCP vouchers with the red team path.

[sinful moon]

Oh as a give-away? That would be neat

[crisp creek]

next christmas?

[sick lance]

Blue team vouchers with their Soc 1

[sinful moon]

oh lol

[blissful snow]

free oscp?

[brittle lynx]

Does anyone know where i can get a windows 10 ISO

[sick lance]

#site-support

You need to put your actaul path

[sinful moon]

you need to specify literally the path to your file....

[sick lance]

Azure.

[flat steppe]

they should give me free oscp for passing their certification and making a video on it.

[sinful moon]

not the example

[sick lance]

They gave away 2 or 3 voucher exams.

As a prize.

[crisp creek]

for christmas?

[blissful snow]

h ok

didn't know that

so basically im paying 14 for oscp

[flat steppe]

"How I Passed the SAL1 in 25 Days- And Got HIRED?"

[blissful snow]

?

[sick lance]

2-3 years ago yeah.

[crisp creek]

cool

[sick lance]

I wonder what is next for THM 😉

[sinful moon]

Too busy with work to even attempt doing any of the give-aways

but I'm glad they happen

[carmine tinsel]

Is that a hint lol

[crisp creek]

their own red certification maybe?

[sinful moon]

Yes it would stand to follow

[sick lance]

That is in the works, but not anytime soon.

[sinful moon]

We shall see

oh nice lol

[flat steppe]

Do they have an API hacking course. that would be cool if not

[crisp creek]

it was funny, tho

[languid torrent]

SYN scans return a TCP RST packet after receiving a SYN/ACK from the server (this prevents the server from repeatedly trying to complete the request) SYN scan allows multiple people to be tested and each port to be tested only once?

[crisp creek]

didn't get it at first glance

[sinful moon]

Not as far as I know, but it shouldn't be hard to extrapolate the knowledge you've gained from THM to do so with the API documentation of a service. Obviously make sure such a thing is within scope for HackerOne and etc

Even with basic API knowledge it's not too hard to poke at that kinda thing

[sick lance]

Come on Rex, you've been here long enough.

[carmine tinsel]

Anyway I did nmap intro today, I keep forgetting what the switches mean lol

It was good to recap

[sinful moon]

My best advise is to nmap every single room, even when they don’t ask you to. Not only good habit for CTFs but yeah will get you to learn flags like the back of your hand

[carmine tinsel]

Oh yes definitely I try to do that lol

[loud marlin]

nmap all the things

[carmine tinsel]

Really needed that today

[sinful moon]

plus lol, every major vulnerability scanner that I know of is literally just automating nmap. Great skill for sure

Nessus, OpenVAS, and many many other solutions are largely just a crap ton of nmap scripts

We did try a vulnerability solution at work and while it had its own agent, for network stuff yeah that was also just running nmap as normal

[topaz skiff]

is there any reason not to just do the "scream at everything" nmap scan on -T4, or rather, is there any reason to be quiet / stealthy with the rooms?

[sick lance]

-T4 is fine for CTF's

[sinful moon]

There is near 0 reason on THM unless there's rate limiting, which is pretty rare on THM

[cedar shuttle]

My brother works for nmap, he will report u to cyber police ☝🏼

[sick lance]

There is one challenge on THM where you need to not trip the alert system with nmap

[sinful moon]

but I know Muriri or however their name is spelled has done at least one rate limited room

[topaz skiff]

oh neat, looking forward to getting to that quiet challenge

[sick lance]

Muriri

[loud marlin]

i am at police list in anyway

[sinful moon]

irl though, I never use -T4 and have seen even standard rate being rate limited

so expectations may not always match reality, obviously -T4 is loud and noisy, but who cares for most CTFs

[carmine tinsel]

-T5 for max chaos

[naive violet]

Or even pentests, they know you're coming outside of red teaming

[sinful moon]

never in my life tried it since yeah when even nmap docs says it will break things, I believe that

[carmine tinsel]

At this point it isn’t an nmap scan, it’s a nmap assault

[naive violet]

I've only had it break HP iLO

I wouldn't scan embedded systems etc at t5

[sinful moon]

that's kinda critical tho lol

[sick lance]

I wouldn't scan anything at -T5 tbh, I'm not that impatient.

[naive violet]

Oh yeah it needed full mains power cut and restored, pain in the rear

[sinful moon]

half the reason I got a used server is for dat Dell iDRAC c:

Wow

[carmine tinsel]

I would do it for the lolz

[inner goblet]

Do I have to download the key inside of Kali?

[carmine tinsel]

With script kiddie switch enabled

[sick lance]

Which key?

[sinful moon]

Presumably your Kali setup should have a stable internet connection just like your host, I will say

plus if this is literally a text key then you can copy and paste from host to guest VM depending on your VM software

[inner goblet]

I’m trying to do this openvpn thing and it’s saying it’s not finding a file or list of my downloads file

[sinful moon]

did you actually download it to Kali then?

[inner goblet]

I downloaded the file try hack me gave me on my actually laptop and not Kali. I downloaded openvpn on Kali and I think that’s the problem

[sinful moon]

Yes you need to download that file inside of Kali

[cedar shuttle]

Hypothetically

[sinful moon]

once you do, it should just be in your Downloads, so you can simply just do these two commands

[cedar shuttle]

Can you cause damage with a botnet running t5s?

[sinful moon]

cd ~/Downloads
sudo openvpn YourUsername.opvn```

[sick lance]

We won't be disciussing botnets.

[inner goblet]

Ohhh ok ok. So whenever I want to log onto try hack me I can do so through Kali Linux?

[sick lance]

We don't discuss illegal/unethical topics.

As per our community rules.

[sinful moon]

Whenever you want to access the VPN to TryHackMe, yes

You don't have to do your THM lessons there, but you need your attack machine connected to the THM network

[topaz skiff]

how often do you have to water bottle spritz people in this discord with that rule warning Scrubz, ha

[sick lance]

Depends on the day I guess.

[inner goblet]

Is it safe to log into try hack me on my kali?

[cunning zenith]

not tryna twist the rules, but doesnt cybersecurity involve knowing threats and how to deal with them? genuinely confused as i was under the impression we are trying to build defenses against known threats

[sick lance]

Yes.

[cedar shuttle]

Just making an observation mb

[sinful moon]

Yes

[sick lance]

If you're under the target of botnets, you've got bigger problems than worrying about -T5 and nmap.

[sinful moon]

There's other ways to transfer the file instead of downloading, but lets just keep it simple

[cunning zenith]

good thing i dont know what both of those mean just yet, but thank you for entertaining my curiousity 😂

[twin ridge]

Gave +1 Rep to @sick lance (current: #2 - 3454)

[cedar shuttle]

I got baseball bat to the shins so you can run 😩

[sick lance]

Hardly, I just informed you of our community rules that you've accepted. 🙂

We don't discuss taking down botnets, using botnets etc.

[inner goblet]

It’s still saying “error to open config file”

[sinful moon]

Then you likely still don't have the correct path

[sick lance]

For the third time, can you please use #site-support 😄

[sinful moon]

indeed would be best to continue there

[blissful snow]

dos anyone know where i couuld train for oscp

[carmine belfry]

Probably best to use the offsec labs. If that isn't possible, there are some rooms/networks on TryHackMe that could help.

[blissful snow]

im new to crets 😭

[carmine belfry]

https://tryhackme.com/hacktivities?tab=network

[dark mason]

Do you guys know any NoSQL tools similar to sqlmap?

[carmine belfry]

TCM have a few videos on their Youtube, this one is good: https://www.youtube.com/watch?v=3FNYvj2U0HM

[blissful snow]

could you send this my dm i can't watch it atm

[carmine belfry]

Can't you just save the link? Not sure what a DM will add ^^

[blissful snow]

I keep forgoting about that

forgeting*

[blissful snow]

are you talking about forwarding

[carmine belfry]

No problem. No I mean, you can save that link into a note or something. Copy/paste it 🙂

[blissful snow]

kk

for some reason i awlays lose them

but i think i have it this time

are there any speific networks that help with cret

or their all good for practice

[carmine belfry]

I'd recommend doing all of the Active Directory network rooms. And then you can try out Wreath and Holo.

Red team capstone challenge is a bit more advanced, but it can definitely be useful to go through if you have the time

[blissful snow]

I was doing wreath i forgot what happened tho

also what do you think I should know before i attempt to study for oscp

[carmine belfry]

I haven't done the oscp, but I think you need to know:

• OS fundamentals (Linux and Windows)
• Networking
• Active Directory exploitation
• Web exploitation

Pretty much everything listed in their course https://www.offsec.com/courses/pen-200/

[tribal lion]

sorry i went offline
yeah

[blissful snow]

ok the only thing i need to study is active directory exploitation😃

last time i did it, it was pretty easy

do i have to be like realllly really good at them

[sick lance]

#site-support would be a better channel

[sinful moon]

Mhmm, it's actually kind of sad that AD/GPO is a dying breed. Azure/Entra ID/Intune is just awful in comparison

[tribal lion]

ok thx

[twin ridge]

Gave +1 Rep to @sick lance (current: #2 - 3455)

[blissful snow]

whats gpo

[rapid merlin]

It’s hella cold in here

[sinful moon]

Group Policy Object, Just a bit more clear than trying to say GP

[blissful snow]

refrigerator ?

[sick lance]

Security Onion will be the death of me.

[blissful snow]

ohh

[sinful moon]

But yeah Group Policy be how you actually apply security policies and more to AD objects

[silver sky]

Layers and layers

[sick lance]

It will be peeled to that.

[loud marlin]

wrong chat

[sick lance]

I seen that typo.

[loud marlin]

=/

[sick lance]

Here all day folks.

Security Onion will make sure of that.

[silver sky]

https://tenor.com/view/happy-new-year-2023-free-gif-27345257

[blissful snow]

welp i have to g in 3 mins

[sinful moon]

just don't forget to hijl-lmno-p as well

I killed chat with my awful "joke" lol

but nah I was just lurking in the support channels for a bit

[blazing granite]

https://tenor.com/view/moment-of-silence-pay-respect-rip-rest-in-peace-bow-gif-15963301

[rapid merlin]

I am not in the fridge, there’s no food in there 😆

[cunning zenith]

ive seen a lot of people in this server kinda identify tryhackme as one of their "main things", giving their user profile or whatnot. This confuses me because i was thinking this was just some educational platform, didn't realise people may get really connected to it... may i ask, as we go deeper into the game of tryhackme, what exactly is the appeal here (im still a beginner tryna figure my way through presecurity)? what makes people want to share their user profiels and collab or whatnot?

[carmine tinsel]

they are thm addicts 🤣

[cunning zenith]

but WHY 😂 what makes it so addicting--

[rugged kayak]

its mostly beginners imo

when you get serious and more knowledgeable you will consume every resource there is

[cunning zenith]

so what, this is like some social media platform for beginner hackers or something?

[sick lance]

The dopamine from gettign flags for hacking stuff.

The rare chance, you may actually get a job oppurtunity in this server.

It's very rare, but it happens.

[whole yew]

"mostly beginners" is the intent of the server - it's intended to be a community where people with limited or even no IT background can begin to learn the basics and fundamentals of infosec

[rugged kayak]

i didnt say it as bad thing tho

[cunning zenith]

yeah thats what i figured, im using it for that very reason

[rugged kayak]

everyone was beginner

[cunning zenith]

just didn't see why people got so attached to it lol, kinda reminded me of a cult-like following or sum 😂

[cunning zenith]

we all are beginners, best way to approach anything is as a beginner, even if youre an expert

[rugged kayak]

people like to brag i guess

about ranks and stuff

[rugged kayak]

[cunning zenith]

oh dear, talk about it 😂

[cunning zenith]

idk looked like a way for them to build something up for themselves because they lacked the pussh to get out of the comfort zone and build the true knowledge set required for a field liek cybersec, but then again, im probs overanalysing

crazy fascinating stuff how we go in expecting one thing and then come out hooked on something else

[carmine tinsel]

leveling up in thm gives me that dopamine rush until I realize just how little I know 🤣

[rugged kayak]

you can get high amount of points with doing little to no ctfs i feel

[cunning zenith]

dude i just want to be able to not feel like a failure after uni 😂 screw points, bloody real life boutta hit us on the nose

[rugged kayak]

true

learn everyday

learn as much as possible

and try to enjoy it

[cunning zenith]

but then again, respect to people finding entertainment in something educational, def a better way to spend time

[rugged kayak]

well i like solving puzzles

i was doing dev before i started cysec

"hmm this shit is interesting"

and 3 months later i am preparing for CPTS

[cunning zenith]

i like that man, you got an organic drive and intrinsic curiousity, bet you gonna blow that cpts out the park 🙏

[rugged kayak]

just feed your curiosity

[round orbit]

What sounds better to put on my LinkedIn?

• SOC Analyst
• Security Analyst
• Security Operations Center (SOC) Analyst
• Any others?

[cunning zenith]

meanwhile my dumbass be like what the hell is cpts, prob some big level certification or sum 😂

[rugged kayak]

its hackthebox red team certification

[cunning zenith]

honestly security analyst sounds smarter and more professional

[rugged kayak]

i am dumb as rock dw

i just try to be less dumb than i was yesterday

[round orbit]

Cyber Security Analyst?