quiet-conversation

[south inlet]

To where?

Depends on the severity etc.

[heavy lintel]

Give me permission for sending a video

& full explain

[south inlet]

You need to verify your account.

[frail vault]

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

May 13, 2024, 10:58 AM

[heavy lintel]

Ok wait

[south inlet]

I've pinged you in the original channel you posted in.

[heavy lintel]

Done ✅

[south inlet]

@heavy lintel please follow the bug bounty guide.

[silver trout]

hello

i got a problem in my VM room Snort, when i run a command it run constantly and wont stop

[summer verge]

#room-help

[golden crow]

You are asked to test a website, and you are given access to the source code - what testing process is this? and I answered [White-Box Testing] it says incorrect pls what is the correct one

[rugged frigate]

sounds more like code audit

[south inlet]

White box testing.

Remove the hyphen, next time, please use #room-help

[karmic moth]

yo can soemone dm me i need help w soem stuff

[tawdry dove]

If you have a question, just ask. Asking to go to DMs for "help with some stuff" makes it seem suspicious.

[tacit marten]

hello everyone, I recently started tryhackme, I'm looking for a partner to learn together or a team to join, I have decent knowledge about cyber security and I would like to learn more,I'm based in north America, please feel free to DM me.

[karmic moth]

mb

[tawdry dove]

What do you need help with?

[polar rose]

Hello, I am a currently working on my CyberSecurity Engineering master degree, and I've recently came across TryHackMe and its community. I would like to ask about advice regarding a task - nothing too much just a general advice on how these tasks can be done. Ill be using my Kali-Linux machine and another 4VMs (DevServer, MiniWebServer, myHobbieServer, and windows2012r2) to complete these tasks. Am not here to scam anyone nor try to provoke you or set a trap, am just really new with these stuff and general knowledge or suggestions could REALLY help. If anyone is willing to have a small conversation please let me know (mainly so that I can provide with the tasks that I would like a generic advice).

[south inlet]

Is the task THM magerial, or school?

[polar rose]

Thank you for your reply, yess its University material. I understand that most people will refuse to help due to guidelines and etc. Am just asking for general information in order to better understand the task in hand. Nothing red-team or black hat related, everything is controlled withing the VMs provided by the university.

[hoary nymph]

Gave +1 Rep to @south inlet (current: #1 - 2255)

[south inlet]

Then you'll need to seek help from them, as we don't know how everything is set up etc.

And we don't allow help with schoolwork/work related topics.

[polar rose]

I see. No worries that's understandable. Just wanted to shoot-my-shot, maybe get some more knowledge cause am starting to get burned out. I appreciate your time 🙂

[summer verge]

you change the username, the last one was a kind of "pegame y decime marta" 😂

[polar rose]

me ?

[summer verge]

yep

[polar rose]

Yeah, I did xD My name in discord is "llamame papa" == "call me daddy" which is a joke basically (same with my profile picture).. After sending like the first message, I noticed the panel on the right side, with everyone's name and role and I felt it would be more "appropriate" to use the name that I have in TryHackMe which is the nick that am using.

Am not trying anything fishy or anything, I just want to be involved in the community :3

[karmic gulch]

in breach-ad room while running ntlm pasword spary got error

[south inlet]

#breaching-ad

[exotic bane]

It's not school or work, but can we share screen with tutor and ask more indepth advice etc? Haven't screen shared as I figured it's copy right law

[odd acorn]

Unfortunately, we cannot verify whether or not it violates academic integrity at your University 🙂

[exotic bane]

Not in school but checked the terms and conditions and its personal use only forgot to edit post or add that

[rapid sun]

hy

[dire edge]

hye

[rapid sun]

how are you?

[meager gulch]

hey guys im timo from mrc i want learn cyber but i need someone to help me step by step cut idk from where i cant start

[tall relic]

At what time of year, that ticket rooms will be uploaded???

https://tryhackme.com/r/room/tickets4

Like this

[south inlet]

No idea when the next one will be.

[smoky mortar]

A ticket event is connected to a release of a learning path, although not all learning path releases will have a ticket event.

[tall relic]

OK Boss. I just wanted to confirm 😄

[mighty echo]

https://www.modos.tech/blog/modos-paper-monitor-pre-launch-on-crowd-supply

Cool stuff!

[cloud zinc]

Use case, beyond tinkering?

[mighty echo]

As I shared my vision with others, I found that many people faced similar challenges: writers, authors, journalists, programmers, students, teachers, doctors, lawyers, engineers, makers, digital minimalists, people with visual impairments, those with health issues and many more.

We all struggled with the same problems—headaches, eyestrain, and distractions caused by our reliance on digital screens. This shared experience fueled my desire to create technology that respects our time, attention, and well-being.

Certainly being on my eink tablet before bed instead of my phone personality has had a massive positive effect on me, just due to the screen

[cloud zinc]

Headaches, eyestrains, so we swap the 24" 4k monitor for 13.3" low-res, low-refresh rate. This is the setup they show. Who in their right mind would want to work like that. Certainly no programmer, journalist, author, doctor, engineer or lawyer. They want "screen real estate" as they say today, to look at documents and drawings all day.

[twin ridge]

To be fair, e-ink is nice to read on

[radiant jacinth]

I have a question. I want to do bug bounties. What path can I learn first in order for me to begin a bug bounty program?

[twin ridge]

web

[radiant jacinth]

Web path?

[twin ridge]

probably a good start, yeah

[worldly island]

i havent found a path specifically for bug bounties but

Pre Security -> Intro to Cyber Security -> Jr Penetration Tester

would get you decently skilled

[south inlet]

There is a new web path coming out soon, that will cater more for bug bounties

[worldly island]

I think I might want to write a room. I did the history of malware the other day, it goes back far. but misses a lot of stuff from recent decades

like sasser, dcom rpc, nimda and all the things that led to Windows Firewall/Defender and ASLR/UAC

[south inlet]

Good luck.

If you're interested let me know and I can give you a channel where that is specifically for room creation queries.

[twin ridge]

note that walkthrough type room submissions aren't being accepted AFAIK

[smoky mortar]

Check out: https://help.tryhackme.com/en/articles/6633511-creating-your-first-room
Particularly, the Best practices section on the page. 🙂

[fickle jolt]

hi

[cosmic jasper]

shhh its the quiet chat

[stoic nymph]

Guys, I want to understand a topic: Can a cellphone use two networks at the same time?, for example 3g and 4g, and what network does the phone use to make a regular voice call?, and why does the phone switch from 4g to 3g when making a call?

I apologize if this question seems too simple, I'm still new, This is my first research on this topic.

[worldly island]

afaik cell phones only use 1 network at a time, but will fall back to the lower one when the higher one isnt avail

[mighty echo]

https://twitter.com/daylightco 👀

daylight (@daylightco) on X

part of the third timeline

Twitter

[raw turret]

What do we do if we are stuck on questions ?

[summer verge]

read the text again and try harder or #room-help

google the concept/problem,

use your imagination and brain, take into account that not always will be somebody to tell you what to do. Do your own research

[raw turret]

Ok thank you

[gritty patio]

is anybody there to help me

[past olive]

What do you need help with?

[tawdry dove]

If you have a question, it's better to just ask the question, instead of asking a question to ask a question.

[twin ridge]

saw that, looks like a lot of hype generation for the moment

[rigid canyon]

Looking for counsel/advice - i’m on month 7 of working as an appsec engineer. I’ve also been helping my boss with some forensic work which is actually way more fun and something i want to pursue. How would you recommend changing course - if at all. I have yet to see any forensic work come up in my day to day. What job positions would you go after? Would you stay working as a security engineer but shift specialty? Is the job growing in demand? Any cool projects to do?

[heavy fossil]

Hi mate,
I would go for Incident Responder, you would still touch to technical stuff linked to your BG but it would add the forensic part to the job (at all level, network, system, timeline, etc.)

[mighty echo]

https://daylightcomputer.com/

If they've managed to get a 60hz eink paper display, I'd be super impressed.

Apart from the £500 price tag, really excited to see what this brings

[twin ridge]

wonder what tech they use

stylus looks like a standard EMR

[soft pier]

eink is whacky to shadow

not seen a need to get any eink thingy to try and make things on

[twin ridge]

it's honestly really nice to read on

[radiant jacinth]

Needing some pc hardware help

[tawdry dove]

What's the issue?

[radiant jacinth]

I sent it to dm so not keep soaking the same thing sorry

[tawdry dove]

Please do not DM without permission.

You can ask your questions here.

[radiant jacinth]

Need help building a pc out of these parts for cybersecurity

Any help from anyone is appreciated the school wants these parts specifically in the pc

My DMs open to any builds to anyone who can help

[tawdry dove]

The spec list is pretty standard for a business/workstation laptop

You can go to pretty much any vendor and spec something out that meets these requirements

[radiant jacinth]

Ik but which i7 should I use, which mother board. There’s many versions of i7s before I can find a a group of mother boards to pick I need to know which processor would last me a good few years before upgrading and which one will do a good job

[summer verge]

you have to do a little thing that is call research 🙂

[radiant jacinth]

Thank you for the help

[hoary nymph]

Gave +1 Rep to @summer verge (current: #82 - 77)

[tawdry dove]

If this is for school you're going to want a laptop. You'll need to bring it to class and labs. Go look at the laptop spec tool on whichever vendor you want to purchase from and spec something out. As Rex said, you're going to need to do some research. It's your money, and you're going to need to make decisions.

[radiant jacinth]

I did do the research but it only made me more confuse for I don’t know the range each core can keep for till it’s time for an upgrade, they want a pc specifically as stated for some of the software running in the course will be heaven such as VMware and one course I’ll be taking soon has virtualization

This semester and probably next will be online only

[tawdry dove]

It's not saying it needs to be those specifically. It's a recommended/bare minimum spec list

Again, all of this is pretty standard

[tawdry dove]

Meaning you can get better hardware and be fine

[odd acorn]

@radiant jacinth Are you looking to build a tower yourself?

[summer verge]

if you still have question is because the research is not finish 🙂 focus more on i7 vs i5 or intel vs amd more than every kind of i7, if you're using it for school I don't think that it would change that much, amount of ram it's also important

[radiant jacinth]

I went over that with the instructor already and they still denied the permission to use it

[summer verge]

denied to use what?

[radiant jacinth]

After I get the computer built or bought (prefer build) It has to be brought to them to approve it for the course

[odd acorn]

You have to take the machine in to them?

[radiant jacinth]

Hence if that was the case I could’ve use another build I had from a year ago that used i5

[odd acorn]

Transporting a whole machine is complete hell.

[radiant jacinth]

Ik but Im caution with my electronics but if unable to travel they need a screenshot of the specs from the command prompt

[tawdry dove]

It is, which is why I recommended a laptop instead. These requirements aren't that extreme

[summer verge]

the question still stand i7 or amd equal, price can change there

[tawdry dove]

What happens at the end of next semester, you attend in person?

[summer verge]

I read prison 😂 I thought whattttt???

[radiant jacinth]

Out of which i7

[odd acorn]

One that is 3Ghz as per their requirements

Don't look at the numbers, look at the actual info

[radiant jacinth]

If they offer, if not virtual or hybrid but atleast I’ll have the pc and continue to work with

[odd acorn]

Don't care if it's an i7 1700k or an i712400f, is it 3 ghz? how many cores does it have? how does it perform with virtualisation?

[tawdry dove]

So there is a non-zero chance that you will or will need to attend in person is what you're saying.

[radiant jacinth]

Yes

I’m just starting these courses I only know how to connect the pieces

[tawdry dove]

OK, because of this, is it the best idea to purchase/build a desktop that cannot travel with you to and from class.

[odd acorn]

With these courses, you really need to show initiative. If you don't take the time to learn the content and go out of your way to research when you don't understand something, you start to massively fall behind. Be curious, be resilient and be proactive 🙂

[radiant jacinth]

I am but road block after road block to connect something only after weeks I barely understand that’s why I goto these discords for help and assistance

[odd acorn]

We have connected a lot of the dots, it's up to you to actually draw the line

[radiant jacinth]

Then I guess I just give up here and think of another route. Only understood a small portion of what was said but I’ll just search somewhere else and see if it’s any different

Only so much info gathering can go so far

[tawdry dove]

As Jabba said, we gave you all the dots. It's up to you to connect them. I feel like I gave you a fairly solid starting point and solid logic as to why building something yourself is not ideal.

[radiant jacinth]

One of the benefits is building is cheaper considering the only reason I could afford to make one is loans unfortunately that’s also why I would want to keep it long term before upgrading

[odd acorn]

You won't need the newest parts, a common problem in computer building is everyone thinks they need the newest parts but last gen works just fine and it will last you years without needing to upgrade.

[summer verge]

get a solid amount of ram and you'll be fine for years

[tawdry dove]

It really depends and isn't always cheaper. Let me ask it this way, what are you going to do when you're asked to attend in person and need the machine in class if you've built a system? You can't bring a desktop and monitor to class. You're going to have to buy a second computer.

[summer verge]

a framework laptop would be more upgradable

[tawdry dove]

They are still expensive

[radiant jacinth]

Most of the classes ask us to have an external hard drive since the classes have donated computers and back up the data to a second or a flash drive

[tawdry dove]

A used workstation laptop meets all of these specifications

[summer verge]

you can't have everything in life 😂

[summer verge]

amazon have refurbish laptops at good prices

[tawdry dove]

At this point, you can do what you want. We have given you the tools to go forth and do good things.

[candid rain]

be careful asking for help in this area. People will tell you to research and learn and figure it out for your self and completely forget that discord and forums and the like are also part of the internet. Asking on here or a forum is no different than asking google except you and ask follow up questions to stuff you don't understand.

some fields will bend over backwards to help teach you and others act as gate keepers and tell you to teach your self all you need is google sadly this field tend to fall in the latter.

[tawdry dove]

I see Jabba replying, so I'm gonna leave this one and go to bed. Jabba you should sleep too, it's not worth it.

It's also like 3am for you

[odd acorn]

Could you point out where there was gatekeeping here? I would love to understand your perpective 🙂

[odd acorn]

I have an assignment in for 4pm GMT, staying up until it's done, unfortunately it's a very difficult assignment and they didn't give us much time to do it in (in relation to our other coursework).

[radiant jacinth]

I got what I need from everyone but still just drop it so no one fights or escalates things I already am starting to regret some things

[tawdry dove]

Ah I see I see. Best of luck. What's the course?

[odd acorn]

I think it's important to hear all members of the community so that I can continue to improve it (i.e. changing rules with community feedback or looking at making the Discord overall much better). TryHackMe are trying to make learning cyber incredibly accessible so it would be upsetting if the community wasn't upholding TryHackMe's values too 🙂

[odd acorn]

It's just a generic computer science cybersecurity degree.
https://warwick.ac.uk/study/undergraduate/courses/bsc-cyber-security/

Unfortunately, they have removed the module listing from the website so I don't know what I can or can't say 😛

[tawdry dove]

Ah, gotcha. If it's forensics or law I can probably point you in the right direction lol

Without breaking rules*

[odd acorn]

It's CICD, I spent the whole week setting up the software and docker, now I'm doing the write-up. It's just a lot of mental energy 🤣

[tawdry dove]

Oh oof. Good luck and keep it away from me

[odd acorn]

Ahahah, trust me I don't want it either rofl

[tawdry dove]

[odd acorn]

Only one section down and already at the word count 😁

[candid rain]

Sorry I was meaning to say someone was specifically gate keeping. What I have noticed on many forums is that people forget about the absolute beginners. I believe that when someone puts themselves out there and asks for help when learning the worst answer you can give them is "do some research". If my kid asked their teacher for help because they didn't understand something and the teacher just said read the text book and figure it out I wouldn't very happy with them. That is what I call gate keeping. Not saying that it is happening here I was just saying that its something I have notice on the internet in this field.

I wasn't trying to point fingers at anyone.

[odd acorn]

Ah, no problem at all. Thank you for clearing that up!

I do agree with you that there is a lot of "go research" in this field. I am more of a fan of the "this is how to find what you are. looking for, go read it" method if something is widely available or documented 😁

[hoary nymph]

Gave +1 Rep to @candid rain (current: #2083 - 1)

[prisma echo]

when in doubt, get thinkpad

[twin ridge]

CI/CD is fantastic

[balmy barn]

can u guys suggest what to use to remain anonymous when trying to attack a website? (educational purposes obviously so i can get some knowledge)

[south inlet]

Seems a strange question for educational purposes...

[tawdry dove]

Attacking a website that you don't own, and claiming it's educational, doesn't magically make it legal if that's what you're implying

[balmy barn]

😂

i think its better to ask here than forums on dnet

[balmy barn]

im curious how they stay hidden

[south inlet]

There are ways, however I don't feel comfortable discussing with somebody who is new, as lot's of people just use this server to try and learn black hat material.

[balmy barn]

hmm maybe im not new and was just wondering on what would people say?

[south inlet]

You been in the server for a four weeks, but nor much interaction.

[balmy barn]

idont use discord

i often get termed i just discovered this group when i saw tryhackme on reddit

[spark sun]

Many times, they don't. It's impossible to be completely anonymous.

[south inlet]

Please don't DM me without permission, have a look in #rules please

[balmy barn]

true

[balmy barn]

ok sorry man completely understandable

were on this type of shi so i get it 💀😂

[molten siren]

@south inlet am i bugging or do u have no pfp

[south inlet]

My pfp is a transparent image.

As you can see in light mode 🙂

[molten siren]

jesus

oh, i was wondering this whole time why my buttons were all blue on discord then realised i had dark reader on

i dont normally use it from the site

[molten siren]

sorry im stealing it, better than default

[south inlet]

😂

It is better than the default

[south inlet]

Do you know how?

[molten siren]

i think i did it wrong lmao

wait no it's working

[south inlet]

Yeah, you did.

[mighty echo]

wow quirky 😛

[lime fern]

Brotha tryna be like scrubz 😨

[wintry saffron]

I thought it was a “discord grey”image but yeah using a transparent image is way smarter

[south inlet]

Yeah, change to light mode it you won't see it.

Blends in well with light mode, Midnight dark mode on mobile.

[mystic tulip]

Strange question but yeah, is Debian usable on a laptop, I know it's incredibly stable but I hear people say the system breaks if u try to get newer packages or update

I don't want to be forced to use Ubuntu, an OS which forces me to use snaps

[pseudo bronze]

Imo very usable! I've used Debian as my daily driver for my laptop for roughly 5-6 years. The only thing was I had to enable non-free software for some wifi drivers iirc. I hadn't any issues with updating.

[mystic tulip]

Im considering moving to debian from arch

I will dual boot once I get another SSD

[pseudo bronze]

I'd say as long as you're okay with not having the bleeding edge packages or rolling release, it's pretty good- although you can always try out the testing or unstable branches. Although, I've recently switched to NixOS myself since I wanted to run Hyprland

[mystic tulip]

I think 2 yr old packages won't affect my daily workflow, I mean at least they are stable

[mystic tulip]

Does Nix use gnome by default or hyprland

[pseudo bronze]

I think GNOME? I haven't run it with a full DE yet tbh

[mystic tulip]

Can I DM you

[pseudo bronze]

tbh I'm not really open for DMs, but if you want to chat or ask me questions here I'm open to that!

[icy parrot]

Someone from Chhile ?

[summer verge]

I don't think so, I've seen somebody from Argentina living in UK, but nobody from Chile

[icy parrot]

auuu that's sad

[summer verge]

why?

[icy parrot]

nothing specific

[summer verge]

I don't get it but OK 😂

[silk yoke]

hi, im doing LinPrivEscNFS having issue when i try to use command mount

gmount -o rw, vers=2 10.10.47.86:/tmp /tmp/mountme
mount: only root can use "--options" option

i went through all the write ups, they dont have this issue

if any of you know what issue let me know

[rugged frigate]

the error message tells you what it wrong and how to solve it already.

[summer verge]

#room-help

[summer verge]

but it's too hard to read 😂

[rose flicker]

can someone help me with some aswwers?

#nmap room

[summer verge]

you should go to#room-help also please don't post the same question in different channels, it won't get answers any faster, just would annoying people

[candid rain]

Reading and understanding what you are reading are two different things.

[summer verge]

why pay attention and try to figure it out what it says, if you can ask, people are so lazy nowadays

[candid rain]

Ever heard the expression "can't see the forest through the trees"? They may have been working at things for a long time and just frustrated or just overlooked it. It happens. You are assuming that because they ask for help then they couldn't have first tried to figure it out for them selves. Nothing wrong with asking for help.

[summer verge]

nothing wrong asking for help, but if you just post an error and don't tell anything else, what you tried, or any other clue, you come out as lazy. People nowadays see more than 3 lines and get automatically frustated 😂

[candid rain]

In this day and age I find asking a question and having a conversation often times is a better use of time and I learn more than sifting through google search results and having to scan article that often times I either don't understand or are not quite what I am looking for. And you can't ask most web pages a question if you don't fully understand the information. I find conversations one of the best ways to fully understand something. That being said some people find researching and reading is how they learn best. 😅 What one person sees as lazy another sees as efficient.

[tawdry dove]

Low effort questions get low effort responses. Cybersecurity requires you to be able to conduct research on your own, without outside help. Reading man pages, Google, etc etc is vital. If you do some research and don't understand what you are reading, the first step is to take a step back and see what knowledge gaps you have. Do some more reading to fill those gaps. If there's still a lack of understanding, coming with a well formated, informed, question showing what you did to solve it yourself is the most appropriate. If you show you're trying through the former, people will provide equal if not greater effort in their responses.

It also shows that you respect people's time.

[summer verge]

my point exactly

[candid rain]

I respectfully disagree. That is basically telling someone who is learning that they should teach them selves. You don't send your kid to school and tell them to teach themselves math. Asking questions on the internet is research it is just a much more efficient research. In fact I believe that is the entire point of some of these rooms in this discord server is to ask questions and help people.

[summer verge]

it's more of a mind set, I understand what didyou means

[candid rain]

sorry I hit a wrong key and posted that before I meant to haha

[rugged frigate]

most simple questions can be answered using a little bit of searching and even looking up single terms if in doubt.

[candid rain]

I agree it is a mind set but I believe it is a mind set that isn't caught up to modern times. Kind of like depending how old you are at some point you may have been told to look for your answer in an encyclopedia. Long gone are those days. Forums and discord servers are often a better source of information. It gives you slightly different perspectives or even just worded in a better way.

[summer verge]

of course it's not wrong asking question, it's what you ask and the way you ask that some time is wrong. You don't ask how I do this, you research, and try a few thing and then ask, and say I did this and this and had this error, also I read these and didn't quiet understood this, etc.

you don't say help me and that's it

[rugged frigate]

modern times wants to be told what to do though imo. attention span is decreasing and thus the will to spend time for longer tasks.

[candid rain]

Really the only difference is you either as google and get a answer that someone typed at an earlier date and may not be exactly what you asked or you ask the question on a forum and the answer isn't prewritten and is specific to your question. Also it allows the person or persons answering the ask questions back and help to steer people in the right direction.

[candid rain]

While that is true people are also becoming more efficient at things as well. Why spend hours hunting for information if you can get the same information in minutes. I only joined the tryhackme server when I had a question and couldn't get answers on right ups because my problem was a little different. Asking was a much better use of my limited time and far less frustrating. I am not in the field and this is all just for fun for me and to learn something new. I don't have hours to spend going down rabbit holes trying to find and answer. I imagine many other people may be in the same situation.

just my perspective I have to get going I hope everyone has a good night/day. I really enjoy hearing others perspectives😁

[radiant jacinth]

hello everyone, i can't connect to openvpn, im new here and can't troubleshot the issue

timur_cyber@Macbook:~/Downloads$ openvpn timurcyber.ovpn
2024-05-29 11:54:24 --cipher is not set. Previous OpenVPN version defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers.
2024-05-29 11:54:24 OpenVPN 2.5.9 aarch64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Sep 29 2023
2024-05-29 11:54:24 library versions: OpenSSL 3.0.2 15 Mar 2022, LZO 2.10
2024-05-29 11:54:24 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2024-05-29 11:54:24 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2024-05-29 11:54:24 TCP/UDP: Preserving recently used remote address: [AF_INET]18.202.168.160:1194
2024-05-29 11:54:24 Socket Buffers: R=[212992->212992] S=[212992->212992]
2024-05-29 11:54:24 UDP link local: (not bound)
2024-05-29 11:54:24 UDP link remote: [AF_INET]18.202.168.160:1194
2024-05-29 11:54:24 TLS: Initial packet from [AF_INET]18.202.168.160:1194, sid=2ec775ee 2ff77197
2024-05-29 11:54:24 VERIFY ERROR: depth=1, error=self-signed certificate in certificate chain: CN=ChangeMe, serial=425397202556807641543660048237946304772097879576
2024-05-29 11:54:24 OpenSSL: error:0A000086:SSL routines::certificate verify failed
2024-05-29 11:54:24 TLS_ERROR: BIO read tls_read_plaintext error
2024-05-29 11:54:24 TLS Error: TLS object -> incoming plaintext read error
2024-05-29 11:54:24 TLS Error: TLS handshake failed
2024-05-29 11:54:24 SIGUSR1[soft,tls-error] received, process restarting
2024-05-29 11:54:24 Restart pause, 5 second(s)

who can say, what's wrong with it?

[rugged frigate]

regenerate your .ovpn file. I assume you generated it a long time ago.

[radiant jacinth]

i tried it 3-4 times, but it didn't helped, tried to ask chatGPT but no results

[south inlet]

#site-support please.

[south inlet]

Hi, don't advertise those sort of things, or ask other members to look for any.

This is illegal.

[silk yoke]

thank you i found the solution

[hoary nymph]

Gave +1 Rep to @rugged frigate (current: #123 - 53)

[plucky badger]

Did anyone take ISC2 CC certification? If YES, On a scale of 1-10, how hard it is for a beginner who completed THM Intro to Cybersecurity and Pre-sec and some related to ISC2 CC videos.

[cloud zinc]

I haven't bothered to take the exam but I looked at the course. It's very basic, non-technical and has little overlap with THM. It's more aimed at the management side of things, but at a low level compared to other ISC2 certs.

In other words: A person intelligent enough to figure out THM rooms has all it takes to pass ISC2 CC. Then it's just a matter of putting in the study huors.

[plucky badger]

Oh okay! Im gonna take it tommorrow so checking if anyone has idea on it.

[cloud zinc]

Good luck. Did you go through the ISC2 course? Without that it's gonna be tough.

[plucky badger]

Yes, I do! It looks easy lil bit to me but never know till i get certified on it! Lol

[cloud zinc]

Good luck!

[plucky badger]

and Thanks much @cloud zinc

[hoary nymph]

Gave +1 Rep to @cloud zinc (current: #191 - 32)

[weary haven]

quiet in here

[summer verge]

I thought the name of the channel was a give away, apparently not 😉

[rose flicker]

can someone help me with this question

I might not adding the right format

Which TCP ping scan does not require a privileged account?

[summer verge]

is this for homework?

[rose flicker]

yes

Nmap Live Host Discovery

[summer verge]

we don't help with homework it's against server rules

[rose flicker]

room-help?

[summer verge]

if it's a room you can go to #room-help if it's homework from uni or work we can't help you

[south inlet]

Is this school work?

[sick gazelle]

Yes, it's why I didn't ask in room help I guess

[south inlet]

Sorry, we don't help with school/college/uni or work related support.

That would be cheating.

[sick gazelle]

Ok no problem

[south inlet]

Thank you for understanding 😄

[sick gazelle]

Ofc thanks

[proven thistle]

😵‍💫

[lost umbra]

Hello guys! What certifications do I need to start work as SOC Analyst??? 🤔🤔🤔

[fathom panther]

L1, usually there would be none as the job postings I usually see for those is entry level or if youre transitioning from a different IT position, BTL1, Sec+, and CCD are good.

[twin ridge]

I always read BTL as BLT

[lost umbra]

Thank you very much!!!

[hoary nymph]

Gave +1 Rep to @fathom panther (current: #22 - 375)

[rose flicker]

my VPN it not working in my machi

─$ sudo nmap -sV 10.2.14.61
[sudo] password for kali:
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-31 19:21 EDT
Nmap scan report for 10.2.14.61
Host is up (0.000012s latency).
All 1000 scanned ports on 10.2.14.61 are in ignored states.
Not shown: 1000 closed tcp ports (reset)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

[sly skiff]

https://github.com/miracleaxax/3num

[naive plover]

hello, in linpeas can i add some custom key word to be highlighted in output ?

or just searching it in the outputted text file

[spark sun]

Typically you would just grep or awk for lines containing your match term

[naive plover]

okay thanks, i was wondering if there is a flag in the args

[hoary nymph]

Gave +1 Rep to @spark sun (current: #10 - 752)

[twin ridge]

Don't think so, but the script isn't compiled so it shouldn't be too hard to check

[naive plover]

yes

i can even add a line in the script

[twin ridge]

Open a pr, might be interesting to others

[naive plover]

i'll try thx

[lost saddle]

good morning

[twin ridge]

very carefully

[summer verge]

in slowmode

[twin ridge]

whoa, slow down there, Bob

[mighty echo]

ˢʰʰʰʰ

[worthy spire]

Looking to move soon, my best internet option might be Starlink, anyone have reviews for remote work/THM experience?

[viral spindle]

Not me specifically but a buddy of mine has it and he hasnt had any issues

[radiant jacinth]

There are some beginner paths you could follow on THM. See this message for a recommended order: #general message

Yeah thats a good one

Nah, not really needed. Python or something is always handy but not needed.

But id still recommend to learn it :p

Thats a hard question... Tryhackme has some rooms... I like https://codecademy.com too

No problem. Good luck :)

[daring vapor]

I’m usually a fan of free resources, but tbh codecademy is really good

[silver apex]

I know I'm late on this, but following along to NetworkChuck's python course on YouTube is also a great source! He's really engaging and teaches it very well (he also does more videos on hacking and cybersecurity in general, so you should definitely check him out)

[south inlet]

@hidden jackal

FYI all deleted messages are recorded, and this is a PG13 server.

[radiant jacinth]

You know he is not liked by much cyber security professionals right? :p

[hidden jackal]

If anyone you would prefer to

[hoary nymph]

Gave +1 Rep to @silver apex (current: #2089 - 1)

[silver apex]

Yeah you're right, but he is a good place to start

[summer verge]

not a fan too much marketing, sales, and splash and not enough info, the old videos were OK

[summer verge]

check https://www.codewars.com/ it's fan and you learn too

[reef glade]

Hello, I was wondering how to claim a CVE ?

its my first cve 😄

[radiant jacinth]

@reef glade how about going to MITRE and doing the same

well, kudos bud for the first CVE

[willow veldt]

Nice...congrats!

[daring vapor]

Thanks, I heard about it but never used it. I’m not that good at programming, but doing some leetcode to brush up on data structures and algorithms hahaha

[hoary nymph]

Gave +1 Rep to @summer verge (current: #77 - 80)

[tawdry dove]

Was this part of a bug bounty, or similar, and have you conducted a responsible disclosure to the affected organization(s)?

[soft pier]

you can skip all the premium rooms and still get a decent understanding

or you could follow this image instead:

[soft pier]

No all of them should be free... Some few rare ones might have become premium

[hoary nymph]

Gave +1 Rep to @soft pier (current: #4 - 1769)

[little vector]

This image is indeed helpful.

[green gate]

Hi everyone did you see this playlist https://www.youtube.com/watch?v=ROO2pDPgja4&list=PLCD3FoP0vxE4FI5dvdLnx-ky8sitsIgOB&ab_channel=DarkSec

[south inlet]

Dark used to be the community manager for TryHackMe

[green gate]

Why isn't he today?

[south inlet]

Dark left, I think he moved to HackTheBox.

This was years ago

Well, not left, more moved on?

[green gate]

interesting i didn't know about HackTheBox

[patent fox]

any reasons why?

[south inlet]

He just wanted to move I guess?

[patent fox]

he won't be creating any new THM rooms now 😦 ; his rooms were great

[south inlet]

I can't remember the last time Dark created/uploaded a room...

Don't worry, the current content creators THM have are great, not to mention the community members.

[patent fox]

yeah

[green gate]

I am not sure if i can say that here but he have his own server

[south inlet]

I'm not surprised tbh 😄

[neon dirge]

all of that for free?

[green gate]

. @neon dirge

[proper acorn]

hi

[chrome zealot]

Trying to have a quiet conversation here.

[radiant jacinth]

Can't hear you

[chrome zealot]

it is really quiet in here. I'm having to whisper (cue whispering sounds)

[sage sigil]

v'z juvfcrevat va ebg13! (rot13 is not allowed, nvm)

[south inlet]

Hello, this is English only server. 🙂

For moderation purposes, this included encrypted messages.

[sage sigil]

alright

[twin ridge]

Now is rot13 really encryption is another question, but yeah if we have to work to understand what you're saying it's going to be an issue

[patent spruce]

What are arguments for rot13 not being an encryption?

[tawdry dove]

It is? It's just that it's a super weak form of encryption.

[patent spruce]

that's what I figured.

[drifting isle]

Hello quick question
I want to create two separate networks on one router
I want to put my CCTV and some devices in a network( like the settings of the router itself), and other devices, such as my friends devices, in another network, for security purpose.
I have an option on my router called Guest WIFI. I understand what it's about, making VLANs.
But I want to know how much security this provides. Is it possible in any way that a device from a different VLAN can connect to another device from another VLAN? (lets say even Discover device's IP of a separat VLAN)

[timid isle]

There is something called VLAN hopping so it is possible but probably hard to excecute when you are not a high profile target, i would buy a proper switch layer 3 that you can configure. I dont know how trustworthy and reliable the functions of your router are

[drifting isle]

I see, thank you

May If i would buy a switch L3, I think i should buy also a wireless access point, so the devices can connect wirelessly like phones

may This makes it a little expensive

[spark sun]

probably won't be feasible with consumer networking gear

[timid isle]

Your welcome,I would look for a smart managed switch like netgears( or an TP Link TL-SG105PE) if u want an easier config because its over web access/browser, unless you want to really config it on the cli then there are some cheap layer 3 switches from FS and a wireless access point i would try to get TP-Link EAP115 N300 ( then look that the layer 3 switch has some power over ethernet then it can power the wireless access point without that you need an additional power supply ( i would look for IEEE-802.3 af/at that supports around 65 watt that is mostly enough for all wireless access points that support PoE))

I guess in total it could be when u get the TP-Link TL-SG105PE and the TP-Link EAP115 N300 around 100 dollar/euro depending where u from,maybe a bit more

[drifting isle]

Thank you very much

[hoary nymph]

Gave +1 Rep to @timid isle (current: #2092 - 1)

[drifting isle]

I see

[twin ridge]

let's keep those in the koth channels, please

[radiant jacinth]

Does anyone have experience with parallels on Mac?
The software to run W11 or linux on mac as application/vm.

Especially compared with VMware fusion?

[south inlet]

Can't get Vmware pro?

[radiant jacinth]

Nah, just curious how it works and peoples experiences

[odd acorn]

Parallels is amazing. It massively out performs VMware fusion both in performance and just ease of use.

I personally wouldn’t pay for it but if you have the money I would recommend it

[radiant jacinth]

Interesting, thank you!

[errant lodge]

a

[finite narwhal]

https://tryhackme.com/games/koth/join/d566593e1683615de7291de2

[neat torrent]

so switching to linux mint today

was going with rhel, Roxy in particular but i just idk i like to use it for my servers not my workstation i mean i could but idk
trying something different
i used rhel, gentoo, ubuntu, debian, arch ect ect but never mint.

[patent spruce]

what sets Mint apart from Ubuntu other than the DE?

[neat torrent]

i just wanted the DE.
it doesn’t matter anymore
i can’t switch because i can’t use dual gpus

i was going to use kvm passthrough since i need windows

[timid isle]

Your welcome 🙂

[hoary nymph]

Gave 1 Rep to hjkkolp_11153 (current: #2094 - 1)

[patent spruce]

Goooooood morning! ☕️

[valid walrus]

good morning y'all

[patent spruce]

Watcha all up to?

[green gate]

when and why all tryhackme machines now started to have only 1 hour for use and not 2?

[south inlet]

Subscribers get 2 hours base time on machines, you can add 1 hour to target machines.

Free users are assigned either 60 mins rolling time, or one boot up a day.

[mystic tulip]

It's one bootup a day, bit misleading when it says "60 mins per day" but doesn't work if u shut it down after 15 mins or so and then boot it up again

[radiant jacinth]

our developer is active

[smoky mortar]

It explains the maximum allowance for free vs. unlimited allowance when subscribed. 🙂

[twin ridge]

For the attackbox

[sly quartz]

did I get money back if I cancel subscription of THM?

[south inlet]

Is it monthly or annual?

[sly quartz]

monthly

[south inlet]

Afaik No, they don't provide refunds for their monthly.

[sly quartz]

no problem

[patent spruce]

Yup yup 🤙🤙

Trying to pop by here each day when I got to thm

[true yew]

Please let me know if this isn't the right place to ask but, I want to do a little challenge for myself. I've never owned minecraft but used to watch people play it all the time and last year I downloaded it for the PC but realized I needed to make a microsoft account to log in. Im not a fan of game launchers and DEFINITELY not a fan of making email connected accounts for games just to play them on PC (can you tell my age, yet?). So I'd love to try to figure out a way to play the game without making an microsoft email address and use say... a burner one or bypass it alltogether. I have absolutely no good reason to do any of this. I just think it seems like a fun way to challenge myself so I want to see if anyone has been able to do this.

[little shore]

I'd say a burner one is the way to go. There should be other things you could challenge yourself with, like tryhackme.com

[true yew]

I've completed all the paths I've needed to do for my job and doing others for fun but I need something different 🙂

but thank you for confirming

[little shore]

Oh.. if you're done with the paths, maybe have a look at HTB Academy as well as I've been reading lots of good reviews about it.

[true yew]

Hackthebox? I think I did try them a few years ago but I went with HTS instead

[twin ridge]

You know there's more than just the paths

[little shore]

Yeah, my bad, that's why I stopped replying.

[fathom panther]

You’d still be legally required to pay for it.

[twin ridge]

Pretty sure there's a java version of Minecraft, don't know how maintained it is since Microsoft bought it

[fathom panther]

Yes, when you buy Minecraft you get both Java and Bedrock edition.

[magic gale]

Hello everyone
I want to become a security researcher
i search regarding security researcher on the google it says basics things like reverse engineering, bachelor degree, blah blah
can anyone in the server guide me how i become security researcher or any course

[fathom panther]

Security research is a broad field. One example is malware researchers: they dissect and analyze novel malware to find IoCs, reverse engineer the attack, and understand how it works essentially. Another is cyber threat intelligence research where you track threat actors, understand their organization structure, find out their common TTPs, infrastructure, etc.

Pick out a field you like (e.g., application security) and build the required core competencies on it. After that, you can look at how you can start your research. It can be looking for vulnerabilities or how to improve the current security.

[tawdry dove]

Java is still updated

For now

[radiant jacinth]

Thats not possible. You have to connect it with a Microsoft account

Dont you need a microsoft acount to even download it?

[tawdry dove]

I believe so

Everything was integrated a couple of months ago

[true yew]

No, I was able to download it without an account. Just can't log in without an account

[radiant jacinth]

plz dm me for anyone interested in linux system programming

[tawdry dove]

We've got the #programming channel if you want to talk about programming.

[radiant jacinth]

well most of the time i get ignored haha

[tawdry dove]

I see you posted once. It may be better if you ask a more pointed question? As in what specifically are you running into that's giving you trouble, vs the whole thing or this whole component is overwhelming.

[radiant jacinth]

i did ask a specific one yesterday about the pwn101 room

[tawdry dove]

I was talking about your message in #programming

[patent spruce]

hai all!! whats up

[tawdry dove]

Hello

[patent spruce]

canadian or scandi?

[tawdry dove]

Neither?

If you're asking where I am from

[patent spruce]

yea. cas of the moose!! wait they exist in US too? think I seen one in colorado

[tawdry dove]

Yes, A. Alces Americana and A. Alces Gigas are in the US

Not sure which moose species is in Colorado

[patent spruce]

oh

yea.. might have been utah but all the same lmao

you big into nature or just Alces?

[tawdry dove]

I like nature

The moose out in the west may be Alces Alces Shirasi

vs Alces Alces Andersoni which are in/closer to Canada rockies

[patent spruce]

cool cool. I like corvids 🙂 hoping to see a bluejay some day

[flat willow]

If i wanna make Videos of me doing the Paths, should i hide the Flags?

[crimson fulcrum]

Up to you, to be honest.

I've seen videos where they have the flags, I still do all the steps I have to do, and problem solve it when I get stuck or something goes south.

But I ultimately use the spoiler only when I get stuck for hours or days, due to technical issues.

[cloud zinc]

I redact all answer in my write-ups. I'm not producing answers dumps. Should I start doing videos I'm gonna redact at least the main flags of a room.

If it's a CTF with just two flags I would hide both, personally.

[sleek yew]

Hello I'm having a challenge , im new to to The cyber world and would love to be helped , my karl linux 2024.2 virtual box Amd64 is inaccessible, please help me out

Any help I'd really appreciate

[little shore]

How did you install your kali linux VM?

[sleek yew]

i followed all. steps on YouTube ..

[sick lark]

Could you elaborate a bit more on as to what exactly your issue is? For example, is the VM not showing the distro? Is it not allowing you to run it? Is it crashing?

[sleek yew]

and even my karl Linux ain't opening yet my virtualization is on

i wish i could share my an image so that someone helps me out

[sleek yew]

can i dm and show you the issue sir ?

[little shore]

I'm not sure if this topic suits this channel, but you'll need to verify your account to post screenshots / pictures.

[frail vault]

@sleek yew

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Jun 15, 2024, 4:26 AM

[sick lark]

Yes

[sick lark]

Just out of curiosity, what topics WOULD fall under "qiuet conversation"?

[little shore]

In the description, it says relaxed and quiet. So I'm not certain myself. I just don't see troubleshooting topics being discussed here. Maybe in the #infosec-general channel?

[south inlet]

This channel is for people who which to talk, but can find #general overwhelming due how to fast it can go

[magic shell]

Is there a monitoring app that doesn’t need access to the target phone ?

[fathom panther]

What are you trying to do with it?

[midnight forge]

I'm pretty sure it's just a channel for not writing in caps. No shouting

[south inlet]

Well, you'd be wrong...

[midnight forge]

Okay I'm gonna stop trying to make jokes in general in this discord. I think it's fallen flat everytime

[south inlet]

There is a time and place for jokes, this wasn't it...

[midnight forge]

aight...

[radiant jacinth]

Especially place😂😛

[patent spruce]

hi ya'll

[odd acorn]

Hey unfortunately we don’t help with schoolwork here.

[mystic tulip]

Is it necessary to learn C/C++ if u want to get a cybersecurity job, and is it actually beneficial to know it

[cloud zinc]

It's not necessary for most jobs, it's a hard requirement for some jobs. It's very beneficial to learn C as it teaches you how computers work at a low (albeit not the lowest) level, which languages like python or JavaScript don't.

[midnight forge]

Is c better than c++ then?

[cloud zinc]

To learn how computers work at a lower level than modern languages: Yes. C++ is hugely complex and none of what it offers is needed for that purpose.

[errant estuary]

are we allowed to work on new rooms in teams (pairs) or does that fall under no hints allowed?

[radiant jacinth]

How come my pc goes to sleep yet when I turn it on either through keyboard or mouse it wakes up without the screens waking up

[granite parrot]

It's absolutely necessary and vitally essential for certain things like reverse engineering and exploit development. If you don't want to go that route then it's not applicable to you. If you do go that route you'll need to learn computer science, like understand the stack, heap, call stack, pointers, buffers, and how memory and registers work at a machine hardware level. Essentially, you're controlling hardware through voltage modification, and you need to understand how the machine is built and how it functions, how it processes data and stores it in memory.

[wide night]

can you put the ssl data into intruder of burpsuite

[mystic tulip]

Alr thanks 🙏

[hoary nymph]

Gave +1 Rep to @cloud zinc (current: #54 - 129)

[mystic tulip]

My uni isn't teaching c/c++ to my class atm (they probably should) so I decided to self learn it

[mystic tulip]

For those purposes would only C be enough? Or is it necessary to get good at OOP in c++

Would some knowledge of OOP in c++ be beneficial for stuff like secure coding?

[mighty echo]

https://nedbatchelder.com/blog/202401/you_probably_dont_need_to_learn_c.html
What do you think about this blog post?

[cloud zinc]

In the 2nd paragraph a lot of points that I never thought of a reason to get exposed to C. Like performance. Strawmen imo.

Then

C can teach you useful things, like how memory is a huge array of bytes, but you can also learn that without writing C programs. People say, C teaches you about memory allocation. Yes it does, but you can learn what that means as a concept without learning a programming language.

That's not an argument against learning those concepts with the language that is still the foundation of a lot of the stuff we use every day. Like the Linux kernel or the Python runtime.

And besides, what will Python or Ruby developers do with that knowledge other than appreciate that their languages do that work for them and they no longer have to think about it

In my opinion that alone is reason enough to learn it, to be aware of that. Knowing that there's more and at least roughly what, without going even deeper to assembly. Seems like a good balance to me.

"What are you gonna do with that knowledge" is something I hear from people studying at university who should have gone for trade school instead. Some people value deeper understanding others care more about application, that's ok.

Pointers came up a lot in the Mastodon replies. Pointers underpin concepts in higher-level languages, but you can explain those concepts as references instead, and skip pointer arithmetic, aliasing, and null pointers completely.

Again: maybe you can teach that without C, but why bother. C is almost everywhere under the surface, it's not rocket science, it teaches exactly these things in a somewhat practical manner. So what's the argument to skip it and learn about those ideas with Powerpoint slides, instead of implementing them in code yourself. People tend to learn best building and breaking stuff.

C has about 30 keywords. It's really easy to learn and play around with. Nobody was ever talking about writing large, safe, optimized applications in this context.

TLTR: Pointless blog post imo. But ultimately personal choice.

[mighty echo]

Interesting, appreciate your time - I don't know any C, so can't formulate an opinion on it but its interesting to see the perspectives of different people on this matter

[primal steppe]

C is vulnerability appreciation 😄

[granite parrot]

I’m tired of this: “You have to learn C so you can understand how a computer really works.”

vs.

https://www.youtube.com/watch?v=CYvJPra7Ebk

I would not pay any mind to anyone who downplays the importance of the relationship between C language and computer science

[soft pier]

well C has come very very far

still there is a lot of instances where other choices then C makes sense for programming

[gleaming kayak]

You don' really have to learn c cause it's the only choice what I did was that i first learnt a little of C after getting a good idea of everything and why the syntax is how it is I switched to python now I make gui, web backed and network stuff in python

[soft pier]

well we started with c++ in school and then moved into microsoft java.... then shadow made their final project in openjava

though technically shadow had used oracle and open java ton before that to make minceraft mods

[neon dirge]

we started with pascal 😑

[granite parrot]

Even Ghidra or IDA pro will decompile everything into C and not C++ or anything else. You take a go binary and reverse it and you will see code in C. It's useful to know C and C++ among other system level lower languages for that career path. The ASM instructions are widely understood across most platforms in the C compiler design so it is easier to reverse them to C instead of anything else.

Otherwise, C/C++ are not that important at all in Cybersecurity. You need to know basic scripting to automate your workflow and that's it in most cybersecurity. If you're going for SAST/DAST, and code auditing, you need to be an already established software engineer.

Only a few career paths in Cybersecurity require knowledge of software engineering and/or programming.

[granite parrot]

For example this is how I reverse engineer Diablo 2

As you can see, the offset for that function in Ghidra is in decompiled C, however the original source code was in C++

Once you figure out what's going on in C, you can modify the ASM. This is just one example of reverse engineering requiring C. I can open up a malware which was written in Golang, and you again will see only C code in Ghidra or IDA Pro decompilers.

Furthermore for binary exploit development, you need to know C so you can quickly write exploits. Exploits basically automate the steps you manually take. So exploit is just a small program/script that runs the steps you need to take in order to escalate priv or whatever else.

You can do it in other languages, but sometimes you need to actually compile and run the exploit and it can't be done from a scripting engine like python or perl.

[odd acorn]

https://www.blizzard.com/en-gb/legal/28d5ebbf-c245-4408-8ba9-043dd5f056bf/legal-faq#:~:text=You also agree that you will not alter%2C disassemble%2C decompile%2C reverse engineer or otherwise modify the Downloaded Content.

You're breaking their terms

[granite parrot]

So that's not applicable. Code editing is 100% allowed by Blizzard. This has been fully established for the past 20 years in the Diablo 2 modding community.

https://github.com/ThePhrozenKeep/D2MOO

Reverse engineering is 100% legal because no original code is ever used.

The day Blizzard says that we can no longer mod Diablo 2 internals and engine etc etc. is the day I leave the Diablo 2 modding forever.

But it's been 20+ years and they only care about battle.net/hacks/online stuff. They don't care what you do in Single player offline.

[south inlet]

I remember in 2005 Blizzard won in court that programmers don't have the right to reverse-eningineer their games.

[granite parrot]

Source.

[south inlet]

https://www.cnet.com/tech/tech-industry/blizzard-wins-lawsuit-on-video-game-hacking/

[granite parrot]

Hacking is not the same as modding.

[south inlet]

You asked for a source, you got it.

nobody has the right to RE their games.

[granite parrot]

Did you read it?

[south inlet]

Yes.

[granite parrot]

I specifically addressed that already.

[south inlet]

A federal appeals court has ruled that computer programmers do not have the right to reverse-engineer Blizzard Entertainment's video games to improve their playability.

[granite parrot]

The parties in that case purposefully reverse engineered diablo 2 BATTLE NET TCP protocols. Not single player game.

[south inlet]

I also remember it because I used to do it...

[granite parrot]

The defendants in the case, Ross Combs and Rob Crittenden, reverse-engineered the Blizzard protocol using tools like "tcpdump" to listen to the software's communications with a game server. Eventually, their "bnetd" project let Blizzard games connect with unofficial servers, yielding benefits like faster response times.

Again, that's network stuff. Highly illegal.

Single player is actually encouraged by Blizzard. They have released OFFICIAL modding guides for players even. Google it.

[odd acorn]

I am here to protect the Discord server and it's members.
Their legal FAQ says no reverse engineering, and you are using a RE tool on the game.

Unless you can get a written statement from Blizzard Entertainment saying that you can do it, it's not allowed here @granite parrot 🙂

[granite parrot]

Sure np. I am not trying to discuss it here. I was just giving an example anyway. Furthermore in the screenshot, the Ghidra is reversing the source code from D2MOO, and not Diablo 2. It's nothing to do with the Blizzard game code.

[odd acorn]

No problem, thank you for understanding :)

[granite parrot]

You're welcome.

[cloud zinc]

Terms which exclusively apply to those who agreed to them. Under the condition that they are legal in the individual's jurisdiction. I understand mods rather being safe than sorry, but in general companies writing things in their T&C means nothing until proven otherwise.

[odd acorn]

You should know that unless you have explicit permission to mess with something, you shouldn't do it 😉

[cloud zinc]

That's a different discussion, one about ethics.

You pointed out their terms from their "legal faq". I am not legally bound to whatever blizzard writes in any of their documenrs as I have never entered a contract with blizzard agreeing to any of it. I don't know about HCB of course.

In my jurisdiction I don't need explicit permission to do with my property whatever I choose to do with it. Publishing the results of such actions is yet another topic.

[south inlet]

They play their games, they would have entered their key thus agreeing to their EULA.

[cloud zinc]

My message was meant as a general statement since I have to object to the idea of everything a company writing in whatever document being applicable and enforcable to people who have not agreed to it. That's what companies bet on.
In the special case here the "legal FAQ" that was quoted explicitely applies to downloaded content from blizzard.com. Given that DIablo 2 is 24 years old there's a high chance at least this specific source isn't even meant to be applicable here.

[granite parrot]

The real deeper point was that knowing C for this path is important as RE is done in C for most practical and pragmatic reasons. Golang, C++, Rust, all decompile to C in Ghidra/IDA Pro

[cloud zinc]

Can you recommend a YouTube channel on the general topic of RE?

[patent spruce]

hi all

[granite parrot]

I generally learn best with reading and I don't know youtube channels about that.

[white zinc]

If you plan on doing binary exploitation, reverse engineering, working with legacy C code, kernel development/exploitation, firmware development/exploitation, or writing C bindings to C libraries in higher-level languages, then yes knowing C is useful. However, if you're planning on exclusively doing web security/development or using high-level languages like Python, Ruby, JavaScript, Go, Rust, Zig, Crystal, Nim, then it might not be necessary to learn C.

[lucid prawn]

Hey guys, just have some questions, I find that I struggle with exploiting websites, is there any good resources online to learn all the owasp top 10 attacks and how to effectively find them and exploit them, like XSS, LFI, etc etc. Also what certs in the web applicaiton pen testing world are good? thank you

[cloud zinc]

There's several thm rooms on owasp top 10

[patent spruce]

ho all

[distant hawk]

I’m shooting for the PJPT and then the OSCP. The OCSP is the most recognized I believe, but it’s difficult. As for good resources, keep at it with TryHackMe and if you can I recommend even some HackTheBox.

[midnight forge]

Like cyberterms said, the owasp rooms on THM are great in my experience. I did some of them fairly recently and felt like I learned a ton

[fathom panther]

dont waste your time on the PJPT imo

[humble sigil]

is there 101 for tryhackme.. just wondering where to go from here. I'm in the easyCTF room.

[glass jetty]

https://portswigger.net

[fathom panther]

#start-here to understand tryhackme

[patent spruce]

is there a dev room?

[cloud zinc]

Dev in what sense? There's DevSecOps

[patent spruce]

ty. very unfamiliar with discord^^

[patent spruce]

no just general. got two ways to write something and I dislike both so was gonna ask for opinions^^

[south inlet]

Thats from THM

[patent spruce]

oh lmao

[twin ridge]

There's #programming

[tacit quarry]

sooo my friend fell for a fake game hack, and basically the game installs a node js server and sends all your browser passwords and tokens i am still unclear about how its doing it, can I get some generals direction towards how I can dissect this malware?

[south inlet]

Malware is for advanced chat only, as it's not a beginer level skill, and the fact you don't know where to start is probably a good clue that you probably shouldn't.

[frail vault]

Discord: What are the advanced channels?

Article Link

https://help.tryhackme.com/en/articles/8671900-discord-what-are-the-advanced-channels

Jun 18, 2024, 5:54 PM

[tacit quarry]

I not really a.. cyber sec specialist but I do know how backends work, this thing has harmed 9k people so far, steals google accounts, session tokens and passwords there's not much i can do rn so the more i know the better ig and I fair certain that the virus isn't a binary and the source code might also be shipped with that, although i can't do much... is there a white hat hacker forum where i can post the malware so the knights can retaliate?

[south inlet]

Not that I know of.

[tacit quarry]

so there's nothing I can do to prevent this?

[cloud zinc]

Hacking back/retaliation is illegal in most jurisdictions.

[tacit quarry]

hmm i didn't really mean retaliation in that manner, I meant getting them to face the legal actions because I don't know what will result in them facing the legal actions

[cloud zinc]

More promising would be sharing the word what that malware does and which servers it connects to so people can configure filters to stop it on their networks. But if you're not an established name chances are nobody takes you seriously enough to act on your report.

[spark sun]

Report to law enforcement. Amateurs getting involved in the investigation has actually caused charges to be dropped, as the investigation and information gained from the amatuers can become "poisoned" and unusable.

[tacit quarry]

alright I agree with both, for the second comment the ip comes from istanbul because that's what google reported the hacker tried to login from, so what are the chances that it happened behind a series of proxy chains

if i really do report it to istanbul cyb dept and there's no hacker there at all..

[tawdry dove]

You report it to your country's police

[tacit quarry]

hmmmmmm-

[tawdry dove]

Not some other country

[tacit quarry]

alright..

does anyone want the link to that infected game by any chance?

[tawdry dove]

No

[south inlet]

Absolutely not.

[tacit quarry]

lol ok

[frail vault]

<#651923438524432404>

Rule 4 - No Illegal or Harmful Activity

We do not teach unethical hackers. Please don't discuss illegal or unethical topics. Please don't post any intentionally harmful commands or distribute malware.

TryHackMe Rules · Jun 18, 2024, 6:08 PM

[south inlet]

@tacit quarry ^

[tacit quarry]

you know i didn't mean it that way

[patent spruce]

just what I was looking for - thanks 😄

[hoary nymph]

Gave +1 Rep to @twin ridge (current: #12 - 578)

[glossy ledge]

shouldnt rely much on the IP it could be a vpn, proxy server etc

[cloud zinc]

@odd acorn

[supple galleon]

whats this rep thing

[cloud zinc]

The more rep(utation) points you get the... well the more you have. Doesn't really do anything.

[supple galleon]

oh

[cloud zinc]

If you reply someone and thank them they get rep. Thanks!

[hoary nymph]

Gave +1 Rep to @supple galleon (current: #2102 - 1)

[supple galleon]

Thanks for telling me!

[hoary nymph]

Gave +1 Rep to @cloud zinc (current: #50 - 146)

[cloud zinc]

So I got 146 rep and i'm on 50th place on the server

[chrome zealot]

quiet conversation

quieeeeet

whispering

[tepid notch]

shhh

thats too loud

lol jkjk

[cloud zinc]

There seems to be no counterpart to YELLING in text communication.

[twin ridge]

You know that rep is totally useless, yes?

[cloud zinc]

#quiet-conversation message

[twin ridge]

Just making sure

[tepid notch]

there is: WLALALALALALYOYOISHOUT

also, it seems like, to thm mods, loud conversation isn't yelling, its sending more than 1 message in 10 seconds

[radiant jacinth]

Any opinions on VMware

[junior ember]

workstation is in an alright state right now but when something goes wrong, their support are beyond useless (even if it's a business license)

and afaik Fusion still doesn't have ARM support (?)

[summer verge]

many the menu is full of them 😂

[south inlet]

This is a more relaxed version of general with enforced slowmode. General can be really hectic, which I know can overwhelm people. This channel is for the quieter, slower-paced conversations

Muiri 2020

[tepid notch]

i use vmware fusion, community edition. I find it too be much faster than vbox, with a better ui. Also, to run vbox moues commands, you hold control, as opposed to command-control. As you can probably tell, one is better than the other.

[south inlet]

Why not pro?

[little shore]

Broadcom did release Workstation Pro for free for home use.

[tepid notch]

im broke

so i use vmware fusion

idk whether its communty edition or personal license

[south inlet]

Vmware pro is free.

From broadcom

[summer verge]

AFAIK vmware fusion was discontinued

[spark sun]

I would be surprised - Fusion is for Mac, and they say it's still supported

[south inlet]

The fusion player is being discontinued, Fusion Pro is still being supported.

This goes for Workstation player also.

Since fusion and workstation pro are now free.

[lethal timber]

Do I get anything if THM publish my room that is free?

[smoky mortar]

The Eternal Glory.™️

[vale stump]

🇸 🇰 🇮 🇧 🇮 🇩 🇮

[rugged frigate]

no

[tepid notch]

quality anime-style wallpapers?

[twin ridge]

I mean, we could get stickers 😛

[winged rain]

Diablo II was the game with open sourced lua code right?

That was Hades II nevermind

discussion above makes more sense now

[soft pier]

well there are more games that use lua as a scripting interface that handles a lot of the modding potential

[lime fern]

Especially Roblox

[chrome zealot]

dom dom yes yes?

quiet conversation

is anyone alive

[wide flume]

discord has became worst then ever updates literally degraded them a ton

[rugged frigate]

it's always been kinda bad.

[sly skiff]

guys i dont understand who is the hacker knowned as 4chan

[mystic tulip]

4chan is a website

[sly skiff]

its a meme

[magic niche]

Hello guys !! Someone is skilled in CTFs ?

[rare junco]

Are u talking about catch the flag

[magic niche]

Yeah

I need a tool to automatize the scripting

[quasi narwhal]

Wdym?

[rare junco]

Can u be more specific

[magic niche]

Smt like team CTF, every team has 4 services to keep up (the same for everyone), and every service has 2 vulns. The purpose is to find the vulns, patch my own code and write a code to retrieve the flag found through the vulns of the others

I need automation because the flag retrieved exploiting the vulns changes every 2 minutes or so

I know that i can just write a code in python with pwn to connect to the servers and with time or crontabs launching the code every 2 minutes, but maybe it exists some tools with an interface that tells me if the retrieving is successful

Idk it's very specific, it's just time saving

It would be good also a good template if i'm forced to write the code

@south inlet

[maiden cairn]

how can ı fix sqlmap is outdated

[south inlet]

update it?

[maiden cairn]

i tried

[south inlet]

which version do you have?

[snow fox]

Can I share my new startup social links?

[south inlet]

We'd prefer if you engaged with the community for a longer period of time, before dropping any self advetising links.

[maiden cairn]

last one

[south inlet]

Can you tell me which?

[tawdry dove]

You're going to need to provide information if you are looking for assistance. We cannot see your computer screen. I'd recommend that you verify to be able to provide screenshots. I've listed a couple of questions below:

1. What are you doing?
2. Is this mysql part of another piece of software?
3. What version are you currently running?

[frail vault]

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Jun 26, 2024, 4:35 PM

[south inlet]

@fickle jolt Don't post ip's in chat please.

[uneven granite]

Hi everyone, I'm new to this world and just starting out. I'm eager to expand my knowledge and improve my skills. Could someone recommend some books to me? I'm already following the learning paths on TryHackMe and practicing; I'm nearly finished with the beginner path, so I have a basic understanding but still have much to learn.

[lime fern]

There are some books in #bookclub

[gray mountain]

hi guys could someone help me with web fundamental part 1 user Accounts, Profiles, and Permissions question What is the account description i am stuck if somebody could tell me the ans i will be really thankfull

[tawdry dove]

#room-help

[gray mountain]

yeah but it was no help

[tawdry dove]

That it's the correct place for assistance

You only posted in the channel 2 minutes ago. You have to remember everyone is a volunteer here. Assistance will be provided when someone is able and available to assist.

[gray mountain]

yeah i know and i am waiting for someone to answer thanks for your help tho

[tawdry dove]

OK, spamming across channels isn't going to get you help faster

[thorn spire]

hi

found this video which I think it exgaratting

https://www.youtube.com/watch?v=Hi7JMTojT-4

[novel geyser]

Interesting watch.

[thorn spire]

to be honest it BS

those device won't prevent ISP from tracing the router

[novel geyser]

Well if he's not using their router, it will. Sure they'll still be able to see his traffic but they wont have access to his CPE

[fast viper]

Anybody have VirtualBox installed on there Mac M1/M2 Pro, or am i still beneficial with UTM?

[winter nymph]

How does anyone have a quiet conversation?

[novel geyser]

very quietly

[fathom panther]

VMWare Fusion Pro is free

[runic edge]

guys, can you help me with understanding what, say, connection to a server is in those rooms? say, i have a target machine, i scan for an ftp port, i find an open one. then i write ftp@<target ip>, and where do i end up? where am i connected to? where is physically the ftp server? i just can't comprehend it. sorry if dumb question

[fathom wagon]

Your in the File Transfer Protocol

I wonder whare you would be physically aswell

[tawdry dove]

If you write ftp@ip nothing is going to happen

[fathom wagon]

I just think of the ftp as virutal more than anything

[tawdry dove]

It will error out as that is not the correct command to initiate a connection. As far as where you are connected to, you're connected to the machine at the IP address through the File Transfer Protocol.

[runic edge]

ftp [ip] will move me to a shell with 'ftp>' to write commands (well, so it happened in the room). so im still 'inside' the target machine?

[tawdry dove]

Yes, you need the space between ftp and the IP. @ prior to an IP, depending, can tell the service to log you in as a specific user.

[tawdry dove]

You're accessing a resource on the target machine, yes. Configuration of said resource dictates how much access you get once connected though.

[runic edge]

so basically, in layman's terms, i connect to where the files are stored and shared on a target machine?

[tawdry dove]

Where the files FTP has access to are stored

[runic edge]

oh i see

[tawdry dove]

It doesn't necessarily mean all files on the machine

I'd recommend reading the manpage/manual for FTP

Lots of good info

[runic edge]

yea sure. the room also walked me thru finding a login and pass for a user entry. does a user in this case mean, for example, an account on your, say, windows computer? like when you start it and choose who to enter by. is it that user that i would be connected as?

say. i have two windows profiles, for Max and for Sally. when you boot windows, you gotta choose which profile to enter. is it the profile i get when 'ftp Sally@ip'? just trying to figure out if the user notion in this case goes beyond ftp

or profiles and users could be two different things on the same machine? in this specific ftp connection case

[tawdry dove]

Let's make this a learning activity. I want you to take that question and conduct some research, use Google, Linux man pages, etc. Break out your paragraphs into the individual questions you want answered, use your desired method of searching, write down what you find about each of your questions, and then come report what you've found.

The process of researching and writing is proven to assist with memory, over someone just telling you.

[runic edge]

i just don't understand what and where that thing is that i connect to when i type 'ftp [ip]' and it shows me some of the target's files. i've found an ftp server can be installed locally, i've seen some on the two types of connection and two channels - for commands and for files themselves - but how am i able to see (some of) the target's files just by typing 'ftp [ip]'. how are we interconnected from the beginning is what troubles me

[tawdry dove]

You're on the same network

Or the ftp server is setup in a way that allows connections from the internet

Have you done #pre-security-legacy-path?

[runic edge]

nope. still on complete beginner

network services room

[tawdry dove]

So pre-security is the precursor, I'd recommend going and doing that path

#general message

Here's the recommended order

[runic edge]

ookay, thank you. i jumped ahead with this one, according to the order, then. the structure and explanation is very merciful on the website, so i will follow the order, then

thank you for your time. appreciated

[thorn spire]

what you mean CPE?

[novel geyser]

CPE is customer premise equipment. So basically the equipment that he's using rather than the ISPs. They wont have remote access to it, especially with TR-069 but they'll still be able to tell what type of equipment he's using based on MAC and will def be able to see the traffic, just wont be able to log into his personal equipment.

[thorn spire]

interesting but SFP GPON module suggestion from the youtube guy help him from ISP watching his traffic

[novel geyser]

Ya they'll still have access to see the traffic, it just wont let them have a backdoor into it

[thorn spire]

to prevent ISP from tracing my only suggestion using VPN

which is the only solution to prevent ISP to trace your activity

[fast viper]

I was able to install parallels desktop for mac

[unreal talon]

How can I hack a game server

[south inlet]

This is illegal, we don't discuss/teach it on this server

[unreal talon]

Got it

[plucky cedar]

Hey, im trying to decide on either buying THM or HTB subscription... any help?

[tawdry dove]

Choose whichever one you want. Each service has its differences, but you're the one that needs to make the decision.

[plucky cedar]

Can i ask what you use and why?

Ive seen reasons for both sides but im still having a hard time deciding

[novel helm]

Have you try any of them?

[tawdry dove]

We don't really do the comparison thing here. There are differences, but those differences and the choices are dependent on the end user.

[plucky cedar]

Ive been using THM up until i hit a point where i need premium

[plucky cedar]

Alright, well, thanks for the insight

[hoary nymph]

Gave +1 Rep to @tawdry dove (current: #17 - 424)

[drifting isle]

Hi
I have an old computer that has an RJ 11 port
Can I connect it to the phone socket directly or do I need a dial up modem, and do I need an additional subscription from the ISP, I dont have any idea how this work!
By the way, because this is old, I did not find much on the Internet. What are the other uses for the RJ 11 port of an old laptop?

[pale crane]

I highly doubt you can get this service from an ISP though... it's quite old.

[drifting isle]

Yes, Me too

thanks Birb

[south inlet]

I can still hear the noises...

[pale crane]

The song of our people. That and the heads-up in the computer speakers that we're about to get a text message on our phones.

[ruby yacht]

even if you found a provider that still offers dialup and assuming the RJ11 port on the back of your PC is a built in dialup modem I don't think todays webpages could load on 56kb/s internet haha.

Heres a blog post from 12 years ago with average loadtimes for popular websites back then, cant imagine its gotten better

https://www.pingdom.com/blog/loading-todays-sites-over-dialup/

[drifting isle]

thank you for this information Nod

[hoary nymph]

Gave +1 Rep to @ruby yacht (current: #640 - 6)

[worldly cave]

Got it

[twin ridge]

That's still a thing no?

[pale crane]

I haven't heard it in 20 years at least.. maybe?

[south inlet]

@maiden nexus can you please stop, please allow mod/admin to deal with it.

[maiden nexus]

Sorry I just don't understand those people

I'm just saying it's not his first time

[worldly cave]

I just think of the ftp as virutal more than anything

[twin ridge]

haven't had actual speakers in a while, but have heard the bip bip bip bzzzzt about 10 years ago

[summer verge]

that was a classic, you knew that a call or a sms was coming even before the mobile started ringing 😂

[glossy dome]

QQ, anyone here ever published a CVE?

[vivid onyx]

yeah I did

[glossy dome]

Okay I found the answer to my question on Mitre's website eventually

[vivid onyx]

oh ok

[civic root]

There are no URLs in that message.

[vivid onyx]

Guys do you know what does ernpl stands for

I cant find an answer to it

[worldly cave]

that was a classic, you knew that a call or a sms was coming even before the mobile started ringing

[worldly cave]

Here's the recommended order

There are no URLs in that message.

[tawdry dove]

You ok?

[lime fern]

😂

[drifting isle]

HI
I have a small project for home
I want to turn my old computer into a cloud storage server
I'am going to download Nextcloud because I found it to be the most popular on the internet
I think Ubuntu is suitable for this
But the problem is that I don't know how to use Ubuntu server. I think most people chose Ubuntu Server and not Ubuntu Desktop.
What do you think, I want some advice

[lofty smelt]

I'd say if you want to setup Nextcloud and forget about it, use Ubuntu desktop, it works fine.

But if you want to learn how Ubuntu server installs then use that.

After the installation they both are more or less the same.

Imagine like Ubuntu server is like Ubuntu Desktop terminal only.

You gotta do everything from there, you can aldo install a desktop environment though!

It's kinda like barebone Ubuntu the server version.

[drifting isle]

Thanks for help bro

[hoary nymph]

Gave +1 Rep to @lofty smelt (current: #2119 - 1)

[pale crane]

Found something for ya...

[lofty smelt]

You're welcome bro :D_ _

[quaint basin]

Ubuntu Desktop is heavier. It's a waste of resources to use it for a server install.
Will that matter in your situation? Probably not.
Is it poor practice? Yes.

[drifting isle]

I will try with ubuntu server
I think it's not that complicated

[twin ridge]

I mean if you need the GUI then sure go for it

If you can work with just the console, then server is a good choice

[lofty smelt]

It's really not. The installer is pretty straightforward too! If you encounter any issue, the internet is a vast place. Just search and you got it. B)

[drifting isle]

I have now finished installing Nextcloud on the Ubuntu server
in a very short time
It was really easy by watching a YouTube videos
But the thing is now that this works, I can't add things of my own because I don't know what might cause this
It works don't touch it lol 😅
but yeah, There are still things missing sure
I will have a good time now to learn more, I must learn more to be able to interact with the server

[lofty smelt]

Very nice, you can try messing about the server in a virtual machine on your main computer if you don't want to risk breaking the Nextcloud installation.

That is the reason I run everything in Proxmox (as ESXi is not free anymore :(_ _) I can leave my main VMs as they are, and mess about stuff in other VMs.

Also every service is in separate VMs, I know it's not very efficient, but I tend to break stuff pretty easily. So it's better this way than everything broken in one single click.

[twin ridge]

May want to look into k8s?

[lofty smelt]

What's that?

[twin ridge]

Kubernetes

[lofty smelt]

Oh that.

[lofty smelt]

Uhm but it can run only containers no?

[twin ridge]

Yeah

[lofty smelt]

I need something to virtualise operating systems though.

[twin ridge]

But you manage your services at the pod level within a VM

Rather than have 1 VM per service

[lofty smelt]

Mate I am not that experienced lmao. What does pod level mean?

[twin ridge]

A pod is a grouping of containers defining your service

[lofty smelt]

:0_ _

[lofty smelt]

OH I GET IT! You meant I can run Kubernetes in a VM and manage all my services within the VM using containers?

[quaint basin]

I mean, technically about 8 VMs if you use K8s, but yes, exactly that

Have a look at K3s if you go the Kubernetes route. It's a complete Kubernetes implementation, but much lighter weight than K8s

[lofty smelt]

Right.

[lofty smelt]

:0_ _

[twin ridge]

There's also k0s

[radiant jacinth]

Would my Ethernet max size be under the internet protocol version 4 tab as total length or does that total length mean something else

[worldly cave]

that was a classic

[worldly cave]

Guys do you know what does ernpl stands for

[lime fern]

I mean I don’t know what the pl stands for but looking it up this is what comes up

https://www.ibm.com/topics/enterprise-resource-planning

Wait

Lmao that’s not even the right spelling

[worldly cave]

The song of our people. That and the heads-up in the computer speakers that we're about to get a text message on our phones.

[mystic tulip]

What

[south inlet]

@lime fern I think I know where this is going. Please take a step backm

[lime fern]

ight

yep your right lol

[fluid plaza]

when do i need the attack mode (-a) from hashcat?

[south inlet]

When you want to choose which type of attack you want to do.

-attack mode.

[fluid plaza]

i understand 😄 thx

[hoary nymph]

Gave +1 Rep to @south inlet (current: #1 - 2489)

[patent fox]

hey guys, anyone else finding nmap scans to be so slow; i usually run -A -T4 -p- -Pn and they always took about 2-3minutes but since yesterday, it's showing about an hour

[little shore]

It probably is due to the fact that you have -Pn, -A and -p- in one line? It also depends on the resources the target has. Have you tried to split the command into two and run -A against open ports only?

[pale crane]

protip: add -v for "verbose" to see the open ports as nmap discovers them

then you can get to explore some of the most common ones while it keeps scanning for the higher numbers

(i.e. no need to wait for nmap to crawl through the 10k - 63k or however many ports there are, if you can immediately see that 21, 80, 443, 3389 are open - and remember what those are)

[soft pier]

protip: you can increase verbosity in nmap while the scan is currently running without restarting

[sly skiff]

how

[quaint basin]

https://nmap.org/book/man-runtime-interaction.html

[sly skiff]

bro i ask cuz i want a response 😢

[quaint basin]

There's your response 🤷‍♂️
The first Google result, for the record. The nmap manual; an unusual place to find information about the operation of nmap, I grant you...

[sly skiff]

well, i was asking the person that has the knoledge

maybe, cuz i wanted her to share it with me when she can

[tawdry dove]

Low effort questions get low effort responses. Research is also a cornerstone of cybersecurity.

[summer verge]

indeed research is an important skill in any area of life but almost essential in cyber sec

[drifting isle]

Hi guys!!
I have a small problem
When I plug ethernet cable in my desktop, I do not get an IP from the router
But when I try this from another computer everything is fine
What could be the reason?

[zenith star]

are you sure you have DHCP enabled on your computer?

[final otter]

guys you think studying and listen to music(classical music) is bad for learning?

[neon dirge]

🫐

[pale crane]

that's how I learn the best, so no I don't think it's bad

[low river]

chill lofi study music for me

[weary viper]

anyone from germany learning SOC?

[zenith mural]

how to learn about hacking ?

can anybody tell me that

[quasi narwhal]

You came to the right place. #start-here

[zenith mural]

thank you buddy

i check it

i like that

[hoary nymph]

Gave +1 Rep to @quasi narwhal (current: #80 - 81)

[raven knot]

now that i know that every laptop and pc has a mac address that appears on the network i cant help but wonder...cant police help us find stolen laptops or phones this way?

[quasi narwhal]

MAC addresses are generally only visible to devices within a local network, and are not transmitted beyond the router.

[raven knot]

but cant my internet providor get the info that this mac address in on this router of mine etc etc?

[quasi narwhal]

They can see the MAC address of the router/modem itself but not the devicew connected to it.

So I suppose maybe a stolen router/modem could be traced.

[raven knot]

hmmm,so when i send to my router something from my phone or pc is the same for them?

[quasi narwhal]

Correct. Everything send from local network beyond the router uses a public IP. Within the network your devices have a private IP.

[raven knot]

i am kinda confused though ngl.cuz when i send a signal to my router the router receives my private ip which then changes to the public...so why wouldnt the internet providor know the private ip of my devices at that time?

since they are doing the change they should know...

[quasi narwhal]

They aren't doing the change. The router does 'exchange' the private IP for the public IP before it acces the internet or communicates with the ISP.

[raven knot]

hmmm,so the router just receives a signal with a request that the router has to forward but it doesnt receive the name of the client that requests that?

[quasi narwhal]

I'm not sure I understand what you mean.

[raven knot]

its okay,my main question was answered anyways,i will learn the details as i learn more.tyy

[quasi narwhal]

The router does receive the private IP so it knows where to send back the response to ofcourse. That information is just not shared beyond the router.

[raven knot]

i see..so not even the internet providor who gave us these routers can see the info they receive

[quaint basin]

Not strictly true. A lot of ISPs do map your home network.

[quasi narwhal]

Potentially they could provide you with a router that does send them this information. Altho I think its against privacy laws in most countries.

[quaint basin]

And that's under GDPR

Remember that the router is often the property of the ISP, loaned out to customers. They often (if not usually) maintain remote control over it, to some degree or another.

Have a look at your account with your ISP and see if you can access a device map of your network.
The last couple of ISPs I've been with literally displayed that information on their web portal 🤷‍♂️
Which is one of many reasons why it's worth using your own hardware instead

[quasi narwhal]

Right so if you use your own router between the modem and your local network?

[quaint basin]

I mean, I run a rackmount OPNsense box plugged straight into the wall, but yes, that would do it too

Stick the ISP device into passthrough / modem / whatever-that-ISP-calls-it mode and use your own device to handle the NAT translation. Only thing they'd see is the router you added (from those metrics at least).

Or just go with an ISP which allows you to use your own hardware and plug that straight into the socket.

Or double NAT if you really must.

Same difference either way

[tawdry dove]

Yee, I'm just plugged in to the ftth to copper box

OpenSense picks it up on the copper

[quaint basin]

That ^^^^
Some ISPs don't like you doing that. Pick one that does and you're golden

[tawdry dove]

If they don't, they haven't said anything lol. I probably wouldn't get support if I called though.

[quaint basin]

I'm with HyperOptic for the UK based. They're awesome for it -- they encourage custom hardware / support DHCP, etc, albeit with the caveat that they can't provide support remotely

[tawdry dove]

Yeah, if I need support I would just plug their device back in. I'm using it as a WAP

[quaint basin]

Heh, I was tempted to do that but honestly the router they supplied is shit. Replaced it with a TP-Link Omada EAP. Was a little concerned about TP-Link, but it's been brilliant so far.

[tawdry dove]

Fios, so Verizon, here

[quasi narwhal]

I'm switching from copper to fiber optic this month. They told me I'm not allowed to install myself they sending some1. Any advice what to look for/enable/disable/ask during installing?

[tawdry dove]

Tbh, what they provided isn't half bad. It's actually pretty beefy

[quaint basin]

When you say install yourself... Do you mean the actual cabling, or the router lmao

[tawdry dove]

I just wanted to have more granular control

[tawdry dove]

I think they mean the actual cabling and the transceiver

I can't spell

[quasi narwhal]

The cable was laid already. They coming with a box or something.

[quaint basin]

TBF, some ISPs do insist on installing the router themselves too

[quasi narwhal]

I have always done it myself but they told me it's not allowed.

[quaint basin]

Either way, I'd be checking with them whether they support custom hardware. If they do, let them plug in whatever they wanna plug in and activate the line, then unplug it as soon as they leave.

[quasi narwhal]

So I'm expecting some special shizzle

[tawdry dove]

This sounds like the transceiver, my installer said he didn't care what I did with the router he brought after he left

[quaint basin]

If they don't, switch ISP

Yeah, I'd guess it's because they need to install a box to switch fiber to copper

In fairness, I'm not sure I would want to install ftth myself lmao

[spark sun]

If the ISP requires PPPoE, it can be pretty painful to configure your own hardware for their network.

[quasi narwhal]

I have an extra router which I could just place between then right?

[quaint basin]

Probably, yes

[mystic elk]

hello,
can someone explain the "netcat shell" concept to me?
in the "Intro to shells" room there is the following sentence: 'netcat "shells" are unstable because they are really being processes running inside a terminal'
I just can't understand what makes it the unstable shell. I get that it can get formatting errors, lack of hotkeys support etc. but what about that 'running inside a terminal' part?

[tawdry dove]

May not be able to depending on what's available. Potential for them to have run ftth specifically for that residence, which may come with some penalty for terminating early if it was written in the contract

[quaint basin]

Disgusting, but true

[quasi narwhal]

I believe by law there's 14 days to cancel the contract after it's installed.

[quaint basin]

Inb4 they send someone back to cut the line

[quaint basin]

In which task did I write that?

[mystic elk]

introtoshells, however I did paraphrase it here a little

[quaint basin]

Also since when is that room sub only

[mystic elk]

sorry, task 5

[quaint basin]

I hope you appreciate the UI hell I'm going through to access this lmao

Right, okay, I see the bit you're referring to. That's actually not hugely clear.

What I mean is that there's no PTY allocated to the shell as there would be if you opened up a terminal, or started an SSH connection.

So, in other words, all netcat is doing is hooking up stdin and stdout to a network socket. You could do the same thing with a python script.
It's not actually a terminal -- it just passes information to and from the pty allocated to your local shell.

[quasi narwhal]

To get back to @raven knot original question. Tracing stolen devices by their MAC address would be possible with cooperation of ISPs?

[quaint basin]

Eh, potentially. MAC addresses can be faked though, and good luck getting ISPs onboard

Especially when you consider that most stolen devices are just immediately shipped out the country

[tawdry dove]

Yes, in not having choices, no not if they run a line out to you and you cancel. Typically you have to pay upfront if you're not in a currently serviced area. So you're paying, in part, for the additional equipment, work hours, trenching, cable, etc to get the service out to you. If they didn't make you pay up front and have you in some sort of contract, it's understandable to have a penalty for breaching early.

[tawdry dove]

This would be different than your standard sign-up.

[quaint basin]

Yeah, I meant in terms of not having choices

I do get the point in requiring a cancellation fee to offset that investment 😄

[mystic elk]

thanks man, that's great to be more enlightened now
so can I for now assume that PTY, among others, is handling the proper interactivity which can't be reached on the raw connections?

[hoary nymph]

Gave +1 Rep to @quaint basin (current: #9 - 777)

[tawdry dove]

I have a thoughts on not having ftth in the US, but it would probably violate the politics rule and I get angry when talking about the telcos that fleeced Americans out of amazing networks.

[quaint basin]

A PTY handles things like SIGINT (CTRL + C), which is why CTRL + C kills your reverse shell unless you stabilise it

[quasi narwhal]

But there couldn't be some sort of list that stolen MAC address will be added and whenever it's picked up by an ISP it will alert law enforcement. 😅

[sly skiff]

stolen MAC address?

[quaint basin]

Good luck getting them onboard with that

[sly skiff]

i think telcel has that

[mystic elk]

thanks Muiri

[tawdry dove]

They can be spoofed so it's already a bunk method of tracking and use in a legal setting

[quasi narwhal]

Right so potentially is the answer.

[sly skiff]

in mexico, telcel can completly block a device if you report it as stolen, how does that work?

[tawdry dove]

They're probably using IMEI

[frail vault]

I could not find an article, please try again.

[tawdry dove]

Or whatever it's called

[quaint basin]

Potentially. But highly unlikely

[sly skiff]

@tawdry dove and it cant be unblocked, right? you would need to wipe it clean

[quaint basin]

On a technical level, it's possible (MAC spoofing aside).

[tawdry dove]

It's IMEI. They're hardcoded afaik

[sly skiff]

oh shoot

so the best they can do is sell the pieces

[quaint basin]

Aye, if you block a phone via IMEI that's it blocked

I'm sure there's a hacky way to unbrick it, but...

[sly skiff]

they stole my dads phone, and we went to telcel

but he got a L O T of 2fa requests per second, they were trying to get to his icloud acc

[raven knot]

i see..so the problems are that 1.isp is lazy and wont 2.pro thiefs will use the laptop with spoofed mac address 3.they are shipped outside the country where isp has no authority

[quaint basin]

I mean, more like good luck getting a private org to co-operate without a warrant than them being lazy

But yes. Bigger problem would be that the device just gets switched off, shipped out to a different continent, and sold off cheap

[raven knot]

i mean..would a simple thief have all that network of people?xd

[quaint basin]

Mainly to countries which, frankly, have bigger problems than tracking down stolen devices.

[quasi narwhal]

A court can order them.

Right so its resource inefficient.

[quaint basin]

Generally speaking, a thief doesn't try to get rid of stuff themselves. They sell to a fence, who is part of a wider network.

[spark sun]

closest thing would be IMEI associated with mobile devices. MAC addresses are supposed to be unique, but..... in reality that is more of a guideline than an actual requirement.

[quaint basin]

So yes, if some petty thief nicks your phone, it could easily be halfway across the world in a matter of hours.

[fathom panther]

No, they just sell the laptop at a low price

[raven knot]

i see...

[raven knot]

ig maybe thats a reason they dont try to track them too..they might end up finding a random who just bought it...and even if it is the real thief he can pretend he just bought it maybe idk

so finding the truth would actually take months..

[quaint basin]

Also true. The people who bought the device are unlikely to know it was stolen.

They might be able to guess given the context, but that's not easy to prove in court

[raven knot]

ye okay i get it,its complicated as fck to find the thief unless he is kinda braindead..sad

[sly skiff]

yeah

i mean, when my dad got the requests (from the icloud) the ip was spoofed, it appeared as switzerland iirc

[quasi narwhal]

Luckily, it's in the city so they laid the cable for free if you signed up for the moment they did the whole neighborhood. Im actually not even going with the ISP that laid the cable.

[still snow]

hi can u gain acces to a machine with his public ip?

[simple mesa]

I have some doubt why is that in the Jr Pen tester path why are so many questions wrong like I try to put in the correct answer but it says wrong answer its like they changed the machines/questions but did not update the answers

[south inlet]

#room-help please.

Tell us which questions you think are wrong

[simple mesa]

Should I put the questions in #room-help

[south inlet]

Yes

[proper dagger]

hello

[runic edge]

hey guys. why doesn't any ctf room open machines for me? say, this https://tryhackme.com/r/room/lessonlearned
i click 'start machine' and it turns grey

my third room like this

waiting for ~5 min

[quasi narwhal]

Wdym? You got the IP in the top.

[runic edge]

won't load :/

maybe im doing sth wrong, i dunno. still dummy at this. i just typed the ip into the address bar, nothing loaded

[quasi narwhal]

Are you using the attackbox or your own VM?

[plain lagoon]

**During scanning networks using nmap or any other thing on Kali during bug bug hunting

__How to stay anonymous?
How to hide our ip __
Any please **

[quasi narwhal]

I think if you are bug hunting within the scope you don't have to hide IP or stay anonymous.

Afaik bug hunting out of bugbounty program scope is illegal.

[plain lagoon]

Thanks

[hoary nymph]

Gave +1 Rep to @quasi narwhal (current: #80 - 82)

[quaint tree]

ya its not needed and honestly you cannot hide your ip as you will scan thus ping so its gonna get noticed the only way to do that would be very complex or just DONT hack from home

[twin ridge]

you probably shouldn't be using nmap on public sites

[hazy steppe]

hey | so can I rely on tryhackme for learning or I have to do more researches

[tawdry dove]

You will have to do research outside of TryHackMe

[glossy dome]

Question: Would malware antivirus evasion techniques suffice enough pages (55 average) for a MSc. Cybersecurity research project?

[tawdry dove]

You'd have to consult your professor or T.A.

[glossy dome]

:((

[radiant jacinth]

Helllo

I am new here()

[sly skiff]

is that a function?

[radiant jacinth]

To cybersecurity in general

[sly skiff]

def here():
{
}

[radiant jacinth]

Hahaa

Well I am here to get some of my questions cleared for cyber security

[sly skiff]

come to #general

[plain lagoon]

Okay thanks

[hoary nymph]

Gave +1 Rep to @quaint tree (current: #2127 - 1)

[plain lagoon]

Then ?

[radiant jacinth]

They may block/report you

[plain lagoon]

Then how can I scan the network If I need any info for hunting

[radiant jacinth]

I'm not the right person to ask xd

But I think it is not intended to bruteforce on ports etc

[marble vector]

Well I think one rule of ethical hacking is having consent. If you have consent you can scan and also use programs like gobuster.

[radiant jacinth]

Nmap and gobuster scans are usally not in scopes as far as I know. But like I said, I have 0 experience so I am not the right person to ask

[marble vector]

well lets put it this way. If you scan a website with nmap or gobuster and find a vulnerability then maybe the website should take care of it 😄

[radiant jacinth]

There is a specific channel for this: #bookclub

[uneven lava]

Oh, thank you! I'll move it there then 😊

[hoary nymph]

Gave +1 Rep to @gleaming belfry (current: #129 - 53)

[radiant jacinth]

Doesn't really matter, but there is less chatter in that channel so chances are higher people see your message :)

[twin ridge]

If it's out of scope, it's probably not legal either

[twin ridge]

Now if you keep asking to do questionable things, we will be forced to remove you from the server