quiet-conversation

[frail rapids]

copped several domains like tryhackme.nl

https://i.imgur.com/3W575TF.png

[frail rapids]

^for the record that is not for phishing. they all redirect to my personal website

[quaint basin]

You could also be a good Samaritan and have them all redirect to tryhackme.com

[frail rapids]

okay fine but I want to keep .nl

[quaint basin]

Meh, better than nothing 🤷‍♂️

[frail rapids]

done

[soft pier]

and suddenly lau uses tryhackme.nl to do writeups for tryhackme.com

[frail rapids]

just SEO boosting at this point

[dusty sleet]

hello shadow
did you make that pixel art yourself? 👀

[soft pier]

no it was a paid commission.... and sadly the artist is not making any more commissions currently

[dusty sleet]

i love it

[soft pier]

yeah it is really nice and absolutely worth the price shadow paid for it considering how often they use it

[mild umbra]

Aw, how nice of you!

[frail rapids]

Do anti cheats look for RDP?

[keen steppe]

PLEASE PUT IT BACK

[pine iron]

Just finished “h4cked” was really fun, but it could’ve also been fun if the attacker patched after themselves and we had to use their patch against them or something

anyways, it was very enjoyable :)

[dusty sleet]

ghidra vs cutter (r2 or the thing we don't put on pizza) and why

[tardy flower]

Haven't used cutter, I mainly use gdb-pwndbg or peda with ghidra for a high level overview.

[burnt night]

Cutter is good, it uses ghidra's decompiler

Cutter multiplatform

[dusty sleet]

ur talking about the new fork then,
how about the radare2 fork?

[burnt night]

The old fork that used r2 still integrated ghidra's decompiler...

Cutter is now based on rizen or whatever but that changes absolutely nothing

[vivid night]

https://tenor.com/view/its-quiet-in-here-ruby-mitchell-wentworth-its-peaceful-here-its-so-silent-here-gif-23010246

[visual breach]

https://tenor.com/view/elmer-fudd-very-quiet-vewy-quiet-hunting-wabbits-gif-21896551

[frail rapids]

changed the .nl one as well in before I get sued

..again

[waxen hollow]

Again

[buoyant salmon]

ok feels good getting rick rolled in morning

[summer verge]

is this like the quiet carriage? 😂

[dusty sleet]

question for the informed ones

which one is better ?
ettercap and mitm the whole subnet, but only for a short timeframe to prevent DoS
or
bettercap alongside targeting only machines you need
?

[twin ridge]

I'd say targeted is always better

[static otter]

anyone know if theres a list of standard linux services that run with the S perm flag, and are therefor not a security issue?

[twin ridge]

there's a few

su, and sudo for one

[burnt night]

Also they are not services.

[celest cairn]

@meager mason

[twin ridge]

you are of course correct, and also a pedant 😛

[meager mason]

awww baybeee

[stray salmon]

Please tell me if there’s a better channel for this. Just wondering if people have tips of mobile-only learning resources to fill some dead time when you don’t have your main driver. Could be an app, a short blog or other. No audio. Personally focused on the pentest track.

[dusty sleet]

cybrary, some books

[mortal venture]

Does anyone use phone AV?

If so what kind?

[mortal venture]

I run IOS but looking to switch back to android soon so for either OS is nice

[polar pumice]

Hello, what are the study room voice channels for? are they accessible to non-subscribers too?

[radiant jacinth]

it's open for everyone & you can join to chill with peoples while doing some CTFs / study together

[polar pumice]

thanks @radiant jacinth

[hoary nymph]

Gave +1 Rep to @turbid gust

[radiant jacinth]

[dense spindle]

hmm whats S perm flag?

[quaint basin]

Technically? SUID/SGID without the executable bit (making it useless)

I suspect they mean the s (lowercase) flag

Which is SUID/SGID

Either way, there is no reason to give a service executable SUID ot SGID as the user account and group to run as are specified in the service file @static otter

[static otter]

passwd Is designed to run that way

I must admit I didn't mean service I just brain farted and ment command in general

In essence I'm trying to come up with a list of usual suspects when I search for misconfiguration so I can remove them

[dense spindle]

ohhh thaaanks man

[quaint basin]

Easy solution?
Create a VM using your target OS and just look at what has it by default.

[static otter]

It would be the case if I was targeting one specific box

I'm probably going to start a git repo list that I'll add to. Sucks that there's not already one tho

[quaint basin]

It's honestly pretty standard across most *nix systems. Most Linux distros have a few small differences, but you learn to catch them by eye and just see what's unusual and what isn't from experience.

[visual breach]

like when you check for suid files, certain things are supposed to have it, so you learn to exclude those by experience and notice the "unusual" files

[carmine geode]

I dont know if this is an every-year thingy, but I was doing this room called 'advert of cyber 2020', just wanna know if there'll be a similar thing for this Christmas?

[short elk]

yep! #announcements message and #895344613873836132

[carmine geode]

wow, thanks!

[frail rapids]

(welp, didn't scroll down enough)

[twin ridge]

Discord does that

[gloomy surge]

why is the voice channel locked?

[quaint basin]

I take it you haven't read through #start-here then? 😄

[gloomy surge]

oh thanks i didn't notice that😅

[hoary nymph]

Gave +1 Rep to @quaint basin

[quaint basin]

Np

[soft pier]

how does that kinda bug even happen

[tawdry dove]

I don't even think it was a bug

It was pushed by the devs to a stable release

[burnt night]

https://www.gamingonlinux.com/2021/11/system76-patches-apt-for-pop-os-to-prevent-users-breaking-their-systems/

"For some reason, an i386 version of a package was never published on Launchpad. Steam being an i386 package, when trying to install it, it had to downgrade that package to the Ubuntu version to resolve dependencies, which removed Pop!_OS packages.".

https://twitter.com/jeremy_soller/status/1453008808314351628

Jeremy Soller (@jeremy_soller)

@gamingonlinux @stephanlachnit For some reason, an i386 version of a package was never published on Launchpad. Steam being an i386 package, when trying to install it, it had to downgrade that package to the Ubuntu version to resolve dependencies, which removed Pop!_OS packages.

Twitter · Oct 26, 2021, 2:41 PM

[soft pier]

that article is great for pointing out the finger pointing

[tawdry dove]

I think this video raises some interesting points too

https://youtu.be/OTY620NUdPk

[spark sun]

he talks a lot of crap about gnome3, and loves KDE plasma, but the most unreliable DE experiences I've had have been KDE plasma. gnome may not be perfect, but it's a LOT more stable. I've been running gnome on my work laptop for close to 2 years, my problems have been BT and audio drivers, not gnome.

The biggest upcoming issue that's going to enrage the neckbeards is the move from xorg to wayland - it's going to happen, and it probably won't be painless

[tawdry dove]

Yeah, I don't really have an opinion either way. I just use what's given to me

[flint knoll]

Linus broke his popOS because of this lol

[twin ridge]

good. Wayland is better

[dusty sleet]

I used to hop between DE's and I think I've tried most of them until one day I installed cinnamon on kali Linux and never looked back, its the perfect balance of eye candy , good UX out of the box and easily/extensively customizable ,what's not to love ?

[burnt night]

Yes this is why the memes exist

[flint knoll]

Yes

I still pity him for not checking the terminal and reading stuff in his screen

[frail rapids]

I wrote my practice English essay today as an exam with low weight. ended up with 350 words with a maximum of 250

I don't understand how someone can write an entire essay in 250 words

[pine iron]

What was the essay type?

[frail rapids]

It was a plea with title, intro, body (3 arguments) and a conclusion, about filthy comments on social media

[pine iron]

I could easily hit a thousand words on that

[frail rapids]

Yeaah exactly

[cloud pendant]

I would add the Mike Tyson Quote.

[twin ridge]

you have to learn to be succinct and concise

get straight to the point and remove all the fluff

[twin ridge]

you ok, ben?

(might be meant for elsewhere?)

[serene trench]

OH

🤣

yes

thanks Hbomb

[radiant jacinth]

hello guys what certifications do you recommend for me to take after the eJPT

[scarlet moth]

what certifications do you have? whats your overall goal?

[radiant jacinth]

i currently posses the eJPT and i took the A+ course and the CEH course but didnt get the certificates

my overall goal is pentesting and get some knowledge on blue team/forensics

also i need a good certificate that is recognized and can help me with my freelance career but not very expensive

[scarlet moth]

OSCP is recognized, depends how you define expensive but it won't be enough to freelance unless you already have experience otherwise

[spark sun]

Do you have a lawyer to consult for freelance pentesting?

[mortal venture]

I can easily hit 150. Would be a struggle for me to hit 200 but I could do it if I had a week or two

[frail rapids]

I had 50 minutes

[radiant jacinth]

OSCP is really great but i feel its a bit expensive idk maybe its just from my pov

[radiant jacinth]

nope i started freelance not long ago on upwork

[scarlet moth]

well honestly, there is no other cert that would meet your qualifications

reason juun asked about lawyer is generally you want someone aware of laws to look over your contract as you can end up in trouble

if your contract isn't specific enough, you could go out of what your customer feels is out of bounds

[tawdry dove]

Retain an attorney

[spark sun]

Without having that legal counsel, you are opening yourself up to a lot of potential risk. The contract itself, the systems you are engaging, all need to checked out before beginning any engagement.

[tawdry dove]

Unless you're intimately familiar with contract law and other regulations, you're going to "get got" at some point. When that happens it's going to be you vs the company as Zojja and Juun said

[radiant jacinth]

Ah okay thanks a lot for telling me about this, because i started new to freelancing and there aren’t that many sources about what to do or how to stay careful from these type of things

i know that before starting any pentest there is an engagement between me and the client that specifies exactly what to test and what are the boundaries

specially to not cause any damage to the system itself

[burnt night]

Very very important. And yes, you'd need to have that as a contract.

[tawdry dove]

You'll also need insurance

[radiant jacinth]

Thanks a lot guys for putting me into the image

[tawdry dove]

In addition to legal representation

[burnt night]

Like big money insurance

Even a small company (eg freelancee) could cause a lot of damage and get sued

[spark sun]

accidentally bringing down a backend db or auth mechanism could result in an outage that costs more than than you'd make on 10 engagements

[radiant jacinth]

Yeah ik that, i tried finding info like this online but couldnt really find anything that goes into detail but after this i will have to put a pause on freelance until i sort everything out

[tawdry dove]

Yeah i forget the specific insurance type, the name it slipping my mind

[spark sun]

contract needs to specify potential damages and risks, and what risk acceptance process should look like for both sides

[radiant jacinth]

damn man, the cybersec/hacking industry really need to be careful in these situations

[spark sun]

Yes. That's the point all of us are trying to get across.

[radiant jacinth]

One of the most sensitive professions if not done correctly

yes and its great that there are communities made so we can all help eachother out

thats the thing i love about cybersec everyone’s constantly looking out for eachother

[twin ridge]

and "getting got" here may land you jail time

[mortal venture]

No way I could do more than 100 words in 50 minutes😫

[radiant jacinth]

what does getting got mean

[tawdry dove]

It's the future tense of got got

The appropriate definition for this use is getting in trouble with guaranteed punishment

There's other slang but not for here

[topaz flume]

does someone need to gab=ve legal counsel to start with penetration testing or just can start on bug bounty programs directly

main main goal is penetration testing and bug hunting , can someone guide me for the same as i am a beginer currenlty i am doing ore security path on try hackme and PEH on TCM

[burnt night]

Usually, you would do pentesting through a company as an employee.

You'd need legal counsel to run your own company etc

Remember that bug bounty is not stable income

[topaz flume]

okok

[frail rapids]

Never thought I'd say it, but damn I want to go to school

In 6 days I haven't been to school for 24 months

like 3 times, probably

time went by quick

[signal marten]

well thats sounds like a lot...

[signal marten]

i can relate despite i havent been to school for a less long time

[lapis dagger]

ikr!

[mortal venture]

Would pivot be the same as lateral privesc?

In a network I mean

[twin ridge]

Pivot means using one machine to access another

A lateral priv sec is gaining access to a different account with a similar level of privilege on the same machine in general

Though I suppose if you get a user account on a different machine it could also be a lateral priv esc

[pine iron]

I would say that’s still no different, I’d say a pivot is only privesc if it’s for the purpose of privesc
All semantics I suppose, just my thought

[twin ridge]

a pivot is specifically using a machine to access another

priv esc aside

but yeah we're saying the same thing 🙂

[pine iron]

Yeah we are hehe

[mortal venture]

Thank you 🙂

[hoary nymph]

Gave +1 Rep to @twin ridge

[quaint basin]

@mortal venture @twin ridge @pine iron

• Pivot: using one network device as a jumpbox to access otherwise inaccessible devices from your own box
• Lateral Privesc: moving between two accounts with the same level of permission (locally or AD)
• Lateral Movement: Moving between two target devices (usually in AD).

So a pivot can be used for the purposes of lateral movement, although it isn't usually necessary as most C2 frameworks can just chain agents.

[twin ridge]

That's mostly what I said ;)

[mortal venture]

Despite how right someone else is Muiri’s input just relaxes me more idk man

Appreciate it once again Muir 😄

Creator of python himself could declare Muir wrong and I would go “but is he really though? Who are you anyways🤨”

[static otter]

is there a site dedicated to tools to drop on target systems
like winpeas but other stuff like a portable scanner etc?

[burnt night]

No but there's plenty of static binaries out there

Whether you can trust precompiled code is a different question

[sullen temple]

Hello, im just a beginner that needs a little bit of help. Can someone tell me why when i try scanning with Nmap while connected to a VPN (IpVanish in my case) it says that Using raw sockets because ppp0 is not an ethernet device. This probably won't work on Windows.

[burnt night]

Ok, why are you scanning over that VPN?

[sullen temple]

Security ?

[burnt night]

How does scanning over that VPN relate to security?

[sullen temple]

Hides my IP address wich is the source of the scan

[burnt night]

Why does that matter?

[sullen temple]

I dont want the other guy to see that im scanning his device

[burnt night]

Why not?

[sullen temple]

He may think im doing something bad

[burnt night]

To me, it sounds like you're scanning something that you shouldn't be. Are you?

[sullen temple]

No

[mortal venture]

🤔

[burnt night]

Then why does it matter if they know?

[sullen temple]

Its a machine of a hosting company

[burnt night]

Do you have explicit permission to test in the form of a legal contract?

[mortal venture]

You should not be enumerating public facing companies unless you have strict access

Or any company

[sullen temple]

My friend is the owner

[burnt night]

Of what?

[sullen temple]

Hellhost.eu

I was just confused why i cant scan over VPN :/

[burnt night]

You're doing something unethical for certain. Please stop. Get a legal contract before doing anything. As much for your own safety.

Don't scan without explicit permission.

[radiant jacinth]

hii

i want to join staff here

[sullen temple]

I know that. But is there any way of scanning over VPN ?

[burnt night]

-ban @sullen temple Admitted to unethical/illegal activity and carried on asking. Ban appeals are [e-mail]

[hoary nymph]

🔨 Banned Sting#8547 indefinitely

[burnt night]

Unfortunately that's not how it works here

[radiant jacinth]

soo?

@burnt night can u tell me pls?

[burnt night]

Tell you what?

[mortal venture]

Eventful morning already ninja ☠️

[radiant jacinth]

umm how to join staff team here?

[burnt night]

You mean discord staff or tryhackme staff?

[radiant jacinth]

discord

[mortal venture]

☠️

[burnt night]

Discord staff are selected from the community. They're not selected from people who ask, in fact if you ask to be staff you're practically disqualified from ever being staff.

[radiant jacinth]

ohk

[quaint basin]

It does kinda put you on my veto list 😆

[twin ridge]

That sounds dangerous

[tawdry dove]

The two energy drinks is the dangerous part. Dosages that high in the US aren't uncommon

[carmine geode]

I'm new to cyber security and really wanna read a book, any recommendations?

[radiant jacinth]

Look older messages + pinned in #bookclub

[carmine geode]

thank you!

[neon roost]

ello

[radiant jacinth]

anytime

[waxen blade]

I am new to hacking but I have a good background of programming, I kinda need a roadmap, any ideas?

[pine iron]

Depends on what pathway u wanna go

What specifically interests you etc etc

If you don’t know, I suggest you try everything

[scarlet moth]

you'll already have some knowledge but this site goes over a good foundation https://github.com/DFIRmadness/5pillars/blob/master/5-Pillars.md

[ripe pilot]

A moment of silence for people who followed nintendo's advice

[quaint basin]

Did they...
Did they actually just tell you to forward all UDP ports to the switch..?

Really?

[ripe pilot]

https://www.nintendo.co.uk/Support/Nintendo-Switch/How-to-Set-Up-a-Router-s-Port-Forwarding-for-a-Nintendo-Switch-Console-1498000.html

[quaint basin]

Oh Lord. I wonder if Nintendo do bug bounty

[burnt night]

They historically have

Certainly for the switch

[quaint basin]

Whose brilliant idea was it to have regular customers forward all UDP ports to a single IP address?
Like, I'd expect the switch to not be vulnerable to anything (touch wood, fingers crossed), but that still seems exceptionally dumb

[rapid summit]

Whose brilliant idea was to name a connected device Switch 🙂

[ripe pilot]

I also think their games use hard-coded ports
One of my room-mates has a switch that couldn't do any online play unless I enabled static port in OPNSense which prevents the firewall from changing the source port between receiving the packet for the hop and sending it back out

So what I'd assume is their services are just made to fire back packets on a set port and don't take into account what the source port of the original packet came in on

[burnt night]

I massively prefer the code name: 'Nintendo NX'

[quaint basin]

"I'm just gonna go forward some ports from the router to the switch. BRB!"

How to confuse a network engineer 101

[ripe pilot]

Took me a moment to decipher when they originally said that "something is throttling the network between the switches"

[mortal venture]

what does threads mean in terms of gobuster? whats to stop me from using 10000 threads and finish a scan in 3 seconds? I have noticed i get a plethora of errors going above 200 threads but..why?

client timeout while awaiting headers is the error i notice when going above 200 threads ish

[gray hinge]

In general, threads are sort of sub processes. In terms of gobuster every additional thread is an additional interaction with the website. Using 4 threads will allow you to run through your wordlist 4 times faster. However, at a certain point, either your device or the server won't be able to handle all the connections (its usually the server) and either it'll start moving so slow that your requests time out or it'll crash entirely

[mortal venture]

Thank you for the in depth reply 😄

[hoary nymph]

Gave +1 Rep to @gray hinge

[gray hinge]

Np. If you want a better understanding of threads vs processes you can take a look at this video. It's short but it explains it pretty well

https://youtu.be/O3EyzlZxx3g

[mortal venture]

I’ll watch it right now thank you again

[radiant jacinth]

1. Go to /etc/locale.gen
2. Un-comment the line that correspond to the layout you want
3. Comment the old one
4. Save + Exit & do sudo locale-gen

it should be good

[twin ridge]

I'd think the device would crash out first. Server CPUs are usually pretty beefy

[frail rapids]

Huh, isn't a process below a thread?

Which is why multiprocessing is better than threads for performance

[twin ridge]

Threads are lightweight processes, but the CPU can only support so many at once

Multiprocessing abuses scheduling on a limited number of threads

Especially when there are a lot of idle periods in an operation, is waiting for a response

For cpu-intensive loads, multiprocessing is not much better than threading, possibly a bit less overhead

[waxen blade]

I am interested In actually hacking like white hat of course but I am interested in being in action

[gray hinge]

Good point

[spark sun]

'Threads' are also context sensitive to the language being used. A 'thread' in Go is a concurrent action, not necessarily a thread in the same sense as in C++. The reason you see a speed increase with 400 Go threads (and you probably won't see an increase in C, C++ or Python) is because 'concurrency' means a different thing in Go than it does in C++.

At least, out of the box with the language-native tooling. Setting up a producer-consumer work division system in C++ threads would be closer to the goroutine model, but still not quite the same construct.

[twin ridge]

Go "threads" are more like coroutines no?

[spark sun]

That's my understanding

They are more like concurrent building blocks, and the programmer gets little to no control over their actual execution

[twin ridge]

In the java world it would be more like what Vert.X does

Or scala actors

Or probably kotlin coroutines as well

Should try making a buster type application see how it goes compared to gobuster

Or at least a traditionally threaded app

[rapid summit]

Java is apparently getting goroutine like virtual threads.

https://openjdk.java.net/jeps/8277131

[twin ridge]

Ha

[jagged bloom]

can i how to use kali linux without installing the os and not using the vmware or box

[rapid summit]

I guess it's possible to use a live cd/dvd/usb

[jagged bloom]

oooo

[scarlet moth]

why don't you want to use vmware ?

[mortal geyser]

I can't confirm at the moment, but isn't there a Kali VM you can install from the Windows store (assuming you're running Windows)?

[burnt night]

That's WSL(1/2)

Not exactly a VM, and certainly not as versatile

[mortal geyser]

Yeah, I looked at it when it first came out, and it looked like they were having issues with the KDM GUI. Still better than dual booting off of a live flash drive, although I guess if you can't install anything (shared/locked down PC), then a live USB might be best.

[radiant jacinth]

What about docker?

[short elk]

why

also to any spanish people here, is celular actually used in conversation? or do you just use telefono? because cellphone is not really used in english anymore

[frail rapids]

Oh man I haven't used duolingo in ages

I should pick up korean again

[scarlet moth]

in Spain, yes

I mean lots of text I've gone through and talked to with my teacher, celular is used

móvil is popular though

[short elk]

ohhh i see thank you

haven't learnt movil yet but thanks 😅

[scarlet moth]

actually I might've gotten that switched, celular may be more South America, but I used to read a variety of texts/listen to various audios

[kindred shuttle]

is this duolingo?

[bold coral]

is it okay to ask if someone here knows any resources for how to use binwalk to extract a jffs2 (and also maybe squashfs) file system?

[pine iron]

Yes it is

[bold coral]

okay well does anyone have any advice on using binwalk to extract jffs2 filesystems?

[short elk]

yassss

[remote echo]

Do you genuinely not know why? Or are you just showing it?

Their answer is correct compared to yours

[short elk]

i don't know why mine wasn't accepted

[remote echo]

Because you use la and an -a

In Spanish the male is always dominant, so if a gender isn’t specified then it’s o and el

[short elk]

In Spanish the male is always dominant
oh i didn't know that

okay makes sense then ty

[remote echo]

I wonder

Does duo lingo actually teach you tenses or do they just expect you to pick it up?

because there can be some weird rules

[short elk]

yeah it does go through different tenses

only at present atm though

[twin ridge]

This is also sadly true in French

[short elk]

that's also good to know when i learn french too 😅

[half depot]

Does anyone know if there's a tool that is able to detect steganography on multiple files (in a folder)?

[bold coral]

For future reference if someone asks about a jffs2 file binwalk extraction there is a THM room for dumping firmware

[burnt night]

cd myFolder && stegoveritas *

[half depot]

[pine iron]

Ok thanks BAHAHA I genuinely had no clue so I was going to allow someone more knowledgeable to answer

[hoary nymph]

Gave +1 Rep to @bold coral

[queen owl]

what do you guys use as primary os? I'm having a bad time distrohopping for that just works perfect distro here any recommendation

[odd acorn]

Windows with Linux VMs

[short elk]

anyone here watched new girl

/ played true american i wanna play

[dusty sleet]

Linux w linux VMs

[spark sun]

@queen owl Depends on what I'm doing. Most of my work stuff is hosted on a cluster running enterprise-like hypervisor as a host for VMs. My work gives me complete freedom for my work lappy, so I run F35 there. My personal desktop is the only windows machine in my house, and it hosts a couple of playing around VMs. I have another personal dev machine that runs Ubuntu LTS and a couple more VMs for dev related activities

[twin ridge]

I need to get a personal dev machine because dev work on windows is sad

[radiant jacinth]

Windows as main OS & some school dev on Debian 11 ( One VM for laptop & desktop, never dual-booting )

[serene trench]

Hey folks, sorry to interrupt conversation. I'm looking for a good file-sync program that is both frequent and has a desktop client for Windows & Ubuntu/Debian. I have two copies of a VM across two hosts that I need to maintain an up-to-date versions of files across the VMs and both hosts.

I used to self-host Nextcloud which I think will do the trick for what I need, however, I don't really want to fork out any more money to self-host. Any ideas?

[quaint basin]

Why not store the files on one and mount the drive as an SMB share on whatever else?

Rsync over SSH might also work Unix -> Windows 🤷‍♂️

[serene trench]

Networking limitations

[quaint basin]

I got nothing then 🤷‍♂️
If you can't network it then you're gonna struggle a bit

[serene trench]

I can network over internet np but no port forwarding and no discovering other hosts afaik

I think Nextcloud might be only option

[quaint basin]

Something like ZeroTier maybe?

[serene trench]

I just hate having to plug-in a USB on one machine, copy files over to it from a VM and then plug it into my desktop and copy to a shared folder on there and vice versa all the time

[radiant jacinth]

I second that

[serene trench]

Do I need to port forward for zero tier?

[quaint basin]

Nah -- just run the service on any relevant clients

[serene trench]

I.e. I go to uni, work on labs and then come home and have to copy stuff over 4/5 times and make sure I have the most up to date on each

[spark sun]

Sounds like you need a cloud solution. Would it make sense for you to do something like the AWS workspace vm?

either that, or VPN back home so you can VNC into your VM

[quaint basin]

^^^
Honestly just using a single VPS w/ remote access options from anywhere 🤷‍♂️

[quaint basin]

Halls will limit that

[serene trench]

Yeeee

I’ll just fork out for another vps I think

It’s worth saving me the hassle

That way I can use Nextcloud, have cross platform and web app too

[quaint basin]

Wait

If Nextcloud is an option

Why not just Google Drive / Mega / something along those lines?

[burnt night]

Mine didn't fwiw

[serene trench]

It’s an option but I will have to spend more money monthly

[burnt night]

Eduroam is now blocking openvpn though for me

[quaint basin]

Halls let you portforward to a VPN server in your room?

[burnt night]

Connect to a VPN server

[serene trench]

Cross platform issues plus I’ve always had issues with file extensions being incompatible / janky

[burnt night]

Puts you on the same network ezpz

[quaint basin]

Now that is interesting.
My Wireguard VPN server at home can be reached through Eduroam

That's how I work most of the time at uni

[burnt night]

I've only tried the THM VPN

[quaint basin]

Interesting

[serene trench]

I had to get vpn mac-address whitelisted for my thm work even outgoing

it's okay

[quaint basin]

I just use attackboxes when in uni

It's easier anyway

[serene trench]

I don't have the luxury of attackboxes for my work ahaha

I pretty much thought that just buying another box and running nextcloud would be only solution so I think I'll just go with that

thanks y'all ((:

[quaint basin]

Wait. @burnt night I definitely managed to connect to THM in a Kali VM on my laptop from uni a while back

[serene trench]

appreciate your comments

[burnt night]

Me too

[quaint basin]

Like, three weeks ago

[burnt night]

Might try it again from a different room

Was in the uni library at the time, will try a classroom

[tawdry dove]

So due to limitations SFTP isn't an option right?

I was just quickly reading through and thought of Filezilla but I haven't read everything yet

[serene trench]

If I host the SFTP somewhere else I.e. the cloud yeah

But then I still have to upload and download things

I just want it to sync automatically 😄

[twin ridge]

Probably nextcloud then unless you want to fork out for something like Dropbox or drive

[mortal venture]

im a tad confused as to what is going on but very interested

can someone pretend to explain to a 12 year old pls

wait nevermind is it just ben is having vpn issues and muir and james are confused as to why, is that it

[quaint basin]

Not even remotely 😆

[mortal venture]

[quaint basin]

Ben needs a way to sync files between two VMs -- one in his halls of residence, one at university. Halls have restrictive wireless access that you can't port forward into, so no setting up VPN servers or public SMB (unwise anyway), etc

[mortal venture]

oohh noted noted

will hamachi not work?

wait i think i misunderstand still, ignore me

[tawdry dove]

Uuuhh TOS?

[mortal venture]

wait what

terms of service?

[burnt night]

They're saying ELI5

[tawdry dove]

Didn't see the word pretend. I am a dummy

Sorry

[radiant jacinth]

I use kali linux kde edition and sometimes I experience a screen blackout that lasts about 2 seconds, it randomly happens.

The reason I mention this is to see if someone else uses kde kali and is experiencing the same every now and then.

[twin ridge]

Sorry, I use a setup on WSL2 with only the CLI for companionship

[radiant jacinth]

seems like something like this and that's amazing.

[umbral parcel]

@quaint basin sir did u make introductory networking and nmap room?

[mortal venture]

https://tryhackme.com/p/MuirlandOracle

[quaint basin]

Yes

[umbral parcel]

The concepts were like a mountain for me
But slowly I climb it like a mountain goat within few days 👍
The room was awesome and clear all my concept
Thanks you sir 👍

[hoary nymph]

Gave +1 Rep to @quaint basin

[misty relic]

Hi

[tired turtle]

Hello

[idle mesa]

hi

[main bay]

hi

[radiant jacinth]

hey

[mortal venture]

did anyone here actually buy sublime

really love the text editor but not enough to buy it. nano is easy to use just boring and i guess i could learn vim

[rapid summit]

nah, using VS Code.

[radiant jacinth]

I've never seen someone buy sublime, like winrar

it depends on your use cases but I mostly use vim & vscodium

[spark sun]

learning Vi/VIM is one of the things that is in practically every linux environment. and, it is usually a huge productivity boost to know Vi, because the hotkeys are all oriented around never moving your hands away from the standard typing position to perform any operation

[mortal venture]

noted

[twin ridge]

Yeah but it's complicated when you don't use standard typing position...

[robust axle]

hey ppl

this isnt for thm, i wonder did anyone ever use trape?

[mortal venture]

hey im having some trouble with django. any time i insert path('helium/', include('helium.urls)), into my urls.py folder under "urlpatterns" i get an error along the lines of Python Runtime Error: Maximum recursion depth exceeded

and my webserver crashes. Its for the django room if this would be more appropriate to ask in #room-help

the log it drops is probably a few hundred lines long and stackoverflow says its because im including the url inside itself but its Ctrl+C Ctrl+V what the room says so im a bit lost :/

[rose gorge]

One message removed from a suspended account.

[mortal venture]

sorry i have it included, i typed that paragraph by hand

[rose gorge]

One message removed from a suspended account.

[rose gorge]

One message removed from a suspended account.

[mortal venture]

no linux

[rose gorge]

One message removed from a suspended account.

One message removed from a suspended account.

[mortal venture]

its okay you tried :/ thats all that matters B

[quaint basin]

Use Flask. Ez

[mortal venture]

rip to getting this path cert then lol

hey if Muir said it then i gotta do it

[quaint basin]

@warped gust your room. Help

Or @glacial nebula given you're around and kinda know a very small amount about Django

[glacial nebula]

A very small amount? Am literally a django senior dev

[mortal venture]

[glacial nebula]

That’s an infinite loop

[mortal venture]

why is it in the room then

or am i just stoopid

[glacial nebula]

I think what was happening is the main app was called “helium” and then you imported the urls from “helium” so it was infinite loop

[mortal venture]

oh i have two things called helium and im not supposed to?

[glacial nebula]

Probably

It was calling itself as far as I can see there

[mortal venture]

noted. ill just wipe and restart, hopefully it fixes

[mortal venture]

thanks

[hoary nymph]

Gave +1 Rep to @glacial nebula

[mortal venture]

oh wait its fawaz you changed your name. youre a django dev? Thats interesting actually

[glacial nebula]

I taught django for 5 years

[mortal venture]

Muir said flask tho so 👍 but still interesting

[glacial nebula]

Muir never developed a real application

I did

[short elk]

https://github.com/MuirlandOracle/Rickroll-Server

[glacial nebula]

Hobbyist projects hehe

[mortal venture]

yeah but Muir has his OSCP and CRTO. you only have every cert in existence. I think this speaks volume here. Flask

[glacial nebula]

Yes am better in every way possible

And am not scottish

[mortal venture]

You dont use flask like Muir said so youre already behind

[glacial nebula]

I used flask, probably more than Muir did lol

[mortal venture]

Big talk from someone who doesnt have a rickroll server

[glacial nebula]

Have you heard of tryhcakme.com? 🤣

[mortal venture]

nah sounds like something script kiddies go to get malware. whats that site?

[mortal venture]

out of curiosity why flask over django Muir??

[twin ridge]

doesn't django use flask as an engine?

[quaint basin]

Yes

[quaint basin]

It's a lot less complicated and gives you a lot more control. I can do fuckery with Flask that would be 10x harder in Django, but Fawaz is right to say that Django makes big applications easier.

That said, there are some really big flask apps out there now

[mortal venture]

looking at flask rn and so far django is looking a lot easier :/ besides that error i had and took hours to troubleshoot ig

but noted, ill give them both a solid go

[quaint basin]

Flask is as simple as:

from flask import Flask

app = Flask(__name__)

@app.route("/")
def home():
    return "It works!"

app.run()

No fancy tools to manage different aspects of the app. It's all pure python. All your own code. All under your control.

[mortal venture]

i wish i knew python but noted once again

[sullen wasp]

fastspi

[floral gate]

Ive been looking at getting into the maker space to try to force myself to learn some python. robotics seems fun and python seems like a usable language for it

[twin ridge]

I wouldn't use python for anything big though

[mortal venture]

I’m looking to learn python and code wars is too big of a task for me although I have a account, and self teaching is dreadful. What do you guys recommend?

Feel free to ping me with ideas^^ I was thinking pay for classes? Idk man

[quaint basin]

I mean, Netflix and Reddit do

[mortal venture]

Muir teach me python 😐

[twin ridge]

I still think it'd make a mess

[quaint basin]

Again, the Netflix and Reddit backends are Flask, and that's just two examples 😆
Django is a lot more common in production, but it's up there with NodeJS Express

[twin ridge]

I mean I suppose for microservices, why not?

[quaint basin]

Not sure I would call Netflix a microservice, but sure 😆

[twin ridge]

I mean they split everything into microservices

like getting a show's info is a different server than getting the video feed itself

and probably a different database, etc

[dusty sleet]

flask is bad, why? code is a mess

I am sure they use a flask, along side a whole wine factory of other home-made tools

[twin ridge]

never said it was bad, just that I can't figure out how to cleanly map out an architecture for a python app

[twin ridge]

and at least 30 different languages because the teams are different

[dusty sleet]

I came to hate python lately

just a personal preference

I discovered my love for ruby and cpp

[pine iron]

U vile creature ||joke||

[twin ridge]

My condolences

[dusty sleet]

I wouldn't say that , not really

cpp is surprisingly awesome

[twin ridge]

yeah but ruby...

cpp is...dangerous

whatever works for you I guess

[dusty sleet]

ruby on rails rocks

and cpp can run on a rock , and makes more sense in some syntax stuff

[pine iron]

U don’t have to justify liking something man, to each their own :)

[twin ridge]

yeah I'm not a fan of ruby, personally

[dusty sleet]

justifying shows why the other party may consider something

also ruby on rails powers github

thats for people saying its dying

[twin ridge]

Gitlab uses ruby as well

[visual breach]

I think ruby is a great language that was ruined by the community

[white zinc]

if you like Ruby and C++ you should checkout Crystal. It has the same syntax as Ruby, but has types and compiles down to native code. https://crystal-lang.org/

[dusty sleet]

yea interesting,i am just not gonna see it cause i don't cheat on my combiled cpp

: >

[mortal venture]

I simply wish to be a top shelf RTO so am forcing myself to learn python

[spark sun]

Every time I have used ruby, I have been disgusted and appalled at the language design choices

[dusty sleet]

so flask is cool with ya?

[dusty sleet]

sun cat

[blazing spire]

🌞

[dusty sleet]

yes

[frail rapids]

Can I copy paste my own medium blogs onto my website without getting copyclaimed?

[odd acorn]

Check their terms

Which you totally read when signing up

[lost knoll]

Hey there 🙂
I'm searching for a program (app) that I can use to keep track of my progress during ctfs. I know there's a lot out there. I also know this has been asked in the past, and I could rememeber something like "Obsidian" being someones favourite. What do you guys use? Any recommandations?

[scarlet moth]

Notion is nice but there are a lot of options, OneNote, GitNotes, Notion, Trilium, Joplin, Obsidian, and I probably forgot someone's favorite

[lost knoll]

Thanks 🙂 Havent seen anything about Trilium, yet..

[hoary nymph]

Gave +1 Rep to @scarlet moth

[quaint basin]

Cherrytree for CTF notes

Trilium for your normal notebook

Trilium > *

[lost knoll]

Thanks 🙂

[hoary nymph]

Gave +1 Rep to @quaint basin

[quaint basin]

Obsidian is great... until you start learning Windows exploitation

Plain text files just sitting on the disk get destroyed by antivirus as soon as you start adding any malicious code

[dull dove]

RIP my c# sc runner

[quaint basin]

Precisely

Cherrytree uses encrypted SQLite DBs, meaning AV doesn't get a look into it

[dull dove]

thankfully had backups so wasn't that big of a loss

[quaint basin]

BUT it gets unstable at higher node counts.

[lost knoll]

Another reason to let Windows alone lol

[quaint basin]

Trilium has the same system (encrypted SQLite DB, albeit much more efficiently structured) but has a tonne more features including things like sync and server setups, and doesn't get unstable at higher counts

[dull dove]

note migration tho

[echo dust]

gpedit.msc > computer config > admin templates > windows components > windows defender > ...

Unless you're using home version of Windows, then get-wrecked x'D

[quaint basin]

Yeah, migrating cherrytree to, well, anything, is a main in the arse

[quaint basin]

I mean, you can administer Defender on Windows Home just as easily.

[dull dove]

just delete all the sigs easy peasy

[echo dust]

yeah, just can't make a GPO you can just copy/paste between machines.

[quaint basin]

But if you're having to put rules into your AV to leave your notes alone then you're doing something wrong

[quaint basin]

How many computers do you have that you'd want your notes on..?

[echo dust]

More like, how many times do you intend to reformat/reset 😄

[quaint basin]

Another advantage of Trilium

Self-hosted sync server. It's as easy as logging in 🤷‍♂️

[lost knoll]

Thank you so much guys 🙂

[sterile junco]

Does anyone know, how to redirect all wifi users from a specific website to another website through? I am using OpenWRT.

[odd acorn]

Why would you want to do that?

[sterile junco]

To test a phishing attack. I have Raspberry Pi 4 B with OpenWRT

[odd acorn]

I'm not a moderator, but I'd probably say that's more for #advanced-general

@patent gate If you would be so kind as to weight in here

[patent gate]

Agreed

Also, You're still a mentor, Jabz 🙂

Sorry Sky - We gotta make sure that folk on here aren't using the server to do anything unethical. What you are building is on the line, and we don't really know you. However, remain active kepp learning on the site and over time you can get access to the advanced channels 🙂

[sterile junco]

I am not doing anything unethical. You can visit my repo https://github/sky9262/phishEye

[odd acorn]

Phishing is rarely an ethical topic.

[sterile junco]

I want to create my own router and after that, if any user will search facebook.com oy anything else using my router it should be redirect to my local ip

Just 4 Education purpose

[odd acorn]

Oh, yikes, yeah that is not an ethical practice either.

I know exactly what you're trying to do.

I'd probably suggest that you avoid discussing it^^

[sterile junco]

I think, all the topics in hacking could be ethical and unethical

[odd acorn]

Yup, but some are strictly unethical.

[umbral parcel]

i know a telegram group 1k ppl
all r just buying scamas proxies
sendouts and etc.
on montly membership

[odd acorn]

Phishing is one of those that could be practiced but there's rarely a time when you would actually use it ethically.

BrokenSyntax, when someone is told not to discuss something, you don't then go and discuss it.

[umbral parcel]

until a time came
what we see in mr robot
phishing for network tower admin logins

[echo dust]

But yeah, as @odd acorn says. The only time it's actually borderline ethical (And that REALLY is up to debate) is as part of a training scenario, and so long as all phish are released unharmed.

[odd acorn]

@patent gate reeeeeeee

[odd acorn]

You're aware that Mr Robot is a TV Series, right? 🙂

[umbral parcel]

yes 🙂

[patent gate]

Phishing - Be aware of it so you can avoid it.

But it's a waste of your talent to actually create one

[sterile junco]

So, I won't get any help

[dull dove]

It's useful for redteamers, but if you're a redteamer and are asking in this discord how to do it then I'm unsure how you got the job in the first place

[smoky mortar]

The moment you redirect someone in the sense you describe, it stops being educational purpose.

[burnt night]

It's weird how often that happens ngl

[twin ridge]

Makes me think they hand out "red team" jobs in cereal boxes

[smoky mortar]

Depends who's definition you go by; if we take the SANS definition, then Red Team means emulating TTPs of real adversaries to make the Blue Team better. No real industry standard for the term itself, so we get interesting alternatives. 😄

[radiant jacinth]

Is SQL injection ever ethical? :)))

[echo dust]

Yes...

But only in correcting someone elses incompetent or unethical practice.

[burnt night]

Yes. I did it at work today

[radiant jacinth]

👍🏻

[echo dust]

Also always the "within the parameters of a defined and executed red team operation"

[burnt night]

Remember that it's not only redteaming

Pentesting, QA, all sorts

[echo dust]

Fair

[frail rapids]

I hate my life, I hate web development and I hate programming

I just spent 10 hours writing a backend for my writeups

Turns out that the headless CMS' content creation UI only exports JSON and not HTML

so I need to write a JSON to HTML parser

[echo dust]

Don't want to use an off-the-shelf one?

[visual breach]

psst. It's a boy! Just wanted to share.

[frail rapids]

Nah 1) that's boring and 2) I want to integrate it with the rest of my website, thus give it exactly the same format/looks

Which is why I went with a headless CMS that has a GraphQL API

[radiant jacinth]

one thing is learning black hat technique in order to protect yourself and your organization, the bad thing is that you practice this techniques.

I believe you must know both sides if you plan on actually doing something.

[radiant jacinth]

you can't counter the cybercriminals blinded.

I also believe auditing should be done with a mixture of "good techniques"/blackhat techniques, how do you expect to improve a organizations security by restraining yourself, you have to simulate a real "evil" attack and of course they have to agree on to that.

[radiant jacinth]

obviously you have to make sure you don't cause any damages in the process.

there is an actual company in my country that operates this way and the state it in the "about section".

[mortal venture]

what room would you guys say "if you can complete this, the PenTest+ should be pretty easy"

[quaint basin]

The whole point of ethical hacking is that "good" techniques and "blackhat" techniques are literally the same.
It's how you use them that makes a difference.

Learning to phish + write/spot realistic phishing contexts is one thing. Deploying them yourself is another.

[burnt night]

Tends to be fully fledged red teamer roles tho

[quaint basin]

Not strictly true. We offer it as a standalone service to pentest clients 🤷‍♂️

Either way though, it's one that is very rarely used legitimately

-ban 755865727029739580 Bot DMing server invites

[hoary nymph]

🔨 Banned ./ythreshzin.py#5593 indefinitely

[burnt night]

Yeah we very very very rarely have SE in scope

[quaint basin]

Oh, we very very rarely have it in scope for a pentest

[burnt night]

I think it's been one gig so far, out of a metric tonne of others

[quaint basin]

If we do it then it's usually standalone

Or a separate phase of the engagement

[frail rapids]

Does anyone know any proper geo/gps trackers that last atleast 3 months and do not use a sim card?

[radiant jacinth]

What are you tracking?

[mortal venture]

Jabba listening to Rxseboy? Niceee. I have a whole playlist dedicated to him, powfu, and sadboyprolific. And a few small others like them :).

[frail rapids]

A car

[visual cedar]

Hello you all, one quick question what if the Bot does not recognize my Discord token? You know who I can contact?

[radiant jacinth]

#site-support

Try "Tile"

That might be something they do.

Or have a black box fitted by your insurance.

[quaint basin]

Whose car, and why

[frail rapids]

My dad wants one because a seller fcked him over and he made a deal with him about repairing the car et cetera. he doesn't believe the seller so he wants to put a tracker on it to be sure

[spark sun]

Once the car is out of your dad's ownership, regardless of the deal, that's not an ethical use

[quaint basin]

Tell your dad to speak to the police

[spark sun]

If your dad was treated poorly, the local action news investigative team may be a better route to social justice

[quaint basin]

You can put a tracker on your own car, but we ain't helping with it

[dull dove]

It's not that difficult to do

[rapid summit]

What's "local action news"?

[radiant jacinth]

Local news paper, probably.

[frail rapids]

Well that's the issue; in my country the buyer needs to do research on the car, which my dad asked the seller to do (which is a rtard move, and I told him) and he said there was no damage. A few weeks later we found out that the car had a crash a while earlier, but was repaired in an insufficient way

Now he asked the seller to take a look at it once again, but do it right

And well, he doesn't trust him. The issue is that the seller technically did nothing illegal because he can claim he didn't know there was damage

[radiant jacinth]

You can literally find out the full history of a car based on it's reg.

[frail rapids]

Yeah, that's how we found out

[radiant jacinth]

Was it a private sale?

[quaint basin]

Doesn't give you the right to start messing around with trackers 🤷‍♂️
Call the police

Vigilantism is never good

[radiant jacinth]

Two wrong's don't make a right.

However three rights make a left.

any of yall got a keychron k2?

thinking of buying one

[spark sun]

https://tenor.com/view/anchorman-jump-yay-gif-5940723

[smoky mortar]

Stay classy San Diego.™️

[tawdry dove]

He'll read anything off the teleprompter, and I mean anything

[rose tiger]

hi, everyone

[marsh steppe]

any tips on going back to learning cybersecurity or in general? fell into a slump and been binging social all media all year.

[pine iron]

Figure out why you wanted to learn. Repeat it. Personally I do little things and think about a cyber application. “Wow I wonder if this self checkout is vulnerable. Let me look up the software version so I can report it if it is” type of thing

[fiery elk]

hello, welcome to the TryHackMe discord.

[tulip mountain]

How do you guys deal with burn out? (without taking a break, I don't have that luxury) I'm at that point where I feel like I'm spinning my wheels and getting nowhere fast.

[rapid summit]

Take breaks. Daily ones at minimum. Do not work for extended periods of time.

[half depot]

Yeah and try to think clear for a moment

[rapid summit]

Focus might help as well. Do not try to cover everything at once.

[spark sun]

Remind yourself to up every hour

One of the reasons I use the pomodoro method for managing my workday is the frequent breaks

[half depot]

This is a good one

[radiant jacinth]

hello hacker peeps

[left panther]

hi

[radiant jacinth]

thy fellow hacker is not verified, why?

[noble nebula]

I just certified myself

Was goin on!

[radiant jacinth]

shhhhhh you are too loud

[noble nebula]

oop

[radiant jacinth]

purple gang

[noble nebula]

whats going on!

Purple gang, but I wonder if I am really entitled to this title lmfao

[radiant jacinth]

bro, if they gave it to you take it lmao

[left panther]

how do you get gang-affiliated

[radiant jacinth]

first you need to be verified

[left panther]

i believe i am

like 10 mins ago tho

[radiant jacinth]

weird, probably just have to logout and back in again

[pine iron]

Nah roles sometimes take time to appear. To my knowledge at least that’s possibly the reason

[radiant jacinth]

ah, that makes sense

[left panther]

ty

[noble nebula]

It was instant for me though

[radiant jacinth]

same

though, for the subcriber one i had to re-verify

[twin ridge]

should be instant

[radiant jacinth]

That's what I as under the impression of

[radiant jacinth]

My name took a few hours to get changed.

[radiant jacinth]

Mine happened instantly when I reverified for the subscriber role

[left panther]

ohhhh thats what it is

im not subscribed yet

[radiant jacinth]

There it is

[left panther]

😄

i had to verify with the bot with the token

[radiant jacinth]

Happens to the best of us 😅

[dusty sleet]

watch todayisnew yt on his daily routine

[dusty sleet]

anyone participated in @hack

[soft sedge]

hello does anyone know how to connect to a physically remote computer? I am using Ubuntu and try to connect to another Ubuntu machine with ssh username@ipaddress but looks like it's not that simple.

[burnt night]

The target system will need to have an SSH server listening for the connection

And if there's NAT in the way you'll need to deal with that

[soft sedge]

how do i turn the listening system on from the target system? thx

[hoary nymph]

Gave +1 Rep to @burnt night

[burnt night]

Now that sounds like a google question

[soft sedge]

ok thx

[kindred swan]

love the pomodoro method! i combine it with focus mode on my phone and some ambient playlists on youtube to force myself back into productive mindset.

[frail rapids]

What's the difference between AD and SCCM?

AD for communicating and permissions and SCCM for software?

[scarlet moth]

yeah kind of... AD is a lot more than that

if you aren't sure what AD is, I'd just go read some Microsoft docs on it

[left panther]

when you say AD you mean Active Directory?

[quaint basin]

Yes

[neon roost]

ello

[mortal venture]

I’m having some issues with Firefox and I’m not sure what to call it so I’m having trouble using google for help if anyone can at least let me know what it’s called? When I click on a different tab it I see a weird mixture of the tab I’m switching to and the tab I am switching from and it won’t load unless I switch tabs again multiple times

Quite aggravating 😐 a fresh install didn’t help. Not sure if the issue is Firefox esr, my vm, or kali.

[radiant jacinth]

You have to be militant in this field. All jokes aside

[radiant jacinth]

Discipline is how to avoid costly mistakes

[pine iron]

Sounds like an issue with performance tbh, can’t load the full tab in time or something

Check ur drivers for everything

[dusty sleet]

download firefox latest version not esr

[frail rapids]

Finally finished my maths exam

spent 180 minutes on a 100 minute exam

It had vague af questions like drawing the income distribution of a country

That's litterally what the question said, nothing more

I could've done it using standard deviations and averages, graphs, charts

relative, cumulative, absolute, frequency based, etc.

so I just drew a class based frequency bar chart

[radiant jacinth]

Did you get the result of said exam? or do you have to wait?

[frail rapids]

Nope. I'm probably getting it this week

I'm expecting atleast 70% but I'm incredibly triggered about those vague questions

Absolutely nuking the score (probably)

[radiant jacinth]

What's your passmark, 60%?

[frail rapids]

55%, but I want to be secure for my finals

Which require a 60%

[radiant jacinth]

Will you get penalised for taking longer?

[frail rapids]

Nah, I got some physical issues while writing on paper so the principal gave me permission to take as long as I need to see how much time I need extra for the finals

[radiant jacinth]

That's good of them, in my class if you have Dyslexia you get an extra 15 min(s)

[mortal venture]

Noted

[mortal venture]

Esr comes default with kali I just keep it 🤷‍♂️

[frail rapids]

https://www.humblebundle.com/books/hacking-by-no-starch-press-books does this look like it's worth a buy?

[burnt night]

Yeah, it looks pretty good. I've got 3-4 of the books already and they're great.

No Starch tends to be pretty good

[sturdy saddle]

malwaretech is looking for people to test some rev challenges hes making, said so in his discord. Just a heads up

[grim crescent]

oh dang, I wonder if they updated black hat python, got that a long time ago

o dam, I got first edition, that's second, and came out this year. I think this is a buy for me

[frail rapids]

[scarlet moth]

its python3 I think

[frail rapids]

Would be pretty sad if it wasn't

[grim crescent]

wish there was an update to practical malware analysis, from 2012, but oh well

[gray trellis]

noooo THM is on a cloudflare waiting room

ahhh at last

[scarlet moth]

yeah that happens with AoC

[radiant jacinth]

so basically this

[scarlet moth]

pretty much

[frail rapids]

Oh

I saw OllyDBG - or whatever it's spelled like - in description of that book so I was like "hmm this book isn't from 2011. it's made by outdated people like with the buffer overflows tutorials"

[burnt night]

It's a good start with malware analysis.

I say this as someone who's worked through many of the challs and read a lot of it

[dusty sleet]

pog

[valid oar]

hii

[subtle lynx]

Hi

[austere oak]

hey

[lavish smelt]

Lookin >> 2 it & def enjoy the learning. 🇬🇧 🇳🇵

[dusty sleet]

God damn he really wanted the top of the month spot so bad

1056 points in two days

[odd acorn]

Who @dusty sleet

[fallen kettle]

damn

[frail rapids]

https://twitter.com/offsectraining/status/1466036636450492422?t=kwdrZTtqG7k-q2NA5NsAnw&s=19

Offensive Security (@offsectraining)

Changes to the OSCP exam structure are coming soon.

These changes will better reflect the current PWK materials and, most importantly, the skills needed to be a successful information security professional in today's landscape.

Learn more ➡ https://t.co/ozwZxCAZau

Likes

172

Twitter · Dec 1, 2021, 1:29 PM

🧐 🧐 🧐

TL;DR: They're being transparent about the exam content and points, and they're adding a domain controller with 2 clients as part of the new exam

[umbral parcel]

Who's behind this aggressive activitiy 🤔

[errant solstice]

Hi

[radiant jacinth]

hi

[flat acorn]

Hi

[radiant jacinth]

Interesting

[dusty sleet]

^

[frail rapids]

I mean

there are is a room that gives 3000 points I believe

I can confirm theres one with 1500 but would need to confirm the other one

[umbral parcel]

which one?

[muted pivot]

@frail rapids how did you get the countdown 👀

[frail rapids]

the one with 1600 is https://tryhackme.com/room/ccradare2

don't use THM to grind points though

use the platform to learn and earn those points

[dusty sleet]

I dont think it will contribute even 500 to the monthly points

[frail rapids]

Ah like that.

Yeah it would only contribute 25%, so 400 points, but it was released more than a month ago so it doesn't count towards monthly points

[dusty sleet]

This was a good day

[radiant jacinth]

Woah 4 screens what what what

[dusty sleet]

rooted 3 med new machines

*2

[radiant jacinth]

grats man

[dusty sleet]

thx

why is room counter different ?

[burnt night]

They're different metrics

One is Rooms In
The other is Rooms Complete.

[dusty sleet]

Do "rooms in "get less by 1- time 2- changing room content 3- sth else ?

[dull dove]

I believe the rooms in might use only public rooms as a metric

[frail rapids]

Why are sockets part of the transport layer?

Shouldn't they be in the application layer because it's used in the software?

[twin ridge]

Or they may have left some rooms

[rapid summit]

Because they provide a service used by app layer

[twin ridge]

you may want to verify to be able to embed gifs 🙂

!docs verify

[deft fossil]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[twin ridge]

Read this ^

[lavish smelt]

ok, thank you

[hoary nymph]

Gave +1 Rep to @twin ridge

[twin ridge]

you also get bonus colours

read the link

😉

[lavish smelt]

reading now, thanks

[twin ridge]

there's a token on your Tryhackme profile, DM the @deft fossil bot in order to set it

[fair orchid]

think of sockets as an instrument that connects the application layer with the transport layer, they are as if they were in layer four and a half

[lavish smelt]

done

https://tenor.com/view/sorry-blue-bird-bam-coyote-gif-16519405

[twin ridge]

there ya go

[lavish smelt]

thank you for your help, I appreciate it.

[twin ridge]

np

[lavish smelt]

Sweet

[twin ridge]

there's a #870288406054334465 btw 🙂

[lavish smelt]

thanks

[hoary nymph]

Gave +1 Rep to @twin ridge

[crude meteor]

!

[radiant jacinth]

I picked up an advent calendar the other day and it's the best thing ever.

[earnest path]

hey mates, im new to this world and ive been looking for some help regarding remote access to the labs from my own testing environment, im not a complete noob, i play with tryhackme/htb/BTLO for a couple of months now, if anyone has some time, how can i have GUI remote access to, for example, tryhackme's windows challenges? because i cant ssh on those

[burnt night]

Either THM's in browser access or the RDP protocol.

The room will have instructions if it's a walkthrough

[earnest path]

thanks a lot, so i cant use RDP for every room i join?

[burnt night]

RDP needs to be enabled
You need creds

[earnest path]

i see, okep 😄

[radiant jacinth]

https://www.youtube.com/watch?v=IPukuYb9xWw

This is going to be shown at CES 2022

[radiant jacinth]

https://www.reddit.com/r/pcmasterrace/comments/r7c8px/this_is_happening_to_my_two_week_old_3080ti/

Yes

[hoary vale]

This is the most genuinely creepy android proof of concept project I think I've seen...

the eye tracking is probably the scariest part

[radiant jacinth]

It is and it's also really freaking cool!

[hoary vale]

It's amazing! The movement and everything is super smooth

It also gives me really strong "I Robot" vibes tho lol

[radiant jacinth]

I totally want to work with robots

[hoary vale]

Between these guys and boston dynamics, some cool robotics stuff is being done

Machine Learning/Virtual Intelligence would need to come a little bit further before working with these kinds of robots would be possible. Well, 'possible' already probably, 'productive' is another thing

[radiant jacinth]

I can't wait for more sophisticated VR systems

but above all like household helper robots like in the jettsons

[hoary vale]

inb4 detroit: become human is a little too close for comfort

[mortal venture]

when searching using / how can i cycle through the matches? Any key i press seems to end the search rather than iterate through them

[still jolt]

n

I think.

[mortal venture]

no that just types n into the search

[still jolt]

Not sure. Try in #general. More active in there. And no slowmode

[mortal venture]

Thank you anyways

[red trout]

👋

[tawdry dove]

CTRL + i should go forward i believe and then i think CTRL + o goes backwards?

If not, try CTRL+ p and CTRL + n

@mortal venture work?

[mortal venture]

none :/

[tawdry dove]

I think you're vi/Vim is broke

Google isn't returning anything else

[still jolt]

Assuming they're using Vi/m

[tawdry dove]

True

I assumed when they said they were searching with /

[spark sun]

Searching with / you can advance with n and go back to previous with N

[mortal venture]

okay i realize my mistake and once i did a quick google search answered me..... I was asking how to use it in firefox but i have also been wondering this too so thank you

quick find in firefox. idk why the hotkeys are diff between linux and windows despite being the same browser

the answer was F3 and CTRL + G

[still jolt]

See, mentioning what you were using would've been helpful. Everyone assumed you were using Vi(m).

[mortal venture]

i realized that yes

[fallen pendant]

When I do Tab+Enter in bash, it freezes and I don't know how to get out of it. Does anybody experience the same thing?

I guess it's tab that's borked.

Now I get it. It's trying to do tab completion.

[snow rose]

Please I don't know to fix this issue.The attackbox is not displaying

[zenith sage]

@snow rose enable cookies in browser

[snow rose]

Okay

[radiant jacinth]

Ello

[dusty sleet]

what us a squid proxy?

「」 cool thing 「」

[frail rapids]

So what I don't understand is, why do ISPs not focus on improving the ping

like wouldn't that make the web A LOT faster

[burnt night]

They do.
But latency and throughput are both important

[radiant jacinth]

Are you talking from a gaming perspective??

I mean, they can only do so much...we all know what happened with the recent battlefield games right on their release....if the netcode sucks, then there's nothing the ISP can do unfortunately.

[spark sun]

Big difference between throughput and latency.

[twin ridge]

latency isn't THAT important for most internet tasks

although I've had a case recently where an aggressive timeout coupled with extreme distance would cause a CORS preflight to fail

that was cute

[frail rapids]

No. general internet use

Say you're doing synchronous communication with small file sizes like JS files and web pages, the biggest bottleneck would be the latency because it's not like you're gonna need 110ms to download a 11kb file with 100mb/s

[radiant jacinth]

my wired issue arrived today. Morpheus is on the front cover

I can't wait for the movie! 19 days!

[radiant jacinth]

Congratz on your new role as trial mod 👏 😊

[rapid summit]

That's more of an application layer problem. HTTP/2 already does a lot to address this.

[umbral parcel]

Can anyone tell difference between
Attackbox and kali machine ?

[burnt night]

Attackbox is kept up to date, has files for THM rooms often, and is designed by THM for THM, and it's ubuntu

Kali is kali

[umbral parcel]

So we can use attackbox for room
When using kali we will have to use openvpn to connect
Am I right?

[burnt night]

Not for THM Kali

And not for THM networks

If you're using your own machine, virtual or not, you'll need the VPN.

[umbral parcel]

I understood

🙂

[umbral parcel]

If I start use kali and kept new files saved in it
Will still be there every time?
Or it will be reset everytime I start a kali vm?

[rapid summit]

As long as you don't use a live image, they'll persist.

Or more precisely: As long as you install Kali locally, they'll persist.

[radiant jacinth]

Let's get ya'll

[dusty sleet]

minor bug in introto86 room
input field expects input but can be bybassed without one

[tawdry dove]

#room-bugs

Just so the proper people see it

[fresh dune]

hello, im having an issue starting my attack box to complete day 4. it says i can only use it an hour a day but this is the first time i’m logging on. any help?

[tawdry dove]

This is probably a question for #site-support

[fresh dune]

thank you

[hoary nymph]

Gave +1 Rep to @tawdry dove

[tawdry dove]

I'm not sure how the attackbox keeps track of time but for streaks the time rolls over at midnight I believe

[dusty sleet]

after refreshing the page the answer appears

[frail rapids]

I can't stop thinking about how a star shape is a quintagon with folded sides

nice star, I know

for some reason it boggles my mind

[opal beacon]

https://www.offensive-security.com/offsec/oscp-exam-structure/

[radiant jacinth]

https://www.youtube.com/watch?v=CUlGNwUbY_8

I love how all the hackers are geeked out together over one laptop screen

[elder holly]

hello

[weary patrol]

hello

[umbral parcel]

Hi

[dusty sleet]

o/

[idle mesa]

hi

[twin ridge]

you mean pentagon

[frail rapids]

oh. yeah that's right

Confused the latin with the greek

[wide thicket]

Hello

[radiant jacinth]

I remember a THM room having a command to clean out /etc/hosts file , does somebody have it by any chance ? 😄

[pallid citrus]

File inclusion?

[burnt night]

Upload vulns but it was only for entries added in that room

[radiant jacinth]

Oh I didn't know that, I'll write my own so

thanks for answering

[quaint basin]

Aye, the one in upload vulns just deletes the last line @radiant jacinth

[radiant jacinth]

Alright thank you 😄

[mortal venture]

Muir what’s your pfp from? Mesmerizing

[quaint basin]

Just a modification on my normal one

I made the normal one. Bee modified it for winter

[dusty sleet]

sad

[radiant jacinth]

I've just rooted toc2, it is by far one of my favorite initial foothold + privesc method 😄

very fun one though

[dusty sleet]

how to scan the 65k ports without writing --range 0 -65k in rust scan

[dusty sleet]

might do it in a year or so

[radiant jacinth]

-- -p- I guess

[dusty sleet]

this is a hackk

isn't -- is passing to nmap

[burnt night]

Pretty sure it does it by default if you don't specify ports.

[radiant jacinth]

[dusty sleet]

okk ty both

[radiant jacinth]

I will downvote myself and get back to maths

[dusty sleet]

I have to go back to math tmmrw

[radiant jacinth]

Math ezpz

[dusty sleet]

math take so long

and need focus

which are 2 things I don't realy excell at managing

[radiant jacinth]

close discord :p

[dusty sleet]

who made this room ?

https://tryhackme.com/room/rfirmware

[odd acorn]

If you scroll down it should tell you right?

@dusty sleet

On mobile

[dusty sleet]

on desktop it doesn't at least as I can see

[odd acorn]

Desktop

[dusty sleet]

sorry my bad didn't open the more section

[dusty sleet]

yall need this https://youtu.be/Qz82KHieDBU

maybe not but still...

[radiant jacinth]

-8ball watup

[hoary nymph]

Yes

[dusty sleet]

this looks intresting https://you.com/

[spark sun]

"congrats you are another new product! your browsing habits are now going to YA3P!"

[dusty sleet]

ya3b as in ?

[dusty sleet]

surprisingly cli r2 commands are intuitive

as somone who didn't know the 86 asm nor radare

radare2 room should be done before the 86 room or there should be some other room to be refrenced before both

so I am doing r2 room and using izz to print all strings as ss below, but the string that is required is not present w izz, what should I do, Ive tried seeking last memory address w s addresss then s+ then izz but no luck

nvm I analyzed wrong bin lol

how would I know which after which in memory ?

[rapid summit]

Wouldn't these be better in #room-help or #room-hints ?