quiet-conversation

[pure mantle]

Not everyone buys laptops because they have to take em places. Just a suggestion.

Aside, I've heard dell's XPS is a good one for battery life

[fast hawk]

Does anyone have any free nitro?

[echo warren]

i have a good beat for when ppl say no

[quaint basin]

You could try asking one of the many bots claiming to give it away, but I'd very much recommend against it 🙂

[twin ridge]

Sigh

You've let me down.

[echo warren]

it was meant for liam

but looks like liam was banned

[quaint basin]

Nah, just left

[frail rapids]

https://twitter.com/QubitFin/status/1487710836173185025?t=GP3GZDNrHRSbF3ndYgtv7w&s=19

Qubit Finance (@QubitFin)

We'd like to offer the exploiter the highest bounty in history.
Let's retweet this!

Retweets

158

Likes

443

Twitter · Jan 30, 2022, 8:54 AM

[winged rain]

It legit sounds like a win win situation tho, good for him

[serene trench]

It's difficult to move that much money gained from non-legal things online

I'd take the 2 million

But maybe I'm just boring 😄

[hoary vale]

I could be self sufficient off 2 mil

I could probably be fine with 1 honestly

[serene trench]

I don't think I'd honestly know what to do with 2 mil

Mhhm, put a deposit down on a flat, buy a car and that's it...?

oh and help my brother through the rest of his uni

[spark sun]

Buy a multi-tenant housing complex, list it through a property manager, continue living the life i have with no changes

[serene trench]

Maybe go on holiday for a month

[hoary vale]

I'd probably get an RS3, then invest the rest somewhere

[serene trench]

ooh that's a smart one

Audi RS3's are 🤤

[hoary vale]

It's the only thing I'd swap my GTI for honestly

Because it's the exact same thing, just better

[serene trench]

I'd buy an BMW M3

and then the rest of the 2 mil will go on the insurance

[hoary vale]

I've got a friend with an M3, can't go wrong there either

[serene trench]

I guess at that point why not get both? 🤣

[hoary vale]

If I was gonna have my dream two car garage, it would be an RS3 + either 911 Turbo S or a Cayman GT4

[serene trench]

oooh yess

[hoary vale]

Followed by crippling insurance

[serene trench]

Hahaha!

That and the road tax 🤯

actually, I would get a Mitsubishi evo x and live my rally driver fantasy!

[hoary vale]

Ooh, that could be fun.

[serene trench]

I have wanted one ever since a kid

[hoary vale]

Was gonna get an old WRX hatchback before I found my GTI

[spark sun]

my dream garage is an early 60s chevy apache and a more modern V8 pickup

[serene trench]

respectable respectable

[hoary vale]

The apache is the one that looks high as a kite isn't it

[tawdry dove]

Cummins go brrrrrrrrrrrr

V8 yucky

[hoary vale]

I just want Audi's magic 5 cylinder

[spark sun]

diesel cost too much

and modern diesels are tricksier to keep healthy

[tawdry dove]

Make your own

[spark sun]

v8 engines are way more reliable for my use case

hauling a small camper-trailer or a 10' trailer of my stuff doesn't require a diesel

[tawdry dove]

Yeah, I would much prefer to transplant an older engine into a more modern chassis

[spark sun]

the chevy stepside is just for funsies, because i love the design

wrapround windscreen and stepside is one of the most attractive vehicle designs

[tawdry dove]

Yeah, newer chevy trucks just look bleh

Older trucks in general look much better

If they aren't beat to shit

[remote echo]

https://youtu.be/EQAGN2l3bdI

Evo. Where you get an evo from.

Literally one of my favorite lines

Love jimmy

[winged rain]

Hire a financial advisor

That's the first thing I'd do with the 2 mil

[winged rain]

Then I'd change my name to Bartholomew

Cut off all ties to society and go live in the mountains

Think about philosophy

Then suddenly come back and create a monopoly in literature

[regal gazelle]

I'd do that even without 2mil - "Cut off all ties to society"

[dusty sleet]

vibe

[hoary vale]

I'd invest most of it, then sod off and be bruce wayne at the beginning of Dark Knight Rises, where people aren't even sure he exists anymore

Then randomly show up with a bunch of cool toys periodically

[scarlet moth]

get 2 mil, put it in the bank

[tawdry dove]

Multiple banks FDIC go brrrrrrrr

[winged rain]

BECOME SANTA

every summer give gifts to the whole neighborhood

Anonymously

[dusty sleet]

Yall jus wasting ur times

[gray jetty]

Oh, thought that's why we're hanging out in discord in the first place

[frail rapids]

https://twitter.com/jonathandata1 misinformation is no more :crabrave:

[ripe haven]

What was the deal with him? I saw some drama on twitter but have no clue what happened haha

[frail rapids]

He made claims about the Chinese app that the olympians have to use in Beijing: it would record them et cetera. The only evidence he had was a few s of the strings of several unrelated apps (e.g. android and iOS) with no reverse engineering at all

According to people in the community, he has a history of making these unsupported claims and is basically a wannabe: he claimed he was #1 on hackerone, while it was #1 in the US in 201* and because all of that hackerone rep was earned on the department of defense which apparantly accepts almost anything

and now imma shut up in before I get muted for rule 2

[ripe haven]

If you have more stuff about him I would live to here it haha, DMs open xD

[twin ridge]

mostly drama

[quaint basin]

Heh, yeah, one of the very first spats was about THM actually. He claimed that being able to pull data from a public API endpoint was a vulnerability.

The public API endpoint in question is the one that the Discord bot uses to announce rooms 😆

[half fractal]

SmH tHm FiXeD a BuG wItHoUt AcKnOwLeDgInG mY rEpOrT

[twin ridge]

uh, no, the api was just moved

[frail rapids]

🤣

[quaint basin]

Along with half a dozen others that were on dumb routes 😆

[rapid summit]

that one was interesting drama as well 🙂

[frail rapids]

Definitely true

I learned that you should only make claims if you can prove it

in before I get hated™️

[serene trench]

That is usually a good foundation for anything in life

[odd acorn]

Oh, God. Don't get me started.

[cerulean basalt]

I can not buy premium voucher

[weary pivot]

👀

[twin ridge]

I mean they're not wrong

[dusty sleet]

Ayo

[mortal venture]

I don’t get it

[haughty sedge]

Me neither, lol

[slow nacelle]

Hello everyone i have question about John the ripper what if I encrypted a RAR file with hashed password not plain text can john still crack it ?

[signal hull]

Remember that hash cracking requires you to have the password in the list that you're using. Regardless of what modifiers/rules you put on it, at the end of the day, it's basically one big list, and you're checking the hash of a password from your list against the actual hash you're trying to crack.

If your wordlist and the rules you apply do not hit the exact "hashed password" you used, then yeah, john won't find it. But, if I took that and put it in my wordlist and did the whole procedure, yes, it would be "cracked".

[rugged frigate]

you can also try to bruteforce it if it's not that long and your rig is strong enough to not take years to do it.

[radiant jacinth]

Is HSTS still vulnerable, or it's fixed ? I'm in an outdated course, so I'm curios

[dusty sleet]

https://github.com/nerdsinspace/nocom-explanation/blob/main/README.md

good read

[dusty sleet]

Hey wanna buy me pfp?

[pale ferry]

I don't know where to go, I need help with a lesson

[radiant jacinth]

Is it homework?

[pale ferry]

It's with the Identifying Devices on Networks practice on TryHackMe

I am stuck on spoofing the mac address question

[radiant jacinth]

Oh!

I know what one you're on without even going

Do you know what spoofing is?

[pale ferry]

I get the gist. I just started today

[radiant jacinth]

Then you need to "spoof" the address of the other machine.

[frail rapids]

Sorry, I only own a cat from da block... no apes here https://opensea.io/assets/matic/0x2953399124f0cbb46d2cbacd8a89cf0599974963/101926207304663902062289126253880087080761763971933907596760126812427254759437

[pale ferry]

I'm so dumb i just realized what it was asking me to do 😅

[radiant jacinth]

You're not the first person to go "wat"

You won't be the last either.

[pale ferry]

I saw that in the forum

[radiant jacinth]

Next time though, you'll probably get a faster response if you confirm it's THM you need help with (We don't help with homework or school work here) and use #room-help or #room-hints

[radiant jacinth]

Yo

[summer adder]

https://cdn.discordapp.com/attachments/755292767453708419/937406469324800010/unknown-63.jpg

[tawdry dove]

You need to verify to post media

[summer adder]

So sorry

[tawdry dove]

!docs verify

[deft fossil]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[tawdry dove]

Follow these instructions and you'll be able to verify

[summer adder]

I am so sorry it is just a pic of the halo rat

[winged rain]

Mountain ranges are so beautiful

I remember going to BC for a summer and just staring at the mountains, they are so mesmerizing

[radiant jacinth]

ikr

[twin ridge]

Mountains're nice

[hushed niche]

which place?

[dusty sleet]

moving here cause heat there

[radiant jacinth]

near nanital in uk

[worthy prism]

I want to use m1 air for cyber security. Do you think this is a good idea?

[burnt night]

No. Virtualization is a big problem with those.

[gray jetty]

also, binary exploitation

[dusty sleet]

no.

[worthy prism]

i choose matebook x pro

https://shop.huawei.com/tr/product/huawei-matebook-x-pro-2021/

[dusty sleet]

Who else get's so fuckin excited whenever u see this guy , he is soo like me with much much more iq points
https://github.com/geohot?tab=repositories

[frail rapids]

Ben 'n jerry's be wildin' https://twitter.com/benandjerrys/status/1489393235655106562

Ben & Jerry's (@benandjerrys)

You cannot simultaneously prevent and prepare for war. 

We call on President Biden to de-escalate tensions and work for peace rather than prepare for war. 

Sending thousands more US troops to Europe in response to Russia’s threats against Ukraine only fans the flame of war.

Retweets

1878

Likes

13033

Twitter · Feb 4, 2022, 12:19 AM

[radiant jacinth]

Everyone say

E

[scarlet moth]

Ben & Jerry's keeping on brand

[tawdry dove]

On Brand for Ben and Jerry's but also a little misinformed. The thousands of troops are IRF1 which is the 82nd Airborne. It's a Brigade sized element that's always on standby, has been since the 80s. In other words, it's a nothing burger

[wary cradle]

@winged rain please avoid content that is political. This is also not a meme channel

[winged rain]

Sorry about that

[frail rapids]

https://twitter.com/joehelle/status/1490771926863724548?t=F6DFEE5oqcVJKHJt6bsdow&s=19

Joe Helle, Mayor of Hacktown, First of His Name (@joehelle)

The duck walked up to the INE stand, and he said to the man running the stand, “Hey! Got any grades?” And the man said, “We have 30 business days, ok?!” And he waddled away. And he waddled away. And he waddled away till the very next day.

Twitter · Feb 7, 2022, 7:38 PM

[cloud minnow]

It do be like that sometimes...

[urban latch]

@scarlet star do you mind if i dm you?

I cant seem ot run the kali machines

[scarlet star]

im a lil busy at work right now =/ did you remember to grab the arm image? and not the amd64?

kali-linux-2021.3-installer-netinst-arm64.iso is the one i used

[urban latch]

ah my bad

thank you

[scarlet star]

no worries - i did exactly the same 🤣

[urban latch]

found it thanks

[radiant jacinth]

First screenshot is the task 1 in the room: The Find Command
2nd screenshot is from my vm linux.
Can someone please take a look and explain this?
Confused about the Find command. I forget accidentally to use precede expression + -name and yet the command found the file. (find file-1-see 2nd screenshot) What is the different? 😕

if you look in the list, the same thing happened with find file-*, command outputs both of the files but then it's without slash /

Oh ok, my bad(thought I should have to ask here)😅

[tawdry dove]

Ignore me

[radiant jacinth]

?

[tawdry dove]

I misread what you were asking

[radiant jacinth]

oh ok, np sir. Happens to all of us 👍

[tawdry dove]

Looking at it, it seems like the command was expecting a file path with the use of the wildcard character? Not exactly sure

And it might also be because you have file-* unquoted

Try find -name "file-*"

Oh wait you already did. So yeah that's my best guess

[radiant jacinth]

thanks for the reply. Yeah that is what I am confused about.
Why find -name "file-* if I can do it faster this way: find file-* ?

Oh I see now what your reply means. File path. Just tested it out to cd and used the full command and this is the result. 😅

figured this out. Thanks for the help 🙂

I think I was confused about the working directory and folder directory. Because I also tried in the mint directory this command: find file-* and he didn't found it, outputs: No such file or directory. So yeah that is why to use full command 👍

[dusty sleet]

this room is broken

https://tryhackme.com/room/phishinghiddeneye

[tawdry dove]

#room-bugs

[sacred hawk]

Excuse me, why I have finished this room but it doesn't show in the dashboard

https://tryhackme.com/room/packetsframes

[gray jetty]

#room-help message

[sacred hawk]

Great, Thx

[hoary nymph]

Gave +1 Rep to @gray jetty

[tawny summit]

just a quick question, is there a recommendation of how much disk space I need for dual boot?

[tawdry dove]

Unless you're in a niche application, Dual booting isn't recommended generally. VMs are leagues better as you don't mess up core components when you mess up. Windows also doesn't run over your boot partition. Is there a reason why you're avoiding a VM?

[tawny summit]

not really. I just thought that dual boot would be easier/more suitable for the not so good pc that I have now, what is apparently not the case haha

I'm going to try and set up a VM, thanks for the info

[tawdry dove]

Not a problem. VirtualBox is a good free option that has a lot of online tutorials

[twin ridge]

Though it doesn't play nice with HyperV and/or wsl2

[dusty sleet]

Duel boot is bae

And I am tired of pretending other wise

[frail rapids]

Dualbooting does have its perks though

e.g. better performance and the dopamine rush when you start your linux installation on bare metal and it responds with a kernel panic

[oak mesa]

can someone put me through....thought it was from the ground up

[burnt night]

Can you clarify what you mean, please?

[oak mesa]

i meant i need basic guidance on hacking pls

[burnt night]

Have you checked through #start-here ?

[oak mesa]

no...thanks ill try that now/

[oak mesa]

thanks bruh

[hoary nymph]

Gave +1 Rep to @burnt night

[short elk]

anyone watch the apprentice

[radiant jacinth]

No

But I used to and it was fun to watch

[radiant jacinth]

So I really should be doing this 🤔

[ripe haven]

@lost knoll Im sorry for the tag, but I finally passed you on the leaderboards, I have been to do it for like 3 weeks now and it finally happened! I believe you can get to me quickly enough though!

You are 12 points away though haha

[molten siren]

personally, i prefer encrypting in base64

[radiant jacinth]

very good

[twin ridge]

Base64 is not encryption

[gray jetty]

ah, the time old confusion between encoding and encryption

[molten siren]

I did a funny

[twin ridge]

yeah I'm still a bit tired

[molten siren]

I woke up about 20 mins ago and now I'm outside waiting for a bus in freezing weather

😔

[half shale]

Yo

Can i become a mod?

or Admin

Owner

Or discord Owner

[twin ridge]

no, and just for asking you probably never will 🙂

[radiant jacinth]

Perks of having a licence.

[molten siren]

😔

Today has not gone very well so far
Right now I'm standing in a supermarket using an employee's charger to charge my phone cause I'm in the middle of nowhere and my bus pass is on my phone but the battery died

At 25% battery now, but gonna charge a bit more just in case

[radiant jacinth]

😦 ouch.

you should pick up a battery pack at some point.

[molten siren]

I have one, but this is literally the first time in quite a while that I haven't taken it with me lmao

[hidden sparrow]

hi guys

im brand new in ctfs can anyone help me with a roadmap as a beginners?

[pure mantle]

#start-here

[forest cypress]

So many new and interesting rooms and so little time. >_< I wonder how many rooms are there overall and if the top places in the leader board have done every single room ... hmm ...

[steel saddle]

I'm sure you have seen this https://tryhackme.com/faq but check "How points work" again and there is also a shortcut (find a bug) to get more points ☺️

[dusty sleet]

https://www.instagram.com/reel/CZRuVhLBwcl/?utm_medium=copy_link

Da?nnnnn

[winged rain]

Never missed a semicolon😂

[vocal timber]

.

[dusty sleet]

.

[rich tulip]

Isnt the bug fixed already?

[frail rapids]

How big is the chance that running malware on proxmox VMs will infect your entire computer?

(e.g. moonbounce-ish exploits with sandbox escapes)

[flint vessel]

how do you deal with stress

[radiant jacinth]

Malware breaking out of VM's is rare.

[gray jetty]

Think about the damage it would cause to thm if it could 👀

[burnt night]

There's been a couple for KVM but if you keep patched

[burnt night]

Not much. THM hosts on AWS, the impact is to AWS not to THM really

[gray jetty]

Yes, but they could stop users from deploying machines

[burnt night]

How?

[gray jetty]

Taking down the aws servers hosting the machines?

[burnt night]

That's still AWS' problem

It's massively redundant

It's not ran on one machine

[torn fog]

hello guys

using the Harvester in Kali Linux

[radiant jacinth]

What ip is that?

[torn fog]

no results

how can I gather info around this ip address

[burnt night]

What IP is that?

[torn fog]

lol its the ip address that given through the assignment

[burnt night]

Why are you trying to gather data on it?

Who told you to?

[wintry garden]

lord ninja xD

[torn fog]

my Uni told me to do this assignment before tommorrow 😕

[burnt night]

We don't do homework help here.

Ask your teacher for help.

[torn fog]

um okay sorry, I thought to get some help from experienced guys here, okay

[burnt night]

I'm a mod. If you have a problem with me trying to establish if it's illegal or unethical, please take it up with MuirlandOracle.

[wintry garden]

When asking other members for help (either with TryHackMe rooms or anything else), Isnt that in the rules? "anything else"

[torn fog]

sorry

[burnt night]

What point are you trying to make?

[torn fog]

okay I will ask for help

in #room-help

[burnt night]

That is only for tryhackme rooms.

[wintry garden]

Im just saying, asking for help on general questions shouldnt be scrutinized, i get being unethical is not ok, and your trying to make sure thats not happening. But asking for homework help isnt against the rools

and im not trying to be rude in any way, dont take it like that please

[torn fog]

oh okay understood, can u name me some discord servers that I can get help

[burnt night]

Asking for homework help is just something not done on an etiquette point of view.
You could argue it's also unethical as it's assessed and they're effectively cheating.

[torn fog]

from cyber sec enthusiasts like you

[wintry garden]

ok man, i get it i guess.

[wintry garden]

sorry

[burnt night]

It's an assignment from your uni.
If you haven't understood the teaching material or you need help, that's exactly what your lecturers and teachers are for.

Get your money's worth out of your education

[torn fog]

its not a home work help actually, its something I really want to learn, I searched through google, I already found the answer, through online ip address look up, I can put that answer to the assignment, but for sake of enthusiasm in cyber sec I have, I want to find a way to look up on the Ip address via theHarvester only

its not a homework help

[burnt night]

Then it's an exam?

Or otherwise an assignment from your university?

[torn fog]

thank you, Im sorry if you guys misunderstood this, I fucking love this field, I was stucked and came here asking for help

[burnt night]

Counts as homework. Same advice applies.

[torn fog]

yep assignment not a graded one, I can ignore it if i want

[burnt night]

The absolute best thing you can do is talk to your teachers

Show an interest, get them to explain further. Work with them.

[torn fog]

yeap, ikr, I believed this could be a good way and faster way to get know than asking from teachers, but it didnt worked as I expected

[burnt night]

Especially at university level, be on good terms with your teachers.
One of the big advantages of going to university is connections.

[torn fog]

yes, I understood, communication with teachers is a key

[burnt night]

I got my job in pentesting, skipping certs and a few years in IT, just by being on good terms with lecturers

(also leaving assignments till the night before they're due is bad)

[torn fog]

yea, that makes sense, also motivated me

[torn fog]

nope today is when they gave assignment and told us to finish before tommorrow, lol, they love to give stressful assignments haha

[torn fog]

hey um

can we get a job just only with certs and without a major?

[burnt night]

There's only one answer to that question: maybe

[torn fog]

always depends on skill and attitude noh

[burnt night]

There's so many factors at work. A degree still makes getting interviews easier. If you're working on a degree, finish it.

[torn fog]

im finishing it haha, wish me good luck

thank you for having a talk with me, alr back to assignment 😂

[radiant jacinth]

I was using theHarvester last week.

[quaint basin]

👋
Just to elaborate on this 🙂
There's never any way to tell if something is assessed or not if it's an academic question, which means that we would be unethical if we helped with it as we would be giving them an unfair advantage over their peers. If it's not assessed then there should not be a problem speaking to a lecturer or teacher about it, which solves the problem entirely 🙂

[lean pendant]

did you know the room to get Windows Priv Esc ?

[wheat marsh]

Hello

[dusty sleet]

No.

[frail rapids]

Just finished factorio for the first time ever

took me 74h

[eternal cedar]

Hi

what kind of certifications are basic for an ethical hacker

[frail rapids]

OSCP, CEH, eCPPT, eJPT, etc

[misty dust]

Hello everyone

[eternal cedar]

Thanks

[hoary nymph]

Gave +1 Rep to @frail rapids

[eternal cedar]

which certificate has the highest value in ethical hacking

[frail rapids]

For beginners I'd guess the OSCP

[final osprey]

Hi everyone.
I'd like to learn C (I have previous experience with python and java) but most books spend a lot of time on basics (operators, data type, etc) and I usually get bored. Does someone know a book that covers other arguments in parallel with C? Like C by projects or C for binary exploitation.

Even game design or scientific computation would be good. I just get bored in learning C for its own sake.

[pure mantle]

you might also try in #bookclub

[final osprey]

I missed that section. I'll check it out. Thank you

[dusty sleet]

Can trilium do this ?

[spark sun]

trilium has support for mermaid.js built in - super easy to use diagramming language definition. not sure about the circuit diagram though

[pearl cedar]

Are streaks based on the specific hour vs just a calendar day? I lost my streak because I logged in later in the day, kinda stinks.

[radiant jacinth]

Wtf

xD

[quaint basin]

That's your attackbox, not the deployed machine 🙂

[radiant jacinth]

Ah

Idk why I got that resetted

[brisk meteor]

I need some general advice on solving CTF's as things get more difficult. When should I give up and look up a write up? I know sometimes advanced CTF's are timed so when it times out. For THM though at what point should I stop trying harder, take the L and learn?

[winged rain]

When you have no idea what's going on or they're using tools techniques you've never learned about it's usually good to look at a writeup then research those tools, techniques yourself

You can't do a CTF if you don't have the knowledge needed to actually do it

I also don't like that you are describing it as taking an L because it's a learning opportunity which should be viewed as a W

[signal hull]

Research the potential tools, and then if you’re still stuck, then consult a write up

Don’t limit yourself to only what you know and are comfortable with, otherwise you aren’t pushing yourself to do the research. If you do research and still can’t figure it out, then looking at a write up or getting a nudge is what you should do

[wintry garden]

i see, i misunderstood and thought asking for help was being considered "unethical" i just misread. Im sorry

[quaint basin]

All good ♥️

[wheat marsh]

I am new to the information security. TryHackMe.com is a good website. If I have finished some lab in the room, I don't know how to find the solution.

[faint shoal]

If you require room help or hints #room-help #room-hints would be the place to go, prefferably after you've done some research and pondering yourself.

[gray jetty]

Literally this, I recently did a room with "redis", didn't know about it before but researched for hours and got the exploit for the foothold!
Sometimes, it is too advanced but you have to put a solid few hours in first before going for a writeup 🙂

[signal hull]

I think it's a lot harder to get in that mindset by just doing THM. I know I found the discipline to do the research when I started doing real events.

Because there literally are no writeups to go off of, so either you keep trying or you just move on

[gray jetty]

Yes, when I was starting in Thm, I'd read more writeups without the proper research too
The discipline is something that gradually develops

[winged rain]

I've realized I've been doing it wrong 😆 I should research first then go look for a writeup

I would look for a writeup then research the stuff in there

[brisk meteor]

Just read this conversation related to my question, this was really helpful thank you guys. I will do my research, follow hints if available and only then find a write up for CTF's if I get really can't go any further.

[wintry garden]

@burnt night ayo

thank you @sharp inlet

[hoary nymph]

Gave +1 Rep to @sharp inlet

[brisk dock]

hi

[radiant jacinth]

hello who are you?

[twin ridge]

Hey now, be nice

[dusty sleet]

Who am I?

[radiant jacinth]

not you, Alik

[winged rain]

hamza?

maybe you are a dreamer

[dusty sleet]

Maybe u are the dream

[radiant jacinth]

Screenshot is from a video:

hi everyone, I need a bit help with installing Linux Ubuntu on my system WIN10 as a partition. this is all very new to me, to install linux on win10

Via YT video learned how to do this but YT broadcaster only has one disk in his system and I have 2.
Primary is SSD and second is HDD Healthy (basic Data partition)
I don't know where to shrink volume and how much, so did also research about this and it said

if you have more then one drive, make sure to choose the one that says Primary Partition

This will be usually be labeled as the C: Drive.
so yeah I think I can do this but I am not sure about. Just do exactly the same as described in the step-by-step plan?

(shrinking volume in C: - boot cd linux - choosing Something Else during installation - right click freespace -click add- ?create partition 4000MB: use as swap area? - right click free space - add - primary partition - mountpoint / - device to choose for bootloader.
And that is it?
I don't get the Swap area thing. What is it for?

How much to shrink in C:? It's an 250GB M.2 SSD drive. I would like to work with Linux more often, to get used it.
(VMware liveboot doesn't work good for me since I figured out every changed I made will be deleted, even if I delete the repositery too )

I think I have already found the right guide to install Linux on WIN10 but I'm just not sure about this. Like I said this is all very new to me

[woven patrol]

You could install the system instead of liveboot within VMware

Where do you want to install the linux system - SSD or HDD?
Make sure you have enough space to cut out from the drive you select
And use Windows' diskmgmt.msc utility to shrink the volume, you will get Unallocated space (free space) in black color in the utility

Any changes you make to an installed system in VMware or any other similar hypervisor tool persists after reboot (not liveboot)

[radiant jacinth]

I would like to install on HDD because it has 1 TB size and only data partition.

I did install Linux iso images on the VMware and changed this in the setting to use iso images. See screenshot

Installing didn't work without the dvd, I tried that already.
After installing and select this option works to open linux in VMmare without the dvd.
Any changes I make to an installed system will persist after reboot?

I'm doing something wrong here with installing linux on VMmare ? But I tried to install iso images only too and didn't work 😕

[woven patrol]

What did you select after starting it?

Install the system
Graphical installaler
Live boot
Live boot with persistence
Settings
...

[radiant jacinth]

Oh, I can't remember that anymore 😅

[woven patrol]

Here you already have a hard disk allocated for your VM (30GB one)
You could install the system on it and then remove the DVD (.iso) from the VM and it will work normally

[woven patrol]

You have to Install the system, you might have seen similar option being selected in the video you mentioned

[radiant jacinth]

In the screenshot that I have shared: option to use ISO image file doesn't mean I have deleted the DVD from the VM ?

[radiant jacinth]

In the YT video it's how to install linux on WIN10 as a partition. On VMmare I already have installed

I tried it again and this doesn't work.

[woven patrol]

That would boot using the .iso file and not the installed system (if you installed it)

[woven patrol]

Have you installed the system in the VM?
But earlier you told, you haven't 😅 (just liveboot)

[radiant jacinth]

Sorry my bad, I think I have then not installed the system in VM.

Ok thanks I think I got it now. Need to search some info about installing system in VMmare without the dvd liveboot, right?
So the iso images that I have doesn't install the system , right?

[hoary nymph]

Gave +1 Rep to @woven patrol

[woven patrol]

What's the full filename of your .iso file?
I guess you have the -live.iso one🤔

[radiant jacinth]

and if I installed the system on VM, all the changes that I make will persist in the VM ?

[woven patrol]

Yes, just like a normal installation (not a VM)

[radiant jacinth]

I have Disc Image Files Linuxmint-20.3-cinnamon-64bit

So yeah that seems be the reason why I can not install without the dvd I think 😅

[woven patrol]

Could you also share an image of the boot menu when you start the VM?
Is this the one?
https://linuxmint.com/torrents/linuxmint-20.3-cinnamon-64bit.iso.torrent

Oh, didn't you see the Install Linux Mint shortcut on the desktop when you login into the VM?

[radiant jacinth]

Oh I don't remember it but it wasn't a torrent. Probably the download site. I have downloaded it through Linux Mint with the sha256 txt

[woven patrol]

It looks, Linux Mint directly opens up a live session and not present you with options like Install, Live boot, ...

[radiant jacinth]

yeah I have installed it on desktop

Ok, I am going to do this again with the dvd on VMmare and will try something else through the installation.
Thanks for the help, appreciate it. brb

[radiant jacinth]

I think this is correct. During the process I didn't see any option + I have changed the location.

Or is it Customize Hardware and use iso images ? But I have Disc Images Files. Doesn't work probably?

[woven patrol]

Well, I am gonna try that myself first.
I don't have VMware, so just to be sure I don't distract you from correct path😅

Also, you should select the ISO image file and boot from it.
Then open Install Linux Mint available on the desktop in the VM

[ripe haven]

I need a little help with something, I need to login to RDP from a user that is on the Domain Controller into another computer on the AD but I have no idea about the syntax haha

[radiant jacinth]

Yes I've waited for you reply and then selected use iso images files. Then I have rejected the dvd and opened Linux Mint and it worked.

Now I also see what you mean, I think this one is what you mean to select option? So here it's somewhere I have to look for install system?

OEM install?

[woven patrol]

Try to just start it, and then install from inside it. I was reading their docs, you will get Install Linux Mint after you get in

[radiant jacinth]

Oh I see. This one?

[woven patrol]

Yeah

[radiant jacinth]

Thanks @woven patrol This was so confusing when I installed, I mean 'installed' Linux on VMmare. I thought whole time this is it: yahh I have a VM now AND installed Linux but no 😅

[hoary nymph]

Gave +1 Rep to @woven patrol

[radiant jacinth]

Thanks again, appreciate your help 👍

[woven patrol]

Actually, I think of it now not showing the Install system during boot.
In most of my VMs, I have had that option😅

[radiant jacinth]

It's my first VM and I choose VMmare, that is actually why I didn't see Install system here

I think I should probably try more few different VM to see which works good

I mean which works easy for me

[woven patrol]

Perhaps not because of VMware, that's just how that .iso was prepared to directly start a system to try out

[burnt night]

That won't be what the issue is.

[woven patrol]

Kali, Parrot would be good if you are regular on THM and learn related stuff

[radiant jacinth]

Oh I see, hmm

[radiant jacinth]

Thanks, will check it out 👍

[hoary nymph]

Gave +1 Rep to @woven patrol

[main reef]

haven't used parrot -- does it do anything better than Kali?

[radiant jacinth]

should i use vmware or virtual box if im looking for a free software and also which os is better for hacking parrot or kali

VMware or VirtualBox is down to individual preference, I can't say much for parrot either as I use Kali, it's handy knowing the things I need for THM are already there, and confidant enough to find and install what I don't have.

[plucky valley]

!rank

ok

[radiant jacinth]

its in #bot-commands channel allowed

[radiant jacinth]

They're not verified either, so they won't get a rank.

[winged rain]

I feel like virtual box is easier for the user to use and it's also open source meaning more updates/features get added to it more frequently

[dusty sleet]

Auto hack script in parrot is op

[main reef]

I run kali out of a virtualbox from my macbook pro. SSH into it and do all challenges from there. Seems to work well

[dusk elk]

Docker is another good option, I find that it's lighter weight than Vbox

[burnt night]

Very important to note that those are not VMs, however

[dusk elk]

Oh I had no idea, are they basically chroot jails then?

[quaint basin]

Kinda
They are closer to being chroot jails than they are to being VMs, that's for sure.
Containers on *nix systems are effectively just process namespaces -- in other words, the processes are segregated but if you use ps aux on the host you'll still see them in the list.
Containers on Windows run off hyper-v, so I suspect they are closer to being VMs, but I haven't really played around with those

Containers are also supposed to (by convention primarily) only actually run one process -- e.g. a webserver

So, a containerised web stack, for example, would use a bunch of different containers -- a webapp container, a database container, and probably a cache container at minimum

Docker containers can run all three at once, but it's very much not recommended

[gray jetty]

well, that went straight into my notes 😄

[spark sun]

the idea of a container is that it provides runtime isolation, and is intended to be immutable. If you are intending to have some kind of backing store to write to, that introduces a pretty hefty level of complexity to configure vs just running a vm

There are performance advantages to a container, but it's easy to donk it up and not provide the isolation intended

containers are a key component of microservices

[dusk elk]

Interesting, thx for clarifying

[hoary nymph]

Gave +1 Rep to @quaint basin

[azure furnace]

Can you deploy metasploitable in a corporate environment for testing?

[trail cove]

https://tenor.com/view/that-would-be-an-ecumenical-matter-father-ted-father-jack-ecumenical-irish-gif-15581044

It would be down to the organisation to decide the scope of what they want you to do

[frail rapids]

How can I make this work?

<!DOCTYPE html>
<html>
  <head>
    <script>
      function makeNode(c){let p=document.createElement("p");p.innerHTML=c;document.getElementById("body").appendChild(p)};
      function printParam(){decodeURI(window.location.toString()).split("?")[1].split("&").map(p => makeNode(p))};
    </script>
  </head>
  <body id=body onload=printParam()>
  </body>
</html>

when I use <svg onload=console.log(1)> it doesn't get executed

it basically prints out the parameters

hm <img src=x onerror=alert(1)> does work

that's quite weird

[foggy vigil]

CEH V11 Exam voucher + Courseware just for 15k INR

[quaint basin]

Yes, but CEH 🤮

Also, would you please quit spamming that in every channel @foggy vigil

Once is enough 🙂

[radiant jacinth]

I could go a bit of CEH...

[quaint basin]

I assume it has another meaning?

[foggy vigil]

Someone might be interested.

[radiant jacinth]

Nah, I'd get that before I finish college.

One cert EzPz.

[quaint basin]

If they are then they will either be very out of touch, or have already carefully been watching the job market in their area to weigh up whether they need to subject themselves to that rubbish.

Regardless, that still doesn't mean you post it in about 6 different channels -- that's just rude 😆

One channel -- preferably #resources is enough

[foggy vigil]

Got you

[radiant jacinth]

"that rubbish" is my favourite part.

[rose axle]

#rubbish channel? O_o

[radiant jacinth]

Is it legal to take revenge on scammers?

[ripe haven]

No. Unless by taking revenge you mean reporting them to authorities.

[radiant jacinth]

😔

Apparently I'm a victim of one

[ripe haven]

What sort of scam? Did you lose money?

[radiant jacinth]

The scam was a 'game beta testing' link

[ripe haven]

And what was the outcome? Was it phishing?

[radiant jacinth]

For the outcome, it was worst than my entire wallet

He broke my computer hardware and the power button doesn't produce light any more

Hence, why I asked question on revenge

i did run antivirus scans, changed my passwords and activated 2FA before he broke my power button

i thought it was safe until the hardware broke

[ripe haven]

Did he break into your house?

[radiant jacinth]

remote

[ripe haven]

So you did it?

[radiant jacinth]

no

I downloaded that exe

[ripe haven]

So you were infected with a virus?

[radiant jacinth]

Yes

The lesson I learnt was to not run any suspicious exe files

im still in grief after what happened

[waxen raven]

Isn't the power button light controlled by firmware? I didn't know a downloaded exe file can go that deep into the system

[radiant jacinth]

It happened about 1 hour after I downloaded that bad exe file

[burnt night]

It can't

It was a very unfortunate coincidence

Those "game testing" malware tend to steal discord tokens etc.

[radiant jacinth]

It cant be a coincidence because my laptop was working fine for years until the exe happened

[burnt night]

It's human nature not to believe in coincidence

But this was a coincidence.

[radiant jacinth]

hard for me to believe

[waxen raven]

Maybe we'll be hearing about a new exploit tomorrow.

[burnt night]

You won't. Power light is handled with ACPI.

[waxen raven]

Right. That would also be a curious thing for an attacker to target

[radiant jacinth]

I suppose there is some sort of way for me to fix my computer?

[burnt night]

Wipe the OS and reinstall

Sending malware over discord and telling people to play your game isn't exactly a sophisticated technique

[waxen raven]

My local computer repair shop doesn't charge to look at your computer, if they're able to fix only then they charge

[burnt night]

It just wouldn't happen

It's a coincidence. Humans hate those.

[waxen raven]

I wish somebody was able to turn off my power button light, I personally don't like it

[burnt night]

You often can in your bios. You can also... You know... Unplug it.

Unless it's a laptop. Then tape over it.

[waxen raven]

Tape is the answer

[radiant jacinth]

I'll tell my parents that my laptop broke by coincidence

I don't think I know how to wipe the OS or reinstall it

[burnt night]

You'd be better actually telling them the truth

[waxen raven]

I knew a 60 year old who got hacked, bank account. Few thousand stolen. She doesn't even know how it happened. Unfortunately the stats say that the majority of victims are over that age.

[radiant jacinth]

I had an assumption that old people weren't smart

[radiant jacinth]

I thought it was a coincidence

[burnt night]

It is.

But tell them the truth about the whole thing.

[radiant jacinth]

I can but that's too hard

[frail rapids]

Nowadays I wouldn't just uninstall the OS

bcs of moonbounce etc

but gl making a new esp lol

[tawdry dove]

This is actually a pretty easy thing to tell them. If you eventually want to get treated like an adult, you need to act like one which means telling people uncomfortable truths

Half truths are still a lie and lying will always blow up in your face

[spark sun]

Most laptops these days have a recovery partition built in. Trigger the factory reset and everything goes to day 1 installs

[radiant jacinth]

Any one know of a good crypter? I'm trying to make quasar FUD rofl

[spark sun]

Sounds cool, what are you trying to deploy on?

[remote echo]

Write your own

[radiant jacinth]

We'll see about that

[radiant jacinth]

I cant do factory reset if the laptop wont turn on

[olive frost]

@pearl latch Could you send a screenshot of cat /proc/cpuinfo ?

[pearl latch]

of my vm

linux?

[olive frost]

Well I just wanted to see what processor your machine is using? Do you know ?

[pearl latch]

its amd

I'm using a m1 macbook

[olive frost]

Okay, so why you installed an arm kali then ?

[pearl latch]

no its not amd

can I dm you cuz it takes time here

[olive frost]

Ye, go ahead with DM

[radiant jacinth]

yo, so I completed the Pentest+ path on tryhackme and got certed. However, I still cant solve the "easy" boxes on hack the box without a walkthrough. Is that normal or what should I be doing to be able to solve them without help?

[brisk meteor]

You and I are in the same boat man. What I've decided to do is to keep trying rooms without walkthroughs but when I fail to get anywhere I do a different room that explains a new concept I might be able to use to get the flag. Currently, I'm failing to solve the Pickle Rick room and I'm not sure if I should be bruteforcing or not. So I'm going to go through all the bruteforcing rooms try hack me has to offer and keep trying when I think I have the answer for Pickle Rick I give it ago. If that fails I will try a different room that teaches me a different technique.
Gives me a reason to learn about things because it's for the purpose of solving a CTF. I understand though it can get pretty frustrating

(Please don't spoil anything people. I'm currently excited to learn about bruteforcing because it might work :3)

[radiant jacinth]

I think the only bruteforcing for pickle rick is with whatever you use to look for directories.

There is an account to log in to, however all the credentials can be found somewhere on the machine.

[brisk meteor]

okay. I shouldn't have said anything lol

[carmine gate]

https://tenor.com/view/seth-meyers-spoiler-alert-spoiler-giveaway-secrets-gif-9191849

[rose axle]

I didn’t even know there were walkthroughs

[spice yacht]

I passed CompTIA Security+ last Monday. Very thanks to a guy that suggested me professormesser.com

[ripe haven]

Awesome!!!!! How was it?

[heady creek]

completing one path once isn't enough unless you're really talented

I went through 3 of the learning paths 3 times

and then for my first boxes, I still looked at hints

not to mention I did wreath

[gray jetty]

Tbf, wreath is an easy level network that guides you with almost baby steps 🤷‍♂️

[heady creek]

I never said its difficult. just saying I went through a lot of materials before I Could do even the easiest boxes on my own

I still remember running linpeas for my first time, seeing 4k lines of output and thinking to myself "this is fucking insanity"

[gray jetty]

Yeh, a little tip for linpeas, pipe the output to less like linpeas.sh | less -r
More readable
And yes, it does take some time just being able to solve easy boxes

For htb*

[radiant jacinth]

@gray jetty have you any rooms today?

[gray jetty]

Ugh, ... whhhyy?

👀

[radiant jacinth]

I'm trying to some now.

Every room I do I can't do a Feroxbuster scan inster other enumeration tool here

All of them refuse to connect.

[gray jetty]

Ffuf, wfuzz, gobuster, are good alternatives but sounds like a connection issue

[radiant jacinth]

Connection is fine, I can nmap them etc.

[gray jetty]

Can you show the error for ferox?

Maybe you brutes 'em too hard and they died

[gray jetty]

Is the machine even accessible via Web?

[radiant jacinth]

I'm not sure tbh.

It's "source"

[gray jetty]

Maybe add it into hosts file, ig

Some machines need a domain name to serve Web content

[radiant jacinth]

Source shouldn't. just has a flick through the video

I'll boot up a machine where I know I need to enumerate it.

[gray jetty]

... what room is this anyway?

[radiant jacinth]

https://tryhackme.com/room/source

I can scan other targets, must be the way the three rooms were set up and I was juts unlucky with the choice 😂

[gray jetty]

Yeh, no bruteforcing is needed for this room 🙂

Also, add ip to /etc/hosts

It is one of those rooms

[waxen raven]

Linpeas is great, after 8 hours trying my first vulnhub box I remembered linpeas and pwned in 20 minutes

[rugged frigate]

it is indeed life saver

[gray jetty]

Is it just me or does anyone else search for an issue in this discord chat and get too invested in a random chat that happened two years ago

[radiant jacinth]

Yeah! I like reading on some of things I missed out on.

[gray jetty]

ahem stalker ahem

[radiant jacinth]

I prefer to call it learning

[gray jetty]

[distant stirrup]

oh

[robust axle]

same man same

[charred hill]

That happened to me the other day when I was looking for something said when I first joined lol

Good eve everyone!

[radiant jacinth]

||hashing crypto is an old room but for the last question for task 4 the letter count for NTLM hash in the hashcat website is 33 but the right answer is 32.||

[burnt night]

User error.
Echo, unless you specify, will terminate with a newline.

Research would tell you the correct answer

[gray jetty]

with normal echo there's a space at the end, but with -n a new line replaces the space and makes it compact

[junior verge]

hi

[radiant jacinth]

google say 14 lol

[radiant jacinth]

thanks

[hoary nymph]

Gave +1 Rep to @gray jetty

[quaint basin]

Eh?

-n removes the newline

And there isn't a space involved regardless

TL;DR: Without -n, echo adds an extra character (\n) on the end, messing with the character count.
With -n, the character is not added so the character count is as expected.

[burnt night]

Then you're looking at input to the LM algorithm, truncates it to 14chars and hashes 2 lots lf 7

[mortal venture]

Hey does anyone know how dnsmasq works? I read the description but I still don’t quite understand if anyone can explain it to a 10 year old

Well not necessarily how it works, that I just about fully understand. I mean the purpose of dnsmasq. I hope the answer isn’t something as obvious as masking our dns queries. Per the name

[gray jetty]

thanks for the clarification, so instead of space in normal echo there's a \n at the end and with -n it's no longer there 👍

[hoary nymph]

Gave +1 Rep to @quaint basin

[quaint basin]

There's no space either way

[gray jetty]

I meant the extra character is a \n

I assumed it was a space :/

[quaint basin]

Nah, there's nothing there if you remove the newline

[gray jetty]

well, that's why I said normal echo

[quaint basin]

Normal echo has a newline

Echo with newline removed doesn't replace it with anything

[gray jetty]

I mean, I said with -n it's no longer there,

~~you're just dying to say I'm a muppet aren't you ~~

[twin ridge]

You muppet ;)

[gray jetty]

nah, doesn't feel the same coming from anyone but muir

[twin ridge]

Sorry I tried <3

[radiant jacinth]

Muppet is a great word to call someone, second is eijit.

[gray jetty]

well done, ya muppet :)

[radiant jacinth]

Oi, eijit! calm it 😄

[radiant jacinth]

https://tenor.com/view/huh-dave-chappelle-what-confused-gif-10721560

[gray jetty]

for reference

[radiant jacinth]

Yeah, that was around the time I joined the discord channel, xD

[gray jetty]

It was a pretty fun conversation,
#general message

[burnt night]

LM is gross and bad.
It splits your password into 2 sets of 7chars qnd hashes them separately, then combines the results. It's old and gross and bad.

[radiant jacinth]

It was, there was even a message I thought Muiri would have got hit with an innuendo.

[ripe haven]

Doesn’t that mean you have to do half the work cracking it?

[burnt night]

Correct

[ripe haven]

Pretty sure it’s actually less but idk

Why not just hash each char separately

[twin ridge]

2^2 less no?

Oh wait no half sounds right

[burnt night]

Exponentially less, each additional char of plaintext adds length(charset) or whatever

Cracking two 7char pws is much easier than one 14char

[twin ridge]

Yeah need to get the math done for that

[gray trellis]

Ummmm... No-one realised that tomorrow is Raspberry Pi's 10th birthday? I think there'll be some announcements...

[glossy elk]

Hello guys
can someone help me how to brute force gpg files
I tried using john but it is taking a lot of time

[ripe haven]

Yo! Can a mod give me the Creators-Lounge role? I’m trying to make a room and may need some help.

[winged rain]

Oooh, what's it going to be on?

[ripe haven]

Some cool stuff, I also need a couple testers cause it’ll have quite a lot of steps that can be messed up, are you up for it?

[winged rain]

Only if I understand what going on 😆

[gray jetty]

better not be a windows room smh

[ripe haven]

Can I DM you?

[ripe haven]

Probably won’t but technically it could be haha

[gray jetty]

writeups are provided for testers 🙂

[winged rain]

Whats wrong with windows rooms?

[ripe haven]

Zeesh hates them

[gray jetty]

[winged rain]

Oh if a writeup is provided I'd be down to try and break the room

[ripe haven]

Maybe and maybe not...

[gray jetty]

👀

[winged rain]

As long as I know where I have to end up

[ripe haven]

Can I dm you?

[winged rain]

Go ahead, my wifi is cutting on and off tho so know that I'm not ignoring you

[short elk]

that's probably the best method 🤷‍♀️ so either

• you're using the wrong wordlist / not applying the right rules
• that is not the intended method

[twin ridge]

Usually being a bit more polite will go a long way ;)

[ripe haven]

Oops sorry, I realised just now that it sounds a little “do as I say”, my bad honestly, thanks for pointing it out!

[hoary nymph]

Gave +1 Rep to @twin ridge

[twin ridge]

Still waiting ;)

[ripe haven]

Sure! Do you mind giving me the role? I would really appreciate it!

[twin ridge]

Is please that hard to say these days? Smh

-arole 708286316529451029 creators-lounge

[hoary nymph]

➕ Gave the role Creators-Lounge to sootierr#2643

[ripe haven]

Thanks hydra!

[hoary nymph]

Gave +1 Rep to @twin ridge

[twin ridge]

Look forward to seeing your room

[radiant jacinth]

GHoP is going a room! this should be good!

[ripe haven]

Honestly I will probably make it a Hard room, it’s probably gonna be medium though cause the stuff I want to do is pretty uncommon in CTFs and I will need to give hints to alot of the steps.

[radiant jacinth]

That's cool, after all, the hints are optional.

[ripe haven]

I was thinking more like hints as a part of the CTF itself, not in THM since I want to have only two flags but I have about 3 steps you need to do before even getting initial access.

[radiant jacinth]

Ah, I see!

[twin ridge]

Remember that everything needs to be self-contained

[ripe haven]

Yeah I know! It just has a lot of steps for the web part!

[frail rapids]

What does IAT mean? I tried googling but couldn't find anything

[radiant jacinth]

Import Address Table.

[runic brook]

So quiet...

[crimson bolt]

So so quiet

[compact ice]

Sorry in advance but I have a stupid question.

Shouldn't malware with admin rights be impossible to delete?

It should be able to counter the request to quarantine by... (suppose malwarebytes) and stay installed, right?

[dry pewter]

I don't have deep expertise in this area, but assuming the malware is running in memory, it could implement countermeasures against endpoint protection. However, if those aren't full proof, or if the malware is not running in memory, then the malware installation theoretically would be less effective at blocking AV, etc. from cleaning it up.

[winged rain]

Pretty sure the most effective way to remove malware is just nuking the system, then there's(hopefully) no traces left

You should already have all your important files backed up following the 3-2-1 rule

[compact ice]

Thank you for the indepth answers! @winged rain @dry pewter

[hoary nymph]

Gave +1 Rep to @winged rain

[compact ice]

I was using my family's laptop and noticed there was adware. I ran malwarebytes and cleared it but was curious as to how they didn't survive.

[winged rain]

The thing about malware is that sometimes it can stick around on your LAN and spread that way. It could spread to your other computers on the system and then after you wipe the initial system that was infected slowly crawl back

[spark sun]

adware usually doesn't behave that way, unless there is deeper stuff involved.
More than likely, the adware has installed itself in multiple places and re-installs a component of it from a component you missed on the sweep.

[proper forge]

What

[radiant jacinth]

ok

[frail rapids]

am I the only one who dislikes the "hacker" culture on tiktok

don't get me wrong I don't use tiktok, but from the clips I see on r/masterhacker I get disgusted

like it's getting to the point where it's just a source for skids, considering the target audience of tiktok

sure people getting into infosec is a good thing but it just annoys me that these folks think they can learn infosec in a few days without any fundamentals like networking or programming and instantly become a "l33t h4x0r"

[radiant jacinth]

Not a problem if you don't use tiktok.

[frail rapids]

it is because all of those kids go on to subreddits like r/howtohack and r/hacking... and discord servers like these

[gray jetty]

I always thought of it as a phase that teenagers go through 🤷‍♂️

same as wanting to become the president,musician, etc.,
~~enginner : ~~

[ripe haven]

I think except for twitter almost every major platform has terrible hacking culture and skiddy stuff

even twitter has alot, but it's way better than TT or IG for example.

[echo dust]

I tried to look at even just the standard tech/IT communities on clock app, couldn't help but do everything in my power to scrub that 💩 from my timeline.

[ripe haven]

There are some nice IT people there, mainly the forensics people for some reason.

[echo dust]

I just found a painful amount of disinformation/misinformation, and since I don't have the time to make my own vids/posts it wasn't worth being on there.

[short elk]

no captcha present and the icons in the navbar aren't loading, yet i have no errors in my console and every network request is a 200 🤔

does anyone know what may be going on

this is in a fresh vm with fresh firefox - the login page on my host looks fine

[dusk elk]

Definitely, all the teenagers ik who like computers have gone thru a hacking phase

[winged rain]

The problem is that "normal hacking" isn't very exciting content

It's more educational than entertaining and I don't go on those platforms to learn

[urban latch]

I’m thinking of learning another programming language, but I’m not sure what to learn. Should I learn C, Go(lang), or some other language?

[slate vine]

Depends on what you need / want to know

[urban latch]

I kinda wanna do machine learning

but i need to learn A LOT for that

where should i start?

[slate vine]

Python would be obvious answer, as its the most popular ml language

Iirc google has free machine learning course

[urban latch]

so far i know python, js, html, css

[slate vine]

Python for ml then

[urban latch]

oh neat alright

i wanna be able to make AI play games

[slate vine]

Like Open AI project?

[urban latch]

not sure what that is.
*"learn" to play games

[slate vine]

Google for Open AI games, their AI can play game better than humans. There's one where they play Dota 2 and beat top team

[urban latch]

oh ok neat! then yeah

[slate vine]

Its really interesting, there's also they make 2 team of bot competing each other in hide and seek, and exploit every possible opportunity provided by the game engine

[urban latch]

yeah, alright ill look into that

thanks

+rep @slate vine

[hoary nymph]

Gave +1 Rep to @slate vine

[broken hemlock]

Sir any way to get subscription discount for students . I have institute mail also if possible to get discount . Please help me

[tawdry dove]

There is a student discount for THM. If I remember correctly, the option to do it yourself isn't working correctly. In order to rectify this you can email support and ask nicely. Please be patient as they are rather busy.

!email

[deft fossil]

TryHackMe

Contact us for support, teaching enquires and more!

[e-mail]

From TryHackMe with ❤!

[quaint basin]

It should work with academic emails

It just doesn't occasionally

[tawdry dove]

Gotcha

[frail rapids]

HTML is my favourite programming language

[ripe haven]

I deadass know C/C++/C#/java/python/ruby/perl but I have 0 HTML knowledge.

[frail rapids]

LMAO

I know the feeling.. I learned the webdev 3 langs in december after programming in .NET and Python for two years

[ripe haven]

What’re they?

[gray jetty]

Html, css, js

[ripe haven]

Oh I dumb, I though Lau was talking about web 3.0 langs and I was like “we getting HTML 2.0 or sum??”

[ripe haven]

Tbh css is just literal hell, I can’t think if a “language” more annoying

[frail rapids]

Yeahhh exactly

HTML and CSS are miserable to work with

[ripe haven]

JS is atleast programming haha

Btw I got a question Lau, are you decent with CTF style reverse engineering? Like encryption reversing and stuff?

[frail rapids]

Not really. I'm still getting better at low level development for it

I've done some videogame RE once for certain purposes, but haven't really dived into it after that

[ripe haven]

oh okeh nvm haha

[still maple]

eh kids will be kids lol reality will hit them eventually. lol

https://tenor.com/view/heman-smile-skeletor-laughing-laughing-hysterically-gif-18559585

[still maple]

yay finally resubed to THM!

[dusty sleet]

@quaint basin ey id like to bring ur attention to what i think is acase of cheating

[burnt night]

That's not really a muiri thing

[dusty sleet]

Please inform me who should i contact

[quaint basin]

Who's cheating?

[dusty sleet]

I talked to some guy in 3rd of feb, he was 0x8, he has no certs , and was happy he got that lvl

I got in contact w em and we talked a bit

Here is my last relevant msg w em

[odd acorn]

Hey @dusty sleet
Can I get you to email me with an explanation of your report, we will look into it:)

[e-mail]

[winged rain]

I've seen these guys make videos on all the paths. I think he's legit

There's video proof of him going through the rooms and explaining his process

His most recent video, although i don't know if it's the same person

https://m.youtube.com/watch?v=pc_NCJW6bl4

[ripe haven]

Do not distribute or provide access to content involving the hacking, cracking, or distribution of stolen goods, pirated content, or accounts. This includes sharing or selling game cheats or hacks. Not sure if the Oxford comma is confusing me or what. @serene trench This is what I was talking about yesterday.

[twin ridge]

might be a few ors too many there as well

ah wait yeah ok could be alright

[ripe haven]

Yeah I'm just not sure if it's saying to not post content about "hacking, cracking, or distribution of stolen goods, pirated content, or accounts" or if it's saying not to post content about hacking cracking or distribution of "stolen goods, pirated content, or accounts"

They phrased it weirdly haha

[twin ridge]

the latter

[ripe haven]

I think so too.

[violet pecan]

hi

[native quest]

hii

[radiant jacinth]

hiii

[gray jetty]

hii

[radiant jacinth]

Combo breaker.

[gray jetty]

well, arn't you a <insert scottish insult>

[radiant jacinth]

No, that's a bit extreme.

[gray jetty]

ok, I sincerely apologize

[radiant jacinth]

No, I meant my word.

Yours was fine, I've been called worse 😂

[gray jetty]

well, It's just that I'm not racist at all, just don't like the scottish 😂

that's a jb quote btw 👀

[radiant jacinth]

It's ok, half the Scottish don't like the Scottish 😂

Yeah, I remember someone said it.

[gray jetty]

#general message

[radiant jacinth]

2020!

[gray jetty]

yeh, I checked all the pins in #general , lot of cool stuff in there

[radiant jacinth]

#quiet-conversation message

[gray jetty]

noooo, that's just memes

[dark pond]

i just started this on campus job and they're tasking me w/ making activities about blockchain and NFTs 🙃

[echo dust]

Doing alright coming up with ideas? Or need some resources?

[safe stump]

hi

[unique bolt]

I'm so sorry

[dark pond]

Yeah, I'm not having any difficulties, I just don't wanna lol. Appreciate it though.

[dark pond]

It's rough out here lol

[echo dust]

No worries, friend of mine works for ProtocolLabs, so I'm sure they've got plenty of resources to recommend if you needed it.

[unique bolt]

Truly merciless territory

[mortal venture]

is it a good idea to give my non sudo root user permissions to the opt directory to add things to it?

i plan to use that directory to sort all my scripts and such

im asking because i still dont fully understand the filesystem yet, and why i need to be the sudo root user to make changes (sudo doesnt work, i need to be root user)

what im asking is it makes sense to put my exploits in the opt directory but with the way the default permissions are configured it makes it seem like im not, and i dont want to mess anything up

[burnt night]

Sudo will work, but if you're using > etc then that's not part of what runs as root.

Put the exploits in /home/kali/exploits or something

You want as little code running as root as possible

[mortal venture]

noted noted thank you, that makes sense. I had a cluster***k a while ago bc nothing was organized so im getting tips from ippsec and he placed everything in the opt directory

had to nuke the system bc nothing made sense

[mortal venture]

I despise that i still cant do easy machines without help lmao

ughh

[winged rain]

You'll get there eventually

Quick question, why does my VPN IP keep changing? I thought with premium you'd have your own unless I'm mistaken or it doesn't work that way

[radiant jacinth]

Your machine VPN should be the same, yours changes? Are you changing servers?

[robust nest]

Same happens to me sometimes start with beginning one

[frail rapids]

Yearly sub expired today 🥲

the time to switch to htb has come

[radiant jacinth]

https://tenor.com/view/ok-okay-umm-awkward-situation-huh-gif-5850917

[ripe haven]

You ought to stay on the server though xD

[frail rapids]

Yeppp I like this community waay more

I just prefer the challenges and CTF style of HTB better

[ripe haven]

More challenging, I like that about it too but I feel like it’s a little annoying

[dusty sleet]

hello

I need a cheap linux vm 4gb ram rhel , to run an oracle db, I would like a static IP or maybe something like ngrok, I explored azure and its kinda pricey , anyone can recommend something else ?

[winged rain]

I'm not changing servers

[summer verge]

It takes time.

[radiant jacinth]

strange, as your THM IP is created then attached to your account.

[winged rain]

I've had about four changes now

[gray jetty]

#room-help

[regal jetty]

• Oracle Cloud 24GB and 4 ARM cores in one VM or split into 2/4 'always' free. 200GB block storage, 20GB object, 2 Oracle autonomous DB @ 20GB ea., 3 noSQL DB @ 25GB ea., 10TB egress free / mo., Ubuntu or Oracle Linux (RHEL)
• AWS Lightsail free for 3 months but only up to 2GB plan
• Atlantic.net 2GB 1 vCPU, 50GB SSD, 3TB egress
• Kamatera.com 30 day trial (?)
• Alibaba 2C 4G / 4C 8G, 1 month
• DigitalOcean new account = $100 credit for 60 days
• Google Cloud new account = $300 credit / 90 days
• Vultr $50 / 60 days
• Linode $100 / 60 days
• https://lowendbox.com/

[regal jetty]

^

[regal jetty]

what flavor is vegeta

[radiant jacinth]

Vanilla flavor 😋

[dusty sleet]

Man

[radiant jacinth]

quick question about obsidian. I would like to use it for only making note, but what if obsidian disappear one day? Saving files is in different format then txt file no?

[half fractal]

Obsidian saves all the notes in .md files which are basically like .txt (you can open them with anything that lets you edit text)

[radiant jacinth]

Gotcha, thanks. Just tested and it works 👍

[hoary nymph]

Gave +1 Rep to @half fractal

[regal jetty]

Check out logseq btw, I like it a lot more for quick/simple outlines and structured notes, YMMV but nobody seems to know about this one so I like to shill it lol

[radiant jacinth]

can someone help me get hacks please

ok my bad

[burnt night]

Hacks for what?

[radiant jacinth]

fn

[burnt night]

@radiant jacinth Are you sure?

[radiant jacinth]

yes please

[burnt night]

-ban @radiant jacinth Asking for fortnite hacks

[hoary nymph]

🔨 Banned cj styl#7929 indefinitely

[carmine gate]

lol

[dusty sleet]

maybe he meant fun

rip cj

[mortal venture]

was almost done with a full port nmap scan and then i accidentally forgot to hold shift while trying to copy some text. I hate myself

[burnt night]

Want a cool tip to avoid this?

Control insert and shift insert can be used for copy paste, tends to just plain work in terminals.

[woven patrol]

Ctrl + Shift can be used to copy that output
Highlight the starting line, scroll to the bottom. Ctrl + Shift + Select the ending line using mouse
Done!
Just use -oN nmap.log 😄

Like the vertical block in vim, SHIFT can be used with CTRL to select a block
e.g. Selecting host IPs from the output of masscan 😅

[mortal venture]

oooohhh neat neat thanks

[twin ridge]

I've started using shift insert a lot recently

[burnt night]

I have it bound on my 60% keyboard to FN+C/V

[twin ridge]

Yeah that can work as well

Not a fan of 60% keyboards though

[burnt night]

It was cheap

[twin ridge]

Fair

[burnt night]

I need to fix the control key(s) on it too, which is one reason behind the keybind

[woven patrol]

Isn't there middle mouse click to paste text that was last highlighted, it is for my Kali, but not Windows?
No keys are harmed😅

[burnt night]

Yeah that's a Linux X thing

[woven patrol]

X11 server?

[burnt night]

IIRC two separate copy buffers are maintained and it's hassle

Like one for highlighted text and one for copied. Middle mouse pastes highlighted

[woven patrol]

Yeah, there are two buffers.
I can use both of them, for example copy reverse shell payload in one and the machine ip in another 😆

Ctrl + Shift + c/v to copy/paste
And Shift + Insert as you mentioned

[mortal venture]

notice the times lmaoo

i will start crying now

[woven patrol]

What's your exact command for nmap?
Is that 43 minutes👀 ?

[mortal venture]

lmao

[twin ridge]

Probably did a -A -p-

[mortal venture]

just the usual sc sv on full port

no not an agro scan. Just script and enum

[twin ridge]

sCV is still pretty heavy on all ports

[mortal venture]

oh did not know. I assumed the scripts was the culprit tho so im just doing plain nmap -p-

[twin ridge]

Clearly not plain there

[mortal venture]

lmaooo what is wrong with this year of the rabbit

do i even need all ports for this box

[twin ridge]

Oh it's a muiri box

[winged rain]

--min-rate 5000

[mortal venture]

Woah

[radiant jacinth]

https://youtu.be/4OUnedMCCW0

[jolly olive]

Yo

[sturdy beacon]

yo

[pure mantle]

if you like this, you'll def like trilium. im shillin too

[muted pivot]

There's Joplin and obsidian as well which do similar stuff

[muted pivot]

I'm a Joplin user for the last 2 years

[pure mantle]

Haven't tried that one. I've been bouncing around a few for years and recently settled on trilium (hopefully permanently)
So far so good

[quaint basin]

Trilium > *

[radiant jacinth]

You must have shares or something.

[quaint basin]

In an opensource product?

The fact it's FOSS is a big part of why I like it 🤷‍♂️

[radiant jacinth]

It wasn't bad, I just don't think it's right, I figured it's better to say that, than leave it at nothing.

[muted pivot]

does it offer authentication and integrations?

[muted pivot]

it doesn't have integrations but it has the option to set up a password

[quaint basin]

You can build plugins for it, aye

[muted pivot]

o.o

[quaint basin]

And yes, it's all encrypted

Advantages of Electron -- every part is customisable

[muted pivot]

oh, our dev might've already built that!

[quaint basin]

You can load in your own themes and plugins really easily

Huh?

[muted pivot]

like a plugin for ad integration in javascript

[quaint basin]

Ew

[muted pivot]

based on AD groups and so un for different level of access

[quaint basin]

Oh

AD

[muted pivot]

yeah, active directory

[quaint basin]

Thought you meant ad as in adverts

[muted pivot]

ew, hell naw

[quaint basin]

Yeah, I don't think you could get it working with AD natively -- when I say plugins I mean more usability things

Wouldn't be hard to stick it behind single sign-on though

[muted pivot]

yeah, that's the point of o365 integration 🙂

Because i want to find a solution for our security related stuff, and sharepoint is ew

so i'm still considering between, notion, this one now and obsidian

[frail rapids]

Have bootkits and rootkits been evolving a lot since 2015?

I'm asking because the book I'm reading was published in 2019 and only has examples from 2007 -> 2015

[twin ridge]

it's got a basic auth, but I was able to shove it behind a keycloak

using shenanigans that I need to finish documenting...*sigh

[crude geode]

good evening thm 🙂

[spark sun]

Confluence is good if your org doesn't mind spending money. Otherwise, there are plenty of wiki style products FOSS or not that can fulfill that role much better than SharePoint

[muted pivot]

I figured that out. I might give it a go

[muted pivot]

Please, don't mention confluence it's bleagh

[spark sun]

it's only as bleagh as you make it be - as far as maintaining a record of team actions, hosting reports, and having templates for specific kinds of activities, it's hard to beat when it's used correctly

[twin ridge]

boo Jira 😦

[regal jetty]

Joplin/Obsidian/Notion is normie tier lol 😛
As soon as I figure out a clean PDF annotation solution for vimwiki, I'm outie like Tim Towdi

Trilium looks pretty sweet, reminds me of SiYuan.

Especially if I can reproduce Dendron-style hierarchical.dotseparated.filenames in a flat structure but with WYSIWYG

(Dendron has fast-search / templating / logic for easy refactoring of that structure though, not sure if that's as easy to mimic)

[ornate folio]

anyone wanna solve tryhackme machine with me

[half fractal]

first time I heard of dendron and it looks great, but I don't like that it's yet another vscode extension I'd have that would start when i open whatever directory in vscode (which I do a lot)
Separate apps like obsidian/trilium work better for me personally because they don't interfere at all with anything else

[regal jetty]

Yeah, I don't use VSCode but I assumed there was some way to segregate that lol
At least the philosophy/methods of Dendron (well-documented in the wiki) can be extracted and migrated

[winged vale]

Anyone know a way to know what ports are passed through a firewall? Without access to it?

[tawdry dove]

Who owns this firewall?

[winged vale]

Working with school, Aruba equipment

[tawdry dove]

If you're working with a school they should be able to tell you what ports are open

And if it's for a class the teacher should be able to guide you on how to accomplish this

[surreal canopy]

Hoping to bounce some thoughts off someone and see if anyone else is in my situation?

[burnt night]

Best just to present it

[surreal canopy]

I did some security work in the past and now I'm getting back into it. I get so far in learning but then there are so many different technologies, protocols, tool combinations, etc... that I start to feel like I'm tossing my brain against a brick wall and start to regress in knowledge. It was that way the first go round and I'm getting to that point again. Not sure if that's normal and if anyone else ever feels like that?

[burnt night]

How long ago was it?

[surreal canopy]

It was about 4 years ago the first go round.

[burnt night]

A lot of it should be the same still

Windows is still here, Linux is still here, both are still vulnerable.

[surreal canopy]

My struggle is trying to understand all of the fine details of every technology so that when I approach a target I know what opportunities exist. This is particularly true when it comes to networking technologies. I feel like I learn and forget far more than I retain. Is that normal for other practitioners? Constantly re-researching things you've already researched?

[burnt night]

Do you keep notes?

And yeah, I keep re-reading stuff when appropriate but the hope is that having learnt it, it's much quicker next time

[surreal canopy]

Yes on the notes.

That offers some reassurances that I'm not just old and forgetful. 🙂 Thank you.

[burnt night]

I'm 20 and I still need to go on MDN every time I do webdev

[surreal canopy]

Lol. I think I may be trying to absorb too many technologies at once. How much time do you recommend spending learning and attempting to exploit a particular technology, say SMB, before moving on to something else?

[ripe haven]

I have a question for you James, do you believe MacOS is a good example of “Obscurity Over Security”?

[spark sun]

Not any more than any other OS. MacOS is derived from BSD, but I'm not sure how often Apple integrated BSD changes and pulls in security updates from BSD.

[ripe haven]

My belief is that getting the MacOS system in order to test it is discouraging for most exploit developers and so it’s not really secure but more obscure, did that make sense?

[tawdry dove]

Criminals gonna criminal. Not sure if blackhat exploit devs are going to abide by whatever TOS apple puts out

If im reading this correctly this is what you were angling towards correct?

[spark sun]

AFAIK Apple allows limited downloads for their OS - it's possible to hack their OS to run on non Apple approved hardware, although that is a violation of their ToS and I do not recommend that route.

There were some viruses and exploits that targeted Mac, but they don't really get used as a vector very much because ransomware is much more profitable

[ripe haven]

That’s true, but setting up a Hackintosh takes a LONG time and is just a lot of effort, while getting a linux / windows machine is just a few minutes.

[tawdry dove]

It's also profitability that dictates where the viruses are going to go

[ripe haven]

I meant more as it’s just a hustle, criminals with get it illegally but most won’t bother haha

[spark sun]

Buy a mac mini and run a mac VM there; I'd double check the license and TOS to make sure you are able to evaluate the security of the VM appropriately. Apple has taken a dim view of security researchers looking at their products as well

Legitimate researchers have pried it open, but Apple definitely doesn't like it

[tawdry dove]

Windows has a much larger marketshare and thus is more likely to be a success for the bad actor. APTs on the other hand likely don't give a damn

[burnt night]

https://www.offensive-security.com/exp312-osmr/

https://www.wired.com/story/apple-t2-chip-unfixable-flaw-jailbreak-mac/

[ripe haven]

I just don’t see people that aren’t doing this stuff professionally and it is their main source of income buying it, could just be me though.

[tawdry dove]

It could also be they want to remain out of apple's line of site and legal wallet

[spark sun]

It's niche. Like being very knowledge about AIX security

[ripe haven]

Yeah that makes sense, Thanks!

[hoary nymph]

Gave +1 Rep to @spark sun

[ripe haven]

Yeah no one likes Apple

[ripe haven]

Just as juun said, it really is very niche

[winged rain]

Even Apple users like me don't like Apple

[ripe haven]

I’m an Apple user, never had any other phone and I absolutely love mine, F*ck Apple.

[winged rain]

Heh, I mean apple pooters

I'm an android fanboy all the way

[frail rapids]

Apple literally contributes nothing to society

aside from paying tax

[ripe haven]

I wouldn’t be surprised if the government is running them to make people pay more tax

[frail rapids]

[radiant jacinth]

I had the very first iPhone, didn't like it, so went back to android a few days later, haven't touched them since.

[gray jetty]

I used the iphone4 for a while, then permanently switched to android

[radiant jacinth]

Not like it?

[gray jetty]

It was good, just limited basically,

like no third party or testing apk you built in android studio, limited filesystem access, no external storage and most of all, relatively expensive then the android ones

[radiant jacinth]

ah.

[ripe haven]

~~ jb the world! ~~

[gray jetty]

I didn't get/understand that?

[burnt night]

Jailbreak

[gray jetty]

Ah, yeh did that on an ipad I got as a gift recentlyb

But still, android > iPhone for tech people IMO

[radiant jacinth]

I don't think I'd ever go to iPhone, I think the next phone I'll get is the Samsung S22 ultra