public-training

[modest elbow]

The day has finally arrived! HackTricks ARTE (AWS Red Team Expert) cert is now available at https://training.hacktricks.xyz/ !
We've opened 100 spots with an early bird discount, don't miss yours!

[reef orbit]

@modest elbow Is there dedicate channel for people who registered?

[coarse ocean]

When I asked this yesterday he told me it was this channel.

[coarse ocean]

@modest elbow Access Key/Secret Access Key not showing up in the IAM labs section as shown in the Labs presentation. Where do we get the creds to access the labs if they're not showing near the lab exercises below the video?

[rare onyx]

I've also raised a ticket for the same thing - hoping its a simple fix

[coarse ocean]

Awesome, thank you. How do we submit tickets?

[rare onyx]

there's a training support channel

#training-support

also if you add your discord handle (check as some start with a period) from here into your profile on the training website it will give you access to the #arte-general channel as well

[coarse ocean]

@reef orbit See above ^

[modest elbow]

How to contact support or ask technical questions in a training.
If you have an active course, you can can go to your user profile in https://training.hacktricks.xyz/profile and add your Discord handle. This will add you to a new role in this server where you will be able to find new channels to open support tickets or ask questions.

[cosmic coyote]

Asking here since I guess this is a common question for the whole training platform: Is there any way to get a full invoice for the voucher payment? After I bought mine, I got the quick receipt via email, but I see nothing else. Maybe I missed something?

[modest elbow]

Thanks for asking! We have just added this option, however it's only valid for new purchases. If you already bought the voucher, just open a ticket and we will generate one manually for you

[magic shore]

need quick help, if you know there is attached policy for specific user and want to check what exactly that policy looks like via CLI how should we check this?

Also how do we know user has iam:SetDefaultPolicyVersion permissions...

am able to see the policy name, using versions you can check version as well, but whats inside that policy? how do we check

[spare cloud]

There's no need, ever, to cross-post a question

[magic shore]

i thought it be wrong group 😉 hence posted twice

[spare cloud]

So you delete it from the channel where it's irrelevant, and keep it in the one where it is

[magic shore]

done .

[modest elbow]

You should have enough permissions to see what is inside your policies in (almost) every lab. This way you know what you can exploit.
You might not bee able in specific ones like the BlackBox one, as it's intended to be more "realistic".
Please open a support ticket if you find some lab where you cannot see this information!

[orchid berry]

Hey, just making sure, if I signed up now, I'd get access to labs immediately right?

I still see the first 100 haven't signed up but want to make sure that if I paid, I wouldn't get put on a wiatlist

@modest elbow

I'd like to begin right away!

[modest elbow]

Hey!
Not exactly, you can buy a voucher now with the discount and use it whenever you want (right away or next month for example)
There is no waitlist at the moment

[orchid berry]

oh perfect!!!

Pays immediately.

❤️

I have to mention, HackTricks has been an amazing educational resource for me, I think what you're doing is fantastic

Also, do you have some time for a quick DM?

I have a couple questions regarding something that I would prefer to keep off the public channel

Not about HackTricks

[modest elbow]

thanks mate, sure. About the dm sure, send it

[empty topaz]

Hi @modest elbow ! I am considering to purchase the course and looking to clear a couple of doubts I have.

1. Do I get lifetime access to the course materials or the contents will it be limited to a certain time?
2. If lifetime access is provided, will any future updates be included in the purchase as well?
3. (Eventhough this is kinda answered in previous post) If I get the course now, can I start my lab after new year? I won't be able to start the labs now as I am focussing on a different cert atm.

Please let me know. Thanks in advance!

[glacial kelp]

Hi @empty topaz

1. Access to the videos and slider is lifetime. Access to labs is not, purchasing the course grants access for 45 days. It is possible to purchase extra lab time (15, 30 or 90 days)
2. Updates to correct things that change in the future will be included. However, there will be no new material added (like other services)
3. You can purchase the course now with the early bird discount and activate it in the next 365 days. Once the course is activated the lab does start automatically. So only activate the course when you are ready to start the lab
   Let us know if you have any other questions

[empty topaz]

Thank you for your response! #purchased

[glacial kelp]

Thanks! Let us know how you find it

[orchid berry]

Hey guys, so far I'm loving the course! Quick question, for the EC2 labs, are the instances up when the lab is running?

[glacial kelp]

Once the lab says provisioned everything is running 24/7 (this might change in the future). Also for lab questions the #arte-general channel is more appropriate

[orchid berry]

How do I get access to that channel

[glacial kelp]

If you bought the course and activated it you can go to your profile page in the training platform and update your discord handle. You will automatically be added to the ARTE channels

[dry garden]

Hi @modest elbow @glacial kelp I bought the ARTE training course and started it yesterday, I also added my discord handle to my profile, but I wasn't added to the ARTE channels just yet. Could you please check if there are any issue? Thank you

[glacial kelp]

Looking into it

[glacial kelp]

looks like your discord handle in the platform is set to a weird number it should be gelbezitrone

[dry garden]

just modified, thank you

[limber sand]

Hello,
I purchased ARTE training and added my discord handle to my profile, however, I am not added to the channel. Could you please help me with that?
Thank you

[glacial kelp]

@limber sand ensure.you are putting ayaka_81050

[limber sand]

Now I am added to the group, thank you!

[orchid berry]

Afternoon everybody! Quick question regarding the extra credit for the ARTE class. Does the pull request have to be specifically about AWS, or can it be about other cloud environments like Azure or even Digital Ocean?

[modest elbow]

Yes, the goal os to show your expertise in AWS to reduce 1 flag.
Ince we realease courses for other clouds we will do the same with them

[orchid berry]

I understand, thank you! Is there a timeline on when those other courses are released?

[modest elbow]

We are expecting to release GCP and Azure this year.
In any case feel free to send the PR if you want and remind us to apply the flag reduction in the future whenever you do the course!

[tawdry canopy]

Hi @carlospolop @glacial kelp I bought the ARTE training course and started it yesterday, I also added my discord handle to my profile, but I wasn't added to the ARTE channels just yet. Could you please check if there are any issue? Thank you

[glacial kelp]

Hi I see in the DB you set the discord handle with the #xxxx try without it. If that does not work try moose_enthusiast I'm not sure now what discord's API recognises as your username

[lone summit]

How perfect! I came here to ask the same question on it! Will be eagerly waiting for the Azure and GCP ones!

[balmy sparrow]

Hey all! Curious how the ARTE course has been for those taking it. I’m currently doing the AWS CloudBreach course

[tropic cove]

Hey all, I just finished the HackTricks ARTE exam.
This was a great course and exam, OSCP style (despite a small reset issue at the beginning, quickly addressed by congon4tor).
Really great course, good instructional up-to-date content in the videos, written documentation via Cloud HackTricks, linked resources to original research, great exercises with cool flag system.
I've done a ton of remote trainings (OSCP, OSCE, CRTO, SANS courses etc; I'm holding 17 certs) - including the ones from Altered Security for offensive stuff in on-prem AD and Azure as well as as CloudBreach's AWS and Azure courses. CloudBreach pales in comparison. ARTE was hands down one of my best training experiences. Already am recommending this to my colleagues. 10/10

[orchid berry]

I was wondering about CloudBreach.

That one you have to like set the labs up yourself with their terraform files right?

[tropic cove]

No, you don't have to provision anything in your own account, but are on shared infrastructure. It is a good course with one nice, clear attack path detailed in a single PDF document, but really a different experience compared to ARTE in breadth and depth, with your own big lab environment here.

[orchid berry]

Oh cool, yeah, with ARTE so far (I am just past beanstalk and onto codebuild) I've learned about so many different attack paths, and based on my prior knowledge of AWS exploitation it's only expanded into even more and I already knew how like compromising EC2 can lead to access of a lot of different services and stuff, but like had no clue about a bunch of these other services.

So like, now with that expanded knowledge, I feel like I am more prepared to tackle more elaborate AWS environments, and better yet, even environments of which there aren't labs in ARTE for because of how well documented https://cloud.hacktricks.xyz/ is.

I know I can just go there and research how to enumerate the service, I can also go to AWS's website do some research there, and find out what I can achieve through it.

[cyan mango]

or replace the instance profile of the compromised instance (ec2:ReplaceIamInstanceProfileAssociation). *

aws ec2 replace-iam-instance-profile-association --iam-instance-profile <value> --association-id <value>
``` There is a error. The right query is :--iam-instance-profile Name=<value>

@modest elbow @glacial kelp

[glacial kelp]

What is this about looks like your message is missing a first part?

[cyan mango]

@glacial kelp https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc#iam-passrole-ec2-associateiaminstanceprofile-and-ec2-disassociateiaminstanceprofile-or-or-ec2-replac At this url

[modest elbow]

Fixed! Thanks!

[tawdry canopy]

Anyone had trouble connecting to their RDS instance after launching it in rds-lab-2?

[tawdry canopy]

I set it to --publically-available and verifed that the instance is running

I figured it might be a security group issue but I can't ping

[glacial kelp]

It is highly likely a SG issue

[tawdry canopy]

got the flag 😎

[modest elbow]

@everyone Friendly reminder that today is the last day of the early bird discount for the HackTricks AWS Red Team Expert cert! You can get a voucher today and redeem it within a year! More info in training.hacktricks.xyz

[tawdry canopy]

Did anyone else get a 502 bad gateway after uploading their app on the Elastic Beanstalk lab?

[glacial kelp]

Did you solve this? my guess is the service was not ready yet or it was failing to start

[tawdry canopy]

I ended up resetting the lab. Going to give it another shot later today

[candid turret]

hi, I just entered the ARTE training. Is there a private channel for that? Sorry, I never used Discord before.

[modest elbow]

Yes! In you account settings https://training.hacktricks.xyz/profile set you discord handle and you will get access to the arte-general channel

[tawdry canopy]

It's weird because I tried reuploading literally the same thing I had pulled down with the exception of just adding a comment and it totally just throws 502

[glacial kelp]

If you think something is broken feel free to open a ticket

[candid turret]

I did that already. But then what?

[glacial kelp]

In your case your discord handle is michael_45127 once you add that to your profile and save you will automatically get added to the correct discord role

[candid turret]

thank you

[candid turret]

Will there be an Azure training similar to ARTE in the future?

[modest elbow]

yes! We expect to release GCP and Azure this year

[silent rune]

Hello I have sent an email to support about the AWS Red Team Expert labs, one of them seems to be broken.

Also, is there any consideration to give us a 60-day lab time? This would give us a chance to a complete 1 lab a day instead of 2 labs a day which is very demanding for people who are employed.

This would also leave people time to research the video contents. Please deeply consider this.

[glacial kelp]

Hey @silent rune do you have access to the arte-general and training support channels? You might need to add your discord handle to your account in our website (in the profile page). There you can open a ticket so we can better assist you with any lab issues

Regarding extending the lab duration we are not able to cover the cost of the labs for 60 days without raising the price. For this reason we think it makes more sense to keep the certification cheaper with 45 days and in case people need it they can extend 15, 30 or 90 days.
I wouldn't think of x labs a day as a goal since there are labs that can be done in 10 minutes and others that will take multiple hours to figure out.

But we appreciate the feedback. We give a feedback form at the end of the certification so looking forward to seeing you opinions

[silent rune]

Thank you, I will look for that. 🙂

[silent rune]

@glacial kelp I added my handle to the profile section. I may need to open another ticket

[silent rune]

I've been thinking about the issue you raised about lab costs. What if you start with the cheaper labs (like IAM, S3, Security Groups) and save the pricier EC2, RDS, DynamoDB labs for a separate provisioning cycle (like a part 2 of the course), making them on-demand..?

This way, we keep initial costs down and only use resources when needed, potentially extending lab access without a big price hike. It could balance cost management with a solid learning curve, offering flexibility for those needing more time. Thoughts?

[glacial kelp]

I've been working on something along those lines. Still in early experimental phase

[coarse ocean]

Why change the whole course for one person? I and many others think it's just fine the way it is. Having access to all the labs from day one is actually better for learning due to a process called interleaving and spaced repetition. So, if you limit it and break it into two courses that would be shitty overall experience simply because you don't want to spend some time on the weekends, and at night doing the labs. Not to mention you literally just started, so you don't even know how long it will take you @silent rune . Why not try it first before you complain and ask for changes?

[silent rune]

I respectfully would like to respond to this:

"Why change the whole course for one person?"

• While I agree, you shouldn't change the whole course for 1 individual. I'm the only person that "you" saw raise this problem. To write off my entire suggest as I'm the only person is not a fair judgement.

"I and many others think it's just fine the way it is."

• You've not backed this claim with any data, it's an opinion you have. A more proper response would be to have a poll.

"break it into two courses that would be shitty overall experience simply because you don't want to spend some time on the weekends"

• This is very narrow minded. You can simply provision the second part at the start, it would just have a stricter timebound like 30-45 days or something, where as the other labs could be provisioned longer because they are simply cheaper to keep provisioned from a cost point a view. The couse would not degrade in quality. I think you misunderstood my suggestion.

"Not to mention you literally just started"

• 20/50 flags captured so far. I'm about half way through. But again, this doesn't discredit my suggestion as not being beneficial or breaking the course in anyway.

"Why not try it first before you complain and ask for changes"

• Your comment is highly offensive and doesn't take into my perspective. I'd like to share that I am "trying it" and I do enjoy the content. Furthermore, it's difficult to juggle full-time security work and still complete all the labs. I work 40 hours a week for a security firm, I usually need to devote my free time on the weekends to cover the labs I missed during the week.

[balmy sparrow]

While I’ve purchased but not started the course yet, it sounds like @glacial kelp point was the lab would be too expensive to keep running for >45 days without raising the price. One way to reduce the infra cost is only spin up the infrastructure needed for the lab. Example, when lab one starts, it provisions lab one infra. When the flag is found it’s deprovisoned. In theory this could allow the course to remain the same price but extend the duration. Or the course authors could just keep the extra money 🤷🏻‍♂️

[modest elbow]

Guys, we are optimizing the labs so no worries about this. Labs will always be available from day 1 and the quality won't be affected

[silent rune]

This is a valid and good suggestion as well. I agree.

[silent rune]

Thank you. And we appreciate everything you do! This is only initial feedback, not poor reviews or anything. Keep doing great work, friend.

[glacial kelp]

Also once the exam is passed we share a feedback form to collect opinions and ensure we keep improving as much as possible

[tawdry canopy]

totally stuck on blackbox-lab-1. ||When I simulate the group permissions I get nothing back. After adding my user to the group I get back the same permissions I had before when re-simulating.||

[modest elbow]

Blaclbox1

[coarse ocean]

I respectfully would like to respond to

[lofty imp]

@modest elbow @glacial kelp hi ! do you know when the course on gcp will be available?

[glacial kelp]

No official ETA yet, but it is in development probably before summer (or even sooner) but no promises

[lofty imp]

ok thx

[granite silo]

hey, I'm just stucked on that way

I modified the database, the status is "active" but postgress seems not accessible

From ec2 instance on lab2 psql is not installed but with nc i am able to get a reply. How do you managed to get the access? seems like sg is denying trafic from public but not from vpc

nvm, got it ||ec2 has internet access, just download psql binary and there we go||

[lofty imp]

Hey guys with @hardy canyon we wrote a review of the certification for those who are interested ⬇️
https://www.hackcyom.com/2024/02/arte-review/

[glacial kelp]

Thank you for writing this I appreciate the feedback

[halcyon ocean]

what is this channel?

[glacial kelp]

For people that have purchased the certification they can access some other channels

[halcyon ocean]

what certification?

[glacial kelp]

Our hacktricks training AWS Red Team Expert

[next olive]

Hi all im unable to solve the sts lab 2. I am specifically stuck at running the github workflow where im getting errors unrelated to the lab.
Do we require aws as well?- tried referencing it including my aws arn
Any support would be appreciated

[glacial kelp]

You only require a github account, check github docs on how to connect to aws from github actions using oidc

[next olive]

Thanks!

[tired wyvern]

I am a noob, doing a challenge and have a png file; trying to learn from output of zsteg -all xyz.png am stuck, anyone who can help?

[ionic violet]

hey friends, someone can help me with some doubts with iam lab?

[mental tartan]

Please ask away (aviously try to keep spoiler free) and someone will try to help you

[glacial kelp]

You should also have access to the #arte-general channel if you bought the course and configured your discord username in your profile in our website

[orchid berry]

Do we have a rough timeline for this?

I can't wait to do the Azure and GCP trainings

[modest elbow]

GCP + Workspace before summer and Azure+EntraID before the end of the year hopefully!

[torpid sandal]

Friends, good evening! Who can help and sort out 2.2 STS - Security Token Service: Github Actions?

[orchid berry]

Watch it

?

[wanton latch]

does ARTE have a written component in tandem with the videos?

[prisma raven]

slides yes

[wanton latch]

cool, are they comprehensive to stand on their own?

[prisma raven]

Yes, but the videos clarify everything, once you pay the course you have the content for ever, so I don't see why not to watch the videos

I recomend it

[wanton latch]

i absorb information better reading. not that i won't watch the videos, i just like having reference text. thanks!

probably going to give it a whirl

[prisma raven]

The cool thing about the videos is that you have examples of carlos creating / configuring / exploiting services, that you may not bee able without an AWS account.

[modest elbow]

As Slayer explained almost all videos have demos not represented in the slides

[wanton latch]

gotcha

thx

[icy jewel]

Hello, I added my discord handler to my hacktricks profile but I still don't have access to the training channel, can someone help?

[glacial kelp]

Hey! @icy jewel how did you spell it? Discord is case sensitive for this... I believe you need to set it to tartof

[icy jewel]

Thanks for your answer, it works now !

[visual sedge]

hey @modest elbow I'm looking to do the ARTE when I have some time - do you have a timescale for the Azure version (I belive there was mention of Azure and GCP versions potentially)

[modest elbow]

We are expecting to release the GCP one in June and the Azure one at the end of the year!

[prisma raven]

https://blog.projectdiscovery.io/aws-cloud-security-config-review-using-nuclei-templates/

Interesting 😎

A lot of checks are going to be automated with nuclei now I guess

Powerfull integration

[glacial kelp]

Interesting nuclei took the time to do this. I thought they were more bug bounty related than for whitebox pentests. They don't have too many checks right now compared to prowler or steampipe but they will add more probably

[prisma raven]

I guess the good templates will be custom by the people like always

[orchid berry]

I hope they add cognito templates

It's also my favorite exploit

I found an 0day in a hack cracking platform by coalfire.

Based on Carlos's teachings!

Super exciting to have found that

[prisma raven]

🔥

[prisma raven]

https://x.com/lauramaywendel/status/1785064878643843085?s=46&t=ed0UUwnQE8skl71qjTa5PQ

Interesting

😂😂😂

[lone summit]

Now, AWS came out and stated that they will change the pricing model! Time to run your sites behind custom 4xx pages to get massive discounts! (Not mine, found it somewhere on my Twitter feed)

[tame knoll]

I can't deploy "github actions" in STS module, though other sub modules are successfully deployed.

<@&937047799441268746> Please help check it

[novel stone]

@tame knoll I will notify it thanks

[tame knoll]

Thx

[glacial kelp]

Hey @tame knoll can you open a support ticket? You will need to add your discord handle to your profile in the website

[tame knoll]

Sure, will do

[little belfry]

I have a question about sql injection wargame, can anyone take a question?

[modest elbow]

@everyone Discover Hacktricks Training AWS Red Team Expert Certification with John Hammond and Ignacio in https://buff.ly/4bllq3i

[visual sedge]

Still on track for this @modest elbow ?

[modest elbow]

tight schedule but still on track!

@everyone
The best hacking course & cert in GCP and Workspace is coming to HackTricks Training!

Learn from the basics (organization hierarchy, permissions...) to expert level (how to escalate privileges, remain undetected, pivot between GCP and Workspace...) in the htGRTE course and certification (GCP Red Team Expert).

Soon we will be releasing the presale with an amazing early bird discount!

[orchid berry]

ohhhhhhhhhhhhhhhhhhhhhhhhh snap

[visual sedge]

nice

[orchid berry]

I'm so glad I've been here from the beginning to see how things are progressing, you're killing it @modest elbow and @glacial kelp !

[granite silo]

https://tenor.com/view/guy-slamming-card-on-table-gif-21126320

[strong osprey]

Take my moneyyyyyyyyy

[latent trail]

I AM EXCITED!!

[cosmic coyote]

Preparing myself to first blood the GRTE cert exam! 🔥

[orchid berry]

inb4u

[orchid berry]

Are there any cool attacks you can do if you only have a Google project ID? I keep finding these in mobile penetration tests that I do as a result of firebase db installations from the app. Being able to leverage that into an attack would be slick

[modest elbow]

Not directly, but there are some resources that can be publicly exposed and you need to know the project id to bruteforce potential names. So the project ID is useful to find other potentially vulnerable resources (there will be some labs about this in the new cert)

[grim meadow]

Any timeline for Azure (MARTE!!!??? :D) ?

[modest elbow]

hopefully for the end of the year

[smoky rune]

@everyone for those in Barcelona and interested there's a CTF game based on a 0day and serverless cloud environments within aws this Saturday 1.
It's free and there will be prices for the winners!

More info:
https://www.meetup.com/es-ES/hackingcybersecurity/events/300898931/?notificationId=1369556153578446848
https://www.meetup.com/es-ES/serverless-barcelona/events/300898832/

[steady sentinel]

👋 hi…what are the charges for lab extension if needed

I am in a full time job with limited time each day…do you think typically 60 days is more than sufficient or is that a chase to finish the course and labs

Additionally, if I take the course which is for life and at any point I just want to do the labs, is that possible without repurchasing the course but only the labs…also any new updates to the labs will be automatically also available to everyone that bought previously …is that right?

This is for ARTE and do we get a certification badge that can be verified by the employers

Last question 😅…are we taught any stealth and bypass in the course as well

[orchid berry]

Yes you do get a badge from either Credly or Accredible

[orchid berry]

Yes you are taught stealth techniques

[orchid berry]

Lab extension prices are on their website. 🙂

[steady sentinel]

Ok..thanks a ton

Looking forward to get started…planning to start end of June

[steady sentinel]

I read there is no badge..but instead a document with QR code

[glacial kelp]

Yes on completion of the exam you get a pdf certificate with a qr code that can be used to verify in our website

[steady sentinel]

Thnx

And can I buy the course today but go through the document and videos first and start the lab 2 weeks later…I think it’s not possible but just trying my luck

[steady sentinel]

And can you also confirm if there’s any update or new topic added then that will also be covered under life time access to the course material ?

[glacial kelp]

Unfortunately that is not possible lab time starts at the time you activate the course voucher

[glacial kelp]

This is the case for videos and slides. Which we do update if behaviours change in AWS. For new labs if your lab time has expired you would need to buy lab time in order to do new labs

[steady sentinel]

Ok 👍

Thnx

[modest elbow]

Hi @everyone ! The presale of HT GCP Red Team Expert (GRTE) is finally here!
Become a GCP and Google Workspace security expert by getting access to this certification with the early bird discount!

More information at https://training.hacktricks.xyz/courses/grte

(The certification is expected to be released with all the content and labs on July 22nd)

[visual sedge]

Nice

[strong osprey]

activate it at any point in the next year
this is nice

[visual sedge]

@modest elbow how long is the early bird offer valid for

[modest elbow]

We haven't decided yet, but potentially for the first 70 students getting it or so

[strong osprey]

When will the presale start?

[glacial kelp]

It is already available

[orchid berry]

oh wattt

This is what it says when you try to purchase now

[strong osprey]

I see the same thing, that's why I asked too.

[turbid rune]

Hi Carlos, are you planning to give discounts at ARTE on the occasion of GRTE? I missed the first sale and it's a little over my budget so I've been waiting for a sale for a while.

[glacial kelp]

Deploying a fix now it was set so only admins could purchase (for our testing) and I forgot to undo that

[orchid berry]

let us know when we can buy ❤️

July 22nd here we come baby 🏎️

[glacial kelp]

Should be good now

[orchid berry]

damn I've having that stupid issue with international purchases again 😐

[sage sparrow]

Is it possible to get student discount in early access voucher?

Moreover, do you have some plans for people who would like to buy ARTE + GRTE? @modest elbow

[orchid berry]

yep

Are there discounts for students?

Yes there are! Create an account using your universities email address, then send us an email from that email address to [e-mail] asking for the discount and indicating a link to your linkedin and we will send you a 20% discount.

[sage sparrow]

Yeah, I have seen that earlier but wondering if it also applies for early access

[modest elbow]

atm we have the discount HACKERMATE enabled with a 20% discount on ARTE thanks to the influencer hackermate

[modest elbow]

It's not possible to use several discounts at once, either early bird or other discounts.
And we have special discounts if several vouchers are bought in bulk (usually by companies). We might considder adding special packs in the future, but the early bird discount is the biggest discount we give, so atm it doesn0t make sense to create more discounts for GRTE

[steady sentinel]

Any plans of issuing badges via badger or Credly?

[glacial kelp]

We would like to do something like this in the future but have struggled to find the time to investigate what the best provider would be for us

[orchid berry]

Accredible or Credly seem to be the move for most businesses atm.

[glacial kelp]

Both are above the pricepoint that makes sense for us at our scale. I'm adding a button in the certificates table that simplifies adding the cert to linkedin profiles

Hopefully that is good enough for the time being

[glacial kelp]

@steady sentinel If you go to https://training.hacktricks.xyz/certificates you should see a new linkedin button which will take you to a prefilled form to add the certificate to your linkedin profile. You can add the PDF as Media and it should look pretty nice

[turbid rune]

Hi @glacial kelp @modest elbow, if I buy the ARTE voucher now, when should I activate it at the latest?

[glacial kelp]

All vouchers have a 1 year expiration

[shy spindle]

Hey there @glacial kelp ! Super interested in the ARTE training. Is it possible to do a payment plan or installments for the voucher?

[glacial kelp]

Hey, currently we are not able to support payment plans. We do have some student discounts if that helps

[tacit stump]

Hi all, I have trouble with provisioning the lab for AWS-Lambda, I have tried to rest the lab with no luck . Anyone can can help please.

[glacial kelp]

Have you tried reseting the lab for that specific lesson or the entire lab account from the dashboard. Feel free to open a support ticket

[tacit stump]

I'll try the entire lab now - Thanks

[balmy edge]

I have problem on EC2 Labs, i configure aws:

aws iam list-users
{
"Users": [
{
"Path": "/",
"UserName": "ec2-......
[SNIP]
......

everything is good, but when i do:

aws ec2 describe-instances

Could not connect to the endpoint URL: "https://ec2.us-east1.amazonaws.com/"

What I'm missing? :/

[orchid berry]

look at what your policy allows

aws iam list-attached-user-policies --user-name <username> #this flag might be wrong?
aws iam get-policy-version v1 --policy-name <policy-arn>```

you may only be able to describe some instances

[languid carbon]

hi mates, just bought voucher for GRTE, am i right that it will be available after release on 22nd of July?

[modest elbow]

Yes! You will be able to redeem it from the 22nd of July and start the cert

[analog scarab]

Hi everyone, GRTE finally starts tomorrow, we are looking forward to it 🎉 Are you guys planning to do Azure RTE in the near future?

[glacial kelp]

GRTE starts 22 of July not June, still 30 days to go

[analog scarab]

ok, thx)

[glacial kelp]

But we are really happy with how it is turning out I think it is going to be great

[orchid berry]

If it's anything like ARTE it'll be fantastic

And hopefully teach me what I can do with all these keys for google projects I keep finding on pentests 😂

[turbid rune]

Hi, you give me an invoice when I purchase the training, right?

[modest elbow]

Yes, you receive an email from stripe with a link to download the invoice

[turbid rune]

Hey @modest elbow @glacial kelp, today, I bought ARTE but ran into a small problem. I have contacted [e-mail] via email. I would be grateful for any assistance you can provide

[glacial kelp]

Hey I'll DM you

[south wave]

Hello @modest elbow I am buying the voucher soon for expert aws cert, I have a couple questions kindly, 1. how long does each lab take per day, 2. is the exam guided (meaning that despite being black box, are there directions to what to exploit or to find?) 3. can i buy the voucher now and begin in few months?
Thank you

[south wave]

@glacial kelp eagerly waiting for your response :^)

[glacial kelp]

Hey 👋,

1. Lab completion time depends a lot on your experience and also what labs. There are some that I expect most people will solve within 15 minutes and others I expect even experienced people to take a few hours. There are 50 of them and they are very varied in difficulty.
2. The exam has very minimal directions. You get a url and work from there to get 3 different flags. It is designed so that if you have worked through the labs you should be able to pass. We have 3 blackbox labs specifically to prepare you for the style of the exam.
3. The voucher is valid for 1 year from the day of purchase. And they once you activate it you have another year to schedule your exam

[south wave]

Beautiful, thank you ❤️

[south wave]

@glacial kelp purchased, added discord id, will discord access be given shortly or only once the voucher has been activated?

[glacial kelp]

Only when the voucher is activated

[modest elbow]

@everyone
ARTE (https://training.hacktricks.xyz/courses/arte) cert was just updated with new techniques in the Black Box (Red Team) and CloudTrail sections and a new Black Box lab was released!
Get it with a 20% discount using the "SUMMERTRAINING" code before the 1st of August.

If you already bought it, you have lifetime access to these updates. Go to those sections and check the updated slides and videos!

[gaunt slate]

https://tenor.com/view/so-hot-right-now-trending-meme-zoolander-this-is-epic-gif-26091622

[languid wasp]

https://tenor.com/view/whatever-little-girl-drinking-too-cool-chilling-yeah-whatever-gif-27534207

[lethal quail]

excellent lab, thanks guys. It broke my brain for a long time.

[south wave]

@glacial kelp please note I DM'd you about voucher questions further, about to activate it. kindly when you have a moment to get to it

[orchid berry]

T-15 DAYS UNTIL GRTE LAUNCH

[lethal ore]

🔐 Calling All Cyber Enthusiasts! 🔐

Are you passionate about cybersecurity? Eager to stay ahead of the digital curve? Look no further! Join our exclusive WhatsApp group where we share top-notch resources, insightful content, and cutting-edge techniques to keep your skills razor-sharp. 🚀

Whether you’re a seasoned pro or just starting your cybersecurity journey, this community is for you. Let’s learn, collaborate and elevate our skills together! 💻🔍🔒

join this invite link https://chat.whatsapp.com/J8HVeSEPDUR2gaE5NB4OoM Let’s fortify our knowledge and build a stronger, more secure digital wor

[gaunt slate]

When I purchase the ARTE training, does the course start immediately or do I get to choose a start date? Thx

[near prairie]

Once you buy it you will receive a voucher. That voucher can be redeemed any time within 1 year and once you redeem it the countdown will start!!!

[gaunt slate]

SWEET DEAL!! Thanks!!

[balmy hollow]

Wanna know if GRTE is worth to take it???

I'm definitely going to take ARTE, but I don't know how big the market size is for Google Cloud

[orchid berry]

Well

AWS, Azure and GCP take up like 90% (made up number, probably accurate) of the market share, so by preparing yourself for all three environments, you are then ready to handle assessments that many people just don't know how to do.

[balmy hollow]

Good way to put it.

[modest elbow]

The GRTE cert is no only about GCP but also about Google Workspace which is one of the most used identity providers. And the companies that use Google Workspace tends to use GCP sooner or later just because it's easier. So even though it's just the hird biggest cloud provider, I find it being used pretty frequently (specially combined with AWS)

[orchid berry]

Combined market share is 67% in total, and GCP makes up 10%, so it's like half of Azure and 1/3rd of AWS.

So yeah it's pretty common, especially if you think about how often you see AWS and Azure nowadays.

And the multi-cloud / hybrid environments are increasingly more common as well

[balmy hollow]

Thank you very much for the information. Im tend to be very new to the cloud but I found cloud hacking very interesting. Definitely going to get both bro.

💯

[orchid berry]

Yeah plus it's fun to learn new stuff 😄

[balmy hollow]

To join the arte traning private group, do I have to purchase the course first

[modest elbow]

yes

[balmy hollow]

thank you very much

[orchid berry]

T-Minus Monday GRTE

https://tenor.com/qptoQrMAbJB.gif

[orchid berry]

T-M 24 HRs!!!

[languid carbon]

Hi,
There is a CORS error that prevents watching videos in the GRTE course.

[glacial kelp]

I'll fix it in a bit sorry

[glacial kelp]

This is resolved now

[modest elbow]

Lets go @everyone !! GRTE - GCP Red Team Expert- certification is finally live!
Get it with the early bird discount while it last!
And good luck to everybody that is trying to get first bloods of the labs and exam!
https://training.hacktricks.xyz/courses/grte

[dusk vessel]

799€ which is wayyy more out of my budget.

[modest elbow]

Sry to hear that! But that will be the minimum price for a completely guided certification on hacking GCP and GWorkspace including novel techniques and tens of labs to practice!

[dusk vessel]

Yh I know. 🥲

[cosmic coyote]

Got mine already! Also this time it was super easy to download the invoice :). I'm excited to start the labs in Aug 🚀

[modest nexus]

Anyone else having trouble deploying the lambda lab in ARTE?

[glacial kelp]

If you get errors deployong labs try resetting your entire environment from the dashboard

[orchid berry]

Resetting the lab is triggering errors.

This occurred after the second deployment of the labs failed.

I was getting unable to deploy project/topic labs or somehting like that, reset my whole lab and it then failed.

[orchid berry]

second lab reset today and the deployment once again failed just now 😐

[glacial kelp]

Fixed it for you but still investigating the root cause if anyone else has any issues please open a ticket

[glacial kelp]

Found the root cause the lab destruction deletes that resource when it should not

[glacial kelp]

Shold be fixed now. Please reopen a ticket if you find any issues

[sudden merlin]

Hello. I'm stacked on "sts:GetFederationToken". I'm setting credentials to default profile and using custom script. But, Im getting eoor for accessdenied. Is there any change I shoud make the script?
https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-post-exploitation/aws-sts-post-exploitation#from-iam-creds-to-console

[glacial kelp]

This question would be better suited for the #arte-general channel if you don't have access you will need to set your discord handle in the profile page in training.hacktricks.xyz

[sudden merlin]

got it. thanks

[pastel totem]

Hi

GRTE labs - iam section, got multiple issue while trying start up the lab, after couple of lab restart it start working, now do not have possibility to extend lab time due to error, could You check it:

[glacial kelp]

Hi, we are aware of this issue and are looking into it. The IAM lab should now be fixed.
For future occasions this would probably fit better in the #grte-general channel. If you don't have access you will need to add your discord handle in your profile page in the training platform

[glacial kelp]

Do you mind moving this message to the #grte-general channel please

[orchid berry]

done

[mental tartan]

<@&1128840997581889586> <@&937047799441268746>

[novel stone]

thx

[toxic trellis]

i have a problem with one challenge on EC2
is there someone to help?

[glacial kelp]

Do you have access to the #arte-general channel? If not you can configure your discord handle in the profile page in the hacktricks website and you will automatically be added to that channel

[modest elbow]

Hi guys!
@SoteriaSecurity is looking for a Senior Offensive Security Consultant (Cloud Pentester) valuing the HackTricks Training ARTE (AWS Red Team Expert) certification as a plus to access the role!

More info about the role in https://ats.rippling.com/en-GB/soteria/jobs/e6251998-dea0-41ab-a13e-e718e1591136

If your company is looking for Cloud Security engineers contact us and we will help you find them!

[fringe violet]

Anybody have experience with wix4? The example from the website is using the old wix3 https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix. I have wix4 working, able to do update info, icons, banner, add shortcut. I'm struggling to add a new dialog to install prompt for msi to have checkbox for desktop shortcut.

[orchid berry]

You might get a better response in #hacktricks

@modest elbow when are we getting ARTE/GRTE energy drinks?? 😂

[modest elbow]

Hahahaha that would be great

[orchid berry]

And why are you only arta-certified 😂😂😂

[orchid berry]

It’d be awesome merch! People could buy them prior to exam to get exam-passing superpowers! 🦸

[modest elbow]

We would love to create it. But we have no contacts to do so hahaha

[orchid berry]

https://www.diybeverages.com/

[modest elbow]

Hahahaha I'll take a look and let you know

[toxic trellis]

I got AWS Red Team Apprentice certificate 🤞
thanks for your support @modest elbow @jimmy
I just posted on LinkedIn and recommended amazing courses and labs to others
https://www.linkedin.com/posts/mohammadhosseinnamadi_aws-pentesting-hacktricks-activity-7228309612368658433-eGTJ?utm_source=share&utm_medium=member_desktop

[prisma raven]

Now is time for ARTE 😎

[orchid berry]

Just got an offer from Coalfire's AWS team! Couldn't have done it without @modest elbow, @glacial kelp and the HackTricks team!

ARTE definitely leveled me up to where I needed to be in order to crush their interviews!

[modest elbow]

Thanks for your words mate! Happy to have helped!!

[tepid tapir]

Great!!!

[mossy pumice]

Congratulations

[frank adder]

Hahaha, I founded that team. Congratz!

A fun killchain that isn't talked about anywhere on Hacktricks is attack AppSync GQL. Lots of devs are lazy and directly inject the temporary API keys into javascript (AWS gives them a maximum life of a couple weeks to prevent this, but people do it anyway). The API key is always fully privileged, so all data is readable.

Less fruitful but just as fun is using Cognito credentials to reach into GQL. Fine grained access control for Cognito+AppSync GQL is really hard, and if they don't use AWS WAF to prevent introspection queries, you can read the entire schema and query whatever you want.

I built a tool a few years ago that makes exploitation pretty easy under the right circumstances: https://github.com/c6fc/countersync

[orchid berry]

That's awesome!! I don't know if you're still there! But I actually wasn't able to take that offer due it being kind of a low offer and also due to legal's extremely restrictive contract language but it's always cool to know that know that I got the chops now! ❤️

[orchid berry]

If you're doing the ARTE, put in a PR to HackTricks and you'll get extra credit!

[normal python]

Congrats

[normal python]

Coalfire has been paying less and less it seems

[normal python]

this is correct email to ask about student discount: [e-mail]?

[modest elbow]

Yep

[normal python]

Thanks really appreciate this course. There’s is not much training like this out there and new fedramp guidelines require a red team but most people are not teaching cloud red team skills.

[modest elbow]

Thats exactly why we created it👌

[normal python]

what is the cost for lab extension?

[orchid berry]

Yeah I actually just breached an AWS environment and significantly escalated as a result of my training here!

[modest elbow]

It depends on the number of days you would like to purchase

[normal python]

Anyone aware of any configuration mapping tools similar to bloodhound/azurehound but for aws and gcp?

[prisma raven]

First GRTE Certified!. 🎉

Awesome GRTE journey, I recommend it to anyone interested on GCLOUD, you are not going to find nothing similar to the Hacktricks training course out there!.

https://c.tenor.com/fJh-W38iA3oAAAAM/dance-kid.gif

[glacial kelp]

Congratulations 👏👏

[modest elbow]

Congrats!!!

[modest elbow]

In GCP it's possible to find your permissions with the testIamPermissions API even if you don't have any permission!
Moreover, it doesn't generate any logs!
Find a PoC in https://github.com/carlospolop/Bruteforce-GCP-Permissions and learn this and many more GCP & Workspace hacking tricks in the GRTE certification: https://training.hacktricks.xyz/courses/grte

[modest elbow]

Next Friday Sept 13th is the last day of the GRTE (GCP Red Team Expert) early bird discount! Don't miss it!

[icy tide]

Hey, If my labs are expiring and I extend the lab after it expires.Does it carry on the progress I made or it will reset?

[prisma raven]

Yes, you don’t lose your progress

[icy tide]

great, thank you for the response @prisma raven

[prisma raven]

Your welcome 💪💪

[tame mantle]

dear sir
I have already purchased the GCP course, but can I study the course first and then start the experimental environment?

@prisma raven

[modest elbow]

Unfortunately no, both things start at the same time

[prisma raven]

No, sorry for not answering faster, heavy work day 🔥💀

60 days is more than enough

I was still having 25 days after passing the exam

So don’t worry

[tame mantle]

ok

[tame mantle]

thank

[prisma raven]

https://blog.projectdiscovery.io/azure-config-review-with-nuclei/

[cobalt swift]

Is there a channel for ARTE?

[prisma raven]

Yes, link your discord ID on the hacktricks training website

And you will be granted access

[cobalt swift]

Got it I'm yet to take the course

Wanted some feedback on how deep do the modules go

I've got lot of mixed reviews online saying most of that content is out on youtube or that it is to basic :/

[prisma raven]

That’s fake 😂😂😂😂

Im pretty sure you won’t be finding nothing like ARTE anywhere else

Tell me what you want to know , I will answer your doubts

You can also check my post where I explained how it works

https://slayer0x.github.io/ARTE/

[cobalt swift]

Can I dm you?

[prisma raven]

Sure

[modest elbow]

2 new lessons about (ab)using GCP Cloud Scheduler and Workflows were released in GRTE certification (https://training.hacktricks.xyz/courses/grte)
If you already got access to it you can check them, if not, you can get access to the certification and will have access to all the updates in the future!

You can also take a glance to these GCP service from a offensive security perspective in:

• https://cloud.hacktricks.xyz/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-scheduler-enum
• https://cloud.hacktricks.xyz/pentesting-cloud/gcp-security/gcp-services/gcp-workflows-enum

[prisma raven]

@modest elbow and @glacial kelp you could have been rich: https://www.linkedin.com/posts/parisel_aws-vdp-vulnerability-disclosure-program-activity-7242113598800429056-Jpdr?utm_source=share&utm_medium=member_desktop

[glacial kelp]

Saw it yesterday they finally have a VDP although it is not a bug bounty program so I guess they are still not paying for vulns?

[prisma raven]

Can be yes... maybe only diplomas XD

like NASA, PDF letters

probably...

[glacial kelp]

BTW if you haven't read this one it is probably the scariest AWS vuln I've seen in the last couple of years https://engineering.doit.com/aws-transit-gateway-peering-exploit-a1715edd4c8a

[prisma raven]

Let´s see

[orchid berry]

oof

that's a big nono

[prisma raven]

luuul XD... how can Amazon fall in this stuff... Only front-end limitting privileges

[orchid berry]

well

they have like thousands of services

[prisma raven]

yeah...

don´t know XD

[orchid berry]

it's pretty tough to catch EVERY thing

it's easy to say from our perspective 😄

[prisma raven]

after discovering this you always asks your self if someone has discovered before XD

[glacial kelp]

You would think a service this critical would have been tested a lot more... I feel like any pentester would try this the first thing they would do when assessing this service

[orchid berry]

Yeah true I would

[prisma raven]

that´s why im saying...

[orchid berry]

"I wonder if I can connect to random on-prem environments!"

[modest elbow]

Did you know that setting arbitrary environment variables can get RCE in most scripting languages?

Some cloud services allow to modify env variables and you can:

• Escalate privileges to roles or service accounts without typical permissions to access them (e.g. https://shorturl.at/ziMvo)
• Execute code in unexpected places, such as GCP Composer’s DAG processor, triggerer, workers, and webserver (already fixed)

Learn and practice these and other hacking techniques at http://training.hacktricks.xyz and http://cloud.hacktricks.xyz.

[orchid berry]

When are we gonna get HackTricks Prod Energy Drinks?

"Fuel Your Code. Break the Rules. HackTricks Prod—Power for the Bold."

🔥

[modest elbow]

Still need to look into that hahaha

[orchid berry]

It’d be cool for patreon supporters or something like that, or just as merch you can buy!

Do you have a patreon btw?

[prisma raven]

https://github.com/dafthack/MFASweep.git

Interesting tool for fast checking in azure/microsoft stuff

[modest elbow]

HackTricks as the wiki has github sponsors

[modest elbow]

Yeah, for Azure there are a lot more tools than for all the other clouds (even together hahaha)

[prisma raven]

I can understand why

😅

[orchid berry]

Yeah this works really well too btw

[normal python]

Is anyone familiar with any vulnerabilities related to dce-rpc in azure ?

[near prairie]

ARTE has been updated again!

Learn how to use and escalate privileges in Step Functions and put it into practice in the AWS Red Team Expert certification (https://training.hacktricks.xyz/courses/arte)
If you already pruchased the cert, you can access the new lesson!

You can also learn some Step Functions cool hacking tricks in https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-services/aws-stepfunctions-enum

[near prairie]

🚨 New Course Alert! 🚨

Excited to introduce HACKTRICKS GRTA: GCP Red Team Apprentice, the perfect starting point for mastering security in GCP and Google Workspace (https://training.hacktricks.xyz/courses/grta).

👉 Learn about the GCP key services.
👉 Discover how to spot and exploit common misconfigurations.
👉 Increase your skills in hardening GCP environments.

To celebrate it we have reduced the prices of both ARTA and GRTA the following month!!

[wraith canyon]

Hi there, how are you? If I want a sanity check on an ARTA flag, can I consult through this channel?

[near prairie]

Hi @wraith canyon , you should go to #arte-general

If you dont have it, in the profile section of hacktricks training you can provide your discord username and you will be added!!

[wraith canyon]

Thank you!

[near prairie]

Anytime, you can also open a ticket for any further questions!!

[drifting stump]

hello all
I'm just curious
if i want to conduct a pentest on Azure and the client will create a user account for me to test with
which role should that iser account get assigned with?
maybe global reader? or is it something else?

[orchid berry]

I typically ask for multiple roles. Not just a single one.

[orchid berry]

Usually I'll ask for whatever the like standard RBAC roles that gets used when deploying new users to the environment, then I'll also ask for a Global Reader role so I can approach it as a greybox test.

Additionally, make sure that the client assigns you an O365 license and all that. It will increase the depth of the analysis you will get to perform.

I recently did a red team op where we could've done a whole bunch of cool stuff and demonstrated a lot of impact had we been assigned a 365 license to our assumed breach account likke everyone else had been

[prisma raven]

🔥

[drifting stump]

hello
how can i know how many days i have left for the lab

i got busy in the past week and didn't get the chance to study

[near prairie]

Hi!! If you go to the dashboard, in the section "Your Labs", you should see how many days you have left for the laboratories of the courses you are taking.

Let me know if you find it!!

[drifting stump]

thanks for answering
but what if they don't have a default RBAC
Global Reader is ok to have
but is not enough to barely do things
what do you think is the suitable approach in this scenario

[orchid berry]

well with global reader, you can read teams/sharepoint

[wraith canyon]

Felicitaciones por el tremendo trabajo que realizaron en los labs y en la metodologia. Sigo digeriendo el material aun y seguire por bastante mas tiempo. 👏👏👏

https://www.linkedin.com/feed/update/urn:li:activity:7249238712474099713/

[normal python]

passed CRTP, CRTO, PNPT, and OSCP in the last 2 months it's finally time for this baby

[iron agate]

https://youtu.be/IospQtj544o?si=UrH_a-Q3__6Tk2yn

[halcyon linden]

Hello, will the azure red team expert be available soon?

[near prairie]

Around the end of this year or the beginning of the next!!!

[halcyon linden]

Thanks a lot

[near prairie]

🚨 GRTE Update & Discounts Alert! 🚨

We celebrate it with new discounts for GRTE. Go to our LinkedIn (https://www.linkedin.com/posts/hacktricks_grte-update-discounts-alert-we-activity-7254065963841576962-Lhio?utm_source=share&utm_medium=member_desktop) or Twitter (https://x.com/hacktricks_live/status/1848302265641173155) and learn how to get the discount!!

Our new lesson on how to abuse Google Workspace Sync is up now. Furthermore we have updated our Cloud Functions laboratories, learn how to escalate Cloud functions via storage monitoring here https://training.hacktricks.xyz/courses/grte.

If you’ve already purchased the cert, these lessons are waiting for you now!

You can also learn some Cloud Functions cool hacking tricks in https://cloud.hacktricks.xyz/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudfunctions-privesc and learn about Google workspace Sync in https://cloud.hacktricks.xyz/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid

[true nest]

Hiya, Python security researcher here. Can someone reach out to me regarding an inquiry in the course content for GRTE when you have the opportunity? (Not a generic question, probably more line of business/abuse of platform related.)

[modest elbow]

Tell me

[true nest]

Shot ya' a DM Carlos. Cheers 😄

[modest elbow]

Did you send it already?

[true nest]

I did yes.

Might be stuck in your DM requests.

Hopefully it didn't go to Spam lol.

[near prairie]

🎉 New HackTricks Bundles! 🎉

These bundles give you a 20% discount compared to getting each course on its own, so you get more for less!

1️⃣ Expert Bundle: Includes GRTE (GCP Red Team Expert) + ARTE (AWS Red Team Expert): Ideal for those ready to master advanced cloud security techniques in both AWS and GCP. (https://training.hacktricks.xyz/bundles#expert)

2️⃣ Apprentice Bundle: Includes GRTA (GCP Red Team Apprentice) + ARTA (AWS Red Team Apprentice): Perfect for beginners looking to build a strong foundation in cloud security. (https://training.hacktricks.xyz/bundles#apprentice)

Take advantage of this opportunity to boost your skills with a HackTricks bundle (https://training.hacktricks.xyz) !

[short lantern]

Hello!
Does anyone else experience with training site issues?

[near prairie]

Should be working just accessed it without any problem!!

Try reloading it

[short lantern]

Ah, it works now 🙂

[limber cairn]

How can I join the ARTE channel?
I am a student and got stuck

[near prairie]

Hi!! Once logged in, you can yo to the profile section on top right of the page. There you should see a box that says "Discord handle (Optional)", you should fill it with your discord ID

You will be added automatically

[limber cairn]

Thanks, I did, but..I don't see the private channels

[near prairie]

Weird should be right below this one

@glacial kelp Should it be already there right??

[glacial kelp]

You have the role you should be able to see #arte-general

[near prairie]

🔥 Black Friday Deals Are Here! 🔥

Until November 30th, take advantage of 30% OFF our Cloud Security Bundles and 20% OFF on individual courses with our Black Friday discount codes. Master advanced security tactics in AWS and GCP with our ARTE and GRTE certifications!

⏳ Don't miss out on these limited-time deals and start your journey with HackTricks today!

The discounts are applied automatically in the web http://training.hacktricks.xyz

[modest elbow]

@everyone In addition to the already mentioned Black Friday discounts we would like to offer a 20% discount in extra lab time until the 30th of Nov as some people requested!
Use the coupon BLACKFRIDAYLABS20 to get it!

[potent gull]

Thanks for the discount offers. When can we expect to see the release of the Azure material?

[modest elbow]

we are working on it, ETA for the first Azure course is early 2025

[glad karma]

Hey how do I buy the course ?

Nvm my bad no coffee full piss head mode

[raven onyx]

Hi team, just quick question.
How long does hacktricks takes to respond on my emails regarding student discount as i need to buy the ARTE asap

[near prairie]

Not much, why?

[near prairie]

You can dm me!!

[sour ginkgo]

Hi all. I need a copy of my invoice for ARTE course. Can I request that through email (If so, which email address)? Thanks

[near prairie]

Hi!! You can send us an email to [e-mail]

[sour ginkgo]

Great! Thanks

[sour ginkgo]

I see I had actually sent an email to this address with this request a few weeks back and never received a response. I just sent another email now.

[near prairie]

You should have received a response!

[sour ginkgo]

Got it! thanks for quick turnaround!

[near prairie]

Anytime!

[devout hinge]

Are the labs in browser or do you create your own lab environment?

[prisma raven]

The labs are cloud based, you gain access to them, so you only need a computer/vm to install the tools needed to interact with the different clouds.

[glacial kelp]

We set everything up for you. You just click a button and wait a bit for provisioning

[halcyon linden]

Hello, sorry to bother you.
It seems that the azure training is scheduled for early 2025.
Will be there some early bird discount?

[near prairie]

Hi!! Yes there will be an early bird discount

[halcyon linden]

Thanks a lot, I intend to buy both the AWS and the azure course, but I have a limited budget.
I intend to buy the AWS course this year and Azure course next year if it's around the same price

[near prairie]

⏳ Black Friday Deals Ending Soon!

This is your LAST chance to grab Black Friday deals on HackTricks Training. Until November 30th, take advantage of 30% OFF our Cloud Security Bundles and 20% OFF on individual courses with our Black Friday discounts. Master advanced security tactics in AWS and GCP with our ARTE and GRTE certifications!

🔥HURRY!!🔥

The discounts are applied automatically in the web http://training.hacktricks.xyz.

[glad orbit]

My GRTE lab hasn't been provisioned yet, can someone have a look into it. Its been 5 hours since I activated my voucher.

[modest elbow]

GCP modified an API just today in there was some labs that couldn't be provisioned. It's fixed already but you need to go to the labs page and reset the lab.
Sorry for the inconvenience

[glad orbit]

Is there a specific labs page, the only page I see is https://training.hacktricks.xyz/dashboard

[near prairie]

Here on the "continue where you left"

The labs start in the part 2!

[glad orbit]

I get an empty page when I try to access part 2

[near prairie]

Weird i can access with no issue, can you try other browser?

[glad orbit]

ok, let me try chrome

[glad orbit]

same thing in chrome

[near prairie]

@glacial kelp @modest elbow Can you take a look to this?

[near prairie]

Look dm!!

[glacial kelp]

Hey @glad orbit I think you should be good to go now. GCP made a change yesterday and yours was 1 of the 2 deployments that failed because of this. I missed that it happened twice and only retried for the other student. Sorry about the delay

[glad orbit]

Thanks @glacial kelp, I am able to access now

[glacial kelp]

By the way if you add your discord handle in the profile section of the website you will be added to some private channels and a support ticket system

[glad orbit]

thanks @glacial kelp , I added my handle to https://training.hacktricks.xyz/profile

[manic solar]

Hi there! I keep getting this error message, I'd like to purchase this before the deal ends

[near prairie]

Hi! It was until midnight EU time.
However we just extended it until the 2nd of December till 23:59 GMT+1!!
Don't miss it❗

[glad orbit]

Can I get access to the private channel?

[orchid berry]

Any updates on when the AzRTE is coming out?

Also, @glacial kelp I never got my GRTE badge

[glacial kelp]

Added you to the role

It is a shame you have to choose between what can to show in discord

[orchid berry]

Ik 😭

But thanks!

[modest elbow]

We are aiming for February, but there is a lot of research left to do

[manic solar]

Thanks a lot! Now I got it. By the way, I can send the voucher again at any time, is that correct? Even if the first voucher link expires

[near prairie]

I dont understand the question 😅

[manic solar]

I received this after purchasing the course.

However, I assume I can use this option to get a new activation link at any time

[modest elbow]

Hi! I think you will get the same activation link with that button. The vouchers is expected to be used in 1 year from the time it's purchased (note you have un 1 Dec 2025). However, if you want to activate it later let us know

[glad orbit]

I have a couple of questions, can you add me to the private channel

[near prairie]

YOu should see the #arte-general channel

[glad orbit]

I see it now, I am working on GRTE, can you add me to that specific channel

[near prairie]

oh sorry #grte-general

[glad orbit]

Thanks, I see it now

[near prairie]

Great

[hybrid forge]

Howdy @modest elbow or anyone that can help.
I am doing the ARTE and am stuck on 2.13 ECR - Elastic Container Registry 2nd Lab - Push Docker Image.
I downloaded the walkthrough but still cannot get it to work.
When I run the lambda invoke command I get the following error in the out.txt file:
{"errorType":"Runtime.InvalidEntrypoint","errorMessage":"RequestId: 0f86b30a-b562-4235-bac1-61ce7e19ad0c Error: fork/exec /lambda-entrypoint.sh: exec format error"}

[hybrid forge]

Howdy @carlospolop or anyone that can

[near prairie]

Hi, please open a ticket so I can help you

[hybrid forge]

How do I open a ticket

[near prairie]

go to #training-support

[hybrid forge]

I dont have access

[near prairie]

Did you added your discord id to your profile in hacktricks training?

[hybrid forge]

I'll do that now

[tiny perch]

Hey there, I am thinking to get 15 days lab extension for ARTA course. But if I am able to finish all the labs in the allocated time that I have left and if I did not redeem the voucher for lab extension (I am guessing everything on this platform is based vouchers), can I then issue an refund for this unused voucher?

[near prairie]

If its being more than a month, and of course it has not being used yes.

[near prairie]

But note that a 2% percent of the transaction will not be refunded, because of Stripe fees

[tiny perch]

Okay 👍

[orchid berry]

Looking forward to it my dude

[modest elbow]

Me too 😂

[south wave]

creds are fine, anyone has same output for kms:PutKeyPolicy (I reset lab, same thing)

other labs ok

I ran --debug also, but doesnt seem to be issue on my end - could someone help please

[near prairie]

Open a ticket

[south wave]

ok

[cedar marsh]

Hi all 🙂 Is this the right channel to ask for hints about ARTE labs? I think my instance of "API Gateway Sign Request" may be faulty

[near prairie]

Is the #arte-general general one

You have to add your discrod name to the hacktricks-training profile

[cedar marsh]

Awesome thanks - just added 🙂

[near prairie]

You should see the channel now!

[stray kraken]

Is there any way to invoke Lambda function without the Invoke permissions?

I noticed the lambda:UpdateFunctionConfiguration privilege escalation via env variables but is it enough just to set them or do I need to invoke the function anyway?

[near prairie]

You need the Invoke permission to invoke it yes

Im not aware of any other way of doing it

[stray kraken]

But there can be some triggers, right? like uploading something to S3 bucket ?

[near prairie]

Yes there could be triggers

[modest elbow]

Also if the lambda is exposed via URL and everyone is allowed to acces the URL it's a way to "invoke" it

[iron agate]

I added GCP and AWS Red Team Apprentice Courses to the Cloud Security Fundamentals section of https://learntocloud.guide a few weeks ago.

[modest elbow]

Thanks!

[modest elbow]

Hi @everyone !
We are releasing the HackTricks assistant chatbot https://www.hacktricks.ai/ for free!

This chatbot has access to HackTricks & HackTricks Cloud knowledge base so you can ask it questions about topics discussed in HackTricks or cybersecurity in general and it'll be able to help you using HackTricks knowledge.

Moreover, it also allows to generate interesting facts and questions about the selected HackTricks topic or even about a specific certification. This allows you to practice hacking (from a theoretical way) from anywhere and prepare for the top certs!

[sand dome]

Cool

[modest elbow]

Might have been a temporary vercel breakdown, its working now

[marble heart]

I still can't access it.

[modest elbow]

? I can access it without any problems

And a couple of guys I asked also can.
You get that error always?

[marble heart]

My friends also cannot access the webpage.

I can access the webpage now.

[marble heart]

I was able to access the website using a VPN. After disconnecting the VPN, I can still access it. However, browsers that have never accessed the site using a VPN cannot reach it.

By the way, I am currently in Taiwan.

[modest elbow]

Yes, I accesed vercel to see the logs and openai is returning some 403 because of the location of some used vercel servers. I'm trying to update the configuration to only use vercel servers from the US

[modest elbow]

could you try again and let me know?

[modest elbow]

new deployment, could you try again?

[modest elbow]

shit, ok, I'll take a look these days but for the moment I guess you need to keep using the VPN

[west wharf]

guys i got an announcement of a pentest AI assistant bot

how to access it ?

think it was from this server, if i remember correctly

[modest elbow]

www.hacktricks.ai

[west wharf]

been using chatgtp some time and its quite alright for brainstorming

how would this compare?

[modest elbow]

This is like chatgpt with further access to hacktricks data with an interface prepared to learn about hacktricks content and prepare for other certs with questions related to them

[west wharf]

This is great

Probably less chance to hallucinations then since hacktricks data is awesome

[pastel totem]

Even in polish it has good flow when I am testing it :d

[modest elbow]

Hi @everyone ! Happy Sunday!
As requested by some users, the mobile version of the web is up now.
Just access www.hacktricks.ai from your phone and test yourself about hacking topics anywhere!

[glad karma]

Works great !

[south wave]

Not related to this training but pretty interesting resource https://comparecloud.in/

[mossy pumice]

Hey thanks for sharing. @south wave

[neon storm]

Hi! I don't know if it's proper channel to ask, but: has anyone run into issues with the ARTA SQS lab? Could you walk me through the correct way to retrieve the output after injecting commands into the vulnerable Lambda function? I’ve tried several approaches and still can’t figure it out. Thanks in advance! 😉

[near prairie]

hi!! do you see the #arte-general channel?

[neon storm]

looks like I don't have access there

[near prairie]

Did you put your discors id into the hacktricks trainning account?

[neon storm]

no, I'll do it in a minute - thank You!

[south wave]

nice resource, it allows to filter extensions for free, unlike greyhatbuckets > https://osint.sh/buckets/

[molten vortex]

Hi everyone, would someone from support be so kind and add me to the gcp channel ? Thank you in advance ps. yes i added my discord id on my profile

[near prairie]

Hi, do you see the #grte-general channel??

[molten vortex]

hi @near prairie , thanks for reaching out. no unfortunately not.

[near prairie]

You should have it now @molten vortex

[molten vortex]

Thank you @near prairie

[modest elbow]

@everyone Learn cloud Hacking from 0 to Hero in 3 days!
The 3 days-3 clouds course is back at RootedCON: https://www.rootedcon.com/trainings-rooted2025/
Learn AWS, Azure and GCP security in 3 intense days with 3 expert cloud hacking instructors in this amazing course (in Spanish)!

[odd thunder]

Not available in English too?

[sterile oracle]

Azure course has been released?

[modest elbow]

It'll be available in english at HackSpaceCon in May, for the moment this is course we only deliver in person

[modest elbow]

not in the training platform, still working on the labs but we will give news soon!

[stiff wharf]

Any plans for this in English, but in Europe?

[modest elbow]

We give also to companies interested that reach us, but we don't haven't look for any other conference in EU yet

[wispy cradle]

Hi, I'm thinking about buying a voucher for the courses, but before doing so, want to check one thing. Is there any expiration for the certifications, or are they valid indefinetly?

[near prairie]

No, there is no expiration for the certification!

[wispy cradle]

Thank you!

[iron agate]

I passed Google's Cloud Security Professional Engineer Exam last night and I attribute most of my success to actually taking the GRTE Hacktricks Course: https://hackidle.com/Course+%26+Certification+Reviews/Google+Cloud+Certified+Professional+Cloud+Security+Engineer

I really just had to fill in a few personal gaps in key management

[glacial kelp]

That is really interesting I'll read the blog post more in depth curious to see how the two certs compare as the have slightly different angles

[modest elbow]

@everyone we are super excited to share with you that AzRTE (Azure Red Team Expert) is now in pre-release with the early bird discount applied! Don't lose the opportunity to get it at the best price.
Get ready to improve your Azure & EntraID hacking skills!
More info in https://training.hacktricks.xyz/courses/azrte

[unique spruce]

Signing up now! [or well, one of my guys are] ... great to see this coming out, we have been waiting with bated breath 😄
Will it be possible to gain access to the course material prior to the 29 March ?

[near prairie]

Unfortunately no, March 29th will be the first day to access the material.

[unique spruce]

thanks for the update, we will look forward to starting, payment has been processed now 🙂

[near prairie]

Awesome!!

[candid pike]

Pls I have html script am looking for the php who can help out

[chrome fox]

I honestly read AzERTY (which is like the qwerty of french keyboard layouts) when I said the message out loud

[cursive zealot]

when is the kubernetes course coming out? @modest elbow

[modest elbow]

Atm it's available on-premise for conferences and companies. For Hacktricks Training platform we will work on it after the Azure one is finished

[cursive zealot]

got it

[cursive zealot]

why the domain is not indexed?

is it just me?

[cursive zealot]

Another question, is microsoft grapth api mention in any of this chapters from the new azrte?

[pastel totem]

I assuming that tokens & API could covered it

[near prairie]

Google de-indexed it some time ago now we use https://book.hacktricks.wiki/en/index.html, and https://cloud.hacktricks.wiki/en/index.html

[near prairie]

Yes it will be covered in the tokens & Api lesson

[modest elbow]

In AzRTE we will talk a lot about EntraID and its APIs

[glacial kelp]

And you will be using it in the labs too

[vapid lagoon]

Would ARTE help with Security Engineering?

[glacial kelp]

If what you do relates to aws I would say yes. Although it is more tailored towards attacking aws more than defending

[rotund drift]

Does the GRTE course have any training on "Apigee X" ?

[near prairie]

Please use the #arte-general channel for these questions, or the ticket system

[pine compass]

I struggled a while with the signup form to create an account for the new azrte training.
It says 8 to 32 chars. But it's actually **24chars **max, it won't accept passwords of 25chars or longer

My advice would be either allow up to 32 chars or change the error msg. It's a bit outdated though, why not accept 40 chars passwords e.g.?

[glacial kelp]

I'll take a look at why it is limiting at 32, y can increase it to 64 but will keep a limit as not having a limit can end in long delays calculating hashes which can impact performance

[pine compass]

Yeah, so it's limiting at 24 now, but I think that's what you meant.

[glacial kelp]

Yes sorry, I'll check in a bit

[glacial kelp]

You should be able to use up to 64 char passwords now

[prisma raven]

Let´s get ready to rumbleeeee 😎

[modest elbow]

Yeaaahhh

[mental compass]

Hi guys, not sure if it's the proper channel...
I'm a little blocked in the EC2 lab from ARTA...
I did the SSRF, i got two roles, the one listing the secrets is not allowed to read them...
So, after trying this and that, and re-readig the materials a couple of times I'm lost...
I also tried to privesc based in the roles I found but I couldn't move forward from that...

lab 1

@modest elbow

[jovial hamlet]

you can add yourname bong into the hacktricks profile which will give you a hidden channel for ARTE-general or ARTA-general . I am not sure for ARTA as i enrolled for ARTE

[modest elbow]

Please, do as @jovial hamlet said to be able to ask in the right channel and to open private support tickets

[mental compass]

thanks!

[mental compass]

Hi folks, general question:
It's not yet clear for me whether Cloud attacks are post-exploitation/pivot or we can target the cloud gathering the organization ID or even with no credentials ??

[near prairie]

You can gather info without credentials (unauth enumeration) and in some services exploit misconfigurations that might have. About post-exploitation is usually when you have some kind of access already and you can change certain things/configurations inside the organization.

[mental compass]

thanks Jim, i see... then it's clear to me now that it's possible to perform unauth tests against the cloud... but the "how-to" is not yet fully 100% clear... should I gather target information, as a "must-have" element, or I as the pentester might have my own cloud user/org to perform the test?
coz in my mind there're 2 possible scenarios: my-creds (kind of "cross env" testing), or no-creds.
So, both scenarios test for publicly available resources, but i wonder if behind the scenes, the cli/cloud requires some such of creds being loaded, or the tests on the publicly available services won't fail when there's someone testing without creds... ??

the "technical" part is not yet fully clear...

[near prairie]

So you are wondering how to perform a blackbox approach, right?

[mental compass]

Well... correct me if I'm wrong: black-box test means no previous intel/knowledge of the target (surface included).
I would like to know just a smaller detail: how the unauth test is performed, should i use my creds (kind of "cross env" testing), or no creds are needed?

[near prairie]

Now i get the question, ill answer in the arte channel or in DM whatever you prefer

[mental compass]

ARTE might be better in case someone like to add something 😋

[lone summit]

Bought it today as well! Will be activiating after March 29, and can't wait to dive into it!

[prisma raven]

Niiiceee

[pastel totem]

Lets go for first blood 😎

[prisma raven]

hahahahahahaha

we are all ready

Glory for everyone, we fight the same battle

🫡

[mental compass]

Hi all! Happy Friday! Hope you enjoy your weekend!

[cursive zealot]

@glacial kelp @near prairie can i buy the voucher and activate in 3 month?

[pastel totem]

Yep

You got 12 months to activate it

[near prairie]

Yes, you have one year to use it, starting on the 29th of February

[cursive zealot]

Got it

[glacial kelp]

Of march *

[near prairie]

Yes March😅

[iron agate]

oh lol my bad lol - it's here: https://hackidle.com/Course+%26+Certification+Reviews/Google+Cloud+Certified+Professional+Cloud+Security+Engineer+Review

[prisma raven]

https://permiso.io/blog/introducing-detention-dodger

This is interesting

Didn’t know about it

Have you ever found it applied in real assessments? @modest elbow @glacial kelp

Im curious now

[glacial kelp]

Never seen this

[wispy cradle]

Hi there! Is there a timeline on when the AzRTA course will be available?

[near prairie]

Probably a couple months or so after AzRTE

[wispy cradle]

Oh its much longer than I thought🤣 Looking forward to it!

[prisma raven]

Go for AzRTE! Let´s tryhard

[wispy cradle]

I'll definitely go for it! Just want to take steady steps lol

[modest elbow]

Hi @everyone ! To celebrate the Azure Red Team Expert certification is released in a week we are going to launch the first Cloud PEASS!
Welcome Azure PEASS (https://github.com/carlospolop/cloudpeass), a script that can get a management and/or a graph token and find ALL your permissions inside Azure resources and Entra ID. Moreover, it'll use Cloud Hacktricks (https://cloud.hacktricks.wiki/en/index.html) and HackTricksAI (https://www.hacktricks.ai/) to color the sensitive permissions you have and even tell you how to (ab)use them!

This is just the first of the 3 initial Cloud PEASS to be released with HackTricksAI support for red teams!

[halcyon linden]

Hello, who is/are the authors of the AZRTE course please?

[modest elbow]

Hi! The HackTricks Training team, Ignacio, Jaime and Carlos

[halcyon linden]

Thank you

After AZRTE purchase, can I enable it whenever it fits my schedule?

[modest elbow]

Yes, you have 1 year to enable it whenever you want

[halcyon linden]

Thanks a lot

[modest elbow]

Thank you!

[halcyon linden]

Does the course cover hybrid scenarios?

[modest elbow]

It will cover AD <--> EntraID scenarios, but this the only lesson that won't be released tomorrow as we are still developing the labs

[halcyon linden]

ok, I understand

[modest elbow]

@everyone the new AzRTE (Azure Red Team Expert) certification is up and running!
If you have a voucher you can redeem it from today!
If you don't, get one while the early bird discount lasts (only a couple weeks more left!)

[unique spruce]

And so it shall be!

[lunar crown]

Hey carlos make a complete web hacking frow intermediate to enterprise level in video form

If you can't then help me about your wiki pages

I am confused

Does those content about web is enough for bug bounty and entry level jobs?

[pastel totem]

for entry jobs despite of "know" vulnerabilities you have to have some basic of app developing, networking, scripting and so one. Most of companies form my experience looking for people which could learn fast, have analytic mindset got basic knowledge which will be valuable during problem resolution. No one looking for guy who could from memory describe all owasp top 10 vulnerabilities

[lunar crown]

This is just describing me

[pastel totem]

so if you got a match not be worried to try 😄 job interviews are not hard like most people thinking

[lunar crown]

Main thing is my english language is weak and and am still learning computer language 🥲, communication skill is literally 0

[silk bolt]

Is there anyone looking for developer?
Now I am actively looking for a new job opportunity or task, and here, I'd like to connect with you. Thank you.

[bronze remnant]

Hello, I don't know it this is the right channel but I'm stucked on SSRF lab, on ARTA.

[near prairie]

Hi, no, go to #arte-general or open a ticket with #training-support

[bronze remnant]

Appear as No Access.

[near prairie]

Add your discrod handle to your account in hactricks training

[near prairie]

Then it should appear automatically

[prisma raven]

hellooo, I have been researching recently about device flow authentication, and discovered in a yt video that is supported by Az Cli, what didn´t expect as Az Cli can´t be configured with access tokens, I might take a look on how it´s managing the connection, cause maybe something can be done in order to make it work with Access/refresh tokens

At the end of the day that´s what you get when device login, a FOCI refresh/access token

[modest elbow]

Hi @everyone !

AzRTE (Azure Red Team Expert) early bird discount will be gone on April 25th. Learn Azure and Entra ID hacking with tens of hands-on labs to practice at the best price while it lasts at https://training.hacktricks.xyz/courses/azrte

Moreover, if you prefer to learn on a live training check out the 2 days 2 clouds course we offer at HackSpaceCon in https://www.hackspacecon.com/HackSpaceCon#/awsazurehacking and learn AWS and Azure hacking in 2 days!

[pine compass]

Pfeww i'm getting the payment on the 24th. Right on time!

[prisma raven]

https://www.linkedin.com/posts/hector-ruiz-ruiz-05a6aa236_cloud-security-cybersecurity-activity-7317532080718995456-4HZm?utm_source=share&utm_medium=member_desktop&rcm=ACoAADrV1cYBDWqdY2taKcRxU2cnHp4XG-rMfRc

Thanks everyone for the support, don´t know why but the tool is getting too much love ❤️

[leaden patio]

Hello. In ARTA KMS Lab any ideas?

An error occurred (InvalidCiphertextException) when calling the Decrypt operation:

aws kms decrypt --ciphertext-blob ms_lab_1_user2_credentials_encrypted.txt --key-id 32778d35-462d-4bf6-b62d-f2c6eb043bbe --profile audit01 --region us-east-1 --output text --query Plaintext | base64 --decode

i removed whitespaces in the base64 encrypted key file already

i used file://enc.txt and fileb://enc.txt

nothing working

file should work as its textmode

[modest elbow]

Hi @leaden patio, please, in the training web go to your settings and set your discord hadle. Then, you will be invited to other training private channels were you will be able to get support and also open tickets!

[leaden patio]

hmm i have done this but never got an invite

😦

[modest elbow]

It's automatic, note that you id is "p3rpl3x_x25"

[leaden patio]

ok solved both problems

[trail veldt]

is the hacktricks training dashboard not loading for anyone else?

i’m not able to access my courses

[near prairie]

Its working for me

[golden hatch]

Working for me too.

[near prairie]

Try removing te cache

[trail veldt]

tried that, tried switching browsers, tried on my phone

just getting a blank screen

maybe something’s wrong with my account

[near prairie]

You should not have any issues, in any case @glacial kelp can you take a look to this?

[glacial kelp]

I'll DM you to troubleshoot the issue

[stiff wharf]

Has this been shared yet and did anyone get around the test it out? https://github.com/FalconForceTeam/dAWShund

[tame mantle]

https://www.hacktricks.ai/
Could you please open it?

[near prairie]

Its working for me

[icy tide]

few days back there some discounted offer for gcp course right? is it still valid?

@modest elbow

[modest elbow]

Last one I think that was in Black Friday. But we always have discounts for students and bulk purchases, what do you need?

[icy tide]

let me ask my boss il get back!

[turbid rune]

Hey, I bought ARTE last June. But I didn't activate the voucher. I'm going through a busy period. Is there a deadline to enable it? Or can I enable it whenever I want?

[glacial kelp]

It is one year after purchase to activate the voucher but if you can't start it yet message us at our support email and we'll help you out

[plucky tundra]

Hey everyone,
I have a couple of questions about the ARTE certification.
In the FAQ section, it says:
"The voucher will grant you 60 days to complete the laboratories. However, you will be able to purchase laboratory extensions if you need them."

• How much does it cost to extend the lab time, say for an additional 30 days?
• Is an extension typically necessary, or are the 60 days usually enough to properly prepare for the exam?
  Also, after passing the exam, is the certificate provided only as a PDF, or do you also receive a digital badge for LinkedIn or other social media platforms?
  Thanks in advance!

[pastel totem]

60 days in my opinion is more then enough i finish all in 30 days

[near prairie]

Hi!
Most of the students dont need the extra days to finish the course, but in case that you need it to extend it, the 30 days extension is 259€.

Regarding the digital badge, no, for the moment we just issue the PDF.
Let us know if you have more questions!

[tidal spoke]

I just started the ARTA training. I deployed my first lab and was able to configure the CLI. When I deploy my lab again, will it generate new keys that I need to update my CLI profile with?

[near prairie]

Hi! Yes it will give you new credentiasl to use for the lab, and update your config credentials file!

[tidal spoke]

Great, thanks!

[near prairie]

For this questions you can use the #arte-general channel, do you see it?

[tidal spoke]

Yes, I wasn't sure since I am doing the ARTA 🙂

[modest elbow]

@everyone
🚨 New HackTricks Training Lab Discounts Now Available!

We’re excited to announce new discounts on HackTricks Training Lab extensions!

When you purchase a new certification, you can now purchase at the same moment a lab extension with great discounts.

🎁 Bonus: This week only, these discounts are automatically applied to users who have already purchased a certification. No action needed!

[echo plaza]

Nice

If we buy them do they immediately activate or can we activate them later?

[modest elbow]

You can activate them whenever you want

[echo plaza]

Awesome, thanks 🙏

[carmine flicker]

Hi guys.I’m thinking of signing up for the arte course — just wondering, is it possible to get an invoice for the payment? I’ll need it for company reimbursement.
Would really appreciate any info!

[pastel totem]

sure it possible

during purchesing you need to click on checkmark

[modest elbow]

When buying the cert from the web page with card you can add your company details and the invoice will be automatically generated with those details.
If you prefer to pay via bank transfer send us a message with your company details to [e-mail] and we will generate you an invoice

[carmine flicker]

I see
thank you all!!

[inner galleon]

Hi, I want to ask if I purchase the 30 days extension to my aws expert course, do I have to use it just after my 60 days (which come with purchase of course) expires or I can use the 30 days extension voucher later at any time even when my 60 days of lab expires. Thanks 😊

[glacial kelp]

You can activate the voucher at any time in the next year from the day of purchase

[plucky tundra]

@modest elbow Hi Carlos! How does it work with ARTE again? Does the lab time automatically start when I buy the course and enroll into the course? Or can I take my time watching the videos and reading the PDF, and then start the lab access after a month or so? Can the lab time be paused?

[near prairie]

Hi, the lab time and course starts once the voucher you receive, after you buy it, is redeemed (you have 2 years to activate it). Both the course and the lab time start at the same time so you dont have extra time to watch the videos. Unfortunately, the lab time can not be paused.

[plucky tundra]

ok, good to know, thank you very much!

[near prairie]

Let us know if you have more questions!

[modest elbow]

Hi @everyone !
We have just launched the new AzRTA (Azure Red Team Apprentice) certification in https://training.hacktricks.xyz/courses/azrta
Take a look and let us know if you have any questions!

[misty zodiac]

Hello

[ebon tendon]

thank you

[prisma raven]

https://www.tenable.com/blog/gerriscary-hacking-the-supply-chain-of-popular-google-products-chromiumos-chromium-bazel-dart

[potent iron]

Hi all, it seems GRTA is a subset of GRTE. So taking GRTA with intention to the take GRTE is not recommended, right? (Because also there seems to be no discount if you have the apprentice course)
If you have some cybersecurity background but no red team what do you suggest to take?

Thanks to everyone that read until here!

[near prairie]

Hi! Yes GRTA is subset of GRTE. We recommend to directly take the GRTE course as it has more content and its more complete. Dont worry about having no red team background GRTE starts from the basics and you wont have any issues (There is also the support channel that can help you). And in case you end up getting GRTA, you get a 20% discount after finishing it for the GRTE course.

Let us know if you have any other questions!!

[potent iron]

Thanks for the fast reply, so money wise is not advisable to start with the apprentice if you're wanting to go for the Expert as well, based also on the overlap.
Is it still 60 days of access since the redeem of the voucher?
What do you need for the student discount? Email account from a student email? Thanks again!!

[near prairie]

Yes, once you redeem the voucher you have 60 days of lab access in GRTE. (GRTA is 30 days). For the student discount write to [e-mail] with your uni email.

[potent iron]

Thanks again, much appreciated

[sturdy finch]

Hi guys 👋, I see you have next meetup in Valencia, Spain

Rooted Valencia, 25–26 de septiembre 2025

Is it possible to register for the event now?

In general, do you have some other resources where people do similar meetings in Spain, especially in Valencia

Thanks🙌

[modest elbow]

@everyone check the HackTricks Training discounts for the Summer!
https://www.linkedin.com/feed/update/urn:li:activity:7346175851421433856/?actorCompanyId=72119507

[golden hatch]

Code is not applicable to bundles?

[near prairie]

No, just to lab extensions, and individial courses

[fallen kraken]

Hi, has the raffle for the coupons been held?

[near prairie]

Hi! Yes, we've published a comment in the post with the winners

[manic spindle]

Does the ARTE course prepare you for a real world Red Team Simulation? Are stealthy methods and attack paths outlined?

[modest elbow]

Yes, Red Teaming and Whitebox review are the main goals of this certification. After learning the basics every lesson contains a section about attack paths per service, and also post exploitation and persistence techniques per service.
Then, in the blackbox lesson you learn more red team like tricks + you have 3 labs simulating red team exercises.
Finally the exam is actually a red team simulation

[digital maple]

yep, it does feel very Red Team althgouth doing azrte 🙂 its good one sometimes too good ha

[lethal zenith]

if I buy in bundle, can I buy the course first and lab later 🥲

[near prairie]

Unfortunatelly no, once you start a course the lab time starts too

[lethal zenith]

That means I can't buy course separately 😦

[near prairie]

No, you need to buy the full certification, with all the content and lab days included. If you run out of lab time, you can buy extensions for it

[lethal zenith]

I mean like, in bundle, I only see course price, not lab price, so, I was asking about that

[near prairie]

The lab time is included in the course

You buy for example an ARTE and a AzRTE you get the course and 60 days of labs for each one of the certs

And if the lab time that is included is not enough you can buy extra time

[near prairie]

Let us know if you have other questions or if it is not clear!

[lethal zenith]

okay

[hasty sapphire]

When the course bundles are purchased you will receive vouchers. These vouchers are then redeemed (when you decide) which starts your lab/course time.

The vouchers last for a year, I think? Essentially it lets you set your pace of owning all courses but taking them at your leisure

[modest elbow]

yeah, and they last 2 years by default (or if anyone expires you can ask us and we will give you a valid one)

[lethal zenith]

Thank you, that's a relief to hear

[modest elbow]

Hi @everyone
Last 7 days for the SUMMER discount of HackTricks Training!

[fallen kraken]

Una vez adquirido el voucher puedo iniciar el curso la fecha que yo quiera?

[near prairie]

Si, tienes dos años para usarlo, aunque se puede ampliar sin problema alguno

[foggy lodge]

Hi @near prairie how many flags are required to pass the GRTE exam totally.. I heard there are 3 flags to find. ...? What are the ways to get Certified

[near prairie]

Hi! Yes it is a 12 hour exam and you need the 3 flags to pass. It is the only way to get certified.

However, if you do a PR to the Cloud Hacktricks book with new Privilege Escalation methods of the cloud you can pass the exam with 2 flags, but it needs to be a new one!

[modest elbow]

@everyone last day of the summer discount! If you want to get some discounted certs or lab extensions use the SUMMER code today!

[rich seal]

If you could only get one, (and have none yet), which one would you get - and take advantage of the sale?

[near prairie]

I would say ARTE as it is the most widely used cloud platform, if not AzRTE is a good option too.

Unless you want to specialice in google cloud, ARTE or AzRTE are the best options.

(My personal favorite is ARTE)

[rich seal]

Nice! I'm not surprised. I'm a little behind in cloud stuff, but have my eye on these certs!

[near prairie]

Also AWS is the simpler one to start and use I would say, the concepts are easy to get and is not as intricate as Azure for example.

[rich seal]

Thanks for that perspective. I’m definitely kind of a noob when it comes to cloud stuff, but I’ve been around the block with traditional IT stuff.

I’ve been putting it off for a while now, but I have come to the realization that I can’t avoid it forever

[near prairie]

Let is know if you have more questions!!

[rich seal]

I really appreciate it.

[prisma raven]

https://x.com/_Slayer0x/status/1951395034458460593

Slayer0x (@_Slayer0x)

🔍 I've built an improved set of queries for BloodHound Community Edition focused on on-prem -> Entra/Azure.

Quickly match compromised onprem users with Azure/Entra identities for privilege escalation or lateral movement.

Owned objects are always our top priority when querying.

X · Aug 1, 2025, 9:30 PM

Modified queries for bloodhound CE in order to easy query for Owned objects on Onprem-AD -> Entra/Azure, as the default ones doesn't filter owned objects, which are the most interesting ones most of the times.

[hardy gorge]

Hi admin, with mandatory enforcement on MFA on Azure logins, does that affects the existing labs in Azure apprantice/expert courses ?

[hardy gorge]

https://www.bleepingcomputer.com/news/microsoft/microsoft-to-enforce-mfa-for-azure-resource-management-in-october/

[modest elbow]

Yes, it will affect a small number of labs, we will add MFA into those labs when the time comes so they continue working

[idle zenith]

is the training site down ?
Trying it for few minutes now.

[modest elbow]

for me is working fine, is it already working for you?

[idle zenith]

yep its working now thanks 🙂

[glacial kelp]

We don't use azure for the website so not sure what your browser was doing 😂

[smoky blaze]

I noticed the AzRTE course curriculum doesn’t really cover concepts like lateral movement, persistence, or evasion that are usually tied to red teaming. Just curious, is there a reason for that given the cert is called Azure Red Team Expert?

[hasty sapphire]

Not an admin, but every course covers these concepts

[modest elbow]

The syllabus indicates from a very high level the services that are going to be used in the course.
Inside those services you will learn how they work and then how to (ab)use them (privesc, post exploitation & lateral movement and persistence).
Then we have specific blackbox sections to talk about other common red team attacks (among them AD <--> EntraID pivoting and in the final section we talk about azure defense services and how to try to bypass them
So I think the certification covers all those things

[smoky blaze]

Gotcha. Thanks for the clarification.

[modest elbow]

Np! If you need more info feel free to ask here or check also https://www.youtube.com/watch?v=CBQl7Kvlu-U

[sudden trail]

Hey . is there any admin for question ?

regarding the course ARTE

[near prairie]

Sure

[manic solar]

Is the training site down by any chance?

[near prairie]

Are you still having issues? It works fine for me

[manic solar]

I can’t access it yet, is there any geolocation restriction? I can visit the normal site for attacks info, but I don’t reach the training subdomain

[near prairie]

@glacial kelp Can you take alook?

[manic solar]

Last time I visited the training site was 3 weeks ago, and it was working fine for me

[glacial kelp]

We don't have any geolocation restrictions

Is there any kind of content filtering on your side like from a work related proxy or something?

[modest elbow]

Remember they are in different domains now.
Training in: training.hacktricks.xyz
Book in: book.hacktricks.wiki

[manic solar]

Correct, I can’t access the first one 😢

[modest elbow]

We dont have any restrictions as mentioned previously

Maybe is your ISP restricting the address

[hasty sapphire]

Maybe try adding the IP of the site to your /etc/hosts manually and see if you can visit it

[manic solar]

For some reason, all of a sudden it’s working now

Thank you all

[ebon tendon]

can we pin this?

[manic solar]

Vouchers expire after a year from the date of purchase, correct?

[near prairie]

Hi! No they expire after 2 years!

[hasty sapphire]

@near prairie @modest elbow ^ also posted in several other channels

[near prairie]

Thanks!!

[grand vale]

Who could i speak with regarding purchasing a bundle for a team of 6-8 for GCP/AWS trainings?

[modest elbow]

We received your email, we will answer it asap!

[trim sparrow]

Are you guys moving to a new domain for the training website? Stumbled upon this on google, and thought the domain looked different than normal.
https://hacktricks-training.com/

Registered 3 days ago. Just wanna make sure noone is trying to create a phishing site

[near prairie]

Hi! Yes we are planning to! But it is not ready still

We will make an announcement when its ready!

[trim sparrow]

Alright perfect, it's looking good!

[lethal zenith]

Can I buy now and learn later?

I saw huge discount and I kinda wanna ... buy it

[near prairie]

Yes, you receive a voucher for each course, and you have 2 years to use them

[lethal zenith]

alright thank you, Imma think hard about it

[near prairie]

Any questions let me know!

[modest elbow]

@everyone Black Friday Month is here! — and so are our biggest HackTricks Training discounts of the year:
• 20% OFF all Courses
• 15% OFF Lab Extensions and Exam Retake Vouchers
• Additional 10% OFF all Bundles
→ That means 25% for 2 courses and 35% for 3 courses.

One discount code per transaction. Offers valid from Nov 1 to Nov 30 .

Discounts already applied at https://training.hacktricks.xyz/

[vapid sonnet]

Wonderful thanks!

[stable yarrow]

Hey @near prairie is the whitebox for the apprentice course the same as the whitebox for the expert course?

[near prairie]

One lab, yes is the same. But in the expert there is another extra lab

[hasty sapphire]

Thank you Hacktricks Team for such an awesome experience, really appreciate all of the help and support for the community and staff. The effort put into the labs is fantastic. A lot of valuable course content and practical examples of how to abuse mis-configurations.

Thank you @near prairie especially for always assisting with my bombardment of tickets.

[modest elbow]

Congrats on all the work mate! Cloud Expert Certified is not an easy one!

[near prairie]

Nice Job!!! And always a pleasure!🫡

[dim verge]

I'd like to ask if the exam requires a passport and webcam like OSCP?

[near prairie]

Hi! No it does not!

[dim verge]

Thanks🫡

[near prairie]

Anytime!

[candid pike]

Greetings house , please who know how to do redirecting of domain for long lasting

[barren viper]

Hello, if I completed the ARTA course and want to take the ARTE course, will the labs I completed at ARTA count or do I start from scratch?

[arctic saddle]

@barren viper Hi, if you already completed ARTA you will have no problem starting from the beginning. In fact, that would be my advise so you can see if there is any additional information on the topics that u saw in ARTA course. If you ask for the flag progress im not sure maybe just someone else who has your prev situation or a moderator could answer if the ARTA flag progress counts for ARTE

[modest elbow]

You will need to redo the labs you did in ARTA in ARTE

[barren viper]

Okay, thank you.

[cosmic aspen]

Hi! My voucher for ARTE course is expiring 14.11, but I had a plan to activate it on 17th of November. How can I do it?

[near prairie]

Hi! No worries DM me or open a ticket!

[cosmic aspen]

Done

[rough idol]

i have done all of my walkthrough , and got stuck and i want to learn the exact way.. and not to waste time.. can i somehow get more walkthroughs?

[near prairie]

I've just seen your ticket ill answer there, but sure we will give you some more!

[chrome wadi]

Stupid question, I've booted my lab up in the ARTA course and have no idea how to access it

[near prairie]

Hi! Please use our #arte-general channel for question related to the certifications

Add the discord handle to the profile area in hacktricks training

[near prairie]

Now what did you do until now?

[chrome wadi]

I've added my handle

[near prairie]

Awesome now you should be able to see the course channel!

[near prairie]

Do you manage to access?

[chrome wadi]

Yeah, got it thanks

[high cloud]

Hi! I am currently preparing for my ARTE exam and thought about getting the other two expert courses too. When reading through the FAQ, I noticed, that the access to the course content after validating the voucher has been limited to just one year? When did this happen? 🙁

[near prairie]

Due to potential compliance issues and some cases of account misuse, we’ve had to make that change in the FAQs. However, no access is being limited at this time, and we currently have no intention of restricting it.

[prisma raven]

https://www.theregister.com/2025/11/04/aws_genz_misery_nope/

What do you think guys? 🤣

A lot of hate on AWS lately

https://dev.to/code42cate/stop-using-aws-4eg

[jade ravine]

well I can definitely agree that you don't need to make MVP complex, but you can still use public cloud like AWS or GCP as simple VPS (also you can get the small boxes for free instead paying the 5€ for VPS somewhere else) - IMO if you have more micro services than paid users you are doing it wrong!

[modest elbow]

Tbh I remember that when I started with AWS I found it pretty complicated to understand. Then I realized that thanks to this AWS is not as vulnerable by default as other clouds (although I agree that several AWS services could be simplified a lot without loosing any features or maing them more vulnerable)

[languid wasp]

AWS is easy to take down if you know where the first data center is….and some tricks from an old hat from the hatter

Hopefully they learned their lesson….but I doubt it

DNS and cloudflare have been taking some hits lately, they think A.I will do all the work for them when really they should be looking for people who actually know what the hell they are doing

https://tenor.com/view/fox-cartoon-cute-jumping-cloud-gif-4788400

[halcyon linden]

Hello, I would like to start the AWS Red team expert course, I have.some understanding of cloud computing, I.was wondering if I should take an AWS course before starting this course?

[hasty sapphire]

In my opinion and from another person I know who took it, you can start from zero knowledge on these.

Obviously having some prior experience helps but is not required is my perspective

[halcyon linden]

Thanks a lot

[high fossil]

yeah, personally I don't love the aws certs (back when I took them in like ~2018). Not very hands on or technical up to the solutions architect/security specialty level. Felt more like sales training than education haha. I'm maybe 75-80% done with the course, and i think you'd get more value from ARTE + experimenting on your own if your goal is any security discipline.

[modest elbow]

@everyone this is the last week of the Black Friday discounts! Check them in training.hacktricks.xyz

[hardy gorge]

@modest elbow Hi there, after I purchase the voucher, when will it be expired, if I do not claim it ?

I am planning to buy bundle but i cannot do all at 1 go. I can only do in sequential when time permits.

[near prairie]

The vouchers have a 2 years expiration date, in any case if the time runs out we can provide another one so you can finish the courses!

So dont worry about it!

[hardy gorge]

Oh that is awesome!

Appreciate it ! 2 years should be enough.

[tiny perch]

Hi @near prairie 24 I can't extend my lab time for some reason.

[near prairie]

Open a ticket or use the private channels for these issues!!!

[near prairie]

Write me the error you get

[tiny perch]

Done

[prime shale]

Hey, does anyone know the code to avail black friday discount?

Thanks in advance

[olive canopy]

The discount ended yesterday

[prime shale]

Wow! I thought it’s until the end of Nov 30.

[prime shale]

I’m in the US. Tough luck ig

Anyway, thank you !

[near prairie]

Hi! Write to us to our email [e-mail], or DM me!

[odd fractal]

@near prairie Sir sorry for ping, but just a question. Let's imagine the situation.
I have GCP cloud and have service account credentials, i've listed organizations and projects and in one project i've been found service account over which i have roles/iam.serviceAccountTokenCreator . Then the service account i can impersonate has permissions on the function

• cloudfunctions.functions.call
• cloudfunctions.functions.get
• cloudfunctions.functions.list

I described the function and find where GCP stored the zip archive with function's source code, but i can't list bucket policies using
gcloud storage buckets get-iam-policy gs://bucket_name

is it correct that i have to try list or download the zip archieve with the function's source code (from both account) to understand what the function does and the invoke it if it will be usefull

[near prairie]

Absolutely, if you can’t view the bucket’s IAM policy, then yes, your best move is simply to try downloading the function’s source archive, take into account you will need storage.objects.get permission to do that.

[near prairie]

Other option would be trying to bruteforce the bucket name, in case the bucket is publicly open, however this usually is unlikely.

[odd fractal]

and is it the good way to find who has it, cause in gcp as i know u have to list everything step by step (and it takes a bit longer than in AWS)
cause i verified it using
gcloud storage objects describe gs://bucketame/function.zip
and if i see the output so i have storage.objects.get permission

[near prairie]

You can also try using the list command (storage.objects.list) gsutil ls in a bucket. But yes try that too!

[near prairie]

@everyone All the videos in the Hacktricks Training courses, now include subtitles in multiple languages. These captions include the languages showed in the screenshot and many more!

Enjoy the content!!

[ebon tendon]

https://tenor.com/view/bow-like-honor-respect-gif-14588358108868813407

[weak gazelle]

In blackbox lab 1, I reached the point where ||I have the user blackbox-lab-1-user-2, added that user to the group, but bruteforcing the permissions gives the exact same permissions I had before adding to the group. (I bruteforced with both bf-aws-permissions and the simulate scripts). Did I miss the first flag at some point?||

[near prairie]

You should be able to read the flag now

[weak gazelle]

thanks, my bruteforce scope was a little narrow I guess

[wicked cradle]

Hi, I need to open a support ticket. I’m having a problem with ARTE Labs. Where can I do that?

[misty saddle]

You can open a ticket in #training-support channel

[echo plaza]

Is https://training.hacktricks.xyz/ ssl broken?

[modest elbow]

it works properly in all my browsers

[echo plaza]

Ok thank you just needed a sanity check haha

[stiff wharf]

What's the current status of the Kubernetes training.hacktricks.xyz? Did I have a fever-dream or miss something about that, I believe to have read, there would soon be a Kubernetes training available.

[stiff wharf]

ah that was the message I remember 😅 So I guess it'll be ready, when it's ready, right? 🙂

[main oak]

Some ISPs have blocked the site, use a VPN and see if you have any issues

[modest elbow]

it'll be ready when it's ready is a good way to define it hahaha hopefully it'll be ready by summer

[fallow galleon]

Is there any role for CRTE?

[near prairie]

You have it already

[fallow galleon]

Nickname color is role? red is CRTE?

[near prairie]

Yes, if you click on your own name you can see the crte-certified label

[fallow galleon]

Okay!! I checked !! Thank you!!

[placid mason]

hey guys

[celest saffron]

Hi

Hallo

[placid mason]

does anyone help me to build a logger software
literally i m facing so many issues

[modest elbow]

@everyone
Do you want to improve your Cloud, CI/CD & Kubernetes security knowledge?
We are delivering some trainings soon!

🇬🇧 Check the 2 days online training about Cloud, K8s & CI/CD: https://lnkd.in/eib9K72y
🇪🇸 Check our on-site trainings in Spanish at RootedCON:

• 3 Days 3 Clouds: https://lnkd.in/eS6tKYAg
• CI/CD attack and defense in kubernetes environments (1 day): https://lnkd.in/eecutMMU

[pastel totem]

@modest elbow what about k8s ceet from hacktricks ? 😁

[modest elbow]

We are on it. In those training you will find a small preview hahaha

[hushed zenith]

Excited for it! The only training for k8 certs that I have seen was from kodecloud. Obviously the focus for those is administration.

[gaunt slate]

which cloud?

[halcyon linden]

I'm currently studying azure red team expert. The part on apps registration, service principals, managed identities had my head spinning, lol

[modest elbow]

the top 3, check the links for further info

[hardy gorge]

@modest elbow <@&1128840997581889586> hi there, i am currently doing azure apprantice course and 30 days lab access is expiring on 8 feb. I am half-way through labs. I will be busy from mid-feb till end of march. So, i want to continue Azure apprantice course in April.

In April, then i plan to buy 15 days lab extension & continue the course.

Will it be ok, if i only buy extension in April & continue my apprantice labs ?

[near prairie]

@wicked cradle Hi! Yes you won't have any issue at all!

[halcyon linden]

I have issue understanding tokens in the azure course, It says that refresh tokens are bound to an audience but later when I read the microsft documentation I have " Refresh tokens are bound to a combination of user and client, but aren't tied to a resource or tenant." so I'm genuily confused (I'm not experienced in Azure, it feels really hard)

[modest elbow]

you will understand it a bit more when the course talk about FOCI tokens.
But in general refresh tokens should be dound to the audience, but Microsoft is Microsoft so they do some unsecure stuff

[halcyon linden]

I'm genuily confused, (I reached the part on FOCI), in the intro module, I thought that we authenticated with az cli, entraID was providing a refresh token, which later could be used to get access token for other APIS (like storage, arm), I feel dumb, I don't really understand Azure

[echo plaza]

Ooooo

[modest elbow]

Tokens in Azure are very confusing no worries. My recommendation for you to understand them would be to play with them.

For example in https://cloud.hacktricks.wiki/en/pentesting-cloud/azure-security/az-basic-information/az-tokens-and-public-applications.html#foci-tokens-privilege-escalation you have a guided tutorial on how to login to get refresh token belonging to a FOCI application that allows to generate other tokens for other APP IDs.

Interestingly this tutorial used to use the App ID of the Azure CLI, but just some weeks ago Microsoft removed that App ID from the FOCI apps. So you can follow the tutorial and see how with a FOCI app you can generate tokens for other apps and the repeat it with the app id "04b07795-8ddb-461a-bbee-02f9e1bf7b46" and se hoe the last step doesn't work (It doesn't allow to generate tokens for other client IDs).

Moreover, the refresh tokens are also generated for other "aud"s, however, as you mentioned, the refresh tokens are not bounded to them. Which unfortunately doesn't mean that any refresh token can generate tokens for any "aud"s. Depending on the "app ID" the token will be able to generate tokens fro different "aud"s. And the same happens with scopes (permissions) also!
"Hidden" in the AzureAppsSweep, you can find https://github.com/carlospolop/AzureAppsSweep/tree/main/GraphAppScopes which is the brute-force I did some months ago to find all the possible combinations based on all the APP IDs I found.

[final bane]

Hi, I'm currently taking the AWS Red Team Expert exam, but I suddenly can't log in to https://training.hacktricks.xyz/signin. I'm getting a "Sign in failed with unknown error". Could you please help me with this?

[small pewter]

Yep I'm in the same boat, I was just about to submit a flag too ☠️

[near prairie]

You managed to end the exam right?!

Should be fine some time ago

[glacial kelp]

Doing some maintenance now sorry for the inconvenience

[mint latch]

Please let us know here when the maintenance is finished

[near prairie]

Should be finished now!

[mint latch]

Still can't login

[neon bane]

Using the new website it works https://hacktricks-training.com/

[glacial kelp]

Working on another fix now so the old website also works

Both sites are back and looking healthy

[rich gate]

Hey guys anyone having trouble with the lab deployment on section 2.8 Azure App Services?
I tried deploying the labs multiple times and I get an error "Error provisioning lesson labs".
Do i have email the hacktricks team?

[hasty sapphire]

Create a ticket. If you don’t see the the channel associated with the course check your profile settings

[rich gate]

Hey dude thanks, I am getting an error while trying to update the discord hundle ^^ it needs the name#number right?

[modest elbow]

No, only name, yours is "titfort4t"

[near prairie]

Hey DM me if you still have the issue!

[rich gate]

Thanks i have managed to add it and the group appeared thanks a lot

[rich gate]

I will try to re-deploy and DM you if i still have the issue

[pastel totem]

https://www.modernsecurity.io/courses/ai-security-certification - may someone done this course? any experience? is this worth it?