👥・help-me

[lost shuttle]

"i have to be right, im always right" type energy

but thx for the info

[lean lance]

Sounds like you are projecting

[lost shuttle]

Regarding the ctfs/challenges is that mostly relegated to user submissions in the ctf channel? anything beyond that? I still feel like i might be missing something, or is this community more focused around just the educational segment?

[quasi berry]

Regarding the ctfs and challenges both myself and @upbeat veldt deal with that ☺️

[lost shuttle]

So would you mind pointing me to the details for how i understand better about whats on offer?

Im only seeing user submissions in CTF, is there a companion site where this is all contained?

[quasi berry]

Not a site, and I've pinged Trap for this

[upbeat veldt]

Yes, there's a few.. there's a server for learning and there's a server for actual competitions. Which one are you looking for more information about?

[upbeat veldt]

Ty

[lost shuttle]

info for both would be nice

ty

[upbeat veldt]

No problem, I'll send some invites.

[lost shuttle]

right on, much appreciated.

[stray mural]

I want to set up Burpsuite professional in Kali

Any resources or way you can give me for setting Burpsuite professional??

[uncut wedge]

buy itt, download it, enterr license keyy and you’re donee

[chilly merlin]

what a magnificient answer

https://tenor.com/view/bravo-applause-round-of-standing-gif-20790999

[unreal reef]

what if u cant afford it

[uncut wedge]

lollll

[uncut wedge]

thenn downloadd communityy 💜

[chilly merlin]

https://tenor.com/view/dog-snoop-dogg-rabjouj-gif-21804700

[unreal reef]

what if i dont like burpsuite

[chilly merlin]

use curl

owasp zap

[unreal reef]

💀

[chilly merlin]

🫠

[unreal reef]

what if i dont like life

[uncut wedge]

usee zapp or yourr own proxyy

[unreal reef]

ding ding ding

🔥

[uncut wedge]

[unreal reef]

mimi knows the methods

[chilly merlin]

thats what i said

[uncut wedge]

reboot itt

[unreal reef]

can u teach me how

[unreal reef]

❌

[uncut wedge]

drinkk kofe

[chilly merlin]

whatever

[unreal reef]

and if i can't afford it

[uncut wedge]

he’s playingg withh you hehe

[unreal reef]

where did u say use ur own proxy

😔

[uncut wedge]

i’ll buy onee for youu

[unreal reef]

oh

alrrr

[uncut wedge]

💜

[unreal reef]

but what if i dont like coffee?

[uncut wedge]

anythingg you likee ill buyy

[unreal reef]

a kinderegg please!

[uncut wedge]

yayyy bestt

[unreal reef]

yess <:

best food

i might need to start bug bounty hunting again

i'm running low on cash

😭

[uncut wedge]

whattt @quasi berry

[quasi berry]

https://discord.com/channels/990435451334688768/1012079751445352518

[unreal reef]

:saut

🫡

[uncut wedge]

yesss

[unreal reef]

hackerone era coming back 😔

[next cave]

...Hello

... How is it going here??

[visual hemlock]

Can anyone help me with some python multithreading output? My program isnt consistent.

[icy crane]

Can i see it?

[visual hemlock]

Here it is 🙂

q = queue.Queue()
thread_lock = threading.Lock()

# Send dns requests
def dns_lookup(subdomain, domain):
    global counter
    
    try:
        full_domain = f"{subdomain}.{domain}"
        answers = dns.resolver.resolve(full_domain, 'A')
        with thread_lock:
            counter += 1
            print(f"{counter} - [FOUND] {full_domain} - {answers[0]}\n", end="")
    except dns.resolver.NXDOMAIN:
        pass
    except Exception as e:
        print(f"[ERROR] {subdomain}.{domain} - {e}\n", end="")

# Worker to hand dns requests
def worker(domain):
    while not q.empty(): 
        subdomain = q.get()
        dns_lookup(subdomain, domain)
        q.task_done()

# Open wordlist     
def load_dns_wordlist(wordlist):
    with open(wordlist, 'r') as f:
        return [line.strip() for line in f]


def main():
    parser = argparse.ArgumentParser(description='Simple DNS Buster')
    parser.add_argument('-d', '--domain', required=False, help='The domain to brute force')
    parser.add_argument('-w', '--wordlist', required=False, help='The wordlist to use for subdomains')
    parser.add_argument('-t', '--threads', default=10, type=int, help='Number of threads to use')
    args = parser.parse_args()

    killer = GracefulKiller()
    domain = args.domain
    thread_number = int(args.threads)

    # Load wordlist
    subdomains = load_dns_wordlist(args.wordlist)

    # Start dns bruteforce
    with ThreadPoolExecutor(max_workers=thread_number) as tpe, alive_bar(len(subdomains), title="Snooping", enrich_print=False) as bar:
            future_to_url = {tpe.submit(dns_lookup, subdomain, domain): subdomain for subdomain in subdomains}
            for future in as_completed(future_to_url):
                bar()
                
                if killer.kill_now:
                    tpe.shutdown(wait=False, cancel_futures=True)
                    break
            q.join()


if __name__ == "__main__":
    main()

[icy crane]

Ill take a look

[visual hemlock]

Thank you :)

[icy crane]

Theres no imports

Threading

Etc

dns.resolver

[visual hemlock]

Discord cut me off last time:

#!/usr/bin/env python3
from concurrent.futures import ThreadPoolExecutor, as_completed
from alive_progress import alive_bar
import dns.resolver
import argparse
import threading
import signal
import queue


# Killer
class GracefulKiller:
    kill_now = False

    def __init__(self):
        signal.signal(signal.SIGINT, self.exit_gracefully)
        signal.signal(signal.SIGTERM, self.exit_gracefully)

    def exit_gracefully(self, signum=None, frame=None):
        self.kill_now = True


# Initialize a thread-safe queue
q = queue.Queue()
counter = 0
thread_lock = threading.Lock()

# Send dns requests...

[icy crane]

Alr hmm

Lemme try make something and test it giv sec

[unreal reef]

js use amass

[visual hemlock]

whats that?

[unreal reef]

a tool

[chilly merlin]

Amass does something completely different

[unreal reef]

more useful

[chilly merlin]

they do different things

apples to oranges

[visual hemlock]

Amass has a dns option, but im trying to make this for practice

[unreal reef]

amass has what u need but

using ai to code stuff for u

isn't rlly gonna teach u

[chilly merlin]

amass is for exposure mapping not what he's doing

he's basically making a diy dirb/sublister

it's similar but amass is more for making a map of a network

[visual hemlock]

not really but it helps me find the things i need

[unreal reef]

what do u need

[unreal reef]

do some digging on amass enum

[chilly merlin]

Also that's true I would stay away from AI unless you're using it like StackOverflow

[chilly merlin]

I use amass all the time

[visual hemlock]

wdym?

[unreal reef]

🤔

[chilly merlin]

what tool u guys use to find vulns in websites

[unreal reef]

okay how could i use amass for subdomain enumeration

[unreal reef]

depends on what vulns u wanna find

[chilly merlin]

nickto?

[formal terrace]

You mean like bug bounty programs?

[unreal reef]

nikto

[chilly merlin]

everything

[chilly merlin]

yea

[unreal reef]

limit it down

[visual hemlock]

dns option from github:
Brute forcing, Reverse DNS sweeping, NSEC zone walking, Zone transfers, FQDN alterations/permutations, FQDN Similarity-based Guessing

[formal terrace]

I manually check for Vulns personally

[chilly merlin]

@unreal reef @formal terrace gimme tools u guys use

[unreal reef]

be more specific

and i'll help you out

[chilly merlin]

me tooo but eats time

to find web vulns pal

[unreal reef]

automated scans aren't fullproof.

[chilly merlin]

like sql injec

[formal terrace]

Maybe burpsuite if allowed

[chilly merlin]

I usually use sublist but you can do it via both active and passive scans using the -d and -o switches

yea

[unreal reef]

what specific web vulns

[chilly merlin]

sqli,ssrf,csrf,xss,dom

[formal terrace]

Most programs don’t even like automated scanning because of potential disruption

[chilly merlin]

based

[unreal reef]

okay so why shouldn't the guy js do that

[unreal reef]

not common to find these vulns

[formal terrace]

Or they might have a firewall that would block you

[chilly merlin]

u mean bug bounty pgms

?

[chilly merlin]

why would you buy a whole toolset if you just need a hammer

[formal terrace]

Yes

[unreal reef]

ykw

nvm.

[chilly merlin]

not to mention we should be encouraging people to make their own stuf

[chilly merlin]

gimme seperate or specific tools if u have

[unreal reef]

depends what im looking for.

[chilly merlin]

yea need to enroll in one and try myself out

[formal terrace]

We’re testing on sites if a tool already exists we don’t need to make our own

[unreal reef]

most of the cases i'd do a manual search

[formal terrace]

It’s not skidding

[unreal reef]

u can use shit like owasp zap or burpsuite for pentesting

decent

[chilly merlin]

Yeah I didn't mean it like that

[chilly merlin]

takes time right in case of ctfs

I meant if it's a small task like what this guy is doing making it yourself is a good choice 👍

[unreal reef]

i dont do ctfs

[unreal reef]

https://www.acunetix.com/support/docs/introduction/

[chilly merlin]

so bug bounties how much time will it take u usually

[formal terrace]

Manual is best so you understand what’s happening

[unreal reef]

depends on the website/app im testing

[formal terrace]

And potentially find a chain of vulns even

[chilly merlin]

done some labs in port swigger

[chilly merlin]

keep in mind most web scanners only find the most obvious stuff, a lot bug bounty programs specifically tell you not to use the automated scanners

[formal terrace]

Automatic scanners won’t help that

[unreal reef]

depends

[chilly merlin]

gimme a rough estimation or average

[formal terrace]

I’d say scan first with simple tools for low hanging vulns then look on your own

[unreal reef]

there isn't a average it varies from the security.

[chilly merlin]

pff

okay

[unreal reef]

and theres not alot of times u find useful bugs to report

so

[chilly merlin]

Yeah the chances of finding a low hanging vuln for a bug bounty is super low

[icy crane]

@visual hemlock check you’re dms

[unreal reef]

^^

if u rlly need smt

burpsuite

owasp zap

nikto

xsser

xsstrie

xssrtike

bruh

xsstrike

but yeah erm

really varies what tools you use

because everything works differently

unless u use obv tools lik dirb

to find directories

or smt like that

[chilly merlin]

appreciate it

umbrax

[unreal reef]

🫡

[unreal reef]

i'd lowkey recommend going into application based bug bounties

easier to exploit imo

ofc depending on the person who made it

[chilly merlin]

still getting started will go into bug bounties sooner gimme some time to get good at foundations

[unreal reef]

bug bounties are a decent way to learn

and if u find smt u will get paid in the process

[chilly merlin]

how did u learn like at begining

would like to know

[unreal reef]

i'm not gonna lie i was a dumbbass who liked breaking security to get shit for free

my whole journey started w the most basic language

lua

which basically i js learnt how to pwn/crack whitelist systems to get shit for free

this is a very short version of a long story

then after luas comunity died out

i researched more about wl pwning

dug myself into a rabbit hole of reverse engineering

and ye

kinda went on from there

i got a longer version of it

which actually explains it all

if you'd like to know that js tell me

[unreal reef]

e

incase u didnt see a reply

and the actual story is a little bit more indepth

this is a nonchalant version

[chilly merlin]

gotcha

was dealing with a guy in chat

[unreal reef]

ima write the full story

cuz like

it's actually informative

[chilly merlin]

IN DMS

[unreal reef]

y not here

[chilly merlin]

will get flooded if u want u can post it in #1181325513055273090 and i would like to revisit so

[unreal reef]

hmm

alr

its not a lesson

just a story

[chilly merlin]

how many years u been doing this

?

[unreal reef]

on and off since 2018

stopped actual pentesting a year ish ago

[chilly merlin]

hmm

6 years

me for 6 months

[unreal reef]

I began my journey with Lua as my first language, which led me to discover a whitelisting service called LuaGuard. Intrigued, I decided to see if I could crack their whitelist. This curiosity propelled me into the world of reverse engineering, obfuscation, and security. Within two weeks, I successfully cracked a major whitelisting service that had over 12,000 monthly paying users and had never been pwned before. I reached out to the owners to inform them of my pwn, assuring them that I had no intention of leaking the exploit. To my surprise, they offered to pay me for my work, providing $50 for each version I cracked and helped patch until the company eventually shut down. After that experience, I shifted my focus from Lua to general application security. I began exploring vulnerabilities in Discord self-bots and even game cheats for a while. However, I soon realized that this path wasn’t stable or legal, so I decided to find a more ethical way to earn money in this field. I researched legitimate bug bounty programs that would ensure secure payment for my skills, and that’s how I really got started in the world of cybersecurity.

there u go

the whole story

[chilly merlin]

💀

[unreal reef]

almost every detail explained

[chilly merlin]

good one

[crystal lark]

Custom or predefined metatables?

[unreal reef]

predefined

[crystal lark]

Which ones?

[unreal reef]

lemem send u the src of the wl

i gotta find it rlq

[crystal lark]

Ok

[unreal reef]

this shit was a while ago

ill send crack

wl

and wl loader

[unreal reef]

go dms

[crystal lark]

Ok

[covert hazel]

Can anybody help me. I accidently uninstalled network maneger folder on kali linux. And now i cant install it back, because the device have no internet

[crystal lark]

Download it on your host/another PC and transfer it to Kali

https://pkgs.org/download/network-manager

Install with "sudo dpkg -i <name>"

You can download it on your phone as well

[covert hazel]

Thx

It worked

[lilac granite]

@halcyon flame hiiiii, help me pleaseee sir

[chilly merlin]

he dare ping the one with aura

[slate bobcat]

Do you guys have any recomandations to spin up free VPC ? Vultr is a making me go insane 0_0

[quasi berry]

Have you tried this? https://www.serverhunter.com/#query=stock%3A(in_stock+OR+unknown)

[slate bobcat]

That's a really cool site . Thanks ben !

[quasi berry]

Any timeee

[south kindle]

Anyone have a favorite version of linux?

[chilly merlin]

Kernel version or Linux distro?

[south kindle]

Linux distro

[chilly merlin]

For me it’s usually Ubuntu with an XFCE environment, or Kali minimal

[south kindle]

Ok, I'm somewhat new to Linux so just looking for a place to start.

[chilly merlin]

What you running rn?

[south kindle]

I use macOS and Windows 11 daily.

[iron juniper]

Hey guys...I'm a literal beginner
I want to go in cybersecurity
What are the things(skills) required for going into that field?
Please guide for the same...

[chilly merlin]

@iron juniper

[restive gull]

Hello, I wanna learn cybersecurity
right now I have no idea what to do
I'm 16 right now I'm just learning everything atp
what to do?

[maiden violet]

Opsec 😩

[restive gull]

i should learn opsec?

[chilly merlin]

yes

dont link your number or ip

to any account

dont use emails with names in them

dont use gmails

dont use tor, use mullvad

[restive gull]

are there any courses?

[chilly merlin]

dont over yap about personally identifiable information

[chilly merlin]

on some forums they have opsec books

[restive gull]

oh

what forums

can i find

on cybersecurity

because there's alot of them

and half of them are black hat

[grim moat]

hello..,
is anyone familiar with ISO27001?

1. may i know an application that can control dll, ocx, etc files? and
2. Inventory control, license management + push update

[chilly merlin]

lol. what are you telling him about?

[summer kite]

i am unable to understand TCP/IP reference model some techincal words such as " Point-to-Point Protocol (PPP) framing and Ethernet IEEE 802.2 framing" which i cannot understand 🥲 can someone help me in networking

[chilly merlin]

Where are you learning networking from @summer kite

[summer kite]

i am learning from website(blog) https://www.geeksforgeeks.org/tcp-ip-model/

[chilly merlin]

Do they have videos?

[summer kite]

hmm they have but basic just overview

comparing with osi that's it

[chilly merlin]

Dm me

Ill give you somewhere better to learn

[summer kite]

this PPP, Ethernet IEEE 802.2 framing this is not covered in video

[summer kite]

ok

[compact hollow]

Can anyone suggest me some jr. Job roles I can get as my first job in cybersecurity or anything around that? And also please do tell what I need to study for them

[twin harness]

jr pentester, you can get a cert on the tryhackme course

[crystal lark]

It will not help you get a job

[compact hollow]

Okay thanks but is there any other approach I can take?

[chilly merlin]

Junior Security Analyst, SOC Analyst I, Security Specialist I

[compact hollow]

And how can I learn stuff about, let's say, SOC analyst

[icy crane]

SOC I like it friend:).

[chilly merlin]

It’s pretty much up to you. You can enroll in college obtain certifications do job specific courses etc.

[compact hollow]

I'm in my kast year of btech in cs core niw tell me what can do more for SOC analyst

[compact hollow]

You like SOC analyst job role?

[icy crane]

I mean it’s quite fun I’d say.

[compact hollow]

Oh
So how can I learn SOC analysis

[icy crane]

Everyone can.

[halcyon thunder]

Alright I am having problems understanding API security and setting up a lab, can someone prescribe some resources?

[unreal reef]

https://owasp.org/API-Security/editions/2023/en/0x11-t10/

https://www.ibm.com/think/insights/api-security-best-practices

[halcyon thunder]

Is knowing web sec a necessity for API sec?

[unreal reef]

https://docs.redhat.com/en/documentation/red_hat_security_data_api/1.0/html-single/red_hat_security_data_api/index

[unreal reef]

eh

api security is a part of web security isn't i

it

[halcyon thunder]

When see from a web sec point of view yes, but in some places (esp core networks of telco systems) it is not a part of web sec.

[unreal reef]

u answered ur own question didnt u

[icy crane]

Umbrax mad now💀🙌🙏

[unreal reef]

am i?

[compact hollow]

Can you suggest me sone resources

[halcyon thunder]

Web sec as in HTTP/2, REST is there but the surrounding HTML rendering stuff is absent.

[halcyon thunder]

Well sorry, it is confusing at times for me....

[icy crane]

https://www.offsec.com/courses/soc-200/

https://tryhackme.com/r/path/outline/soclevel1

[halcyon thunder]

Any resources on how to set up a local lab?

[icy crane]

You sound pretty mad, Mad Max.

[unreal reef]

"max" and no i am not mad

dk how that came to ur mind

[halcyon thunder]

The old ones or the new ones?

[unreal reef]

❌

[chilly merlin]

https://www.youtube.com/watch?v=mvsiuLzpx2E&pp=ygUec2V0dXAgYSBob21lIGxhYiBuZXR3b3JrIGNodWNr
If you need further assistance..ping @valid belfry

[icy crane]

You’re a light switch, you always turn it off.

[compact hollow]

@icy crane thanks

[icy crane]

New ones

[unreal reef]

and ur a random person on discord who doesn't know when im annoyed or not <:

[icy crane]

Anytime dude🫶.

[halcyon thunder]

Ughh those movies except fury road was a eyesore to watch

[icy crane]

Yh true.

[icy crane]

Well popularity has nothing to do with knowledge and clearly you go for popularity.

“Random”

[unreal reef]

fellow 0day is a random person on discord to me aswel

hes "known" on social media

still a random person

[icy crane]

Then what are you another random? Yes, yes you are.

[unreal reef]

yea.

i am.

in ur life im another random person

[icy crane]

I like the honesty.

[chilly merlin]

whats going on

[unreal reef]

nice

[unreal reef]

this thing called a conversation

[halcyon thunder]

Also, if anyone wants help in setting up and understanding SDRs and signals, please feel free to ping me, I have been doing that for quite some years now.

[icy crane]

True but I’m a random too;).

[unreal reef]

to some people ur not a random

to me u are

doesn't make a difference in ur life

because im not in it

or does it 🤔

[chilly merlin]

doesn't seem like it. someone is saying your mad

[unreal reef]

depends how u react based on others opinion.

[unreal reef]

ur mad.

are u mad?

i said u are

but are u?

[chilly merlin]

[unreal reef]

there u go

answerd ur question

someone saying another person is mad

doesn't mean their right

[halcyon thunder]

they're*

[unreal reef]

ok?

😭

[icy crane]

https://tenor.com/view/womp-womp-cat-gif-12768989307250413732

[halcyon thunder]

https://tenor.com/view/hah-righttt-yeah-right-whatever-you-say-ok-gif-16175049

[valid belfry]

Yes

@halcyon thunder if you need help @ me but I am at work rn

[plush ruin]

Hello, so im thinking about the following, i would like to end up as a team leader for incident response teams but im not sure what path to take, im currently working on my CISSP and know pretty much all of the CCNA exam. Any tips in carrier paths, certs? Im only 21 so i have a lot in front of me but i do like planning the direction i want to go later on in my life :)

[quasi hollow]

@plush ruin which direction do you wanna go btw black | white?

[crimson belfry]

After getting a certificate from Google Certificate in Cybersecurity, what should I do next? I've been trying to figure out what to do next, but I'm just stuck in one spot lol.

[glass venture]

Create ur own project

[unreal bloom]

expand your portfolio

[glass venture]

And then start freelancing

[reef remnant]

Maybe Comptia security plus?

[unreal bloom]

constantly look at ad's and etc. for contracting / freelancing work . u are bound to find work you feel u are able to do . but never stop expanding ur portfolio even iy dont have work

the one constant is education

u will never know enough

[crimson belfry]

That's my next goal, but the thing is my current job doesn't pay enough for that (bills and all the adult bullshit :*)), but I'll be studying for it until I save enough, unless there's such a free thing lmao.

[crimson belfry]

Where is the best place to look for that?

[unreal bloom]

getting your name out there on job sites

[glass venture]

Its the internet ur bound to find something free

[austere ice]

does anyone here know how to bypass a passcode in a ipad ios 17.7?

[unreal bloom]

and if you havent already, let your irl circle of family and friends know what u been doing

[glass venture]

Go to ur local tech store for that 🥲

[unreal bloom]

keep guessing 😄

[glass venture]

Finna get locked out for 50 years

[austere ice]

lit

[glass venture]

🤣

[crimson belfry]

Alright, I'll do that then, thank you.

[crimson belfry]

There's no such things as free

[unreal bloom]

no stress

[glass venture]

Yeah there is

The other day i found a free $1 on the ground

[unreal bloom]

learning is free nowadays (iy have the hardware)

[crimson belfry]

LMAO, that's irrelevant to what I've been asking for 😭 But you know what, you can be right about that.

[glass venture]

😭

Check ben

@quasi berry

He prob asleep 🥲 by now

[crimson belfry]

I'm gonna assume he's an early bird or he's probably in a different country.

[quasi berry]

Hi

What am I needed for

[quasi berry]

an early bird? 💀

I'm in the UK

[crimson belfry]

This.

[quasi berry]

A+, Net+, Sec+

[crimson belfry]

Yeahh, well, anyone can be an early bird 😭

[quasi berry]

Well

What exactly is your focus in cyber?

[glass venture]

Early bird gets the first worm

[crimson belfry]

I'm a night owl.

[crimson belfry]

That's a good question, tbh

[quasi berry]

But the night owl gets most of the worms :3

[glass venture]

Ooo

👀

[crimson belfry]

Is there any way I can learn which side does what, so I can learn which one I could be interested in?

[crimson belfry]

Eh, there can be lazy night owls.

[glass venture]

Them times u gotta get up n push thru the laziness frr

[crimson belfry]

That's the point of my job, get up, work, then get home after work, then read book till i go to bed.

[glass venture]

😭

I feel like u dont get a healthy amount of sleep

🥲🥲

I hope you do tho

[crimson belfry]

I do actually, that's why I love night shifts.

[granite summit]

can someone help me with this problem, I need help using johhny for parrot secuirty. what path way do I have to use

[halcyon flame]

So yeah @maiden solar - what commands has this class introduced you to so far?

Does the question require you to list txt files in a single directory, or in many?

[maiden solar]

We've been learning basic commands and about a week ago and a half we started scripting. The question states that I have to make a script to search for all "txt." files in your home directory and then change these file persmissions to 644.

week and a half ago*

[halcyon flame]

Ok.. so again, what kind of commans has the class taught you to use so far?

The question doesn't seem to specifically state the grep command, unless that's not the whole question

Anyway yeah

What commands have you learned about so far?

[maiden solar]

chmod, grep, ls, cd , cp,

i cant think of all of them rn, but those are the ones on top of my head

[halcyon flame]

Ok, have you learned about using the | character to "pipe" together command outputs?

Also, does the question mention recursion at all, as in.. does it need to change all files within subdirectories as well?

[maiden solar]

Yes we have, I don't just rememebr much of it.

No it doesnt, it just states I have to search for all .txt files in my home directory and then change file persmissions to 644

[halcyon flame]

Ok.. that could be interpreted as all files, including those in sub directories

[white steppe]

hey guys can anyone help me, i have an old iphone 7 plus and i need to either get pat lock screen or fully reset the phone. thanks

[maiden solar]

ok sounds good

[halcyon flame]

Let's start small @maiden solar - do you know how to read the manual for commands in Linux?

As in.. the documentation which includes all parameters etc

Or, we could start at the very basics

Tell me, how would you list all files with the txt extension in your home directory?

[maiden solar]

grep -l *.txt i dont know if that is correct

[halcyon flame]

That is one part, but there is another command you mentioned that you can (and would need to, if you want to use grep) to use prior to that

grep generally either needs to be piped input using |, or to be provided input with the final parameter (being a filename, or input)

How else could you list files in your home directory, and only list .txt files?

Have you been told about the command to show command manuals / documentation yet?

[maiden solar]

Yes

[halcyon flame]

What kind of examples have you been given to use the | piping feature of bash?

Or what ways have you learned how to USE that feature

[maiden solar]

Well i havent had any hw that makes me use the piping feature. My teacher only has videos for us to see

[halcyon flame]

Have you watched them all? Do any of them demonstrate it?

Because, with the limited set of commands you've provided, you'll likely need to use it

You could always use other commands, but if they expect you to use what you have been taught, that might not be the right thing to do.

Sorry if I'm being very limited in what I say. I could always just give you a working solution, but that'd kind of defeat the point

If they've introduced you to the | (piping) feature, surely there must have been some content describing how it works?

[maiden solar]

Yes sorry, I just get really confused. There is so much material to learn in a specific time that I just forget some stuff. So thanks for having patience with me

Let me just go over the piping video my teacher has published

[halcyon flame]

Sure

Also check back over the video that introduces the ls command

While in theory you could chain together three of the commands you have been provided to come to a solution, you really only need two.

Or one, if they do not expect you to make the changes recursively

[maiden solar]

Ok sounds good. Let me check them!

[halcyon flame]

Specifically, check out the man entries for the commands you have been given. They all have something in common (although cd does not have a man entry)

I've got to go shortly I'm afraid. What I would recommend is this

Build up towards your solution in steps - Linux and its core binaries were built in such a way that they can be combined in order to achieve tasks that no one command can achieve on their own.

Breaking down the question..

1. How do you find all txt files in your home directory (optional, find them recursively)
2. How would you execute chmod on those files to change them to the required permissions
3. Can you complete this task with a single command?

Read of the command manuals carefully, go step by step 🙂

This can be achieved in a number of ways, it's up to you to find them.

Good luck!

[maiden solar]

Thank you, really appreciate it. Hopefully it all comes together and I can finish my hw. Been stuck on it for a bit haha but thanks again for helping me!

[halcyon flame]

(also, if you find one way to do it.. if you have a feeling there are other ways, explore them too and document them - they may build some fundamental knowledge that will need later)

No worries, everyone starts somewhere

[rain hollow]

For beginners what is a good place to start to build a good foundation? What should I learn first?

[maiden violet]

look at pins in #1181325692823150642

[chilly merlin]

what do you want to pursue?

[hollow orbit]

can someone help me recover my instagram ?

[chilly merlin]

https://help.instagram.com/account-recoveryHow

[plush ruin]

White hat i'd say

[frigid jolt]

@wanton marsh could u possibly help me

[wanton marsh]

https://tenor.com/view/hi-hey-hello-there-kitten-cute-gif-16697937

Now can I help

[frigid jolt]

gooo dms

[chilly merlin]

I had few questions can someone help

🙂

[lean lance]

Hey there, whats up

[humble wren]

Hi all. New here and had a question over something I saw on someone’s videos I follow.
They mentioned something called bandit on overthewire.org
They said it is easier and better than try hack me. For anyone who is a beginner like me. Just curious if anyone has used this site and has been able to compare it?

[lean lance]

OverTheWire holds your hand alot less and requires more initiative and researching yourself. I'd suggest starting with THM.

Then move over to HTB or OTW

@humble wren

[humble wren]

Thanks. I appreciate the input. @lean lance

[lean lance]

You're welcome 🙂

[honest mango]

How can I get rubber ducky USB?bros

Can someone help me on this

[lean lance]

https://shop.hak5.org/products/usb-rubber-ducky

From the source

[leaden axle]

Does anyone have any good recommendations for todo apps? This would be on windows (I've got neorg on linux)

[honest mango]

Can't i just make one of my own

[grand bane]

techincally you can make anything

[lean lance]

If you mean from a regular USB, short answer: no

You can buy smth like a Raspberry Pico microcontroller and make it act as a rubber ducky

[chilly merlin]

I mean he can something related but not a fully fledged rubby ducky

[lean lance]

You know how the Rubber ducky works right?

[chilly merlin]

Yeah i do

[honest mango]

Oh thanks bro, what are the process?

[chilly merlin]

he can get some other scripts and use autorun creator to do something else.

[lean lance]

That is not the same, and not very effective, besides autoruns are often blocked

[chilly merlin]

IM just trying to give him hope :/

[lean lance]

Rubber Ducky introduces itself as a HID device. Which makes it pretty much undetectable

Because PC's fully trust things like keyboard and mice by default

[chilly merlin]

Autoruns been blocked on every device since win 7

[chilly merlin]

btw why doesn''t windows block it or smth

[honest mango]

I will need to understand how

[lean lance]

Not always the best solution

[chilly merlin]

HID device windows thinks it’s a keyboard

Or mouse

[lean lance]

Well.. to the computer it's just a keyboard or mouse

Nothing else

[chilly merlin]

It doesn’t know what it actually is cause it loads keyboard drivers and signatures

✅

(I think keyboard it might be different now)

Hmm

[honest mango]

Thank you family

[lean lance]

Buy a Raspberry Pico for like 8 dollars

And you can make one yourself

[chilly merlin]

But run him through it ... it may work for hiim : )

[lean lance]

I got like 8 of em, they are amazing 🙂

[chilly merlin]

an arduino can work too right?

[lean lance]

Yea

Technically any microcontroller

[chilly merlin]

[lean lance]

They are very fun to play with

[chilly merlin]

and cheaper right?

[lean lance]

Cheaper then what?

[fluid shard]

Hey 👋

[chilly merlin]

bruh. is it the firmware or hardware

[fluid shard]

Can I get help from you guys??

[chilly merlin]

raspberry pi

[lean lance]

Pico is cheaper yes

[chilly merlin]

Yeah

[lean lance]

Pico

[lean lance]

It's the hardware, microcontroller to be specific.

[chilly merlin]

@fluid shard What do you need help with.....

[lean lance]

You can do alot of cool things with them

[chilly merlin]

what but if its plugged in can it appear in like gparted or disk management...

[lean lance]

It's a device, not a software

[chilly merlin]

huh>

[fluid shard]

So, apparantly there's a new way of scammin'

[lean lance]

Go look up on microcontroller, and how it works and what it is

[fluid shard]

Please have a look

[lean lance]

It's cool and interesting

[chilly merlin]

@lean lance

We don’t do unethical stuff here

[chilly merlin]

#📜・rules

#1286135820008296509

[lean lance]

Relax folks, you didn't know the intention yet 😄

But yeah, make sure it follow guidelines here

[chilly merlin]

Just warning.. incase...

[fluid shard]

So, my friend got a message from a random dude who messaged him that he had reported my friend for fraud and that his account will be suspended within 24 hours. For cancellation, he needs to bind his account with another account

[chilly merlin]

Aya

[lean lance]

Ah the typical account takeover scam, yea.

[fluid shard]

Now, my friend, without knowin' anythin', did it and the scammer got the access to his account.

[lean lance]

Grow the account bigger then the original and then report the original account

[fluid shard]

Is there any way y'all can track the scammer down?? I have his IP address

[lean lance]

Access to his? You said something about suspending his account

[lean lance]

That is not something we do here

[chilly merlin]

was it an email?

[fluid shard]

The account suspension was a fake notice created by the scammer

[chilly merlin]

its the trick. merge the account or get your account suspended

[lean lance]

You will have to contact the platform this occured on about it

[fluid shard]

How can I contact??

[chilly merlin]

Was it gmail? @fluid shard

[grand bane]

Depends on the platform

[lean lance]

Well maybe "(platform) support"

A google search

[fluid shard]

If I give you guys the IP Address, can y'all track it down??

[lean lance]

While it might be a scammer, anything unethical or something along the lines of vigilantism is not encouraged or helped with here

Please, like mentioned. Read the #📜・rules and #1286135820008296509

[fluid shard]

Ohhhh...I didn't know that

[lean lance]

That's okay, I'd suggest contacting the platform with all the proof you have

Taking things in to your own hands is only gonna make it worse or not do anything you want to achieve

[fluid shard]

Yeah, it was

That was a really convincin' lookin' bot sayin' to bind the account with some other email address:- [e-mail] smn' like that

[chilly merlin]

https://support.google.com/accounts/answer/6294825?hl=en

I think its something to with family sharing @lean lance

idk

[lean lance]

Revoke all permissions, change password, contact Google

[granite summit]

who here has used parrot OS?

[chilly merlin]

scammer took over the account

[lean lance]

Could be yea, you can link different accounts this way

[fluid shard]

No, it wasn't the gmail account that was hacked, it was the discord account that was hacked.

[lean lance]

Well then contact Discord about it. These things happen very often

[fluid shard]

Well, is there any number of discord??

[wheat lotus]

that can be recovered easily i guess

[grand bane]

This is from the FAQ about hacked accounts: https://discord.com/safety/360044103651-reporting-abusive-behavior-to-discord

[wheat lotus]

https://support.discord.com/hc/en-us

[fluid shard]

Thanks y'all, y'all are life saver

[lean lance]

https://support.discord.com/hc/en-us/requests/new?ticket_form_id=4574398270487

[lean lance]

Straight to the correct ticket form

[lean lance]

You're welcome and good luck

[lean lance]

Oh hello Six, cool new name 👽

[wheat lotus]

thanks cyphr 👽

[chilly merlin]

Hmm their response time doesnt seem good

peeps on reddit say 2-3 months

[grand bane]

i've never personally interacted with discord support but i've never heard good things lol

[chilly merlin]

ohh this is six🙂 hello cousin

[lean lance]

As a company, Discord is quite shit tbh (don't ban me Discord, I know you can read anything in any server)

[wheat lotus]

hello 👋

[lean lance]

Watch me get banned by Discord again now lmao

[chilly merlin]

guess its the lucky ones....

[grand bane]

https://tenor.com/view/bane-no-banned-and-you-are-explode-gif-16047504

[obsidian umbra]

Question fellas, when I set LHOST on metasploit framework like on exploit/multi/handler as my public ip it fails to bind and won’t connect back to the test target like it should and yes port forwarding is enabled on my router but still doesn’t work, any advice?

And I’m not trying to use private ip cuz I wanna see if it connects back using public ip if anyone was wondering

[chilly merlin]

What’s your lab setup? Two devices on different networks?

[obsidian umbra]

Two devices on the same network

I’m trying to reverse connect though the internet instead of private network

[crystal lark]

Are your subnets different? Also, you will not be able to connect to a different device using public IPs that is within the same network. Most routers do not support NAT loopback so the target device will have to be on a different network

[obsidian umbra]

I’m not sure if subnet’s are different. But what if it still doesn’t work when on a different network?

[chilly merlin]

Try diff port, check firewall settings

[crystal lark]

It does. I actively use Metasploit for managing my sessions when doing Pentests. If it still does not work, it is more likely issues regarding Port Forwarding or Firewall. You can also set the LHOST to 0.0.0.0 for receiving external connections

[obsidian umbra]

Kinda check with firewall and allow connections for port 4444 and same deal but I’ll look into it when I’m home

[obsidian umbra]

I will set LHOST as 0.0.0.0

I’ll do it later I’m not home

[chilly merlin]

Yeah..that will make sure the device is listening for incoming connections on all ifaces

[chilly merlin]

Okie

[coral rampart]

@fallow yoke Hey Monke, how are you?

[rose lark]

Guys I want Windows 7 iso files for pentesting

[chilly merlin]

Search in https://archive.org

Can my link work too?

[lean lance]

It can, but could also be infested with infected versions

[chilly merlin]

Yeah.. was gonna tell him to get from Microsoft section

[rose lark]

What's service pack exactly?

[lean lance]

A collection of bug fixes and product enhancements

[rose lark]

McFee deleted it. Are you sure those files are safe?

[halcyon flame]

I certainly wouldn't trust..

No offense..

[lean lance]

Been a well known source for many years, but if it flags avoid ig

[halcyon flame]

Shame MS took down their own links

[lean lance]

That site used to be using MS links, but i guess things have changed in recent times

Mb

[lean lance]

Yeah, they should offer it through some kinda of dev portal or smth to be honest

[halcyon flame]

Latest they provide is Windows 10 for trial ISOs now unfortunately

I mean.. Virtual Studio sub provides such access, MSDN, whatever

But yeah, a cost

[lean lance]

I dont take offense, apparently the site is not how i remember it to be

[halcyon flame]

Cool beans 🙂

[lean lance]

If i'm wrong, i'm wrong. Simple 😄

[lean lance]

Ah good one, might be yeah

[halcyon flame]

I've got a perpetual license, they provide versions going back a way

https://visualstudio.microsoft.com/dev-essentials/

Unsure if it still provides the benefits for new subscribers or not

[obsidian umbra]

UPDATE: I tried putting the LHOST to 0.0.0.0 and didn’t work

On metasploit

[lean lance]

What port are you using?

[valid belfry]

Sup app

@obsidian umbra lhost is your own ip

Idk if you know that

0.0.0.0 localhost > localhost > 127.0.0.1 localhost

If you run ping localhost you are pinging yourself

Or any of those

[obsidian umbra]

I know it’s my own IP but I had two other people that were helping me out on a situation

[valid belfry]

I don't think metasploit will work without port forwarding

Your device is not able to reach to another device

[obsidian umbra]

Basically, I’m trying to do a reverse connection using a public IP instead of a private IP.

I do have port forwarding enabled

[valid belfry]

Which ports and which ip

You portforward your machines ip to the internet

[obsidian umbra]

Port 4444 and my public ip

[valid belfry]

What router do u got

[obsidian umbra]

I don’t know the brand, but I use spectrum

[valid belfry]

For me I need to specify a local ip to forward to the internet

I use spectrum too

[halcyon flame]

Check out ngrok

[obsidian umbra]

Guys I was talking to earlier said try 0.0.0.0

[obsidian umbra]

For tunneling? Could help

I did try to use the tor network and that didn’t work

[halcyon flame]

If there's port forwarding enabled coming back to your IP.. is that coming to your host or vm (if you're using a VM)?

Yeah, Tor not the way

[obsidian umbra]

My own computer host

This is all ran off of a laptop

Arch Linux

[halcyon flame]

Have you verified that you can connect to the forwarded port from an outside host, like a VPS or something?

[obsidian umbra]

Not really it just doesn’t wanna do a reverse connection back when it comes to public networks instead of private

I thought about building a machine on AWS Linux and trying that

[halcyon flame]

I'd advise confirming the port forwarding is working yeah

[obsidian umbra]

Is there certain devices that can be port forwarded?

[halcyon flame]

If it can open a port to listen, and the router or whatever can forward on traffic.. there is no limitation

[lean lance]

Try using port 443, I've had similar issues with ports above 1000 in the past on some networks

[obsidian umbra]

Port 443 didn’t work. I’ll definitely note it if I need.

I might just need a VPS

[lean lance]

Hmmm are you sure the payload itself is not messed up?

[fast maple]

i need help

I am representing my school in districts for cyber security and I also did last year and i got thrid place (only reason why i got third was because there was only three teams) and the progrm is called skills USA. I have the guide on what the questions will be about and they are about the NIST 800 181 Cyber Security workforce frameworks I am new to this and i want to get first becasue if I do i can go to state and therefore

[obsidian umbra]

I’m positive the payload is not bad

[halcyon flame]

@maiden solar how did you get on? 🙂

[chilly merlin]

I'm here

you never mentioned port forwarding

[rain hollow]

I'm in school for software development and also interested in hacking

[versed vale]

Please where can I purchase license key for Socionator

And how do I setup visual basics on my MacBook

Please help me

[maiden violet]

Hello!

[maiden violet]

On their website and stack overflow discussion for the VB

[tawdry knoll]

Guys I need suggestions please. I’m trying to build a database honeypot and I have a dual booted system, windows and Kali OS. I don’t want to run this project on my immediate environment. Can I install a virtual box and also install Metasploitable. My computer is 8gb Ram. Also is there any other alternative for the project that would be helpful.

[echo talon]

@tender dust https://book.hacktricks.xyz/network-services-pentesting/pentesting-rdp

[hallow kindle]

@analog adder @ me if something breaks again

[analog adder]

nevermind, waited a little, turned it on and my pc did a sike!

and booted

[hallow kindle]

Hey!!! Thats good!

[analog adder]

it wasn't posting at all

[fluid berry]

Yooooo

Live in canada, do cybersec jobs give a shit about which uni you went to get your comp sci degree? Or do they like you having lots of certs ?

[unreal reef]

me myself don't hold any certs i js personally do bug bounties and other shit but I would assume the more certs u hold the better chances you have

[fluid berry]

how much do you get from just doing bounties?

[unreal reef]

varies from person to person

theres no exact amount

every program pays differently

and for each bug aswel

[fluid berry]

Yeah I get that, but from what I've seen it's pretty hard to live off just doing bounties because of the variability; do you work on the side or you fully in it?

[unreal reef]

I don't work within it or it related things.

my knowledge is purely from just having it as a hobby

from when i was younger

[fluid berry]

gotcha gotcha

[unreal reef]

bug bounties depends on the person

their skill

like lets be realistic if ur good enough to do bug bounties for big ass companies like roblox ur gonna get paid quite good money

but if u aren't skilled enough to find exploits in it

you won't

so it varies on ur skillset

[fluid berry]

Yeah bug bounties are something Ill go for when I get experienced in the field, but Imma try applying to security positions first

[unreal reef]

lmao we went 2 fully different routes

[fluid berry]

I haven't even gone down the route tbh, I'm applying for universities rn so my choice degree isn't even decided yet

I'm just worried if employers give a shit about where i get my degree from

[versed vale]

I don’t know how to access their website

[chilly merlin]

their requirements are basically breathing is optional

[chilly merlin]

ask in a couple more channels you might get an answer quicker

[wicked sorrel]

my evil ginx is not working

the program tried to add a TLS certificate to it

but then i got this error

failed to set up TLS certificates: login.microsoft-onedrive.3.4.1.zip: obtaining certificate: [login.microsoft-onedrive.3.4.1.zip] solving challenge: login.microsoft-onedrive.3.4.1.zip: authorization failed: HTTP 400 urn:ietf:params:acme:error:dns(ca=https://acme-v02.api.letsencrypt.org/directory)

[wicked sorrel]

and then i figured at least the website will start

but it didnt

pls help 😭😭

[chilly merlin]

@wicked sorrel try this https://github.com/kgretzky/evilginx2/issues/452

[normal ginkgo]

Hi

[chilly merlin]

Create a new account or contact roblox support

[lean lance]

This stuff happens alot on Roblox, account take overs are like a daily occurence there. Contact Roblox like already mentioned.

[deft light]

yow ^^ I need help with my cloudflare tunnel and maybe with my webserver. I cant reach my website not even in my own network. Any ideas why? I use nginx and my domain is set and is under sites-enabled and sites-available and for now only http is set

[lean lance]

Where are you hosting it? Your own network or in the cloud?

[deft light]

on my raspberry pi 4 in my own network

[lean lance]

Did you setup port forwarding to the Pi?

[deft light]

maybe I got the wrong architype amd instead arm but I checkt that now

[deft light]

no but I don't need that or? when I use cloudflare tunnel

[lean lance]

Ah right, yea you should not have to

[lean lance]

yeah double check that

[deft light]

ok ok what is od that when I try to get on my website from the same network it also cant reach my webserver ... Am I right that I only need a dns entry with a that my domain point to my webserver or for that I need portforwarding? onyl internal I mean so not from the outside

[deft light]

I will do ^^

I reach it with the ip in the internal but not with the domain of mine

[lean lance]

Check from the same network if the website even is accesible: <ip of Pi>:port

Ah ok

Then it's surely a configuration in Cloudflare

Double checked all the DNS settings in Cloudflare?

And make sure its ARM for cloudflared

Pi is ARM as you probably know

[deft light]

ok so no tunnel configurated and one a record with domain pointing to webserver

Am I now able to reach my website with my domain even the tunnel is not configurated?

or do I need port forwarding for that or a tunnel to even use my domain

or does the dns record I set need some time to establish global records ...

[lean lance]

Without the tunnel, port forwarding will most likely be needed for typical home networks

Because of NAT

you can try pinging the domain and see the IP response

[deft light]

no output

nslookup and domain give out that server is my router and a ipv6 adress and "No internal type for both IPv4 and IPv6 Addresses (A+AAAA) records available for ..."

ok so let me set up a portforwarding rule for port 80

then when it should work shouldn't?

[lean lance]

Before I'm typing walls of text to troubleshoot, check this vid, you are probably missing a step: https://www.youtube.com/watch?v=D2lzdfohKJo&pp=ygUoaG9zdCB3ZWJzaXRlIG9uIHJhc3BiZXJyeSBwaSBjbG91ZGZsYXJlZA%3D%3D

[unreal reef]

🫡

[deft light]

sure thx ^^

[lean lance]

If after the vid you still have trouble, you can ping me 😄

[deft light]

ok well the video did not help me :/ @lean lance so now I did set up the tunnel per cli and it is running also with the right architecture arm, but now when I go to my domain in the browser it says
Error: Redirect error

The website you are trying to access is redirecting the request in such a way that it can never be completed.

This problem can sometimes occur if cookies are disabled or rejected.

I am confused ^^

[lean lance]

Sounds like a misconfig with nginx and https redirect

[deft light]

what is odd that I did set the ssl/tls to off in cloudflare and in my nginx server there is no https/443 conifgured

but it also tries one time to resolve it as https:// domain.... and then you refresh and it switches to http:// ... also I did turn of that cloudflare automatically only do https ..

[lean lance]

Yeah it's still redirecting to https

Why not use HTTPS anyway?

What is your nginx config looking like

[deft light]

I mean I want to but doing that now is harden then to find the problem why it is not working anyways now with only http and without https and certifications ...

[lean lance]

Well, https is mostly forced in different areas. Which is why there is a redirect loop now

Install certbot on the Pi

[deft light]

server {
listen 80;
listen [::]:80;

    root /var/www/herbfarmer/html;
    index index.html index.htm index.nginx-debian.html;

    server_name domain.xx www.domain.xx;

    location / {
            try_files $uri $uri/ =404;
    }

}

that is the sites-available do you also net the main condifuration file

[lean lance]

sudo apt update sudo apt install certbot python3-certbot-nginx sudo certbot --nginx -d domain.com

The problem is definitely the combo of using the tunnel and non-https. It can be done but usually gives conflicts.

Besides there is no reason not to use HTTPS, it's very easy to setup anyway

[deft light]

ok sure I do that

[lean lance]

Let me know 👍🏼

[lean lance]

copy your message before sending it, if it's very long Night Owl bot will remove it @deft light

I saw you fixed it at quick glance, the rest I couldnt read 😄

[deft light]

@lean lance thx man ^^ now it is working, let me now if you wanna have look at my website 🐦
I did describe the way I got there but the bot just del it and said to me don't sent the message over and over again xD
So yeah a short version of that is that there were two problems

1. that I had was the "sudo apt install certbot python3-certbot-dns-cloudflare -y" I used that because let's encrypt could not establish a connection to my webserver, also I had to make a api token and link it to the cerbot ...
2. after I did all right it told me
   400 Bad Request
   The plain HTTP request was sent to HTTPS port
   nginx/1.24.0 (Ubuntu)
   fixed that with enable always use https ... and rewrite http to https ... on the cloudflare dashboard and also did reconfigured the tunnel so it don't verify the origing server pull

ahh now it works

yeah the other message was to long ^^

[lean lance]

Nice, yeah that sounds like things I've come across as well. Glad you fixed it mate 🙂

Sure you can always drop the link

[deft light]

me too ^^ thx again for the help

[lean lance]

No problem 🙂

[static cairn]

Yo how much cybersec should I do as a web developer?

[spiral barn]

Yo guys hope your doing well can anyone assist me with some web challenges of a ctf ?

[unreal reef]

what ctfs

[spiral barn]

ironCTF

[chilly merlin]

hey

does anyone know if Ethical hacker course by Cisco is a good course to take if ur new to ethical hacking

[chilly merlin]

is that the name of the course?

its called “Ethical Hacker”

[chilly merlin]

hmm

there's other certs you need to accomplish not only that

[chilly merlin]

im currently studying Networking Basics, its part of the “Junior Cybersecurity Analyst” career path i was checking if i can skip the rest and start with ethical hacking related courses

[chilly merlin]

yeah there's others you need to pursue. net basics >>net+>>sec+/pentest+/oscp/sec+ and CySA+

[honest jolt]

Check the other users to discover which user account was used to make the malicious changes and revert them. After reverting the changes, what is the flag that you have received? what does this mean?

like i dont get it what should i answer there

[chilly merlin]

i think the one you are referring to @chilly merlin is CySA+

[honest jolt]

@chilly merlin can you helpme out?

[chilly merlin]

what's wrong 😕

[honest jolt]

i wrote something can u help me with that question

[chilly merlin]

send message link . cookie lazyy

[honest jolt]

here

[chilly merlin]

I'm not yet doing ctfs... ping a hacker here...

@rare canyon

[honest jolt]

what are you in?

[chilly merlin]

@unreal karma help this guy out please 🙏 ^^

[chilly merlin]

not yet ctfs

[unreal karma]

the flag will be somewhere in the account’s data after you revert the fuck shit

[honest jolt]

huh

i dont get it what should i answer there

[unreal karma]

whatever the flag data is, its inside the file that the flag would be in. orrr the flag could be a 🔑

i dont have enough context to know what type of flag you’re looking for

[honest jolt]

this is question on trychackme

[unreal karma]

did you try following instructions step by step? they are pretty clearly stated

[honest jolt]

wdym

[unreal karma]

1. check the log or personal accounts to see which account made changes

2. revert said changes

3. find the flag in the user that made said changes

[unreal karma]

@chilly merlin i do not have the patience to teach and this reminded me of that.

[honest jolt]

can you come in my dm

[unreal karma]

https://tenor.com/view/obama-what-seriously-what-the-president-gif-16881768

[honest jolt]

bro i understand whatever you are saying

answer

i just dont know what to put there

[lean lance]

You clearly need to take a step back and properly cover the theory and information

[honest jolt]

it has to be something specific

[lean lance]

That is the point, you need to find that out

[unreal karma]

https://tenor.com/view/look-what-yep-this-gif-13617583

[lean lance]

Thats the whole point of CTF like challenges..

[unreal karma]

right, the flag could be anything

usually its a key or relevant plaintext information for the beginner CTFs for THM and HTB

the point of cybersecurity analysis is to find a non-uniformity

[lean lance]

Just saying what to put there won't teach you anything. It will just tell you the answer. Not how or where to get it. The challenge is to look around and work with the information you are given.

[honest jolt]

i get it yea

but last time i asked the question like this thing

[lean lance]

Don't give up, keep thinking and read over and over the info you have

[unreal karma]

then why you asking us for

[honest jolt]

i was right i had already put right answer but it just didnt show me

[unreal karma]

this^

[unreal karma]

screenshots would help us help you immensely

[honest jolt]

when i entered correct one it said it war incorrect LOL untill i coppied same word from someone else

[lean lance]

Analysis, problem solving and creative thinking. The most important skillset for a hacker

[lean lance]

Then the format was not matching

[unreal karma]

its just a text issue, when in doubt, type it out

[chilly merlin]

ohh sorry. but thanks for your help

[unreal karma]

i try where i can

mans found the flag already💀💀💀

[lean lance]

It has to be the exact flag, not partially or differently formatted. One character off and it would be incorrect.

[honest jolt]

nah i didnt 😄

[unreal karma]

ill leave you to people that will be more helpful

[honest jolt]

i thought of this Insecure Direct Object References, is this even flag?

[honest jolt]

🙂

[lean lance]

And when looking for the answer in some writeup. Make sure to try and understand the WHY and HOW. Not just blatantly copy and paste

There is no shame in using write ups if you are stuck, but make sure you tried everything. And when you find the answer, find out why it is correct and how you would have gotten it, what you missed, what you should have checked/done etc

[honest jolt]

On the site on the right, click "Your Activity" and try to enter numbers between 5 and 10 instead of 11 in the user_id=11. this is hint i get something but man i think i am way too dumb for this shit

[lean lance]

That's the true way of learning

[honest jolt]

well its my first day trying new things

[chilly merlin]

don't think that just try to understand

[chilly merlin]

you'll get there

[lean lance]

That is the thoughest, just make sure to always go back to things you don't understand. Don't just "Submit" and move on

[lean lance]

You did the best you could 😄

[chilly merlin]

What going on here

[lean lance]

Smart advice

[chilly merlin]

ctf

[honest jolt]

@lean lance where are you from?

[lean lance]

That is highly secret

Nah it's not actually

Netherlands

[chilly merlin]

From Earth

[honest jolt]

they trying to teach me something but im way too dumb for this LOL

[chilly merlin]

Join me me too dumb

[honest jolt]

i got cousin there

eindhovem

[lean lance]

We all felt that way when we started. I still feel dumb in this field sometimes

[honest jolt]

n

[honest jolt]

tu tu tu tu

max verstappen

[lean lance]

Don't worry about it, just keep learning

[chilly merlin]

CAP

[honest jolt]

ego

[lean lance]

NO cap 😄

[chilly merlin]

?

[lean lance]

There is always somebody way better then you are 😄

[lean lance]

He meant I'm being humble I guess

[honest jolt]

there always is someone better than him too 😄

[lean lance]

Not what he meant haha

[honest jolt]

LOL my brain not braining

[chilly merlin]

Confused rn

[chilly merlin]

mimi too

[lean lance]

😆

[lean lance]

Wait, really?

[chilly merlin]

yeah

[lean lance]

Ah that's cool. Didn't know that 😄

[honest jolt]

Broken Access Control and Insecure Direct Object Reference

nah nvm

[chilly merlin]

Where is Netherlands

In map

[honest jolt]

europe

between belgium

and germany

[lean lance]

Next to Germany, Belgium, Luxembourg

[honest jolt]

on top of france

[chilly merlin]

imagine you've met and you both don't know 🥲

Okay so europeans

[honest jolt]

you american?

[chilly merlin]

hmm not all

[lean lance]

I would have recognized a fellow cybersec enthusiast

I hope

😄

[chilly merlin]

Yea

[lean lance]

Especially a girl, that's rare

[honest jolt]

LOL

[chilly merlin]

ask her

[chilly merlin]

exactly!!

I'd love to meet if there are near me sadly not

[honest jolt]

@lean lance i read this 4 times

and my brain is still not braining

[honest jolt]

come to georgia LOL

[chilly merlin]

lol there are... just not in this server..

[honest jolt]

imma meet you anyday

not state

country imean

[lean lance]

If you are truly stuck, look up the answer BUT don't move on until you understand why the answer is the answer

[honest jolt]

look up where?

[chilly merlin]

bruh you forgot about your ctf

[honest jolt]

😄

[lean lance]

What room, what lesson are you on

[chilly merlin]

Hmm really?

[honest jolt]

Web Application Security
is this room?

[chilly merlin]

obviously. yall are tech gods

[honest jolt]

cookie where u from

@chilly merlin help me get green card

only thing i can offer is genius keyboard

[chilly merlin]

Antarctica

[chilly merlin]

you have to earn it.

[chilly merlin]

Wat drop server link in dms

[chilly merlin]

W wat u talking about

@honest jolt are you on THM?

Green card?

[honest jolt]

😂

[chilly merlin]

I don't have a link lol. just sayin'

[honest jolt]

yea?

[chilly merlin]

I'll look for one

[honest jolt]

@lean lance u here?

[chilly merlin]

@lean lance does THM have room IDs

[honest jolt]

how old are yall?

[lean lance]

Brb

[chilly merlin]

I'm in womb

[honest jolt]

where do i see that?

[chilly merlin]

https://tenor.com/view/blijven-binnen-gif-24488260

elli

ello

@honest jolt needs help

@honest jolt wdup man

[honest jolt]

this many people getting bothered for my question LOL

[chilly merlin]

^^
He's trying to solve a ctf and this is given @chilly merlin

[chilly merlin]

you need all the support

✨

[honest jolt]

i love you @chilly merlin

[chilly merlin]

Ayoo

[honest jolt]

no homo

[chilly merlin]

Weird