👥・help-me

[spiral notch]

a vpn?

lol

[still rose]

Yea that works ik but i want my burp collab link to be sent

never played around much with a vpn just clicked connect and disconnect. I cpuld probably setup my own proxy

[barren barn]

[honest pendant]

Anyone who can help me out with finding voucher for certification like CWL red teaming or any other certification vouchers.

[cyan juniper]

#👥・help-me Advice?! 🤦‍♀️My iCloud, iPhone, and Mac got compromised with live persistence I can’t kill. I found a Cloned drive on my Mac (obviously wasn’t meant to find files deeply embedded) that had coded file drops, VPN hops, checksum checks, and payout confirmations — some files triggered to kill my terminal and eventually bricked my Mac, it’s now stuck on the gray “?”. Even after resets, wipes, keys, 2FA, and a new iPhone, iCloud files still delete live off my phone. I can’t find the access point and it’s alive and living its best life currently on all my shit. Anyone here rip out persistence at this level?

[crisp star]

You sure you just didn't enter your credential in a phishing page?

[gusty siren]

Hey guys. I have a question. I don't know a lot about cybersecurity, but I've got a couple years of experience coding with plenty of programming languages (C, C++, C#, Java, Python, Rust). I want to continue working with programming but want to start doing stuff involving cybersec and "hacking." What field and learning resources would you recommend in my case?

[cyan juniper]

Oh, I wish it was that. Unfortunately, I know who it is, and they literally infiltrated my whole Mac, and it only started acting up when I found it and started parsing the files and reading the encoded commas, which clearly were involving illegal under my shit - I’m more annoyed that he acted like he didn’t know shit about technology

[rain acorn]

Hi everyone. I’m in need of a white hat . I have little to zero experience and apparently I’m an easy target. It’s been years of someone violating my network, devices and emails. The ISP has basically said I’m on my own and even though Ik this may be a big risk I’m willing to risk it just to get some peace.
Please reach out if you are a good human who can make time to help a scarred victim like me. Thank you

[crisp star]

For the average person just following these 3 simple rules.

1. Don't click on any suspicious link or download files from questionable websites.
2. Use MFA everywhere
3. In case you get compromised and you don't know how, reset your Pc and change all of your passwords.

[rain acorn]

Hi OX. I have an idea of how my info was obtained originally ( by some people I let stay at my house due to being homeless. Friends of friends) but resetting passwords, using MFA may be a bandaid on a missing limb at this point.

[viral kettle]

isps lwk suck, they rly dont gaf about the stuff that goes on

[crisp star]

It's called having layered security. Your "main" security step is not having any kind of malware or enter your credentials in the first place.

And if that fails you better hope the other security measures work for you.

You can also harden your system, but that's going a bit too much into technical detail.

[viral kettle]

Would it be smart to double check ur router for open ports or vulnerabilities at this point?

[rain acorn]

I’m at ground zero right now. Please give me the nuclear option. They use my sister voice to make calls to me when they haven’t actually called. It’s scary and beyond anything I’ve ever imagined

[cyan juniper]

ISPs and standard support won’t do much once it goes deeper than surface level access. First step is to document everything: device logs, iCloud sessions, look for odd network traffic. From there, focus on eliminating possible entry points (startup items, profiles, VPNs, hidden certs) and confirm if the activity is tied to the account itself.

[rain acorn]

No open ports. I checked.However our devices not all at one time. Make 40 plus hops to connect

[viral kettle]

Sadly the calls may also not be because of the intrusion, AI voice calls have been growing, even those with familiar voices

[cyan juniper]

Do Your calls come in with an actual phone number. If so I can run and get the ips and trace them even with vpn

[rain acorn]

This is interesting is there a how to for non gods out there somewhere that I can do this myself? Or a company that I can hire?

[crisp star]

You pick phone calls from random strangers, because I don't

[cyan juniper]

lol you sound like me I just posted that in another chat

[rain acorn]

It does but it’s a spoofed number . It’s my sisters actual phone number as far as I can c

[cyan juniper]

lol same

[viral kettle]

Yeah scammers lwk got hella good

I'd honestly tell everyone yk to text you before calling first

[rain acorn]

No I do not. It’s my family’s number that shows.

[crisp star]

Are you an important person? E.g some kind of CEO or someone that has a high position?

[cyan juniper]

Oh shit, I mean if it was an SMS you can back door the metadata but other than that if it’s phone calls, it’s gotta go through your carrier

[crisp star]

Because going so deep is usually reserved against high target profiles.

[viral kettle]

So wait, some people where allowed in your home, and that's when it started?

There wasn't anything else you noticed?

[cyan juniper]

I’m over here given advice yet I can’t help myself bc my ex is way smarter than me apparently haha

[cyan juniper]

They would have to know how to access or at least have the password to the Wi-Fi to access the router if they never logged into the admin and changed the password

[viral kettle]

They also could've just bruteforced the password, I'm also not really sure what their exact issue is, it could be malware that moved laterally, or could be leaks, i have no clue

Honestly they also could've just accessed a device in their house as well

[cyan juniper]

Just change your phone number

And reset your router

[rain acorn]

It’s been happening since I let them stay at my home but they have ratcheted up their attacks this last 2 years.. I’m not an important person and I feel like I’m physically been assaulted. So if anyone can help me or can recommend someone professional to help me I would appreciate it

[viral kettle]

That'll fix the calling issue but I re-read the original post and it sounds like a shit sow, emails, devices, a lott

For years is insane

[rain acorn]

I think they have the device serial #’s as well but I like the way u think. Hmmm

[cyan juniper]

That’s why you hard reset the router which will suck ass if you have a lot of smart things in your home bc you have to reconnect it all

Have you blogged into your router ip to change the admin

[crisp star]

Proffesional service, especially for forensic can cost you over +$10'000 easily lol

[cyan juniper]

Damn, I’m in the wrong profession

[rain acorn]

I have actually changed the router 2 times and have a new one in a box looking at me right now

[crisp star]

Like I said, your best bet is just to reset all your devices if you are that worried about it.

[viral kettle]

Well set that up lol

[cyan juniper]

It’s looking at you saying get that old shit out of here

[crisp star]

Also jumping from a router into a different device is quite difficulty anyway.

It's not like you can gain access to a device just because you have access to a router.

[cyan juniper]

If it makes you feel any better I’ve got a live listener on all of my shit that I can’t kill

[viral kettle]

What 😭

[cyan juniper]

Yeahhh I posted for help bc I can’t help myself!! Deeply imbedded in all of my shit

[viral kettle]

jesus

[cyan juniper]

Side note it’s my ex and I did find out parsing his files he injected on my Mac he’s been banging my brothers wife wilddddd

[rain acorn]

Sorry. I obviously can relate

[viral kettle]

Jaw dropped to the floor.

[crisp star]

How exacly did you find that out?

I have my doubts with that story.

[viral kettle]

Also why not j call the cops if it is true?

[cyan juniper]

Check yours msgs

[cyan juniper]

Because I didn’t know exactly what was being done. All I was reading were these conversations that were in code words I can show you a snippet I don’t know exactly what they were doing, but it was very telling that it wasn’t legal but what am I gonna do I’m not a snitch. I’m from Jersey unless it involved harming other people, but I never got that far because he crashed my Mac

• Tunnel is stacked. Triple layer. Exit node clean.
• Receipt confirmed. Ghost account will cover payout trail. Those are two snippets from raw dumps- and I have no clue what was being done so idk

[crisp star]

That sounds more like you shared the device with him and he has also his account on it.

[cyan juniper]

No, we live together for years and he always acted like he never knew anything about technology, but my Mac was in my office and it wasn’t locked. I didn’t think he really knew anything. Honestly he fooled me but I should’ve known because he would always talk about “this kid at work.” who knows everything about hacking. He literally cloned my hard drive so he was controlling my files and his files that were embedded.

[cyan juniper]

He hasn’t had access to any of my tech stuff in well over a year and he’s still to this day currently is remotely on all of my shit and I can’t get him off I literally took a video with my other phone and watched all of my files. Get deleted one by one as if I was doing it. It was bizarre.

[viral kettle]

If he has unwanted access to a device, it's not legal, saying your from jersey is a strange excuse for an issue that's fixable

[crisp star]

Honestly I have my doubts that this is possible. If you factory reset your Mac there is no way that he has access to it.

[cyan juniper]

What am I gonna do? Bring my phone to the cops and say what? They don’t care about that kind of stuff out here not to mention he’s friends with the chief of police so he’ll get notified before anything happens anyway. The jersey stigmas are alive and well.

[viral kettle]

I mean there is ways but I think it's very unlikely he's that skilled in the field

Bring your mac to the cops?

not even

/#

[cyan juniper]

I can’t factory reset it it’s stuck on a screen with a blinking gray question mark

[viral kettle]

Tell them the situation, just do that and see what they say

If he IS friends with the cheif that is probably goiung to be a thing lwk

[crisp star]

Well then go to you nearest apple shop and let them do it if you don't know how.

[cyan juniper]

My Mac is dead. I can’t get past the blinking question mark I tried all of the hot keys nothing worked I even contacted Apple and try to report it to Apple and I saved my conversation and there was nothing they would do.

[viral kettle]

Open it up then

swap out storage for a clean version

[crisp star]

Can you even swap storage on a Mac?

[viral kettle]

I want to say yes, but lemme check

What version of mac do you have

[crisp star]

Apple in general is very restrictive what an enduser can do.

[viral kettle]

Oh fs but I think some of the oldish ones only had warranty voiding stuff blocking the user

it looks like post 2018 macbooks have the storage integrated into the logic board

but pre 2018 is good

You said you did hotkeys, did you enter recovery?

[cyan juniper]

That’s a picture of the cloned on my Mac once I tried to delete it. Shit went South.

[crisp star]

That looks normal to me?

[viral kettle]

Yeah I was going to say...

This was before the question mark then?

[crisp star]

I'm not a Mac pro, but if you erase your disk, I assume it doesn't touch any important system files?

[viral kettle]

It doesn't

You'd have to manually do something like reformatting to wipe it all

but that would make the mac useless so

[crisp star]

When I do a fresh Windows 11 installation I erase everything, including the boot section.

[viral kettle]

Smart

Again did you try entering recovery? and what model is your mac?

[cyan juniper]

Untitled 2 is a clone

[crisp star]

That's the storage name

[cyan juniper]

Yep I tried rebooting from bios it’s just stuck

[crisp star]

You can change it to whatever

[cyan juniper]

No that’s not mine

[viral kettle]

Does your model have a physical drive you can swap?

[crisp star]

https://www.reddit.com/r/applehelp/comments/f3swuk/i_need_to_erase_my_hard_drive_on_my_mac_can/

Ohhhh

The other one is for emergency recover

I was a bit confused about the Internal and Disk Images

[mossy pecan]

can someone help me, i ask my friend for a project and he made it for me but heres the twist he used pyarmor to encrypt the file so can someone help me decrypt it

[crisp star]

So I guess the Disk Image is the one that contains all the important system related files used for the boot process and other critical component while Internal is just your storage

[cyan juniper]

Untitled 2 had full system folders (/System/Library/, /Users/, /Applications/, /private/var/), same timestamps as my main system, plus my caches, crash logs, and Keychains. That means it wasn’t recovery it was a literal full mirrorclone of my active drive that I never created. Not to mention the date it was created was last year and my Mac is four years old.

[crisp star]

that sounds like normal default folders?

[viral kettle]

So you can nottttt physically change the drive okay

[cyan juniper]

OK, whatever you think doesn’t make a difference not trying to prove myself or anything to anybody I just wanted to get it back and running and I can’t

[crisp star]

https://support.apple.com/en-gb/guide/mac-help/mh27903/mac

Yea probably because you erased some system files

[cyan juniper]

Yes, definitely

[crisp star]

https://support.apple.com/en-gb/guide/mac-help/mchlp1599/15.0/mac/15.0

Eh 2 different varients depending on your CPU

[cyan juniper]

Can I? Maybe you can walk me through it on bios clearly I haven’t tried

[crisp star]

Just follow the instruction

[cyan juniper]

when I tried to remove the “alleged” clone untitled 2, I corrupted the boot process and removed the Mac’s ability to find a valid system.

[cyan juniper]

Thanks for the insight teh boon

[fathom summit]

https://tenor.com/view/im-watching-watch-you-eyes-on-you-kid-cute-gif-16282723

[fathom summit]

Kenji you have been warned before about unethical practices. I am watching you 👀 how do we know you are telling the truth?

[hardy pulsar]

Can't we get a mod to ban him since hes been warned before?

[fathom summit]

@mossy pecan need more info here. Why do you need help if your friend supposedly encrypted? Why would you ask us if he gave you the project to do?

[mossy pecan]

can someone help me or give me idea of how to make hcaptcha solver

[fathom summit]

Answer my questions

[mossy pecan]

sorry what questiion was it

im so sorry

😭

[fathom summit]

The ones I tagged you in

[mossy pecan]

he gave me a file but i ask chatgpt whats this file and chatgpt said its encrypted with pyarmor thats why im here to get some help decrypting it

i thought i can get some help insteadd im being question

[fathom summit]

Pyarmor is used to protect code. Decrypting without permission is unethical & illegal. You have asked for unethical help here before. Honestly, I do not believe you. You need to stop

[mossy pecan]

im so sorry

😭

can you help me how to make hcaptcha solver instead

hotami

[chilly merlin]

i need help with this question on tryhackme.com dns in detail : What type of TLD is .co.uk

[crisp star]

Not if it's malware

[crisp star]

United Kingdom

[chilly merlin]

5 character limit

[fathom summit]

For what? What will you use it for. Pick your next answer wisely.

[chilly merlin]

ive tried uk , co.uk and more

[fathom summit]

https://tenor.com/view/birdy-owl-hoot-gif-15662908

[fathom summit]

@mossy pecan answer

[ivory scroll]

[mossy pecan]

Please stop questioning me😭

im going to use it for my project

[hardy pulsar]

What project

[cyan juniper]

Damn some of you are ruthless. Don’t be cyber bullies #notcool

[fathom summit]

People need to follow the rules here and not try to bypass them. No bullies here just protecting the flock, thanks

[cyan juniper]

Sometimes it’s not what you say it’s how you say it

[twin seal]

https://tenor.com/view/cat-orange-cat-laughing-aaaa-gif-4465510619613777157

[open laurel]

Good morning

[fathom summit]

Thanks for your opinion. Sorry for your misinterpretation 🤷‍♂️

[cyan juniper]

@fathom summit I don’t believe it was my misinterpretation. I pretty much verbatim took it for how you said it. I just have a weird feeling if you were in person with whomever you were talking to you wouldn’t say it that way to their face. That’s all I’m saying if you wouldn’t say it to their face, don’t say it on the Internet.

[twin seal]

Not in here

[lost vapor]

let mods do the job people, the reason we're asking for intent before providing service is because we are a partnered server, if anything remotely unethical/illegal gets assistance or a stage here it's on us

[mossy pecan]

oh sht

didnt know that

[woven anvil]

Still kenji?

[mossy pecan]

yes why

[woven anvil]

Kenji

My friend

Please

I beg you

[mossy pecan]

are you getting tired of me

[cyan juniper]

You are hostile AF @fathom summit

[woven anvil]

Start at the beginning

[mossy pecan]

beg what

i did

[woven anvil]

Learn all the individual things you need to do what you want to do

[mossy pecan]

but you cant really change the fate when you need some help

[twin seal]

^

[fathom summit]

https://tenor.com/view/stewie-owl-owl-stewie-not-interested-gif-13065734

[woven anvil]

I don't think you "need" to cheat in mobile legends, or break other people's encryption.

These seem like Wants

[mossy pecan]

i didnt mean cheat

[crisp star]

There is a difference between asking for help and just use google.

[mossy pecan]

lets forget about that

[lost vapor]

but this is your end goal

[woven anvil]

But I can't if you are asking right now to break someone's encryption, not even fully understanding what the language is you are trying to decrypt into?

If you ask a new bad thing, then people will think of all the bad things that were asked.

[lost vapor]

yup and this isn't the first time that it happens, again: we are an ethical hacking server. we don't provide services to others or guide them through an entire operation.
to some degree people have to pull most of the strings, and we help from time to time with questions that are straight forward and comfortably answerable, but not when it comes to unethical/illegal activities.

[opaque needle]

Hi guys

[spiral notch]

omfg

no way you’re still trying

[whole patio]

would that happen to be the very same friend as here?
#👥・help-me message

[opaque needle]

Yh

[crisp star]

With Discord

[peak kraken]

how do i transfer my terminal from vm onto my desktop. like a new tab but terminal

[fathom summit]

https://youtu.be/u036M7p6-ak

[rotund star]

Sudo apt install opsec doesn't work

[whole patio]

Who said that?!

[tidal prawn]

Anyone wanna guide me I'm about to start

[fathom summit]

Hey best of luck in your journey start here #👥・new-member-guide

[tidal prawn]

I get that alot o just need someone to see since i won't understand most stuff

[whole patio]

You want the honest, or the nice answer?

[tidal prawn]

Honest

[fathom summit]

Keep doing research and learning. It will click, keep trying. You got this 💪

[tidal prawn]

Noone will

[whole patio]

no one will. I see that question daily, and no one ever volunteered.

[tidal prawn]

I mean I'm not that good at English and it got alot of talks and learning a new thing and lazness-AHHH

[tidal prawn]

There's a chance

[whole patio]

There isn't

[fathom summit]

That is ok. You can still try my friend, if you are really passionate & intrigued about learning then you won’t be lazy.

[tidal prawn]

It's still pretty hard honestly

[whole patio]

lazy is fine, means you are likely to think about doing stuff more efficient. But this isn't a field of shortcuts and walkthroughs

[whole patio]

It's not entry level, that's why

[tidal prawn]

Basics are the actual hard

Since if i know the basics I'll learn automatically when progressing

[whole patio]

And the less likely you are to research on your own, the more likely this would be a drag for anyone to teach

[fathom summit]

You got to start somewhere & grow. Don’t make excuses, lock in 🫡

[tidal prawn]

Imma try

[fathom summit]

That is the spirit, you got this

[spiral notch]

Works for me

[rotund star]

How do I go from being a script kiddie to an amateur "hacker"

[crisp star]

There is no definition for that.

[rotund star]

Okay I'm just gonna read some more documentation then

[crisp star]

That's how you land in tutorial hell

[rotund star]

Okay then what the hell do I do

[crisp star]

You have to mix it with reading and practice lab

[rotund star]

... Read what?

Documentation?

Practice lab yeah sure i can do that

[crisp star]

Depends what you want to know. Cyber security is big

If you wanna attack Active Directory, then your read about them.

[spiral notch]

what

[near slate]

hey everyone! 👋🏻
anyone here who has a broad knowledge of the secp256k1 ecc?

[crisp star]

Guess someone will stay being a skid for the rest of their life

[rotund star]

Where can I read them

I mean

I spent the whole day yesterday figuring out how to install kali-linux WSL

[rotund star]

Where can i read them

[spiral notch]

pov you asked the same thing

Twice

[rotund star]

He didn't answer me

[crisp star]

The first thing you should learn is to use google for simple questions

[spiral notch]

What for

[spiral notch]

you gave him 20 seconds.

[coarse pasture]

everyone is a skid

[rotund star]

Okay I'm just gonna ask chatgpt then

[spiral notch]

never getting far

Brain gon shrink this way

[fathom summit]

@rotund star that is unethical & illegal and we do not condone in unauthorized access. Please read the #📜・rules

[spiral notch]

oh no this is going in the hall of skids

[crisp star]

Well gues he's never going to work in the industry with that approach

[spiral notch]

too late for him

[coarse pasture]

wtf did he say

change their wallpapers to what

☠️ ☠️

[rotund star]

Okay sorry

[near slate]

i had some questions regarding the curves structure which i couldn't find elsewhere especially on BitcoinTalk or other platforms.

[spiral notch]

ChatGPT, google

[coarse pasture]

oh hi kvts

[spiral notch]

hi ^^

[near slate]

doesn't have the answer, ofcourse i tried them 🙂

[rotund star]

Goodnight im going to sleep gng

[fathom summit]

Good night 👋

[jaunty spindle]

hey chat can someone help me with sending a GET request plz?

[honest crescent]

If possible then can you elaborate that
Generally sending any request we use burpsuite, but I will have to know what are you exactly talking about

Are you getting error through burp?

[jaunty spindle]

im on tryhack me doing the viewsite

Make a GET request to /api/users. What is the flag?

?

[honest crescent]

Ohhh from your description it seems like a API exploitation

Well so Get request is a kind of request that your browser sends to the server to view the content of it

Here the target has /api/users so it is using api
And you can send a get request to it through cURL command and then pipe it to jq like this:

curl “http://target.here/api/users” | jq .

It will show a nice JSON output, maybe flag will be there or you might have to find other api endpoints

[jaunty spindle]

hmmm thank you for this i wish you could give me a visual

[next tinsel]

so there's this dude who created an instagram account pretending to be someone ik and he's out there spreading misinformation about her

i tried reporting the acc for "pretending to be someone else" but instagram doesn't think that acc goes against the community guidelines

a scammer had tried doing the same before in the name of someone else but that time, the acc was removed in like 10min after reporting

what do I do :/

[whole patio]

There is not a lot you can do, if meta support decides to do nothing.

[jade bone]

Signed up for HTB been doing a few modules but am running out of cubes, I started with 40 cubes and am now down to 10. Is there a way to get more cubes and if possible for free? I'm not trying to spend heaps of money but also dont want to keep shifting between htb, thm etc I mainly want to kind of finish one before I do the other. TIA 😁

[spiral notch]

when finishing certain modules

you get 10 back

[jade bone]

Yea I knew that but that leaves me in a loop between 30 and 40 cubes Im wondering if I can earn cubes somehow or something instead, thanks for the answer tho 👍🏼

[spiral notch]

No, you can’t

You have to pay

no worries tho

[jade bone]

Yea damn that sucks then. Alright thanks anyway

[spiral notch]

just do Tryhackme lol

-# (goblin pls don’t kill me)

[next tinsel]

man

[whole patio]

yeah.. bummer.. but if you thought asking that on a hacking oriented server would net you a different result, then the answer is no, #📜・rules no. 3

[next tinsel]

yeah

:/

i thought of just sending him some convincing link cuz atm he doesn't suspect me of anything

might as well try to get access to that account

[whole patio]

Apart from being illegal, it's also simply that every buffoon comes here, daily, asks the same question with a sad sob story no one can verify and tries to argue like he's talking to chatgpt

[next tinsel]

ah

well it is what it is

i could just give you the fake acc and the actual one

it's pretty obv

[whole patio]

you can also just drop the entire line of question, and get to stay on this server.. cause this shit ain't flying

[next tinsel]

ah

[whole patio]

the #📜・rules have no subsection "unless you dont want to, ofc"

[next tinsel]

i just asked it here for the sake of getting suggestions

i don't want no "hacker" to do the work for me

i ain't tryna rent a hacker or anything duh

[whole patio]

great. thats settled then

moving on

[next tinsel]

sure thanks

[lusty coral]

Hey guys I’m new here

Hope all is doing well 🩶☦️

Really on a beginner level what would suggest I start with on a full scale learning aspect?

[whole parcel]

#💕・free-resources etc

[umbral grove]

Well If you need help or want to know how to hack

#👥・new-member-guide #👥・help-me #💕・free-resources are here

[lusty coral]

Thank you guys so much

🩶☦️

[jolly orchid]

What vpns would you rate the best?

[spiral notch]

Mullvad

completely anonymous, let’s you literally send money via envelope with no return address

Servers are ram based

No logs

[past dock]

I just come into cybersecurity recently.
Please give me top resources I can use to learn effectively and efficiently

[spiral notch]

#👥・new-member-guide

[mossy pecan]

can someone please help me this "Bluestacks requires at least 6gb of free disk space in C:\programdata\bluestacks_nxt drive to install"

[odd steeple]

check ur storage dude..

[spiral notch]

what

kind

of question is this

[umbral grove]

Mullvad

[blazing crypt]

it is more like a note than a question

[blazing crypt]

are you telling or asking

[finite vessel]

free up some storage brother

the error details are there

unless you're looking for a workaround if that is your end-goal?

[hardy pulsar]

Any good antivirus that anyone would recommend?

or is window defender enough?

[languid viper]

got doxxed 120th time now

[hardy pulsar]

how?

[odd steeple]

anyone who can give pros and cons of code dex?

[torn sundial]

Is restorecord safe?

Does it leak my ip?

Can someone even know my house with ip

[umbral grove]

No

[umbral grove]

And yes

[umbral grove]

Ive spoken to one of biggest discord d0xing usser the og owner of infosec and yes

[spiral notch]

#📜・rules

report them

on insta

no, u dont

report them

[umbral grove]

Report them to the police and talk with your perants

I promise you the longer you wait the worse it gets

Like ive seen enough extort cases

And the victim never gets in trouble

[rotund star]

Why does sudo apt install opsec not work

[lost vapor]

it's a joke

[rotund star]

Is chrome good opsec

[lost vapor]

are you joking or are you being serious

[next dagger]

seriously joking

[livid sky]

fr0stbyt3s got hacked and his discord account got compromised but he is on it and when his account is clean would it be possible to unbann on this server?

[whole patio]

who just said that?!

[rotund star]

I saw a guy saying sudo apt install opsec in a tiktok comment section

[lost vapor]

yeah nah
don't rely on tiktok for cybersec

the entire platform is literally mostly bs

hence why i never bothered hopping in
the app itself is dedicated to make you doom scroll for as long as you live

[next dagger]

lol it’s banned in my country

[lost vapor]

better that way honestly
it's not banned here but i have never ever registered a tiktok account

i never had tiktok and never will

i feel proud saying that lol

[next dagger]

me too

[woven anvil]

Whats the difference between that and instagram

[lost vapor]

none honestly
i don't do instagram either

they are both dedicated to make you scroll

[woven anvil]

Designed to steal your "Agency", and allow you to have less control over that part of your life. Kind of like doritos.

[glad ember]

How to get virtual numbers ??

[umbral grove]

Apps

[opal pilot]

I had a phone addiction but 3 to 4 months from now I deleted everything and now I have so much more free time

I don\t even want them anymore

https://tenor.com/view/freedom-gif-14887144685173519659

[rugged trellis]

I’m new

I wanna learn

Can someone help

[solid gull]

#👥・new-member-guide

[glad ember]

Which app kindly mention

[umbral grove]

2number

[umbral grove]

If you need help or want to know how to hack

#👥・new-member-guide #👥・help-me #💕・free-resources are here

[glad ember]

Available on playstore??

[umbral grove]

Yep ill send you the link

https://play.google.com/store/apps/details?id=com.bpmobile.second.phone

[opal pilot]

oh I know this I used it

there were a tool compatible with linux that I used to sue to get free calls and spoofind for free 😭

but it got banned or patched or idk

[torn sundial]

Ty

[stone jay]

good evening i pretty new here

i want to learn coding but dont how to start

any suggestions

[haughty dawn]

https://www.python.org/about/gettingstarted/

[stone jay]

thank you

[opal pilot]

@woven anvil btw last time when you were talking about flashing kali with rufus is bad

were you talking about only for kali's case or rufus as an app

[woven anvil]

#👥・help-me message

Thats the context

DD mode should work in theory, but the regular mode ignores the standard to "automate" some things, which can break some ISOs

[opal pilot]

thanks ♥️

It's just that It was in the back of my mind and I just remembered it

[whole patio]

not just kali, there are other distros too - I just don't use rufus anymore if I can help it

Not saying it is a problem for every OS image out there though

[woven anvil]

yeah, thats why i linked the topic. ^_^

[modern cradle]

hi i need help

[spiral notch]

https://dontasktoask.com

[twin sentinel]

helloo, what do you need?

[modern cradle]

Can you send me a DM

[twin sentinel]

I usually don't talk on dms

But what's up?

Are you looking for some specific topic? Maybe i could help c:

[modern cradle]

I don't how to explain that thing.

[spiral notch]

he probably needs his exs insta acc back, yk, the usual story LOL

[spiral notch]

ofc you don’t, thus why’d you want him to dm you

If you don’t even know how to phrase your question

or why ask if you don’t know how to ask

[twin sentinel]

That's what I thought

There's a channel for a reason

I don't mind helping others

[twin sentinel]

Literally the acc was created in less then a week, I'm just being careful ;)

[whole patio]

If people want to go to DMs on a hacking-centered discord server they simply want to evade scrutiny and nothing they say is truthful

"I dont know how to explain that thing" is either an obvious lie, or they should come back when they collected their thought

Like showing up at a restaurant and telling them you really dont know what you want to order

[modern cradle]

I can't understand the Hack the Box fawn challenge in task 7

[whole patio]

You are on the HTB discord and have not asked there?

[modern cradle]

No

[whole patio]

I know that you have not, the question is "why"

its their content, ask them

[spiral notch]

people are getting dumber by the day

[whole patio]

you are literally named "batman htb" ffs

[modern cradle]

I know what the question is, and I know the answer, but it's showing me an error message.

[whole patio]

And what made you think "Hey.. I better not ask the people actually offering up that task.. lets go over there to some random other people instead"?

That's no way to go through life, son

[woven anvil]

i promise i researched the plymouth thing after you talked about it

[foggy breach]

who better to teach than the people who made it, great courses

[little mural]

chat how do i flash linux onto an android :D

[opal pilot]

Holy shit 🤣

[opal pilot]

You need to have a jailbroken phone first

To fully use linux on it

Or if you want just termux

[haughty nova]

Android is based on the Linux kernel. What are you suggesting you want to do with your Android?

[grand kindle]

Anyone familiar with instagrapi?

[toxic sand]

What does the “target” in VM target mean?

[whole patio]

context?

[toxic sand]

No like what is target?

A software or operating system? Smth like that?

Also how do yall manage the cubes in HTB academy? Subscriptions?

[whole patio]

I understood your question

Now tell us where you got that from, give us some context to your question

[toxic sand]

Oh I was in HTB academy and they told me they have two targets and their names

But I don’t understand what target itself is and so I asked

[whole patio]

I've never used HTB, but I assume it means that you connect and in your network there are two virtual machines, that are your target. Maybe one server, one client

[next dagger]

target in htb’s context is the ip address of the server you need to attack

[toxic sand]

Got it

Thanks!

[next dagger]

[toxic sand]

Also how do I manage the cubes

[whole patio]

HTB has its own discord server, maybe join there

[next dagger]

you pay cubes for unlocking modules. each module you complete you’d get some cubes back

but if you want to do advanced modules then you need to buy cubes

[toxic sand]

🥲

[ashen steeple]

I new to this, i need some help, why does the NTLM sends a random number to the client to do verify, why cant it just verify the hash?

[whole patio]

The "hash tag"?

the ntlm is the hash

[versed sail]

Heyy

Oh wait Im in the wrong channel

[whole patio]

neither NTLM1 or 2 are mere numbers.. how sure are you that you are really looking at NTLM?

[ashen steeple]

i saw a graph that shows how NTLM works, and i saw it sends a random number back and i had no idea what the random number do

it says that it was suppose to be a challenge, but how

[outer kayak]

I don't know

[nova crater]

-# why can’t I put images here?

[ashen steeple]

The server authenticates the client by sending an 8-byte random number, the challenge. this is what Wiki says, i don't understand

or doest it means just send 8-byte of random string?

[whole patio]

#🤝・roles-info

[nova crater]

.w.

[whole patio]

I don't know where you saw that, nor what server or client you speak of, but nothing about that sounds like ntlm

[ashen steeple]

this make me even more confused, isn't that how the challenge-response authentication works? or i am completely wrong

[whole patio]

not with 8 bit it doesn't

ah.. I see what you mean

https://en.wikipedia.org/wiki/NTLM

[finite heath]

I want to learn OWASP Top 10 Web 2021

I want to learn it in a way so that I can able to explain to anyone even layman.

• Definition
• Root Cause
• Testing Techniques
• Impact
• Mitigation
• Code Example (secure vs insecure)

[ashen steeple]

I'm just being stupid, I understand it now, thanks for the help

[twin sentinel]

Helloo! I'm looking for notes and practical exercises to take the AWS Certified Cloud Practitioner exam. Does anyone happen to know of any good sources?

[little mural]

I tried rooting it and that didn't go well so it just bootloops now

so I decide I'll just flash like debian or something instead of stock

[little mural]

I want to flash a more standard os instead of stock, since it only bootloops rn after I failed at rooting it

[civic bone]

HELP

IM BEI|NG

KIDNAPPED

[twin seal]

https://tenor.com/view/realkimroro-police-gif-23236998

Help is on the way

[umbral grove]

GET in the VAN

NOW

Brother/lover

[civic bone]

oki

[haughty nova]

Flash TWRP recovery and there are options to flash different OSes like GrapheneOS or LineageOS, but I suggest researching first. With TWRP you’re able to flash and install any OS or app like Magisk for rooting.

[little mural]

any good tutorials for that?

also my phone's an a/b boot, would that change anything?

[haughty nova]

Just search your Android’s model and how to root, there should be some wikis or video tutorials on youtube

[little mural]

uhhhh the only tutorial I found was one singular dead xda forum

actually that's how I got it boot looping in the first place

[haughty nova]

What is your phone model?

[little mural]

REVVL V+ 5G

[vague turtle]

wasssssuuuu0ppppp ppplll

[lament obsidian]

Guys i need big time help I have been so burnt-out on learning the fundamentals of Cyber Security since june. Legit I feel like Im just constantly learning simple things and not actually getting to the practical side. What should I do?

[modest sluice]

Are you going to school for it or are you being self taught ?

[modest sluice]

?

[lost vapor]

just learn what you need until it's over, once you do you can get some hacking related knowledge
where are you learning?

[sage lodge]

https://tenor.com/view/twilight-bella-swan-ill-never-let-anybody-hurt-you-protect-you-i-will-not-let-anyone-hurt-you-gif-3378308279527539328

[lament obsidian]

Gonna start uni for it but self learning rn

[lament obsidian]

I’m using try hack me rn on pre security so close to the end but I’ve been on it for ages. I’m start uni for Cyber Security tho

[lost vapor]

yup that's how it is

[modest sluice]

Oh ok I don’t have any advice for you because I’m about to start my journey Thursday I’m going back to school

I’m going to do computer science

First

[lost vapor]

you'll keep learnin fundamentals as you go as well

sometimes you'll stumble upon technology you're not familiar with

and you'll need to hack it, to hack it you first need to understand how it works

a lot of the time hacking flow becomes faster due to the person knowing what they're messing with

i wouldn't be able to hack an active directory as much as i'd be able to hack into a web server

that's a lot of reactions lol

[lament obsidian]

I appreciate it very much that’s why

Yh I fully understand you I just can’t wait to finish the fundamentals to finally start hacking something practically

[modest sluice]

The power of understanding is profound . Knowing and understanding is distant from each other

[lament obsidian]

Rn I just need to lock in and hopefully finish pre security by next week and any other relevant fundamentals thanks @lost vapor

[modest sluice]

Do you do any activities to increase your thinking power z? That may help

[lament obsidian]

Wym like reading?

[modest sluice]

Such as chess , reading , fasting , pure supplements , nutrition, and sleep

[lament obsidian]

Yh I mean I do reading nutrition is 50/50 and sleep is not very good rn 😭😭😭

[woven anvil]

Play nerd games on steam that teach hacking or networking concepts for fun

[lament obsidian]

Like what?

[modest sluice]

If your mind is not there you won’t be all that you can be . You need nutrition and sleep unless you can’t and if you can’t you must just bear a great attitude and try harder

[woven anvil]

Turing complete is good for understanding hardware/ how a cpu/ram are made
Tower Networking Inc gets you some interesting network practice
Shenzen I/O is also interesting for integrated circuits.

[lament obsidian]

Ohh damn

[lament obsidian]

Your right

Thanks so much both of you @woven anvil @modest sluice

[woven anvil]

obviously, games will be unrealistic, but its a nice "fun time activity" instead of your 5th games of valorant, or whatever people play these days

[modest sluice]

Your welcome Z

[woven anvil]

Games like Screeps help practice programming(using JS 🙁 )

[lament obsidian]

Yh 100% they’ll teach you things rather than make you waste time

[lament obsidian]

Ok

Thanks so much bro I appreciate it loads

[civic bone]

Well it's too late 💔

[spiral notch]

anmd

whgat have u learnt

already

[solid gull]

In #📜・rules

[fathom summit]

@lyric ibex first -> you hit the back button -> scroll down to rules -> select that -> then you read the #📜・rules

[fathom summit]

https://tenor.com/view/im-watching-watch-you-eyes-on-you-kid-cute-gif-16282723

[lost vapor]

@shrewd larkwe don't help with those type of things over here, read our #📜・rules

[leaden canopy]

Ok so im now going into my last year before university and I am currently leaning towards working to becoming a pentester/red teamer etc. etc. Now I have 3 options: 1. Go to one of two bigger Uni's to do a bachelor in Computer Science, then I can do a master in cyber security or just continue my work after the bachelor. 2. Go to a smaller uni to do Information Systems, one plus is that it's close to me. 3. Go to a other big uni to follow a cyber security bachelor which is new this year. What do y'all think?

I think so far my preference would be 1. but I wanna hear what you guys have to say

[lost vapor]

i've gotten into pentesting and hacking without much of computer science, all depends on what field to you want to excel in

[leaden canopy]

I mean im not that educated yet but red teaming seems like something that I would really enjoy doing

And right now I am working on getting into bug bounties myself

But the thing I was thinking about was that in my view Comp sci is a bit broader and after I can specialize

[lost vapor]

no need for any compsci stuff, learning hardware, networking, OS fundamentals, and some programming should be enough

if you do wanna go by that road because you're interested in the information go ahead of course, but if you fear that you'll miss out on something: trust me you'll be fine

don't take it only from me of course, you can check out google or even ask preplexity on that
i rely on ai to some degree for relevant information

[woven anvil]

Some of compsci was relevant

Its just the pacing of it didn't make sense

[leaden canopy]

Im not in the usa btw so its different

[woven anvil]

me neither

and helping people with school work all the time
it doesn't seem that the pacing is much better in a bunch of places

[leaden canopy]

My idea was just that with compsci u can go all kinds of ways and if I do a bachelor in cyber I immediately specialize

[leaden canopy]

ah ok

[leaden canopy]

Im working on those basics already myself now

[woven anvil]

Imo, the pacing of the classes are much better when you already have an understanding of the fundamentals

tryhackme -> hackthebox -> homelab

Understand how to:

• Install different OSes in VMs (Windows/Linux/BSD),
• Make a segregated VM network with its own VM router
• Use something like python, and find projects to do where you can implement python into it, like a "server manager" for a game or something.
• Build a computer( or how hardware works in general.)

You will learn way faster doing it this way, and you won't be in a position where they are asking you to use ubuntu in a VM, and everyone in your class is having trouble with it because everyone bought gaming laptops with 16GB of RAM and it can't run windows + web browser + an 8GB ubuntu VM because they want a GUI, and so nothing gets done.
The best part about school is the ability to interact with your peers there, and strengthen your knowledge by helping and tutoring others. After doing something 100 times, troubleshooting weird issues or setups by people making mistakes, you get a strong understanding of all of these things, and it helps you a lot when it comes time to sit down and learn a new concept on your own for whatever cert or job or whatever you want to do in the future.

[leaden canopy]

Thank you for the info! Seems like im on the right path then lol because I've started with some of those things already

I am following the mooc.fi python course and I build pc's for a living

Also setup multiple vm's with kali and arch

and mint

also doing thm

[simple basalt]

Hello evry1

please i need a mentor and some1 who can guide me tru my projects

its not fre thoigh! lol

[woven anvil]

Nice. The "Segregated network" is an easy one, where you just work inside whatever hypervisor you are using, and make VMs to act as the "Gateway", or the "DHCP" server, or whatever other part of a router you want to learn about (these are just debian VMs, but you could use any linux, BSD, or even Windows if you hated yourself)

[simple basalt]

got a new role after so many years of interviews ....

[leaden canopy]

Interesting, ill look into it!

[woven anvil]

Forgot screenshot
These are on 2 virtual bridges.
1 for "WAN"
1 for "LAN"

Can think of a Virtual Network Bridge as a "Network Switch" emulated in CPU.

[simple basalt]

Any1 with 3rd party experince ?

[woven anvil]

We don't really do Mentoring here. If you have questions about specific things, then feel free to ask them. But we recommend to get a deeper understanding, starting somewhere like here https://discord.com/channels/990435451334688768/1306084252437450763

[simple basalt]

thanks @woven anvil

[valid belfry]

Hello

Are you trying to create a virtual network

[woven anvil]

Nope. I was responding to someone else.

[valid belfry]

Ah my fault

Tired asf

[woven anvil]

like my WAN IP? 😉

[valid belfry]

Yo jeevis if you're interested check this out

My friends and I use it for project

I'll dm it

It's a lot

[subtle estuary]

Can someone help me in regards of my home network, it was compromised, someone rewrote the admin page for my Motorola router, I can’t find a .bin file online, the ISP is not assisting me , my coax cable is acting as if it’s an RJ45 , my identity was stolen also

Ive come to conclusion per wireshark scans, it appears someone did a MITM ARP Spoof attack

If not, I understand

[brazen ravine]

Hi everyone can someone please help if possible. How can i log into my yahoo account, i lost a contact number long time ago where they send verification messages and doesn't allow me to login using other options. Is there anything that can help me?

Thanks!!

[umbral grove]

@lost vapor

[umbral grove]

#📜・rules

[lost vapor]

holy skids

[umbral grove]

#📜・rules

[lost vapor]

call in your isp

[coarse pasture]

manifest it

[honest crescent]

Send them a mail! And wait for the rare case to happen “their response”
If you don’t receive any help, best option would be give up TikTok! Less best option would be create a new one

Thanks for your question 😊

[glad ember]

Anyone has ios spyware software or Pegasus??

[next dagger]

whom do you want to spy on

[glad ember]

I got project for android and ios

[next dagger]

a project of making a spyware? i don’t believe that

[glad ember]

You have or not??

If you have then kindly give me that

[next dagger]

or what if i don’t?

do your research first dumbo. pegasus isn’t just random script you pass on discord servers. plus distribution of spyware and anything unethical is against #📜・rules

[glad ember]

Then that is your choice what should i ddo

[glad ember]

I know its illegal

[next dagger]

but you didn’t know the rules

[glad ember]

Ok thank u

[spiral notch]

bro

LMAO

find it yourself

it took me like 1-2 months to find Pegasus

sample n source as much as possible retrieved

• it’s not effective anymore

[glad ember]

Bro anyother that is worth effective

[spiral notch]

nothing that’ll be free

or public

[glad ember]

Ok boss

[umbral grove]

Stop talking about this dued

[lost vapor]

the whole point of a pegasus or the main idea behind it is that it's hidden from any public access purposefully, finding one is a big deal and what you'll find on the internet like any other type of malware would be detected and not work anymore.

people just forget about that when talking about these stuff

either that or they just don't really know to begin with

[next dagger]

what’s your project anyways?

[tired eagle]

nobody has this

[tired eagle]

and no. you dont have pegasus
you have a malware sample taken off of an infected phone
you do not have the source code, binaries, or infrastructure to the actual control panel

[spiral notch]

infras to the c2 obviously not, I told you I attempted to retrieve as much of the source as I could

sample is obvious

[tired eagle]

yes so you do not have pegasus lmfao you are basically saying "oh yes i have lumma stealer because i went on malwarebazaar and downloaded the latest uploaded sample and reversed the source"

but you dont have the infra or backend control panel, making the sample useless and only for research, understanding and IOC collection

[spiral notch]

^^

[tired eagle]

so idk why u say "i have pegasus bro took me like 1-2 months to find pegasus bro", like u actually have access to the whole thing

[spiral notch]

and I clearly stated

source and sample

[spiral notch]

.

read the entire thing first lmao

[tired eagle]

yeah ur making it seem like u have the entire pegasus setup, control and builds

[spiral notch]

when?

[tired eagle]

unless you literally misunderstand what the guy was originally asking for

[spiral notch]

I literally clearly stated I have as much of the source retrieved as I could and the sample

I very clearly stated

[tired eagle]

yes from a sample which is useless

[spiral notch]

what you hallucinate out of the literal words I said is not my problem

[tired eagle]

he didnt want a sample of the malware

that was the original question

he obviously doesnt want a sample of it, guy probably couldnt even jailbreak ios 14 successfully

he wants the full thing, to be able to use it against people

you, then saying, "i have pegasus man it took me 1-2 months to find it" implies you literally have full access to pegasus control panels and builders

/exploits etc

[spiral notch]

obviously from that 1 message. Thus right after that I said sample and as much of the source as I could retrieve

I very very explicitly said it

you’re still going of implications “oh you said this so let’s ignore all your other messages and say you’re wrong with like less than half of the entire context”

[tired eagle]

when you say "as much of the source as i could retrieve"

are you referring to the backend infra or again, the samples of pegasus

because if you're referring to the samples then that is what i mean, he doesnt give a shit about that, and those samples have been heavily reversed and documented by other people over time

my point is that you just saying "oh i have pegasus yeah"
you dont have pegasus you cannot use pegasus
you have samples which were used in campaigns, you cannot use them yourself

[next dagger]

why do you care so much? it was made clear he’s not going to get it from here anyways, if the third party has the source or not

question is already answered

[tired eagle]

to avoid people from claiming they have shit that they dont

helps avoid misinformation, scammers, etc

[spiral notch]

LMAOOO

bffr

[next dagger]

i’m not sure how thrashing someone over something they claim is doing any good to this channel. if you want to report it or something there are channels present lol

[spiral notch]

as if I’m gonna sell it first of all

Second of all

I told you I clearly mentioned things

I’m going off of clear facts

You’re going off of implications

[tired eagle]

which you created yourself

[spiral notch]

No LMAO

Which you interpreted and hallucinated

[tired eagle]

did you assume he was literally asking for samples

or the entire infra to be able to use pegasus

[spiral notch]

I did not assume anything

I just wrote

[tired eagle]

that you had it

when you dont

[spiral notch]

Assuming doesn’t lead somewhere always

[tired eagle]

you have samples

[spiral notch]

as you can see, right now it doesn’t

[twin seal]

Wth is happening right now

[tired eagle]

two completely different things

[spiral notch]

he’s going off of implications

saying I don’t have Pegasus

[lost vapor]

She literally wrote she has samples lol

[spiral notch]

because in his opinion it’s the e entire thing

[normal prawn]

Hey i just got called by someone who calldd with their own number and the person said my name and some random stuff (prob someone that knows me), how can i gather information about a number?

[next dagger]

not sure but if you want popcorn ive got it

[tired eagle]

here is you assuming he means samples

but ok

[spiral notch]

find WHAT yourself

Find IT

literally can mean either

[lost vapor]

We don't assist with those things here #📜・rules

[spiral notch]

It’s yku assuming I mean samples

[next dagger]

police. no other way

[normal prawn]

im sorry

[spiral notch]

I’ve literally said multiple times what I have

Yet you keep assuming

[tired eagle]

my point is that you cannot "find pegasus"
it is literally not publicly available

[normal prawn]

alright ill try that

[lost vapor]

All good

[spiral notch]

And my point is that I don’t have the infrastructure to it but I’ve obviously already mentioned it

I said what I do and don’t have

You keep saying “no you don’t have it because even though you didn’t say that you have it you apparently implied it”

I have not implied anything

[next dagger]

the other guy’s going about attacking her with a question that is already answered lol

[spiral notch]

^^

[tired eagle]

you saying this literally sounds like you have everything you need to use it

is all im saying

[spiral notch]

yes, and I agree with you

yet you still take things out of context

BECAUSE

right UNDER this

I type the following

[spiral notch]

.

That was my message right under

so I have no idea what’s your reason for taking things so blatantly out of context

whether to defame cuz you’re bored or to spark some things up

I’m not wasting my time more on this anyway

[tired eagle]

which can also imply that said "source" you're talking about could be either backend infra or samples

[spiral notch]

have a nice day

[tired eagle]

idrc im just saying what you said in the way you said it made it sound like you have shit that you dont

[rigid remnant]

hello i was looking for help i saw one of the last videos that talked about iphone security and how to check it through the phone app using codes when i used the 61 code the first option was enabled and when i tried to disable all it said there was an unexpected error what should i do

[toxic sand]

Is asking to be paid in bitcoins normal for a hacker?

[tired eagle]

usually crypto is preferred when it comes to underground sellers yeah

though if you're looking to "rent a hacker" or something, chances are its just a scam

[umbral grove]

True

[toxic sand]

What’s underground seller?

[tired eagle]

cybercriminals who sell malware, fake phishing pages, databases, etc

[toxic sand]

Oh oh

That’s not great

So for a job at an organisation crypto is weird?

[tired eagle]

uh, yeah usually lol

[toxic sand]

Thanks

[whole patio]

"Hi, I am the new information security officer, and I have full confidence in my capabilities. I also would like to be paid in bitccoins" 😄

[odd steeple]

somehow i got my number leaked on a server what precautions can i take rn? they are signing up to apps and im getting tons of otps any suggestions/advice

[tired eagle]

change ur number

[blazing crypt]

eject your sim , take 100 grams of gunpowder , put you sim inside a pich with gunpowder , take 1 liter of oil , burn the bag and spill whole oil on it

problem solved

[ashen steeple]

Question about Kerberos, after you send a requested and id to the server, and it sends a respond that is encrypted with TGS, but the client doesn't have a key to decrypt it, then how is the client be able to read the message

[tired eagle]

the TGT doesnt need to be decrypted by the client

the AS wll include a session key which is encrypted with the clients own key derived from their password, thats what lets the client continue

[lime ginkgo]

Hello greetings everyone

[tired eagle]

👋

[ashen steeple]

but the second process it sends a ID of service request with it

i don't understand why it sends the same thing twice and it's only used for two times

[tired eagle]

its not sending the same thing twice, its that the TGT is a reusable token, the TGS will just forward a fresh authenticator, which prevents replay attacks

[ashen steeple]

so the message that doesn't need to be decrypted is only used to be authenticated by the server?

but it kooks like the client sends the whole thing back without doing anything to it how can this help with authentication

[tired eagle]

yes

[tired eagle]

the ticket itself proves auth, and the authenticator proves the client is active and holds that session key

[ashen steeple]

so does it means that i need both of it in order to pass the process

[tired eagle]

yes both parts are required

[ashen steeple]

can i do the same thing that is use to cheat NTLM, by just hijacking the two message and send it to the server

i was thinking this, because if the process only verify the result isn't it pretty mush the same thing as NTLM

[tired eagle]

kerberos is designed to prevent this by using its authenticator, its session keys are used only once per ticket request, and the fact that tickets expire

the authenticator for kerberos uses timestamps so, that wouldnt work in a replay attack

[tired eagle]

no because of the authenticator

[ashen steeple]

but if i hijack the message with timestamp wouldn't it work? or that's simply not how it works

[weak summit]

I am trying to make exploits for spesific CVEs , but I cannot find the exploitation details just a brief description which is barely usable, where can I find exploitation details

[lost vapor]

gotta search for it the right way, eventually you'll come across a PoC

what's the cve for if you don't mind me asking?

ctf?

[ashen steeple]

Oh wait, because when you hijack it the time stamp will expose you so it wont work

thanks man

[weak summit]

Tomcat RCE

CVE-2024-50379

[lost vapor]

are you exploiting in a ctf or?

lab?

room?

box name maybe?

[weak summit]

No I'm just making CVE exploits to upgrade my skills

[lost vapor]

the cves are already made

[weak summit]

Find a reliable exploit for this CVE in python

You probably can't

[lost vapor]

me who just found one

[weak summit]

In python?

[lost vapor]

by a simple google query

yeah

a github withi t

[weak summit]

Gimme a sec

[lost vapor]

cve = common vulnerabilities and exposures

[weak summit]

Oh yeah didn't check that one

[weak summit]

I know what cve means

However not every CVE has a poc

[lost vapor]

yeah just clarifying these stuff are known
you said you wanted to make a cve

it's different

[weak summit]

No

[lost vapor]

you're right

[weak summit]

I said i wanted to make an exploit for cve

[lost vapor]

ohh kk

[weak summit]

I struggled with latest CVEs so I assumed it didn't have one either

Thanks for the help

[lost vapor]

even latest cves can have PoC's

just gotta search a bit more

i am using duckduckgo as my search engine btw

i find it to work better when i search for stuff like that

[weak summit]

Yes but CVEs that came out days ago usually don't I get the point tho

[tired eagle]

a lot of the time, you wont find those details as they are commonly not disclosed

most you could do is download Tomcat versions before the patch occured, then after the patch occured, and diff the two files to see what was changed

[lime cobalt]

Guys how to hack lucky patcher ?

[tired eagle]

elaborate cuz this question makes no sense

lucky patcher in and of itself is a sort of cheat, allows you to get multiple gems/bucks etc in mobile games

so what do you mean you want to "hack" it

[lime cobalt]

It was a joke

[tired eagle]

hilarious

[weak summit]

Yep I'm trying to avoid that and that's exactly the problem I'm facing I was wondering if any of you knows somewhere where such details are exposed

[tired eagle]

no, it doesnt exist

those types of details are usually found by patch differs who reverse engineer the patches to find a way to make an exploit

then sometimes release a Proof of Concept exploit

[woven anvil]

PoC is usually only released after a patch i believe(though not everyone would follow the rules)

[tired eagle]

it depends on the exploit though, if its an exploit for something that nobody seems to use, theres not going to be much interest for it

and therefore not much research done into the actual patch and going even further, making an exploit for it

[weak summit]

I see

[tired eagle]

however if its something interesting that can affect lots of devices, or perhaps many company networks use it, etc etc, then it will have more research done and potentially more POCs

[weak summit]

That means I'd need to spend like a whole day trying to make an exploit?

[tired eagle]

you'd probably spend more like a week just reverse engineering the patches

[woven anvil]

If your plan is to make exploits, then yes, you would be the one making the exploits(instead of just taking other people's)

[tired eagle]

potentially more depending on the complexity of the exploit/patch itself

then after you understand why the patch was implemented, and how it was implemented, and you understand the root cause of the vulnerability, then you can start to think about how you'd write an exploit for it

[weak summit]

Seems tough but thanks for the analytical explanation

[tired eagle]

it is tough, zero day/one day engineering is extremely complex and requires extensive experience in other areas such as reverse engineering and binary exploitation

[weak summit]

I thought a zero day was an exploit of an undiscovered CVE , that'd be refering to a one day I suppose

[tired eagle]

a zero day is an exploit of a non discovered vulnerability/CVE yes

a one day would be an exploit that is created after a patch, usually through patch diffing as i mentioned

and finding one days is obviously a lot easier since usually patches are narrowed down to a few functions which get modified so the vulnerability is patched

however zero days you are going in blind completely

[weak summit]

What about a CVE that has not been patched but it has been found and there's no public exploit for it

[tired eagle]

thats disclosed

but unexploited

there is no specific "day" name for that

[weak summit]

Alright

[radiant stone]

Ya all the "days" refer to is days to patch

[ashen steeple]

does Redis has a build in nmap filter or it's just the owner's decision

for some reason using /nmap -sV <ping>/ only result in all port is ignored

[lament obsidian]

I’ve learnt everything until the part where you learn about URLs and HTTPS

[hardy pulsar]

Is there rooms on THM or HTB where I can see how certain pentesting tools work in a contained environment?

[spiral notch]

Hydra room

nmap room

introduction to metasploit

burpsuite

[hardy pulsar]

Thank you

[hardy pulsar]

Are u in the ctf team or r u too busy to join?

[tired eagle]

most rooms in THM or HTB will have you practically using the tools related to the room

[hardy pulsar]

Yeah thats true I was just wondering thr specific rooms that a beginner like me could see how the process of using the tools looked like

[tired eagle]

check out the junior pentester path

[honest pendant]

Hi everyone i have a basic question can two devices have same ip address at the same time ?

[tired eagle]

for public IP addresses, no

for private IP addresses, yeah

[honest pendant]

Bro can you define answer please

[tired eagle]

though special cases like NAT will make it so that many devices inside a local network will share one public IP but each have unique private IP

[tired eagle]

if there were two devices on the same local network witht he same private IP, that will result in an IP conflict, though across different networks, NAT, Anycast, etc, it can work fine

though again for public IP addresses on the open internet, no, two devices cannot use the same public IP address

[woven anvil]

You can SNAT from LAN to LAN as well. Not only exclusive to WAN(But that is where it is commonly used)

[molten shell]

small question, how can i detect honeypots on onion? i'm searching for some legit hacking stuff

[tired eagle]

any "legit" hacking stuff on tor is just going to be straight garbage

ur not gonna find some super secret and new hacking techniques that allow u to press 1 button and hack anything

[molten shell]

a friend of mine said discord hackers ain't shit, last resort to learn something

[tired eagle]

it just simply doesnt exist, the clearweb would be better for finding resources on the different subjects within hacking

[tired eagle]

they arent really, mostly just com kids who think they know shit

[molten shell]

got a point

[tired eagle]

though you seem to be ignoring the fact that real researchers are out here on the net doing real and proper research into new techniques

see DEFCON talks, BlackHat talks, etc etc

[molten shell]

but still, how does one detect honeypots? nobody wants to be caught by the feds

[tired eagle]

thats kinda the whole point of a honeypot you're not going to be able to detect it

[molten shell]

so how do people know some already?

[tired eagle]

primarily because there is usually nothing about a webserver or site that indicates its a honeypot, what indicates its a honeypot is who owns the site, which isnt exactly easy to figure out

[molten shell]

and how do i know that the first websites that pop up when i search something the feds put honeypots into aren't honeypots?

[tired eagle]

talk within the scene, past experiences, sometimes OPSEC mistakes are made

[tired eagle]

again, you dont

[molten shell]

yeah i figured it out while i was typing

[tired eagle]

thats the point of a honeypot, it is made to catch criminals

what "hacking stuff" are you looking for on the onion anyways

[molten shell]

i wanna create malware

seems fun

[tired eagle]

you'll find barely any resources about that on the onion

not to mention before even "creating" your first malware you should know how to write code in the first place

Python, C, C++, etc, whatever you want to go with

[molten shell]

i'm trash at all

i m cooked

[tired eagle]

everyone is when they start out

maybe start with python first if you dont actually plan to spread your malware, since that can give you a good idea of how a lot of python malware works

then move into C when you're more experienced in writing code in python

[molten shell]

yeah but it would be a waste of energy to start now since i'm literally studying on a profile of bio-chemistry, it would've been profitable if i was on the maths-informatics one

[tired eagle]

it takes years for even a quick learner to fully understand the aspects behind coding, especially when it comes to external libraries, interacting with underlying operating system utilities like the WinAPI, etc

[tired eagle]

well then just learn it in your free time if you are interested

i have malware development resources if you want them, cant paste here as the bot will delete it but u can dm

[molten shell]

i could but yk, school stuff and my country has the hardest learning system itw

[molten shell]

sure why not

[spare geode]

Ok so I have what I think to be a networking question, I am considering port forwarding on an old laptop for server hosting for a game, that’d be happening on my home net. On a 10 point scale how bad of an idea is that? 10 being the highest.

[tired eagle]

how many people are playing

[spare geode]

I’d say a max of 8

Game has dedicated hosting tools which include an account system

Like passwords and logins

[tired eagle]

wouldnt be a big deal you'd probably just have to harden the firewall a bit to prevent any inbound connections or requests that arent logins from your friends

[spare geode]

I am somewhat concerned though as I have to hardcode the logins myself into the server’s config file and the passwords can only be stored as plaintext far as I know

[tired eagle]

if the logins are on ur laptop u should be good provided its semi updated

[spare geode]

The laptop?

[tired eagle]

yeah

[spare geode]

Oh yeah that should be fine then

[tired eagle]

wouldnt want to be hit by eternalblue in this day and age

[spare geode]

I know of the name but I forgot what does

Nsa backdoor thing, right?

[tired eagle]

exploit the NSA created, was leaked then used by north koreans for the wannacry attack

[spare geode]

Oh yeah

Fun

Old laptop is set to auto update but it can’t handle windows 11(it is win10 atm), thinking of looking into linux for it and see what I can so from there 🤷‍♂️

Speaking of which, anyone know of any good linux distros for lets say someone who fears cli and is far more comfortable with guis?

[shrewd lark]

Can anyone help me get the real worm gpt

[whole patio]

impossible to say

Ah, the usual crossposting "help me hack social media"-nonsense. Never mind then

[spare geode]

Was literally about to tell you lol

[whole patio]

So.. twisting nipples for crossposting/rules violation.. how far along is the bleeding edge tech now?

[versed pagoda]

@tropic lagoon what is hoot helping you with im just curious

resseting ur router?

[storm wave]

Yo anyone knows how you include nexus mods to fitgirl repack games?

[tropic lagoon]

No

The router is off

[versed pagoda]

Ohh

and ur trying to turn it back on

[tropic lagoon]

I was asking for help to turn it on

Yes

[fathom summit]

@tropic lagoon so you already powered off your router for 10 seconds & turned it back on? You also said you contacted your provider and asked if there was an outage & they didn’t help you? Did you also look for a reset button or option on your app that you use to reset it?

[versed pagoda]

Did you pay your wifi bill lol

[tropic lagoon]

I can't look for the reset button on the router it's higher then me

[fathom summit]

Use your superman powers to fly up to it

[versed pagoda]

Do you have a ladder

[fathom summit]

Jkjk

[versed pagoda]

Or a chair

[tropic lagoon]

And i tried to look for a reset button on the application but it said the same thing as i told you earlier

[tropic lagoon]

I was using that to look already

Bu there's a wsp button

[fathom summit]

Did you really call the provider and ask if there was an outage in your area? I am surprised they didn’t advise you.

[versed pagoda]

Search up if there was one if they wont tell you thats werid

[tropic lagoon]

I would know if there was one and no it's not he also said the same things

[tropic lagoon]

Check your dm I'll send you the photos

[versed pagoda]

I don’t check my dms. You can explain here

[tropic lagoon]

If u can't even look at the problem how will you help

Thanks for the information

[fathom summit]

Call your provider back and ask them to test the connection, send a reset signal & walk you through resetting it. Come back and let us know what happened.

Could be a faulty modem and or router.

[tropic lagoon]

It's 1 am in the night should i call?

[fathom summit]

🤷‍♂️ I mean you want internet right, they should have 24 hour support. If not, you may have to wait till the morning. And for future reference do not ever send a picture of your router to a stranger with the default creds showing in the picture. Please make sure to always change your ssid & passwords to something else. Best of luck.

[tropic lagoon]

Thanks for the help but there's no major information of me or my router on the router so it's safe ig?

[fathom summit]

Ok, because I looked at the pictures you sent, it was blurry but it looked like the default ssid & password was on the bottom left corner. It’s deleted now so 🤷‍♂️. Best of luck, let us know how it goes.

[tropic lagoon]

That was help and the support email and a qr support bro how could u see it's a password 😭

[fathom summit]

It was blurry, was just making sure. Some providers put it on their routers. Wanted to make sure you were being safe. Now stop wasting our time & call support!

[tropic lagoon]

Ok

[fluid pecan]

Anyone here has a TikTok bot script???

[lost vapor]

we don't help with these stuff here #📜・rules

[foggy breach]

Hey, I'm being nominated as club president for a college. I'm looking for ideas... well, more professionals to attend these events to help develop skills and workshops for associate-level students. I have heavily influenced TryHackMe as a great learning platform, because it is. Would anyone want to volunteer in these events and present a short course?

[tired eagle]

sure what short course type you looking for

[foggy breach]

from entry level to cyber analyst, and maybe pen testing. I'm also considering doing a workshop for repairing devices. The goal is to be productive to beginner and semi-advanced.

[tired eagle]

i could do that

[foggy breach]

would you mind sending me your linked in in dm?

[tired eagle]

im not doing that but ill send my blog

[foggy breach]

thats fine, ill send you my linked in

[tired eagle]

ok

[nova fiber]

Hey all I'm new here just wondering about any cool gadgets any of you guys know of?

[coarse pasture]

wdym by gadgets?

[opal pilot]

cardputer

[nova fiber]

Things like the flipper and esp32 et.

[nova fiber]

like a sine wave generator?

[opal pilot]

cardputer have esp integrated in it and it also have a keyboard

which is a huge benefict

[nova fiber]

Ohhh

[opal pilot]

no it's from m5stack

https://shop.m5stack.com/products/m5stack-cardputer-with-m5stamps3-v1-1

you can flash it with a firmware like evilm5stack = project or any hacking firmwaer you want

[nova fiber]

Legend is this just for writing cards or?

[opal pilot]

you can do wardriving with this alone

[opal pilot]

writing cards?

what do you mean

it is a esp and keyboard that have other modules used for hacking

and it's super small, like a credit card size

[nova fiber]

I think I saw someone using one of these to copy/write blank NFC cards etc. that's what I thought it was but wow thanks for the info I'll defs get one and look into it

[coarse pasture]

check dms

[nova fiber]

What does esp mean sorry I'm just learning I only knew it as a name for a chip

[opal pilot]

it is a chip

[nova fiber]

Does it stand for something?

[opal pilot]

it's like a microcontroller that have wifi and bluetooth