Hacking learning material

I'll start with some books and some links, I hope it will help. >List of tools, malware and exploits for pentesting, bug bounty and sec research https://github.com/Hack-with-Github/Awesome-Hacking https://github.com/ytisf/theZoo https://www.exploit-db.com/ >CIA and NSA soykaf https://github.com/x0rz/EQGRP https://github.com/DonnchaC/cia-hacking-tool-archive https://github.com/DonnchaC/shadowbrokers-exploits >Wikis https://www.owasp.org/index.php/Main_Page http://netsec7moavvkprc.onion/Main_Page https://lainwiki.cocaine.ninja/index.php/Sec >Tutorials http://www.primalsecurity.net/tutorials/exploit-tutorials/ http://www.opensecuritytraining.info/Training.html https://www.cs.fsu.edu/~redwood/OffensiveSecurity/lectures.html http://phrack.org/issues/69/1.html >News http://kenblog2vwew64r5.onion/ https://www.reddit.com/r/bugbounty https://www.reddit.com/r/netsec

>>6 I thought as a chan, reddit was considered filled with only crap-tier material

>>9 Reddit is a huge community, it's quite childish to think that it doesn't have good material just because 4chan decided to make fun of it a few years ago.

>>9 Reddit produces great stuff, at least the ones that delve into technology, I can't speak for them all. Don't let that meme change your perception of the site.

New to /sec/, how do you guys practice this skill? Also, copying some of the pasta from 4ch's /g/ board, just wondering if the material is anygood: How To Become a Hacker: http://catb.org/~esr/faqs/hacker-howto.html >Learning https://cybrary.it/ https://n0where.net/ https://www.offensive-security.com/metasploit-unleashed http://resources.infosecinstitute.com/ http://www.windowsecurity.com/articles-tutorials/ https://www.sans.org/reading-room/ https://www.corelan.be/index.php/articles/ http://opensecuritytraining.info/Training.html https://www.blackhat.com/html/archives.html http://www.securitytube.net/ http://opensecuritytraining.info/Welcome.html https://beginners.re/

>>9 The communities that surround places like reddit and tumblr are toxic but it doesn't mean that there isn't good material on the site.

>>14 >>18 It isn't just "a meme", it's the mentality of reddit and on which it was built. The "joke stealer meme crowd" 4chan ridiculed is now on technology subreddits. If you want something new, don't delve there. If you want to really learn something that is already mainstream I heavily suggest mainstream venues like reddit.

http://archive.li/R5TUV maybe this will help

>>28 Eh, I'd tend to agree except in the case of /r/netsec It's so technical it filters out MOST of the skiddy bs

Test

Smaller Reddit communities are fine, there's a sort of quasi-meme on there that if a board gets too big another board with a separate name but for the same topic will pop up with better oc and better discussion. Large boards are absolutely awful though, oc is usually good, but cringey and the community becomes solely based on getting karma as opposed to what the point of karma is, which is to promote community growth and posts that are beneficent to the board or to the thread. I'm sure early into Reddit's existence karma for this function worked well and did promote the site to grow to the size it has, but the site overall alright and I use it. Polite sage for off-topic

Arguing about inanities such as this with no actual relation to security is one issue with simple dumps of information. As the board is still young, I'll post this rather than delete many posts, for now.

>>26 In terms of practicing, just disassemble anything (presumably but not necessarily an executable binary) that you think is interesting. Trace the paths through the program that user input takes with a debugger and attempt to discern how you can influence its behavior.

Hacker General's back bby

I fuarrrking love that picture. Are there any HQ versions of it?

I'll suggest a few more resources. Cryptography: http://cryptopals.com/ I also pasted this in /lambda/ because it's relevant there as well. Reverse Engineering https://beginners.re/ https://challenges.re/ https://microcorruption.com/login (good soykaf) http://skullcode.com/ (hardcore!) War Games: (I'll just post my two favorite wargames sites, someone here sure has a bigger list) http://overthewire.org/wargames/ http://pwnable.kr/ And also a book. Please enjoy.

Oh and how could I forget this one.

>>31 OP of HG#6. I'm glad someone archived it.

>>18 >Don't let that meme change your perception of the site Tried to create a thread on /r/netsec the other night. It actually never appeared as open, probably wasn't accepted by the mods. Cool place, you were saying

>>53 That is exactly why it's a good place. You are supposed to read the rules and submit according to them. The same applies to lainchan, this is not a thread about reddit and enough has been said about it. Either use it or don't, if you want to discuss reddit, create a thread about it.

>>38 >Arguing about inanities such as this with no actual relation to security How is talking about resources considered to be entirely off-topic? >>54 >neurosuggesting the rules weren't followed

>>55 >How is talking about resources considered to be entirely off-topic? Reddit is not related to hacking. The resource was posted, either you use it or you don't. This is not facebook nor 4chan.

Malware collection and exploitation pack collections for analysis and learning use only https://github.com/ytisf/theZoo

>>56 Please, take some camomilla. My teapot is enough long

This course looks promising. I'm looking forward to it. http://security.cs.rpi.edu/courses/binexp-spring2015/ Has someone completed it?

Reviving this thread

Hey, does anyone want to get together on IRC tomorrow and work on hacking together? we can create a room on the irc

>>206 There are already existing channels including #wired-students, #LainHackGen , #netsec , #lainctf , but if you want to make another, then feel free.

>>207 I didn't know that #lainhackgen was still a thing, thanks for the heads up!

what book would you recommend as a general introduction to security, aimed for people who are tech literate but have never been educated with a security focus? my university doesn't even offer a security course. :(

>>223 The art of exploitation. It's in one of the first few links.

>>233 Grey hat hacking, what ever is the newest edition, i think 4th, but 3rd should till be relevantish

>>235

>>237 >>235 i greatly appreciate it

https://www.rand.org/pubs/testimonies/CT473.html i tried to upload the file, and it did not post, so here is a link

Nice compliment to the Handbook.

>>7 >>237 I wish to know why clamscan is showing these two to have some type of malware? Are they false-positive due to the text inside of the pdf or actually an injection in the pdf? ./1492339203108-0.pdf: Html.Trojan.XSSShell-1 FOUND ./1492939464537-0.pdf: Html.Exploit.MHTRedir-7 FOUND

>>470 >malware injected in pdf's >mfw I really hope there is no crypters on here....

>>479 Eh, I'm pretty sure it's just false positive since clam finds a lot of stuff and is very paranoid. I did some research, and there was this one site that did malware analysis did not show any network traffic. Maybe it's just the code. Oh, also, here's a nice link: http://www.amanhardikar.com/mindmaps/Practice.html

Someone mentioned this in another thread, > get Equation Group's ETERNALBLUE running > scan your city for open SMB ports > pwn random computer > meterpreter> webcam_list > rinse, repeat I think I can figure out everything besides the city wide port scan. How can someone scan a whole city or area?

>>666 Nice digits, but I feel like there's more interesting stuff you could do than just list webcams. Afaik you can't directly search an area with one ip range, but check the GeoIP database and there are probably a few ranges assigned to a 3-4 city area.

>>666 IP Range sounds like only option, maybe you could try something with city's MAN, but as I imagine that requires more work and probably is illegal (note that in some places scanning is also illegal) but don't take my word on it since im still a newbie to this

I have been HOOKED on wechall.net for past hour. The ranking system, the wide range of challenges (programming, exploits, crypto, cracking....) and the community are a thing of beauty. Highly recommend.

>>666 There is a utility called leviathan, If I am remembering correctly, It can scan entire countries.

https://0x00sec.org/t/shared-thoughts-after-6-years-in-pentesting/2492 I think the essay linked above could help some folks. The essay above has been retweeted and shared by Weld Pond and the Grugh (which as the writer, was an immense honor that kind of blows my mind). For the sake of transparency,(again) I am the writer; even though my essay is being shared on many sites, I have posted it less than 5 times total (including the first time it was ever posted on a site that I respect but have no financial interest in). I am just trying to give something back to the communities I have found great value in. Thank you.

>>666 City is a bit too weird and specific, but if you wanted to scan a bunch of IP addresses for a specific port, you'd probably want masscan.

>>1307 Dude nice job, im extremely novice in this stuff . Where did you start to learn since your self taught. This is so overwhelming cause there is so much information.

>>934 This one? https://github.com/leviathan-framework/leviathan

Python, anyone?

>>1393

>>9 /r/netsec is good. You are right though that as a medium of discussion chans are superior. The up/down voting mechanism on reddit means that communities immediately censor ideas they don't like before any real discussion has a chance to start. And then having everything you say tied to a global username with public counters to score how many people agree with your posts just creates a giant, ignorant filled, insider trading echo chamber. Oh course, reddit is not about enlightened discussion anyway, it's about fulfilling users' emotional needs so that they stick around and generate money for the owners. Keeping them dumb is just a bonus.

>>1395 I didn't say insider trading, I guess you guys can figure out what the substitutions map back to. Anyway, there's a lot of stuff here about specific technologies. My favorite security books are about the hacker mindset in general. Security Engineering by Ross Anderson The Best of 2600 The second one in particular is completely outdated but that's not the point because the technology is just the details, the important part is having the right mental attitude and approaching the world from your own unique angle.

>>1424

>>1425

>>1426

What material would you point a beginner in infosec towards? I have programming and web development experience, but close to zero infosec xp. Currently i'm reading "The web application hacker's handbook", since i already have the web dev knowledge, it seemed like a good place to start. Any other recommendations? Keep in mind that i'm approaching infosec as i approached computer science, i'm trying to learn a little bit of everything before narrowing down on what i prefer.

>>1801 These are some good books, but what your doing now is right if you want to start web pentesting, I would recommend downloading owasp vm or dvwa to start simple, sql and other web attacks are not as common as they use to be but I would look up html5 vulns and practice there. as for a general pentesting, you just gotta download vms from vulnhub and practice attacks, if you can't figure it out look at the walk through and learn from it!

>>1802 Thanks, i think i'll finish "web application hacker's handbook", but for such a highly rated book, i can't really say that i'm impressed. I'm 115 pages in and i haven't yet learned anything new at all.

>>1809 >Thanks, i think i'll finish "web application hacker's handbook", but for such a highly rated book, i can't really say that i'm impressed. I'm 115 pages in and i haven't yet learned anything new at all. I can relate a little. For me, the main value I'm getting out of it is very thorough and specific instructions. Yes, I could figure out that the password recovery page is a good place to look for bugs, but being told beforehand that it is and having several different things to look for helps. Walking through this book like a check list would probably be enough to exploit many many websites.

>>1810 yeah, the first few chapters are "how to html/php/asp/etc" once you get past that it gets better

Is violent python any good ? Worth buying as someone who is fairly new to python and pentesting?

>>1940 >PS. This is general advice, i have not read violent python and i make the assumption that you're new in tech. If you're new to programming, pentesting is probably not a good idea, information security is an advanced subject because it goes from the assumption that you already have an understanding of how computers work. Besides that, i wouldn't recommend a python book for pentesting, a good portion of web related attacks do not rely on programming on a basic level, specially not for beginners. You will need to understand the technologies the thing you want to attack relies on. At a minimum you should understand networks and common web applications. As a good book for beginners, i would recommend "Web application hacker's handbook", just ctrl+f for it in this thread, there's a lot of commentary and the book is posted somewhere in here. It's not a GOOD book for beginners. It's a very dry book, but it goes from the assumption that you don't understand web technologies. The technologies he speaks of in the book are a bit unrelated, but it's irrelevant for newcomers, you need fundamentals more than anything at this point. If you need/want to learn programming for programming sake, i highly recommend EDX's CS50 course, it's free. They also talk about some vulnerabilities and information security.

>>1942 Thanks for your response. I have been programming for years and I'm doing degree level computer science, it's more that I haven't studied much specifically on the vulnerabilities on systems, that is how to capitalise on them practically. Unfortunately my university is more interested in teaching how to design things such as Java applications for android, so I'm really looking for some good resources for practical aspects of cyber security. I've read a few books on security, they cover things such as MAC authentication, symmetric / asymmetric encryption. Which is great for the theory side, however it doesn't help much in practical aspects.

>>1942 That said I might have a look through the Hacker's Handbook you mentioned. I'm aware that for many aspects of pentesting programming is not required. But if I'm looking to try and design some tools for my self to have a play around with, I am looking in the right direction?

>>1943 Just like computer science, information security has many branches, before trying to find a book you should read a little about each. There's a lot you can do, in penetration testing you will target web-facing applications, and there's very little programming involved in that, except when you need to use small scripts or create tools. There's also reverse engineering, which requires a lot of programming knowledge, application vulnerability, which ends up using reverse engie but as a tool instead of a subject, and a lot more. Web application hacker's handbook is a great place to start if you're only interested in pentesting. Otherwise, i think "The art of exploitation" might have a more general approach, if you download that one, look for the box it comes with, just the PDF isn't enough. >TL;DR: read about each general infosec area, then look for material in that area. "Hacking" as a subject is far too broad, it's like "computer science"

>>1944 If you're looking for web-facing applications, sure. But if you're looking to exploit local applications, it's not such a good option. If you're not sure what you want in infosec yet, i recommend just some light reading on forums/wikipedia. For forums, greysec has some neat tutorials.

>>1946 Thanks for the advice !

-> BEGINNERS MUST WATCH: 10,000 foot view of penetration testing: http://www.mediafire.com/download/b71c8v...esting.rar -> The top 10 OWASP vulnerabilities explained & exploited. Good for getting a big picture of present day web hacking: http://www.mediafire.com/download/zodyqc...icture.rar -> A ~9 hour long course on website vulnerabilities and how to exploit/secure them: http://www.mediafire.com/download/7dgfkk...ffense.rar (Hack Yourself First; How to go on the Cyber-Offense) >These were taken from https://greysec.net/showthread.php?tid=1563 , they have more material there, a lot of it hosted in public. Good additions to OP text.

>>1950 There's also: https://github.com/CaseAnon/Dump/blob/master/Links.txt

Fourth edition of gray hat hacking. Epub format.

>>1950 Links are down for me.

http://zempirians.com/ebooks/ Huge collection of Ebooks that can be used!

can we have another ebook thread?

Free infosec course with a CTF at the end. Seems fairly good, haven't read the first class yet, but seems beginner friendly enough. https://cybersecuritybase.github.io/

>>2761 http://zempirians.com/ebooks/Companion%20Files/ Good material, thanks!!

>>3098 I'm going to participate in this, looks good.

>I finally beat stapler vm on vulnhub, took me longer than I'd like to admit on finding an exploit that worked... anyone else have any good stories they'd like to share?

>>3158 Be fan of a game series look through portfolio pages of an ex employee >password protected folder with title of possible new game >try to guess password for 2 minutes >get bored >View source copy link of thumbnail of secret pic url ends in xxx_x.jpg copy link of public full size image url ends in xxx_y.jpg >try to change x to y in thumbnail >secret image available in full size post online after 3 days its all in the gaming news >tfw i did something any idiot could do and people acted like i'm a major h4x0r

>>3159 Hey just look at the guy who "stopped" a virus by registering a dns name he saw in the output of `strings`. It's more common than you think, and honestly that's a good thing. Probably a hundred other people looked at the same filenames and didn't draw the connection that you did. We need people taking initiative and making guesses at how to solve a problem even when they might be wrong.

>>3160 you're probably right. It just seemed way too obvious for me. But considering the game is from a pretty big publisher I can be proud to have leaked something from a company that doesn't get many leaks.

>>3161 What game are you talking about?

>>3162 I don't really wanna share the name since my username has been mentioned in most of the articles. It's newest trailer has been released not so long ago. That's all i will say

Hey i would need this book but i cant find it. Can you help me?

>>3211 It's published this month and you expect it to be on torrents?

>>3213 rhetorical questions are for those that care just point at him and laugh

>>3213 Yeah pretty much I did. Why should I ask when awaiting no answer?

>>3213 >>3216 Given that it only requires one person to acquire a digital copy and share it, it's not all that unreasonable an expectation.

Infosec forum, fairly small, lots of content, good crowd: https://keys-daggers.org/

>>3219 >403 Forbidden That's a pretty soykaf security community if you ban Tor. What do you do, sit around studying for CEH?

Any help on basic buffer overflow, I managed to find EIP but im struggling to find how to place shellcode

>>3241 Put shellcode right after buffer overflow begins.

So I control the EIP and I have my shellcode (calc.exe) I'm trying to use one of the DLL's inside the program to jump to ESP to make it more stable. The code is in pic and the exploit I'm trying to recreate. (https://www.exploit-db.com/exploits/9177/). Can someone help me? This is my first time doing exploit dev go easy on me...

I am getting into car hacking. Are there another ressources which i should read?

Hey, I'm doing a sample buffer overflow challenge (overthewire's behemoth1) and it's taking an embarrassing amount of time. i don't feel like taking the time to find my shellcode manually, so I was trying to find some way to jump to it, but before I have control over the program there's a leave instruction that screws up the stack frame for me. Should I just suck it up and try to get to it manually or are there any ways I could lower ESP to the point that it lands where I need it to without borking my shellcode, and then jmp esp? any help appreciated, i'd also settle for advice on accounting for the difference between gdb and a normal environment without having core dumps or being able to attach gdb to a running process. I think if I feel like being flashy, a ret2libc might be an option here too? Not sure.

>>3354 fuarrrk my life into pieces I got it working in gdb but I think the address I found for the little jmp esp; ret gadget (would you call that a gadget?) is different inside gdb from outside.

>>3355 disregard that, i suck cocks I actually was hitting my shellcode but it wasn't working how I expected, fixed it by A: when passing shellcode to behemoth1 w/cat, ending with a dash so it doesn't just close after spawning the shell (cat ./thing - | /behemoth/behemoth1) , and using shellcode that preserved the euid so i wasn't back to square one even w/ a shell

>>3211 /**Why you want to learn infosec if you can't find a simple book btw..?*/ Here it is: http://libgen.io/ads.php?md5=0D73CF9818D7DA4F6260217301B663DA Your welcome lainon.

>>3368 Thanks for your effort but i had the book one day after asking

Hello, anons. I need some help getting into this hacking thing. I want learn how to crack software but I have no idea how to do it The content in internet is mostly about web app, net sec and other things but almost nothing about cracking, I once found a website with cracking tutorial but I forgot it So. Any advice?

>>3375 Is reverse engineering related to this? I am the same guy btw

>>3375 I think in a previous iteration of this thread there was a paste about learning to crack software. Let me see if I can find it for you.

>>3377 >>3375 http://web.textfiles.com/software/howtocrk.txt I believe it was this. Yeah, reverse engineering could probably be considered related to this and I think it'd have a pretty similar core/prerequisite skillset. Happy hacking, lainon.

>>3378 Thanks a lot Do you think that crackers have job opportunities?

>>3379 I doubt it, but really couldn't tell you.

Here is a good channel made by someone on /r/hacking https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w

Does anyone have team-teso's paper on format string vulnerabilities? Their soykaf's down and archive.org doesn't have the file (formatstring-1.2.tar.gz).

>>3395 Is this it? https://github.com/trailofbits/ctf/tree/master/exploits/references I only know because I'm actually working through these ctf's at the moment. A PDF like this probably won't show up on Google right.

>>3396 That isn't it, I think. I did find it helpful, though. Thanks anon! Found it here: https://crypto.stanford.edu/cs155/papers/formatstring-1.2.pdf

do you have some course to learn maltego? Tutorials?

>>3477 I fell kind lost too, it's very different from the previous version.

>>3477 ytchannel: https://www.youtube.com/user/PatervaMaltego RTFM: https://docs.paterva.com/en/

bump

Can you do these kinds of things using a lisp? are there any resources for that in scheme or common lisp or am I forced to learn C?

>>3632 You may find this interesting: http://philosecurity.org/2009/01/12/interview-with-an-adware-author This was an interview with the author of some Scheme adware for Windows. He discussed how it was very small and lived in some Windows intercommunication mechanism that made it difficult to detect it was running, because it wasn't actually a process. He also discusses how he eventually wrote it to target other malware so people wouldn't bring their machines to get cleaned and also wipe it. This page, unfortunately, seems to be down, but it may come back up later. I checked the Wayback Machine and found nothing, but do respond if you later manage with it.

I've yet to find the CS APP 3e pdf

are there any CTF type things for web stuff? I read the web app hackers handbook years ago but never did anything with it.

>>3762 Many CTFs will include a web-app component these days; there's also plenty of challenges for webapp stuff. In addition, there are things like Damn Vulnerable Web App and OWASP's WebGOAT.

Thanks lainons these are good resources, i will try to share some of my own

If you haven't seen it yet! Here are some more resource dumps! https://hkh4cks.com/blog/2018/01/15/security-resources/

>>3762 Have a look at this, it's pretty fun. http://overthewire.org/wargames/natas/

here is some stuff i found on github you might enjoy https://github.com/Simpsonpt/AppSecEzine https://github.com/citypw/DNFWAH

Sam brown released a violent python and malware analysis course for watching on his site, It comes with projects and other stuff for hands on learning too! https://samsclass.info/

Does anybody has some materials about military pen testing or military it assets? I take anything thats military it security.

anyone have any good resources for asp.net vulnerabilities? need something a little more in depth than the tutorials on youtube lol

>>4776 CVE database

>>4777 gratzie

>>3637 Found a copy of the page: https://archive.li/NF6yv

This repository found on github may help in security: https://github.com/xapax/security

So im a physics student i love physics and i would like to continue and build a science career but at the same time im interested in cyber security and cryptography and i think i can make more money by that can some of you old users recommend me books,websites etc so i can start studying the basics of cyber security

>>5994 >physics >cyber security

>>5995 Russian memes eh? It is like they're too deep for us westerners to understand, but even then they sound fuarrrking retarded.

Get an MSc in compsci, or at least a proper BSc and a few years of experience trying to fuarrrk with existing, working systems. It's a good start.

List for noobs

>>5994 Read the thread for material. Being a physics student is irrelevant, you can do more than one craft at the same time. Stop asking for people to hand you soykaf on a plate, it's not something that's viewed kindly in the infosec community.

>>5995 Physical + Jailer + Cyber Security = Air Gap + Faraday Cage + Fire Wall Not even GNU fREEEdom can penetrate his security

>>5995 Interesting "opinion" considering a physicist invented the "internet". Physicists often take more mathematics that can be applied to cryptography (save for discrete and set theory) Physicists can go into electrical engineering Most physicists know how to code RF / Electronic warfare is literal physics >>>/baph/

>>6487 TIL physicists do number theory

>>6488 Don't be a pedant :P Diff Eq, the Calc Series, Linear... It wouldn't take much to apply that math to crypto instead of physics. I'm not saying it would be trivial, but it wouldn't be mind-bending.

>>6487 Saying that physicists know how to code is as offensive as saying that indie devs know math because they need to use linear algebra sometimes. Just do soykaf, nobody cares about dick measuring based on a title.

>>6489 no, it really wouldn't. You can't understand RSA without at least passing familiarity with number theory, and ECC requires quite a lot of requisite knowledge to make any sense at all. You don't learn anything related to any of that stuff in any calculus class. You can probably understand most symmetric crypto, but that's not the hard part at all.

>>6500 I agree, but that's not my point. My point is that it won't be extremely difficult for someone to make a transition. How many "infosec professionals" do you know that can explain ECC, DHE, RSA, or even the difference between a block or stream cipher? You don't need a mathematics degree AND an EE degree to understand electronic warfare. I know plenty of people allegedly in the industry that are dumb as fuarrrk. I also know several people not even in infosec that are pretty decent. >Passing familiarity Exactly. I'm just saying OP isn't gonna get rekt and that some mathematics and critical thinking used in physics can be transferred pretty easily.

>>6500 >>6512 I completely misread your post.

>>6512 I don't know any infosec people, but I do know many cryptographers. They're all mathematicians through and through.

>>6515 Not all infosec people are cryptographers.

>>6516 just saying, the mathematics that most physicists are conversant in(which is what the original thing was about) is not applicable to cryptography.

>>6517 Ah that's fair, I was incorrect in >>6487

Thoughts on overthewire.org?

>>6535 A good intro level for people coming right out of the gate, not much else.

Check this https://www.secjuice.com/

>>6537 Perfect then. Thanks

do you think this would work as a slowloris attack using wget? slowloris() { # slowloris attack with wget # # $ slowloris WEBSITE # website=$1 ## make 300 wget threads ## which recursively download ## with a slow connection for ((c=0;c<=300;c++));do wget -b --tries=9000 --limit-rate=1k $website done }

>>6606 >set up lab >test it >post results

>> 6607 > can't setup lab, limited resources segmentation fault

>>6608 bummer, I don't think it would work btw, or at least it would be effective, because slow loris attacks, takes advantage of the fact that apache limits the number of sockets, so you just need to keep a connection on it, you might do some damage to the bandwidth bill but other than that, prob not.

>>6606 When you connect to some webservers they spawn a thread and read your request. Actually processing the request happens in the background or on the main thread. The point of Slowloris is to never finish sending the initial request, just keep slowly sending fake headers 1 character at a time spaced by something near the timeout. If you do it enough times in parallel then the server will not have any threads left to handle new connections from real clients. The attack has nothing to do with bandwidth. Sending the characters slowly is to save the attacker's bandwidth, it makes so difference to the server as long as the connections don't timeout. >for ((c=0;c<=300;c++));do >wget -b --tries=9000 --limit-rate=1k $website >done --limit-rate only limits the download speed but since this is happening on the main thread it adds zero stress to the server. Also this loop is only going to run wget 300 in serial which is also pretty pointless. Slowloris is a trivial thing to write yourself in Ruby or Python though. If you insist on sticking with bash you might be able to do it with netcat.

>>6610 >Also this loop is only going to run wget 300 in serial which is also pretty pointless. Nevermind missed the -b on wget

I'm guessing wget finishes "the initial request" meaning downloading 500000 times the index.html at 1k wouldn't change a thing and apache could handle it. my initial thought was 'this is going to fuarrrk with the apache's thread design' Well, I'll try to get a server running somewhere and I will try it just for fun

looking for Data Science Malware from NoStarch. Anyone?

>>6610 >if you insist on sticking with bash you might be able to do it with netcat isn't /dev/tcp/ enough?

>>6612 Wget won't work due to the nature of the requests it sends. They're complete requests, not drip-fed partial headers designed to hold the thread in existence for as long as possible. >>6997 I would need to take a gander at bash's networking code, but my guess is that you probably can't spawn enough /dev/tcp processes fast enough with bash, or some other similar bottleneck with bash file descriptor creation

OSCP anyone? The one I got is from 2014

>>7391 I'm in a point where I'll rather work in a totally different field than programming, but if I make the decision to stay in this field then I'll pass this cert during the summer. The only thing really bothering me is the 24h exam, because I'm very bad at handling high fatigue and I'm the kind to always prioritize a good night of sleep over every thing else. That's the only priority I ever got straight. I love you Lainchan, you're the quite shy intelligent girl I have trouble to get attention from while /g/ is the noisy outgoing dumb Stacy I hang out with because she's giving me some pity fuarrrk

>>7867 >I love you Lainchan, you're the quite shy intelligent girl I have trouble to get attention from while /g/ is the noisy outgoing dumb Stacy I hang out with because she's giving me some pity fuarrrk what the fuarrrk, really? >>7391 They are revamping the entire course soon, that isn't to say it isn't useful, it's is, but keep in mind it's out of date! If your looking for a more updated video course, https://www.youtube.com/channel/UC0ArlFuFYMpEewyRBzdLHiw

>>554 I would still be paranoid. Use trantor/libgen.

>>7881 I fully agree. I got mine in 2017 and got my (somewhat worthless) OSCE last year. Wait until they redo the labs and exam. They're doing an internal revamp right now which is why the OSWE is now online. This will be coupled with other changes to the labs late 2019 / early 2020. A buddy of mine works at offsec and has told me they're currently working on a restructure. >inb4 I don't believe you I wouldn't blame you, but I'd still hold off for other reasons. If you're trying to get into pentesting this year, I'd say do it regardless if it's something the company you're applying for wants. Fwiw the cert is well recognized and sought after. If you want to take it to learn, I'd say wait until it gets revamped. Definitely. Definitely. Do not take the OSCE right now. As it stands you'll only be exploiting NT 5.2, and only countering DEP.

>>7892 was OSCE really worthless? What's so bad about it?

>>7901 Eh I mean, it wasn't worthless. I spoke too strongly. It's just not worth the price tag imho. If you can do all of phoenix or nebula on exploit.education (highly recommended just in general btw), you're basically ready for the exam. As with all offsec exams, if you read the PDF you'll get the rest. The main gripe I have is the complete lack of addressing ASLR + DEP and on more modern platforms. They should at least have covered x86_64. I will say though, if you're not really into exploit writing and you want a cert to take to help you with a goal I think it's good. I felt accomplished when I got it, but I wish I would have spent much more time working with free binary exploitation education resources. I also don't regret it. If you're on the fence but can get work to pay for it, I'd 100% do it.

>>7902 >>7902 I've been looking for exploit exercises for awhile, I thought they were dead... Thanks for the post!

>>666 You can use censys.io api. It allows you to query their database ip by city name, it's pretty accurate at the city level.

Humble Bundle Collection | 20GB https://mega.nz/#F!xXIG2aSB!kqvvtpSIqWZRti0Ifbweog

Is there a High Res version of this pic?

Anyone have resources for android architecture/exploitation?

Writing the ROP chain for this atm: https://pwnable.tw/challenge/#32 I had only done Microcorruption before, this soykaf was no joke but I also had to properly learn the SystemV Elf format - also fuarrrk you jump obfuscation. I'm also currently reading Secrets of Reverse Eng. which is Windows based and actually really great.

>>6 OSCP updated materials?

Can somebody suggest me books/resources which help me in vulnerability research/ rating?

does anyone have the pdf for ABCD of Hacking: The Beginner's Guide?

How do you guys go through all these books? Just like 30 pgs a day? Im always intimidated by the size of these 600pg+ books

>>8375 Many books will provide overlapping knowledge so there are many passages you can skim for interesting stuff but not really study. After getting into a subject in general you will see that every book has less and less to offer, but this just in volume as the quality is what you seek after. This also proves why good introductory books are so important. They provide the mapping of the subject and the main pillars upon which you can build further understanding.

>>8375 20 minutes a day and you can read about 50 books a year. 300 pages a week and you're basically a grad student

Do someone the most recent version of this course? It's the video version of the CEHv10 prep book. https://www.pluralsight.com/paths/ethical-hacking-ceh-prep-2018

>>8908 I have the lab and powerpoint slides my dude! https://github.com/ManhNho/CEHv10/

>>8911 Thanks! Now I have the book, slides, labs, tools, exam(?), just need to videos.

>>8916 there is a bunch of CEH video's online, just set a side a Saturday and watch one.

>>8927 I did watch some, but most of them are from the outdated version of the Pluralsight course. Lacks of 2 modules, but they do the job. If someone in any case have access to the course and is willing to share I'd be glad. You know, it's better when the contents match.

>>8944 once in a blue moon you will see a OSCP course posted online or streamed, but Offsec doesn't like that and shuts it down faster than your wife will turn down birthday anal.

>>8990 there was that dude who leaked them on twitter a while ago >@cyb3rsick then all of a sudden he stopped posting... hmmm...

>>8999 this temper tantrum https://twitter.com/cyb3rsick/status/1088216320938860545

>>8990 >once in a blue moon you will see a OSCP course posted Why do you make it sound like such a rare occurrence? If someone leaked it then surely it exists on TPB or some torrent site.

>>9029 alot of the time, it's the braindumps, not the large video files, when it's the video files, more often than not they're malware

>OSCP Learning for an exam doesn't work if you actually want to learn something.

>>9036 it does teach, however security is a every broad field and it won't teach everything, it's pretty weak on web app and pivoting. but as a entry level cert what do you expect

>>9036 It sounds like you've never taken it. It's obviously about passing the exam, but the best part IMHO is the lab environment and guides allow for a variety of exploits in a somewhat realistic environment. You just won't find a better cert to get your feet wet. You won't come out of it prepared to do a pentest, but you'll come out of it with enough to get put on a team and learn proper methodology really quickly.

Here is a nice sized git repo of resources https://github.com/trimstray/the-book-of-secret-knowledge#manualshowtostutorials-toc

Hey is https://tryhackme.com/ any good as a resource? It has a some entry level stuff but seems pretty decent.

Some friends and me made a security group on our college, we are on negotiations to fund some books for learning (10 aprox), so lain, which books should we get? We want to get into forensics, crypto/steganography, CTFs, and I personally want to learn reversing, kernel hacking/programming and network stuff in general

>>10085 All the books are worthless https://github.com/scwuaptx/HITCON-Training https://pwnable.tw/ https://cryptopals.com/

>>10092 I disagree, most are worthless. The rest are overpriced (which is what libgen is for), and a poor substitute for hands on.

>>7926 Are you exploiting my PDF collection?

while (fgets(line, sizeof(line), stdin)){blah} is this overflowable?

>>10116 no fgets reads in (size-1) bytes and appends a null-byte, you could also just run it in a debugger to double check.

>>10092 >>10093 Are they worthless because security improves as vulnerabilities are found aka they're information becomes outdated?

>>10170 that wouldn 't make them worthless, because any sufficiently sophisticated explanation of a vulnerability is bound to teach you some things about how it came to be and your intuition will likely improve as a result

>>10170 Nah, worthless because internet resources and hands on are better. Case in point, if you know even a smidge of C it's likely that this site will be all you need: https://cwe.mitre.org/top25/archive/2019/2019_cwe_top25.html

>>10170 No, things are never really fixed, most of the stuff from phracks Malloc Maleficarum *still* work almost 20 years later. I mean extra security checks have to be bypassed, but the basic steps haven't changed much. Sometimes old systems are sufficiently hardened while new systems (in the interest of speed) aren't allowing *really* old attacks to come back in style - a good example is tcache which allowed unrestricted double-frees in glibc 2.27-2.28, now there is a check but it can be trivially bypassed by overwriting the the chunk bk pointer to 0.

to whom it may interest, OSCP updated all its course work to include windows ad, updated win32 exploit dev, and added alot more boxes

>>10187 forgot link https://www.offensive-security.com/offsec/pwk-2020-update/

Anyone that does HTB challenges, do you find trouble with your payloads? I find that I can't set my LHOST to eth0 or it will fail to create a session. Also most payloads don't execute at all on my machine, and if they do, they don't respond to 'cd' commands. At best, I can 'ls', 'pwd', and 'cat'. I've probably misconfigured my exploit, but does anyone have a suggestion? This makes challenges hard to complete.

>>9976 >it has some entry level stuff it appears that it is all entry level from first glance. im sure its good for new people.

>>10348 >>10348 set it to your vpn addr instead of eth0, sometimes it will disconnect on you too

>>10350 Thanks for the pointer. Set it to tun0 and switched my payload to reverse_python and it's been working ever since.

>>10355 glad it worked for you happy hacking

Has anyone here set any goals and try to meet them?

defcon / blackhat / whatever videos are great to learn from. though hit and miss some are brilliant. a few i downloaded (see end for youtube id) 'Black Hat 2013 - Exploiting Network Surveillance Cameras Like a Hollywood Hacker-B8DjTcANBx0.webm' 'Black Hat 2013 - Million Browser Botnet-ERJmkLxGRC0.mkv' "DEF CON 18 - Zoz - Pwned By The Owner - What Happens When You Steal A Hacker's Computer-Jwpg-AwJ0Jc.webm" 'Defcon 21 - DNS May Be Hazardous to Your Health-9Sgaq6OYLX8.mkv' 'Defcon 21 - The Secret Life of SIM Cards-31D94QOo2gY.webm' 'DEF CON 22 - Deviant Ollam & Howard Payne - Elevator Hacking - From the Pit to the Penthouse-oHf1vD5_b5I.webm' 'DEF CON 22 - Zoz - Don'\''t fuarrrk It Up!-J1q4Ir2J8P8.webm' 'DEF CON 26 - smea - Jailbreaking the 3DS Through 7 Years of Hardening-WNUsKx2euFw.mkv'

>>10394 oh and I'd love any other suggestions to view please :)

>>10395 wildwest hacking fest has some decent videos. https://www.youtube.com/channel/UCef0TWni8ghLcJphdmDBoxw

This is pretty good "I’ll Let Myself In: Tactics of Physical Pen Testers – Wild West Hackin’ Fest 2017" http://www.youtube.com/watch?v=rnmcRTnTNC8

This book has been shared in this thread. I've heard it's the bible of pentesting, is it true? Is this a good book for a beginner pentester?

>>10511 it's good for a beginner, but I would recommend getting the newer version, it's out of date and a lot of the resources are not there anymore and the phone exploit kit that was made by the author is pay to use.

>>10544 Thanks. I can't seem to find any version other than the first version, though.

>>10549 it's been years how is she not finished yet.

Anyone have anything using JavaScript? Is it used much in pentesting?

>Got my OSCP >Got a bunch of comptia certs >Flaunt my bug bounty page to show hands on experience. >Can barely get an interview It hurts to live. I feel like a dumbass.

>>10755 the struggle is real lain, the best i can get is a helpdesk job

>>6 as a professional in this field, i want to point out that all of these are horrible materials for learning

>>10770 i guess i shouldnt add garbage to this thread without contributing. my suggestion is if you want to do it seriously there are two broad paths: 1. web security 2. binary exploitation and reverse engineering (1) you can get started with web security by doing some bug bounties, studying write-ups and trying to apply these tricks to whatever. you're probably going to start out with some garbage xss and other low value bugs, the key is to continually learn and improve. (2) if you want to be a real hackerman and do the ida pro soykaf then go download a crack of ida pro and start tearing programs apart. go make game hacks and then apply the knowledge you learned to hacking other programs. finding bugs and exploiting them. also, before you try to start hacking crap, you should atleast have a good grasp of programming and basic cs fundamentals (basic data structures, algorithms, i/o, networking, etc) as well as security fundamentals like security models, hashing, encryption, authentication, etc. You should probably be familiar with at least Python and Java. For a fun youtube channel I also recommend LiveOverflow he makes good content

>>10758 If you can only get a helpdesk job with an OSCP, that's kind of on you lainon. >>10755 Sadly, networking in the meatspace is the fastest (depending where you are) way to land an introductory infosec job. >>10771 >You should probably be familiar with at least Python and Java I disagree with Java. Unless you want to go into mobile, Java is a pretty worthless language for a beginner to learn or reverse for security's sake. What *is* pertinent with java is understanding de/serialization and java web technologies (tomcat, struts, etc). However, IMHO, learning a .net equivalent will provide conceptual knowledge that is easily translatable to Java when confronted with a deserialization vuln or other java web application testing. .NET will be largely more immediately usable in an internal network when also writing other utilities interacting with the win32 api. That being said, .NET is also disappointing. Now, Java isn't bad to learn, but if I had to defend C I'd say while it's more difficult, learning C will provide you with a more in depth knowledge of low-level programming, memory management / exploitation, and payload creation among many many other things.

>>10771 >>10782 Could you guys give me a direction into profound cybsec? I know how to program decently in C#, JS, and also have played alot with linux distros and their structure and functioning, but i can't see any up to date content or about exploit developing these times, thanks for the info also boys.

>>10771 Thanks.

>>10511 It's a good place to start if you want to prime yourself for further learning. Particularly if you plan on signing up for most beginner pentesting courses (e.g. PWK, SANS). Otherwise it's just pretty basic stuff.

For those who have not seen this. Contains plently of great data. Courses, resources and warez; https://projectowlofficial.github.io/

>>11139 pretty cool indeed, thanks for sharing

>>6 bump

Why is there no book like "Real Life Bug Hunting" but for binary exploitation instead of web? I can't find a a single good book for that topic. On a different note, are the Ghidra books available right now any good or should I at least wait until the Debugger is released?

>>10549 >>10551 >patreon I guess that explains everything. As long as people keep paying, it will never be finished

>>479 really curious about this, I have a lot of PDFs myself and never thought of scanning them for malware... how do you check a pdf for malware?

Was directed here, I just compiled all the books in the hacking 101 humblebundle if anyone's interested. Some of them are dupes of stuff already in this thread. vola /r/1jq1enm3m

>>13727 standard av / virus total

>>13736 thank you did it come with the .epub version too or just the pdfs?

>>13743 Didn't buy the bundle. Compiled them all from many sites.

>>13736 >>13743 >>13751 https://www.humblebundle.com/books/hacking-101-no-starch-press-books Whixh of them are actually worth reading?

>>13752 I began on Serious Cryptography and am a decent bit into it, but it is a passion of mine. I skimmed Black Hat Go and Real World Bughunting, they look like the next candidates for me.

The guy that does nullbyte does alot of good tutorials on security from powershell and other stuff https://www.youtube.com/channel/UCaXV-r0zzGOsVg3V2U164wA Figured someone would want to take a look.

>>14174 >good well no, that guy does nothing but skid tutorials without explaining any of the backgrounds. Where's the point in learning tools without knowing what they do and how they work?

>>14175 these are much more in-def long series.

>>14176 >looking at hacker OS I don't know why anyone would care

>>1395 Ladies? No handbags now. Settle down.

The Art of Software Security Assessment by Mark Dowd, John McDonald and Justin Schuh What do you think about this? Is it a good introduction to C vulnerabilities and will it lead me to exploiting them? I found it on https://www.openbsd.org/books.html the books on this list that I actually read were all great so I'm thinking the others must be too. Please let me know which ones you particularly enjoyed.

To preface I am new to hacking and security in general but I do know how to code and other basic networking skills as I am currently working toward a comp sci degree in college. What would be a good starting book or website if I wanted to deep dive into this? Their are so many resources that its hard to figure out which one would be best for somebody who is new to this.

>>14358 lmao I don't think you are studying CS if you believe that there is a single book about "hacking". At least tell us what you want to learn or simply lurk moar.

>>14358 depends on what you want to do? exploit dev -> Hacking the art of exploitation 2 it's an old book but a good one to learn still pretty practical but a good starting point. Web application -> Web application hackers handbook v2 basically the bible of web app hacking. while some stuff is out of date most is still pretty practical over the years. burb and ffuf are your friends. Reverse engineering -> practical malware analysis handbook I don't know alot of RE so I can't give you any really good sources Also if you get a chance be a sysadmin, being able to build networks is fundamental to taking them apart.

>>14371 Did you even read the stuff you are recommending? Practical Malware Analysis is not a good beginner book for RE

>>14373 Not the original lainon, but your dumb. There are books on hacking, a normal CS degree doesnt cover exploitation, and Practical malware analysis covers dynamic and basic static analysis and is a great intro to RE. I'd recommend beginners.re for static analysis though.

Dear friends, i am a big fat skiddie noob and i have compromised some routers with soykafty passwords. Question: What is the funniest way i can let them know theyve been pwnd and should change their soykaf password?

>>15092 depends how "pwned" is pwned. if you've got SSH access, throw the message into the static HTML of their web interface. if they've got wireless capability, prefix or suffix their SSID with your message. whatever message you chose, make it short, sweet, and ideally helpful. for example: "My SSID" -> "My SSID? Not anymore! (Change your router's password :)".

can we get a discord or irc or something? kind of boring learning this stuff on your own. i'd like to work on a project with someone, i've done some basic stuff myself and now getting into malware dev.

>>15163 I know that lainchan's irc has a channel for it. I forgot and haven't browsed it much.

>>6 Im trying to find a copy of this book: https://www.amazon.com/Black-Hat-Ruby-programming-Pentesters/dp/B08JHSF6GT does anyone got a file?

https://hide01.ir/ enjoy

>>15744 Iranian TLD... No thanks

You don't need no crazy tech github repo doo-hikeys with network tools to get the job done! Step 1. Get a ladder Step 2. Find a corporate building Step 3. Walk into said corporate building Step 4. Go to some sucker's computer Step 5. Profit

>>15749 The strict security grandma at front desk asks you for ID.

>>15746 Why on earth do you give a soykaf about Iranian tld?

any good resources you lainons could supply about wifi cracking (getting started with it)?

https://certifications.tcm-sec.com/ New Cert dropped by TCM it seems pretty decent from what I looked at. >Price is one of the cheapest >actual external pentest of a network (not ctf oscp) > have to do a debref of the pentest. >cert is lifetime and training updated and constant. What does /sec/ think of it?

>>15750 >The strict security grandma at front desk asks you for ID. I ask her to bake me a pie to confirm she's a real grandma or just a fraud.

>>15758 https://github.com/bettercap/bettercap here is a decent tool read the docs and crack the handshake.

>>15771 great, thanks lain, ill look into that! do you have any recommendations maybe on content to read up on regarding wifi and wpa in general? id love to grasp how it even works before i blindly step into an entire toolkit

>>15772 If you wanna learn about wifi you will need to know about the 802.11x standard this has all your basic frequencies for wireless networking. If you don't want to dig though hours of IEEE docs this is a good cliffnotes version https://www.bboxservices.com/resources/blog/bbns/2018/04/30/802.11-wireless-standards-explained You will also wanna know the 4 way handshake and how and how devices authenticate and connect to wireless routers https://netbeez.net/blog/how-wifi-connection-works/ This is a good rough sketch of what to know. Bettercap is really good, it simplifies it a lot like metasploit does for exploitation. It's also written in GO now if your into that kind of thing with a javascript engine for custom modules and scripting. Hope that helps.

>>15773 nice, thanks a lot man! ill look into that!

I hope I can maybe get some help in this thread. I'm working on Love on HTB. I guess this box is about SSRF, I'm struggling with understanding how to do this. I know on the box it has a input for a URL to scan for "malware" and that according to the HTB forums you're supposed to fed the input field the sites own address? I'm struggling with understanding how to capture what the site is freely echoing out. Can any of you give me a nudge if you've completed this box?

>>15777 > I'm struggling with understanding how to capture what the site is freely echoing out. If your just trying to capture requests you should be able to do with with burp, zap, or even the request tab of devtools of your browser even. I haven't tried love yet, sorry I couldn't help to much.

>>15778 What's happening is there's an input field that says specify the file URL: Then has an input field and a button that says Scan file. When you click it you get a request like this. ET /beta.php HTTP/1.1 Host: staging.love.htb User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Referer: http://staging.love.htb/index.php? Upgrade-Insecure-Requests: 1 People on the forums are saying the answer lies in Upgrade_insecure-requests:1

>>15779 https://www.oreilly.com/library/view/hands-on-application-penetration/9781788994064/dbc0d180-b5ed-4ed3-87e4-8986d9d0c6a4.xhtml This site has a similar request listed as well that I Found

>>15779 try fuzzing that part of the request using fuff. https://github.com/ffuf/ffuf

>download all blackhat asia 2021 presentations >vast majority are all by asians with broken english and terrible microphones so glad i didn't pay $2500 for this, while im sure the content is good it's udemy tier Indian levels of quality im having to suffer through and keep rewinding to understand wtf they are trying to say in bad english

>>15800 With any luck someone will subtitle them or something.

Hello lain, I don't wish to derail this fine thread, but neither do I want to create a new thread for the question. I wonder: is the study of cryptography, cyphers and so on still "worth it"? Yes, I understand it depends. Let me try to explain what I mean: Mathematics as a field is massive and will probably never be a "solved problem". however Topology is mostly done, as much as this claim will trigger some people reading this. There's little research going on in topology and there's little fundings, The low-hanging fruits are solved and even the crown is harvested. Is cryptography in a similar situation? Unfortunately time is a most limited resource and "find out for yourself" is not an option. >lain why do you care? What is "worth" to you? well if you start studying some huge and difficult field, if you begin to invest your first thousands of hours in a study, you have to make a cost-benefit analysis. In terms of interest: many things are interesting in the world, I could just as well study something else within the realm of Computer Science. So a factor would be the probability of being able to find marketable solutions that can be packaged into a product, a business. So a factor is wealth. A factor could also be recognition: are there *practical* problems left to solve that allow you build a life around it, get published, get good consultant jobs and basically dive into forever without having to worry that your study is an equivalent to anteater expertise https://www.youtube.com/watch?v=qXD9HnrNrvk An essay for an answer is not required, a quick evaluation from lains-in-the-know is sufficient for me, thanks a lot.

>>15766 The guy with the giant punisher tattoo on his chest? Something tells me he's a grifter but I don't know.

I know stuff in the hacking realm changes frequently, are older books such as the 2008 hacking: the art of exploitation still relevent? and even some other older pieces?

>>15882 Yes it's still relevant, there's a second edition of that book I don't know if it's the one that came out in 2008 but that book is worth reading it teaches you a lot.

pentester academy is like kicking dead whales down the beach ass i cant understand a word the IndianS are saying

when will udemy invest in some quality control jesus christ

>>15915 don't listen to Indians, ever. Call me racist, but Indians seem to be incapable of being competent.

https://securityzines.com/ security topics taught as if you are a literal 5 year old

>>15740 https://rubyfu.net/ its literally just the book version of this site

>>15740 >>16243 https://github.com/blackhatruby/BHR_Labs forgot to post the labs too

>>16243 >>16244 Thanks for the share, i'll take a look.

>>6 https://lainwiki.cocaine.ninja/index.php/Sec this link doesn't work. Am I just stupid? Do I need to open it some special way?

>>16273 ssl cert is expired

every course or subject is done by a Indian i can barely understand great

A lot of useful links catalogued and categorized https://github.com/rmusser01/Infosec_Reference

>>15779 You've probably figured this out by now, but think LOCALLY. And to extend this further, what services from your nmap scan can only be accessed from the target's machine only? If you think LOCALLY and point the scanner at that service, you may be surprised.