Simple Security Questions

Last one reached reply limit. This is the Simple Security Questions thread for simple questions. If you have a simple question and a suitable thread doesn't already exist, just post it here and someone will probably try to answer it for you. Remember to do some research before asking your question. No one wants to answer a question that a simple search can already resolve.

And now my question! I got the portal page working. Just one thing left. How can I block access to all IP addresses except those in the 192.168.0.0/24 and fc00::/7 range with iptables?

>>4229 iptables -F INPUT # warning - this will delete ALL of your existing rules iptables -I INPUT -s 127.0.0.1 -j ACCEPT # technically you didn't ask for this but you need it iptables -I INPUT -s 192.168.0.0/24 -j ACCEPT iptables -A INPUT -j DROP I'll let you figure out the ipv6 one yourself

Also you'll want this other rule iptables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT it allows packets that are part of connections that are already in progress without that you'd be pretty screwed

>>4231 >>4232 Pretty sure one of these should be OUTPUT.

>>4231 >>4232 >>4233 Yeah this didn't work, I could connect to the internet but not any internal IPs. Had to get into my router's failsafe mode to fix, but it's back to normal now. Any other ideas?

Parrot or Kali as my everyday OS? Thinking of getting my hands dirty and jumping into the deep end, all with appropriate swimming trunks and inflatable ducky to keep me from drowning. Crypto bought no loggin VPN through Tor/I2P is a must, but what you guys also suggest? thinking of using my extra after uni time for gettin back into the game, any suggestions and tips?

>>4237 >Yeah this didn't work, I think the question was ambiguous. >>4229 >How can I block access to all IP addresses except those in the 192.168.0.0/24 and fc00::/7 range with iptables? What >>4231 gave you are rules to only allow incomming connections FROM 192.168.0.0/24 (into the box running IP tables). I'm not sure if this is useful but it is a valid interpretation of the question.

>>4238 >Parrot or Kali as my everyday OS? Never heard of Parrot but Kali is definitely not intended to be an everyday OS. It is intended to be used as a Live system. You boot it into RAM, do your thing, then all evidence is erased when you poweroff.

This is the Simple Security Questions thread for simple questions. If you have a simple question and a suitable thread doesn't already exist, just post it here and someone will probably try to answer it for you. Remember to do some research before asking your question. No one wants to answer a question that a simple search can already resolve.

>>4240 I said block connections *to* all IPs *except* those, though. I don't see how I could've worded that better. That said, still looking for options. Kinda stuck on this last part. Any help appreciated.

how do you configure tor to never leave the country you're in? idk if it can be done with the browser (you can't set relay nodes, and even if you exclude all countries it still hops boarders) but apparently you can have better -- direct control over your connection by using the tor ControlPort, but I can't seem to access that through regular searchable means (the docs don't actually explain this part). how do you access the tor controlport?

>>4245 you would kind defeat the purpose of Tor that way, but whatevs https://tor.stackexchange.com/questions/1247/changing-in-the-relay-selection-in-tor-source-code

>>4241 Parrot Security OS is a Linux distribution based on Debian with a focus on computer security. It is designed for penetration testing, vulnerability assessment and mitigation, computer forensics and anonymous web browsing. https://www.parrotsec.org/ Basically Kali for everyday use

>>4244 >I said block connections *to* all IPs *except* those Change >>4231 to OUTPUT and keep >>4232 as INPUT. >>4247 Kali Linux is a Linux distribution based on Debian with a focus on computer security. It is designed for penetration testing, vulnerability assessment and mitigation, computer forensics. Marketing fluff applies equally well to any "security" dsitro. >Basically Kali for everyday use I don't see any evidence for that.

>>4253 >didn't hear about parrot but a few mins ago >calls it marketing fluff immediatealy It is hard to accept any change

>>4254 >didn't hear about parrot but a few mins ago >calls it marketing fluff immediatealy I don't understand how you could possibly have read it that way. >>4253 obviously means that the explanation in >>4247 is marketing fluff since every word of it applies to Kali as well as Parrot so it doesn't mean anything.

>>4259 >still changed few words >thinks fiest line of wikipedia gives him enough of a description to give a rash opinion Lol kay

>>4261 1. You schlled a distro >>4247 2. You got angry because you thought someone was disregarding said distro >>4254 3. Turns out they were only disregarding your soykafty description >>4259 4. Now you are pretending it was a troll all a long to protect your ego >>4261 Doesn't this place have mods to ban underage retards like you? No wonder it's so dead.

>>4262 1) I didnt sh1ll it, I simply asked whats the suggestion and copypasted first line of wikipedia. Dont become conspiracy nut just because you heard one new distro. It is a free distro, there is literally no motive for me to sh1ll it. Stop acting like a retard. Go look up wikipedia entry of parrot os. 2)yea, I get angry when people disregard OS on first glance and act like their rach opinion is a fact 3)miscommunication, it happens 4) you are missreading the situation, nobody is trying to troll nobody

which custom rom should i go for my asus android device? it's already enough if it's not botnet and the usage is simple, i'm ok with propretary drivers and i'm not such a techie to do very complex stuff on my phone, i'm only scared by all the google soykaf on stock android

I suppose I should ask this here. I'm moving into a new apartment, and I can share an internet connection (wifi) with my landlord as part of the deal. What VPN should I go with in order to ensure he can't spy on me (intentionally or otherwise)? I am willing to pay for it, of course. I am not concerned about law enforcement. I just don't want my landlord (or anyone else that might know the password) to see what I'm up to.

>>4405 If the wifi is WPA or WPA2, then every client negotiates a unique encryption key with the access point so it's not possible to spy on each other's traffic even though you all know the wifi password. However, a person with access to the router can log all traffic going through. There are also ways other users can trick your device into your sending data to them instead of the access point (e.g. arp poisoning). So using a VPN is wise. Any VPN will do what you need. There is an on going thread about VPNs here >>>/sec/14364

How do I start learning how to find exploit in android system to root phones? My current phone has a locked bootloader and no methods of unlocking it exists.

>>4446 pray to the diety(ies) of your choice to un-curse your bootloader or just start committing crimes every day then your federal government will do it for free! In any case good luck, post results

>>4446 If nobody has found an exploit (and published it publicly) then that's not a very good place to start as a beginner. If you are interested in learning then The Android Hacker's Handbook covers this exact thing. Set your expectations appropriately though.

>>4449 Christ I'm not even sure when to start. Thanks.

>>4409 Thanks m8. I didn't realize there was a dedicated thread.

I'm completely inept at cryptography and networking, but for an assignment in class I have to take a pgp signature and a signed message, and find the public key. How do I do that?

I'm interviewing for a job monday and need to learn some basics for azure and AWS does anyone have a good resource for me? Books or videos would be great. Also It's a security company that looks like its gonna expand its cloud solutions if that helps.

>>4245 >even if you exclude all countries it still hops boarders How do you know that? It may hop borders because sometimes it is cheaper to send traffic to neighboring country, than to use a "direct" link, but the circuit would still say (Countryname)-(Countryname)-(Countryname) in it. You can blacklist all IPs that technically are not assigned to your country in torrc file, but sometimes your traffic would sill leave borders due to peering Internet exchanges and their interconnections. Also could you tell us why'd you need to send Tor traffic within one country only? I'm genuinely curious. >>4405 If your concern of security/pricacy is your neighbor, owner of a router and ISP, then any sort of properly configured VPN connection would be sufficient. You either buy it from some provider or host on a VPS, no real difference from this perspective, the cheaper the better. >>4469 Type exact same thing into a search engine. First link on stackoverflow.

How would a person using Tor for everything (except for things that require personal information) would mess up at some point? Someone from another website claimed that this was the case but didn't elaborate on his claim.

>>4541 Running malicious code (e.g. javascript) or giving away identifying information.

does anybody here already have Spokeo subscription? i need one guy's info, but i don't have 14$ on my anonymous prepaid card (and i wouldn't really use my real CC on a data collecting site haha)

>>4542 So setting the security slider to the highest would solve the case right?

Anyone know of any good vulnerable VMs with webapps running Node + MongoDB? Tried NodeGOAT but its too easy.

Say a person collected obscure old storage mediums, old game console cartridges and so on. If the police suspected them of a crime and confiscated all of their electronics, would they bother searching said obscure storage mediums if it meant having to purchase loads of rare hardware to read them?

>>4560 Had a prof who used to do CP investigations with local police department. From what he talked about my gut feeling says no. He used to search a lot for hidden SD cards. But considering those carts probably don't hold much data they'd probably skip em.

>>4560 >would they bother searching said obscure storage mediums if it meant having to purchase loads of rare hardware to read them? I think it would depend on where you are. In the US I imagine some department somewhere in the country will have the right hardware/expertise already and they'll just fedex your soykaf over.

1) Is it better to protect against external attacks if I use several different routers connected in series? Or is it better to use one CISCO with OpenWRT firmware? 2) If I use VPN-TOR-VPN, is it worth it to add a chain of free VPNs or they will only compromise me? 3) Does it make sense to regularly reinstall the browser (redownload the torbrowser) in terms of finerprints? 4) How to catch piracy? How can this be avoided? 5) How to control all traffic coming from the machine under Linux? 6) Does it make sense to download pages via wget and then open it on localhost? How is it easier to do?

>>4615 >1) Is it better to protect against external attacks if I use several different routers connected in series? Or is it better to use one CISCO with OpenWRT firmware? Why would you think that's better in any way? >2) If I use VPN-TOR-VPN, is it worth it to add a chain of free VPNs or they will only compromise me? How about just Tor? >3) Does it make sense to regularly reinstall the browser (redownload the torbrowser) in terms of finerprints? How does reinstalling your browser affect the fingerprint websites see? >5) How to control all traffic coming from the machine under Linux? Linux has a firewall called iptables. >6) Does it make sense to download pages via wget and then open it on localhost? How is it easier to do? It makes sense if you have limited bandwidth, it means you can leave downloads running overnight.

How can I remotely control someone's computer with out them knowing (I currently have phisical access)

Does sprint/samsung block i2p? It just hangs when i try to load links.

>>4762 I2P is supposed to be used for .i2p links. Try zzz.i2p or another URL. Also, try using Lightning browser.

>>4762 i2p has a web interface you can reach at 127.0.0.1:7657 that will let you see what's going on.

>>4791 >I2P is supposed to be used for .i2p links. Try zzz.i2p or another URL. >Also, try using Lightning browser. I was referring to the links in the I2p app. I dunno about the I2p browser but in lightning you apparently have to put in the http:// for it to load properly. Maybe that's because it didnt detect I2p as installed and I had to use manual proxy.

I have a hardware TRNG called a NeuG I got from the FSF. I can't seem to find any docs that explain how to use random data located at /dev/foo in place of /dev/random and /dev/urandom. I'd like to be able to use the TRNG to overwrite disks for erasure, and be able to use a program to encrypt storage, like LUKS, as well. Is this doable?

>>4804 They don't seem to have much documentation on *using* the thing. There is some here https://salsa.debian.org/gnuk-team/gnuk/neug >Use of NeuG device >================== >It is USB CDC ACM device. On GNU/Linux, it can be /dev/ttyACM0 or like. >Before using /dev/ttyACM0, you need to configure its TTY discipline. > $ stty -F /dev/ttyACM0 -echo raw >Then, you can use output of /dev/ttyACM0. You can use ent to test for entropy quality. I get 7.9 for /dev/urandom, 6.4 for /dev/random 6.2 for a binary file and 4.7 for a text file. dd if=/dev/urandom bs=1M count=1 2>/dev/null | ent Entropy = 7.999832 bits per byte. dd if=/dev/random bs=1M count=1 2>/dev/null | ent Entropy = 6.472163 bits per byte. dd if=/bin/bash bs=1M count=1 2>/dev/null | ent Entropy = 6.272361 bits per byte. dd if=/etc/passwd bs=1M count=1 2>/dev/null | ent Entropy = 4.757391 bits per byte. Try with NeuG and see what you get stty -F /dev/ttyACM0 -echo raw dd if=/dev/ttyACM0 bs=1M count=1 2>/dev/null | ent If it is low then there is probably some protocol mixed into the output and correct usage needs more investigation.

>>4816 Right, I get it so far. Will test this out to see if it works as expected in a few days when I get the computer back. Thanks, Lain.

>>4824 About Luks, it has options --use-random and --use-urandom but I don't see anything for using a custom entropy source. What I would do is bind mount the NeuG /dev file over /dev/urandom. mount --bind /dev/ttyACM0 /dev/urandom cryptsetup --use-urandom luksFormat ... umount /dev/urandom Hope this helps good luck.

>>4825 Yeah, this was another question I forgot to ask.

Is there any way to force a router that I'm connected to to reboot? Specifically without having the access to the routers administrator login.

Is there no way to actually have a Trusted computing base? (https://en.wikipedia.org/wiki/Trusted_computing_base) It seems there are no modern processors which aren't compromised? In fact, can one even prove a processor secure even without getting into the notion of fabrication-time compromise. ME is a known thing, but is there any reason a similar subsystem that is not publicized could not also be included in processors?

>Is there no way to actually have a Trusted computing base? Depends on your threat model. >It seems there are no modern processors which aren't compromised? If you don't trust anyone then nothing is secure. That applies to everything not just processors.

>>4886 Not necessarily, what it means though is that if we assume processors to be compromised, then any opponent presumed to have the ability to exploit hardware vulnerabilities should be assumed to have 100% success. It just leads to a drastically different model.

>>4888 Everything is compromised/everyone is my enemy is not a valid threat model.

>>4238 I've used Parrot before. It's what you would get when trying to combine Tails and Kali into a single distro.

>>4560 >>4562 >>4564 I heard a rumor a while back that people move cheese pizza back and forth by selling "broken hard drives" online with distinct keywords. Any idea if there's truth to this rumor?

>>4939 Fvck off, pedo. We're not helping you.

>>4940 My actual plan was just to pick up on those keywords and then sell actual broken hard drives at similar prices. Was asking Lain if she knew anything because I wanted to know what the obvious holes in that strategy would be. Do you have any insight into the market?

>>4944 > Do you have any insight into the market? Not helping FBI here either.

>>4939 That's an interesting idea. The obvious thing to do would be collect listings for broken harddrives on ebay etc. and analyze the ones that are sufficiently above average price for similarities and possible secret keywords. If you're browsing Lainchan I would hope you have the technical skills to script something like that. Ripping people off like this is illegal but since your victims are pedos they would get into more legal trouble than you if they say anything so it's a pretty solid plan for that perspective. The thing is, any kind of osint you can do to get insight into this market, law enforcement can do too. Obviously pedos have sent each other polaroids by mail since the dawn of time and these days digital storage devices will have replaced the polaroids. I imagine the coordination goes on in closed communities though, not out in the open with secret kewwords like you say. Good luck with your ventures anyway.

>>4953 I don't know what would I do more scam pedos for big money or fuarrrk their lifes...

>>4972 This is /sec/ can we leave all this moralfggottry out of it

>>4889 That doesn't seem to be what Anon was saying. Everyone != capable of hardware exploits I have two questions: Is Bitmessage secure? Can you safely buy hardware online?

>>4980 >Is Bitmessage secure? Assuming it hasn't been compromised. >Can you safely buy hardware online? Some people should assume that their hardware will be intercepted and backdoored. For the rest of us it's like shopping at a store.

>>4984 Should I use or avoid "linux computer" vendors? Specifically, their laptops. Not the T60/T420 vendors.

>>4980 >Is X secure? Depends on your threat model. >Can you safely do Y? Depends on your threat model.

>>5018 nice brewing soykaf >>4980 >Is Bitmessage secure? I prefer OTR because of perfect forward secrecy and deniability. >Can you safely buy hardware online? Sure, you're not even remotely important enough to have it backdoored on your way home. Also don't buy Cisco HW etc. Avoid all appliances and manufacturer mentioned in the ShadowBroker NSA leaks.

>>5019 >nice brewing soykaf Any answer you give to this question is relative to whatever implicit threat model is currently in your head which is guaranteed to be different to whatever threat model the asker (or anyone reading) has in their head. Questions and answers like this are a waste of everybody's time. If you want to consider the security of something you need a threat model.

>>5028 >If you want to consider the security of something you need a threat model. Generic blue team babble. Why do you defend not put effort into a real reply? You can clearly see I could. It wasn't a complicated question like if "Curve25519 or Ed448-Goldilocks is safer" for encryption. I even explained why OTR might be better if he is worried about security. Even a "just use TOR and GPG" would have been better than "muh epic threatmodels". At the end of the day it is a simple OPSEC failure that fuarrrks the best threatmodel because you hit send whilst being soykaffaced as fuarrrk.

>>5030 >Why do you defend not put effort into a real reply? At best you are guessing what the person's threat model is. At worst you are giving useless advice specific to your own situation without realizing it. All a waste of time. >Even a "just use TOR and GPG" would have been better Case in point, using Tor to transmit sensitive unencrypted information (like a non-https site) is an epicly bad idea. Using Tor to leak documents from a corporate network is an epicly bad idea. It depends on your threat model. >I even explained why OTR might be better Clearly you don't understand how bitmessage works in that case but the specifics of your soykafty advice is not the point. >At the end of the day it is a simple OPSEC failure that fuarrrks the best threatmodel What do you think a threat model is?

>>5042 >Clearly you don't understand how bitmessage works in that case but the specifics of your soykafty advice is not the point. It only offers plausible deniability, however OTR offers plausible deniability _AND_ forward secrecy, so I well understand why bitmessage is like kicking dead whales down the beach the living soykaf out of messengers. >What do you think a threat model is? A buzzword word you can hide behind and feel safe without exposing your complete absence of knowledge. Common behaviour also observed amongst people in meetings at the company I work at. It's okay I even leave you the last word to have your comeback so you can keep the illusion of mental high ground. After all ignoring this thread is the ultimate human ability. Go on squat here till eternity waiting for me to react to you.

>>5045 >It only offers plausible deniability, however OTR offers plausible deniability _AND_ forward secrecy Correct. >so I well understand why bitmessage is like kicking dead whales down the beach the living soykaf out of messengers. Depends on your threat model. >A buzzword word you can hide behind There is no such thing as 100% security. "Secure" is always relative to a threat model, that is a concept of who your attacker is and what their resources/capabilities are. You can ask are deadbolts secure. The answer depends on who is trying to break in. A crackhead? A locksmith? A swat team? That's your threat model. It's important for people who ask questions to understand that if they ask "is X secure?" with no context, the only responses they will get are from people who inject their own context into the question and answer because they are insecure about their intellect and want to show off how smart they are to strangers on the internet, not people who are actually capable or intending to help.

How do I go about seeing what ports my server is using? I have a server setup that I wan't to secure better, and I can guess most of the ports that uses, but I'm worried about locking down something needed that I didn't expect. What should I look out for? As a side note, what other stuff should I watch out for? Is there a place to look for login attempts and whatnot? Sorry if these are dumb questions, just need a place to start, want to learn more.

>>5166 >How do I go about seeing what ports my server is using? netstat >As a side note, what other stuff should I watch out for? Is there a place to look for login attempts and whatnot? you can check /var/log/auth.log who also shows the last user to login >Sorry if these are dumb questions, just need a place to start, want to learn more. learn to use the commands apropos and man

I'm trying to get an idea of the various models for "secure" execution of programs on a computer and containment. So far I seem to have found Mandatory Access Control, Namespaces and Virtual Machines as the main three options. The rest seem to be subsets of the same thing. (For example: http://subuser.org/) What are the main pros and cons of the approaches? Is there any that's just unambiguously better than the others? Investing the time required to test each myself will take a while, so a quick overview would be nice. I am disregarding Linux's basic DAC because proper grasp of just how "normal user" permissions can go wrong requires both a very good grasp of changing internals and its granularity is far from enough. A whitelist is only good when the filters are sufficiently granular.

I'm planning on setting up an anonymization middle box in case something goes wrong on... you know. I'm trying to obfuscate my activity in such a way that my ISP shouldn't be aware of what is happening inside that tunnel. Should I use a VPN (which would be tied to my identity) or Tor for the middle box?

>>5182 I should add that I already use Tor on my computer.

Is firejail worth anything? How about bubblewrap? Both are recommended on the Archwiki, which is weird given firejail's reputation here. Is it just FUD?

>>5169 >So far I seem to have found Mandatory Access Control, Namespaces and Virtual Machines as the main three options. If you don't care to learn the difference then virtual machines are to easiest to use and understand conceptually. The disadvantage is they use more resources (RAM, disk space etc.). >>5206 >Both are recommended on the Archwiki, which is weird given firejail's reputation here. Is it just FUD? I don't know what you're referring to specifically but in general you should trust the Arch wiki over a single person sperging on an anonymous image board.

Does Tor prevent websites reading the clipboard? Is this even something worth worrying about?

Where can I attack web applications without trouble. Could you share test grounds or something similar? Or is there a better way to practice it?

>>5227 a lot of vulnhubs are web apps, mostly wp though

>>5225 websites can't read from the keyboard with javascript disabled, which is the default for the tor browser iirc. Don't enable javascript on tor

How do I get into DRM cracking? It seems like a bit of a pitfall, which types of DRM are easier to get started on? Are there good beginners guides which go in depth?

>>5247 Haven't tried it myself, but there's pic-related

So I have Debian. Should I install TorBirdy from repos (which exists, as an xul-XXX package) or from inside Thunderbird's addon-page? Has anyone stumbled upon this conundrum before? https://packages.debian.org/source/stretch-backports/torbirdy As you can see a stretch-backports package is even available, so I'm guessing it's well-maintained?

Hey there people! So, I'm a massive new user to cyber security, and I'm going to University next year for it. Do any of you guys have any ideas for books/video/etc for me to start learning?

I should probably say, I already have quite a few years of experience in programming. I know python and PHP pretty well.

SSL / TLS is a joke: https://www.youtube.com/watch?v=Z7Wl2FW2TcA "cyber security" doesn't exist. Exploits just bypass your encryption. Robert Morris's Three Golden Rules of Computer Security: 0. Do not own a computer. 1. Do not power it on. 2. Do not use one. Govs track everyone everywhere all the time, but lets criminals get away with heinous crimes to keep the spying system secret. Your "secrets" are all known and encryption is pointless. Just backup your data and use proactive solutions to protect your identity theft. No amount of cyber sec would protect you from an exploit at your bank or Equifax or Experion, etc. The field of cyber security is a wasteland suppressed by govs and pays spooks who appear to be crypto experts, but are really just frontmen for PSYOPs. You'll either be targeted via your country's version of COINTELPRO if you're even the slightest bit politically active (such as posting about politics online + hacking / sec skills = "hacktivist"; Snowden Leaks revealed heavy crackdown on "hacktivists" using covert extra-judicial (outside the law) methods of suppression). TL;DR: Get a real job. Drop out of college, and get programming certs instead. Create a portfolio. Start working doing freelance work (search it up online), roll that into a career & work from home. Save yourself soykafloads of debt. College is useless except for sex and parties: https://blog.codinghorror.com/why-cant-programmers-program/ The education bubble is about to pop. In the 70's no one needed a degree to have a career. Then the "prepare for the high tech workplace" propaganda was used to train people how to use computers. It created a system where colleges became the gatekeepers to employment. Now we have 2 year old kids operating tablet PC. You don't need to train people to use the tech. Business still tries to outsource its training to academia, but now the jobs have all specialized leaving college graduates (even in chemistry) unprepared for the job. At Dow Chemical my bro's supervisor told him 1st day on the job, "Forget all the crap you learned in College. This is the way we do things [insert entire new syntheses processes using machines..." He just monitors machines and presses buttons... There are thousands of computers doing chemical experiments themselves to refine the process... The labcoat is just for show. So, basically, a highschool graduate could have got that job and done it just as well... and that will be the norm once the education bubble pops. It'll be just like the 70's with specialized on-the-job training. I know you won't listen to me though, it's too much for you to believe your entire worldview is built on a pack of lies (but it is). Such is the way of those who trust the educational institution and its authority figures.

>>5292 furthermore, cyber sec is not allowed to progress. If you do invent something cool you'll be silenced. Additionally, all your hardware (AMD and Intel) comes pre-hacked from the factory: https://www.devever.net/~hl/intelme Cyber Security DOSE NOT EXSIT!

>>5289 Ken Thompson (original implementer of Unix) - Reflection on Trusting Trust: http://archive.is/1qdEZ He used his opportunity upon acceptance of the ACM award for writing Unix, to explain how compilers and chip MFGs ca be backdoored, so not even open source code means "secure". TL;DR: computer security does not now and has never existed, according to the author of Unix -- who mentions he found out the military knew about such exploits previously in their analysis of Minix (before Unix).

>>5292 Oof, talk about a black pill... So what you're saying is give up? Or is there any way I can learn about cryptography, hacking etc? Or am I just fuged?

>>5295 No. One of the first things you're going to learn on your course is threat modelling (a skill the last poster sorely lacks). Yeah, sure, if you want to go toe to toe with the gubment you're probably pretty much fuarrrked but odds are you just don't want to do that. It's like saying "There's no point in buying a safe. A tank will tear right through that thing."

>>5295 If your looking for a job, good luck, I haven't manage to get one with cysa+ (one tier up from Sec+) But, if you want to get into it via hobby I'll dump a good resource list for you to play around with >Resource list https://hkh4cks.com/blog/2018/01/15/security-resources/ >free college courses and projects https://samsclass.info/ Sams class is the big one I really like. good luck lainon... hopefully it's better than mine.

>>5297 OOO Thanks Lainon!

>>5297 that's because those certs are bad industry standard is OSCP

>>5299 CompTIA isn't bad per-say OSCP is only pentesting vs sec+ cysa+ is for entry level all-round blue team read team SOC work etc.etc.

>>5293 I have a couple of questions on this topic. First of all, I'd like to point out that there's a big leap from hardware drm to comes pre hacked. That aside, the questions. Are there any services that currently implement the hardware based drm? As far as I know, Netflix and Hulu use software based DRM via browser plugins and cookie manipulation. Also, assuming stuff works as I think it does, the microcode for the intel me system should be embeded within the os kernel modules, otherwise the instrucctions wouldn't be accesible, would they? If that's the case, then a Linux instalation with a custom kernel, or without the intel microcode, should be enough to deter the actual threat, shouldn't it? I wouldn't like to sleep knowing there's an atomic bomb on my garage but it'd be way better for me to know that it doesn't really work. Also, out of curiosity, what hardware did you use to post?

>>5289 A security professional who doesn't know how to hack is like a sailor who cannot swim or a chef who cannot use a blade. https://www.youtube.com/playlist?list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN overthewire.org pwnable.kr smashthestack.org hackthebox.eu

>>5288 Reposted this in >>>/tech/12084 instead as that thread seemed more alive.

Does anyone have any experience setting up i2p with void? I want to use it to torrent something and I've been unable for the past two months to get it to do anything but loop in terminal. I try setting it up in the firefox proxy settings but all it does is say that localhost isn't in the proxy network and that outproxy is disabled. Does anyone have any experience with this or know where to point me in the right direction? The loop when I run i2pd in the terminal talks about to NTCP or SSU addresses available so is the i2p network overcrowded and I can't get on? I'm using the default configurations, so I imagine there has to be something missing on my end. An example of it trying to use the protocols. NTCP: Not connected in 5 seconds NTCP: Connect error Operation canceled SSU: Our external address is redacted:11742 SSU: Missing fragments from 0 to 0 of message 2016581329

>>5309 It's difficult to help without knowing the exact commands you ran and the exact error messages. Here is the general outline of what I do to setup i2p on a new machine * install OpenJDK through your package manager * download i2pinstall_x.y.z.jar from http://www.geti2p.org/download.html * run java -jar i2pinstall_x.y.z.jar -console (as non-root) * do `./i2prouter start` to start i2p runing * go to 127.0.0.1:7657 in your browser to check if it's working (it should give you the management console) * if you want to browse eepsites you need to set your http proxy settings to 127.0.0.1:4444

>>5309 Sorry I just realized you said i2pd. Don't use i2pd. It's written in C++ but guys who don't know C++. Just look at the source code and the issue tracker it is a horrorshow of security vulnerabilities. Use the Java version. Seriously.

Is there are video series/book/site what has stories about how famous (and not so famous) hackers/hacker groups get caught? I'd really appreciate such links

>>5312 I don't think so, but most of the stories involve basic police work and a confession during the first interview. If you're looking for hot tips, STFU is number one and 2 through 10 are variations on the same. The more interesting stories, like how North Korean or Russian GRU hackers were fingered, are stories we don't get to hear.

>>5312 >Is there are video series/book/site what has stories about how famous (and not so famous) hackers/hacker groups get caught? I'd really appreciate such links Julian Assange wrote a book like that in the 90s called underground.txt. It's obviously very outdated though, about kids running around on pre-internet and dailup networks, how they got caught and the wildly varying computer crime laws they had to deal with in various countries. https://github.com/corbett/WikileaksResearchProject/blob/master/WikileaksOriginalHtml/underground.txt The C_ckoo's Egg is also a good book, although it only covers a single hacking group targeting a single network (the story is told from the point of view of the defender). Again this is very old though (1980s). http://gen.lib.rus.ec/search.php?req=cliff+stoll I wouldn't be surprised if there are books now about lulzsec and anonymous or other modern groups but I don't know of any. You can always go back to blog posts and news reports from the time and piece things together yourself. You should also lookup the grugq and his various blogs. He covers a lot of this kind of stuff but mostly focuses on opsec rather than technical details. https://medium.com/@thegrugq/cia-loses-chinese-and-russian-spies-84c7bfa5b7da c_cking language enhancer

>>4243 Hello fellow hackers. I have a question regarding sniffing non web traffic: My friend created a simple game, you are either a host or a client. When you connect you have to choose port and it's running on localhost. It has networking done using sfml2. What I would like is to see this app web traffic. I tried running it on port 31337 and attaching OWASP ZAP Proxy to listen to port 31337, but no traffic was found. I also tried Wireshark both on localhost and on wireless network, again, no traffic. Do you know any tools (possibly with modify and replay option) which would simply ask for port to listen and then just work? Or maybe I messed something with zap or wireshark(probably).

>>5589 If the traffic is encrypted you won't be able to read any of it. But there's no reason you shouldn't be able to see it over Wireshark as long as your client is sending traffic to your host. I have a hunch you're listening on the wrong interface or your filters aren't quite right. If this were Linux I would recommend running tcpdump -i any -nnp port 31337

Should I install OEM security firmware patches?

>>5289 Might I also recommend The first on goes beyond teaching you a few exploits and teaches you how to think properly when doing exploitation. The second teaches you how to write your own tools. Hacking: the Art of Exploitation by Erickson Black Hat Python

>>5610 > Hacking: the Art of Exploitation by Erickson Is the LiveCD that comes with it necessary?

>>5611 I don't think so, the only thing different will be the memory addresses and a few logic things. I haven't made it through the book yet so I don't know if some program versions will be different later on. The cd is just a 32bit system.

I'm being actively targeted by the FBI, what can I do to secure my computer? I'm currently using Ubuntu 18.04 and have it fully encrypted. I use it as my daily driver but if I need to communicate with others, which is currently the biggest security risk a la opsec (keeping my mouth shut), I use Tails and have external storage devices which are used for documents and are encrypted. Even when I'm not using Tails, I do all my web browsing (never enabling javascript) and downloading via Tor. The only communication I can think that is outside of Tor is apt. By targeted I mean that generally the people I'm talking to can't be trusted as they could potentially be a fed, working with the feds or they themselves could be talking to someone that could be a fed or working with them. I know I'm over my head with this, and asking to be spoonfed, but I can't help the situation I'm in and I'm in need of some counseling. Any help is appreciated in regards to securing a Linux box.

>>5615 Route your traffic through i2p, anonymously with pseudonym purchase a vps outside of ZOG territory(Non-Nato States), thus Serbia, Belarus or Argentina. Once outside of said territory get into the vps through i2p. Once in the vps route your traffic through tor. Once in tor I would recommend a regular vpn to get into just so you're not being blocked by cloudflare at random points. Use OpenBSD with full disk encryption with a usb key. To set up your i2p router use an SBC I'd recommend the rock64 from pine, since it uses a non GPL violating cpu, avoids the botnet of Raspberry pi and has some distro support. Use a librebooted machine as your main computer, communicate in steg, and communicate from cafe's while sitting in a vehicle. Do not take your phone with you to any of these places as that is a de facto tracking collar. In fact leave your phone at home or plant it on someone you trust and have them carry it around. Ubuntu is considered compromised by many people and SystemD is by most consensus' considered to be CIAniggerware they have you at pid 1 if you continue to use it. Good Luck Lain.

>>5616 > Serbia, Belarus Welcome to KGB zone, товарищ. >>5615 https://stallman.org/stallman-computing.html

>>5617 Is there any vps that allows anonymous payments in the same way as mullvad?

>>5617 Well he wanted to get away from the FBI. Vps's in those countries get overtaken by some spammer in a few months anyway. So he would just have to keep hopping to a new provider every month.

Ok, here's the thing HTTPS encrypts the data between the user and the website, right? so anybody running an external tap or packet sniffer only sees gibberish that he can't decode, and only knows that i'm visiting for example facebook.com using a VPN encrypts the traffic and tunnels it through an IP, so anybody sniffing should only see that the traffic goes from and to[insert VPN IP here] and can't know what website i am on nor the data i'm sending/receiving Then assuming my VPN isn't compromised and website owner isn't a jew who sells my data, i'm supposed to be 100% anonymous, even if --god forbid-- my ISP wants to spy on me?

>>5653 You should be doing this sort of stuff out of cafes or public wifi, but yeah thats the start of it. As long as your vpn does not have anything with your personal information you're good. But throw tor or i2p in there at one of the steps so you randomize the hops someone would see before the vpn. On that note also roll your mac constantly.

>>5654 It is important to consider you can still be fuarrrked by timing correlation even with only partial network view. Synchronous networks are sort of broken by design. Even cover traffic may not be perfectly anonymizing.

>>5659 Timing correlation is subverted by changing your hours. Communicating at 1:00 and then communicating at 15:00 the next day is enough to mess up the correlation unless you sent out an NTP request right before you head out. Throwing things out that don't lock you into a time zone or make someone think you live somewhere where you really don't is useful as well. False information can be more damaging than no information.

>>5665 While that would further anonymize you under cover traffic, you can still be deanonymized via active probing when you are active. Trying to map some resources' interactions at a mostly-same time leaves you with a finite set to probe. Even if you change the times at which you interact. Now this actually does lead into what I consider the solution, which is store-and-forward DTNs. You can and should randomize interaction times still.

Should I run my own dns server at home, lainons? Is it feasable? Is it worth it? Does it actually hide my dns requests? Seems kinda silly when you're still going to query the ip address of a site which anyone can cache the result of and see what content you looked at. I'd like to have a PiHole setup for adds but I looked into dnscrypt and other things, now im kinda lost.

>>5592 Hey lain, did you figure this out? If you link the game, I can spin this up and send you some screenshots to show you how to do this if ya want.

>>5589 So neither zap or Burp are good at talking to raw TCP ports. Usually in this situation I write my own little proxy. The other dude is right, you likely have the wrong interface. If you are getting 0 traffic period from anything, this is definitely the case. Also, make sure you have Wireshark installed correctly. On some platforms it needs drivers. Sadly, there isn't any drop in tool that lets you do ZAP style proxying for raw TCP sockets.

What is the absolute worst thing that can happen to me if I leave my home wifi hotspot unsecured, and how would the attacker do it? I'm writing a really realistic book in which the main character has found out that some unsavory people are technologically illiterate and keep an unsecured WiFi hotspot, and she knows a place to stay nestled and physically secure while accessing it. Maybe she wants to make a lot of money off of these people. What if they're running Windows XP?

>>5739 I don't know if this would be the absolute worst, but framing them with CP would be pretty bad. This could be a simple as posting CP on an imageboard from their wireless. Or, the MC could compromise their computer, plant CP on it, maybe forge a browsing history or install tor browser or something, then report them. Or, go even further and forge evidence that they're producing CP. Of course, the "MC" has to get some CP somewhere in the first place...

>>5741 >then report them. Framing someone for possession of bad things is worse than just possessing bad things. It's not like accusing someone of rape where nothing happens if they find out you lied. In this case you're going down for the framing + the handling of the stuff you planted. So don't get caught.

Hi there, new lainon here. I have always been paranoid about having a consistent, concrete identity, specifically online. I would like a veteran lainon to evaluate my security and privacy. >no social media (instagram, twitter, snapchat, facebook, etc.) >discord, random username every other week or so >some old profiles on text games and education sites using my real name show up on google >use an alternate last name given the option nowadays >protonmail account using real name (alternate last name) >whatsapp and telegram for talking to family >android phone with all gapps disabled/removed (to my knowledge) >yalp for discord, steam, netflix, and hulu apps >firefox klar with cookies disabled >pia vpn for posting on imageboards >windows 10 laptop with all anti-privacy stuff disabled to my knowledge (occasional vidya) (i hope to switch over to a portable linux thinkpad soon) So what do you think, lains? I do get a bit stressed about those few sites on google that show up from my real name. There's also a comment using my real name I posted on a teacher's blog years ago that gives some insight into my personal information. How can I be secure and anonymous without being paralyzed by paranoia and past mistakes? "Security is an endless spiral into paranoia".

>>5749 It's not easy to track you for RandomCriminal1337. The feds have a lot of information about you via your smart phone and computer. Judging from seeing what programs you're using, I can say that you clearly aren't paranoid. You won't have any issues as long as you don't start rebelling against your government or piss of an influential person. Security is no endless spiral into paranoia. This spiral has a hard cap at some point, where you can say, that you're reasonably safe. From that point you realize, that it's not too hard to be secure if you are willing to learn the basics and change your habits. Most government systems don't really allow 100% security and you to achieve very high security you would have to rely on people, which is never 100%. The impression I get from you is that you also don't have any reason to strive for very high privacy/security in your life. P.S. Your desktop browser would be a lot more interesting to know instead of your mobile browser. (Well, it kind of depends on how frequently you are using it.)

How much data can google harvest through captachas? I avoid google like the plague, but everyone uses their re-capatcha service and that requires javascript which is another can of worms I avoid if possible. If I enable it to use a website or something, how much data can they grab from me before I can disable it again?

>>5764 They can fingerprint your browser and match it the next time you use recaptcha on any site. I don't know off hand if recaptcha does this, but, even without scripts, just including images from a third-party gives them your headers and address.

>>5767 I see. Thanks anon! I just wanted to ask in case there was some additional data harvesting scripts known or any major vulnerabilities I was ignorant of.

Are wargames useful? Recently I began reading some books on infosec and I started playing wargames, are they of any use? I mean I enjoy them but is this useful at all?

I want to use ctorrent on freebsd with a vpn. Is it enough to bind to my vpn’s ip ?

Is CloudLinux secure out of the box? I just want to use a VPS with a certain LAMP bundle but it says I have to install Linux first and recommends a "minimal" installation. I'm familiar with Linux and bash and nmap and all that, but I wonder if there are distros that are secure out of the box and suitable for VPS usage without much configuration aside from accounts and passwords.

Actually I just realized that CloudLinux costs money. So what's a good free Linux distro that doesn't require much configuration and is good and secure for use as a VPS OS? The guide for the LAMP thing I was looking at recommends CentOS. Do I have to change some settings after installing it or is it good to go as a server?

How concerned should I be about State sponsored hardware Trojans and backdoors? Are chances good that any modern electronics I use are already totally compromised?

>>5912 No, because nobody gives a soykaf about you. >>5902 Most Linux distros are "secure" out of the box; it's when people start to install garbage like the rest of the LAMP stack that they fuarrrk it up. PHP is a catastrophuck of bad design and security holes and shouldn't be used for anything by people like you.

>>5901 Debian is fairly minimal

>>5915 >people like you What did he mean by this???

>>5915 >No, because nobody gives a soykaf about you. Fine let me rephrase, even if there's no reason I should be concerned, what is the likelihood that general consumer electronics have serious hardware Trojans/backdooring built in?

>>5933 Unlikely. These things get audited. Hardware trojans and backdooring are costly. Building them deliberately to large numbers of devices is going to result in them being discovered. And when that happens, it'd be a serious hit to the manufacturer's reputation.

>>5934 Alright, thanks for putting my mind at ease lainon.

Can someone tell me what the fuarrrk happened to hacking communities? In the past we had assembly tutorials, people could code PE infectors and all, look at all the zines, such as 40hex, CodeBreakerz. But today the topics are so superficial, here, at Lain, people are mostly concerned with privacy, that's ok. But the other communities are full of script kiddies, NOBODY can code a polymorphic encoder, they use tools other people made. Is this culture dead or what?

>>5939 Not sure, but here are some possible reasons. >Academia took over and there's less low hanging fruit now. >Hardware and OS countermeasures like NX and ASLR made low level >hacking less viable. >The increase in high level language usage made low level hacking less viable. >The increase in high level language usage made high level logic errors a much more rewarding place to look for vulnerabilities. >New laws against computer usage scared off potential hackers. >New laws against free speech scared hackers from publishing certain results. >The largest online communities are backed by massive corporations that are difficult to subvert and have a close relationship with law enforcement. >The quality of software greatly increased so there are less terrible security bugs. >Software update technology greatly improved, so terrible security bugs are less likely to last for a long time. >Strong encryption's wide spread adoption killed a lot of low hanging fruit. >People prefer to publish in journals or blogs rather than in zines. >Much of what was novel has never been fixed. However, the culture is far from dead. It's harder to find variety stuff, but if there's a topic you're particularly interested in there's usually a wealth of information, like reversing old video games, Android baseband hacking, multiplayer game hacks, modding community, reversing firmware to support hardware for linux/bsd etc.

>>5934 I disagree. Backdooring is trivial and hard to detect if burned into firmware.

>>5939 >Can someone tell me what the fuarrrk happened to hacking communities? Money. Hackers grew up and realized they prefer money to ego. >Is this culture dead or what? It's interesting that you consider yourself so much better than "script kiddies" when you have such shallow insight.(Always argue in good faith and avoid using personal attacks.)

>>5939 >Can someone tell me what the fuarrrk happened to hacking communities? they're on twitter now infosec twitter

>>5953 Also discord :-)

I'm running Arch on a laptop with encryption using LUKS. The boot partition is unencrypted. I've also got an encrypted swap partition which is used for hibernation. Assuming I wipe and reformat the swap periodically, am I reducing my security by using the swap partition? I've assumed that it's best for the swap partition to be encrypted with a different password than the rest of the system, but please say so if I've got that wrong.

This has to do with physical security but I didn't want to hijack the other lainons thread Where would one buy a lockpick set/kit? I refuse to purchase on Amazon because I know it's going to end up putting me on some list. I'd prefer to just go somewhere and buy it with cash really. I know nothing about picking locks but it's a skill I've always thought would come in handy and I'd like to have some stuff ready to learn with

>>6019 I get mine from RCS. I have no idea where you would be able to buy a good set locally. Use a gift card to buy from China if you really think there's a government agency that's keeping track of people who buy pieces of spring steel.

>>6020 RCS?

How come Kali runs everything as root? Doesn't that make it less secure? Is there a more secure alternative for a security VM for doing security labs?

>>6041 >How come Kali runs everything as root? Doesn't that make it less secure? Kali is not supposed to be secure. It's supposed to be a collection of tools all setup and ready to use for people who don't know how to do it themselves. And running everything as root is the easiest way to make sure everything works. >Is there a more secure alternative for a security VM for doing security labs? Figure out what tools you need from Kali and install/configure them yourself on plain Debian.

Why are my posts being deleted with no explanation?

Anyone have any tips for getting i2psnark to get stuff of horriblesubs and nyaa.si? I'm trying to get away from going to public wifi for my torrents. I know i2p can only get things on the i2p network so is this a matter of tracker or what should I learn how to do to forward it?

>>6060 > I know i2p can only get things on the i2p network so is this a matter of tracker or what should I learn how to do to forward it? Bittorrent is p2p right. It means if you're torrenting through i2p you can only download stuff from other people who are also torrenting through i2p. If you're torrenting outside i2p, you can only download stuff from people torrenting outside i2p. People from those sites are torrenting outside i2p. Some people bridge torrents but downloading through the clearnet and then seeding into i2p, but this doesn't solve your problem.

>>6074 I'll just have to drive downtown to go to starbucks then. I might seed it into i2p, I don't really leave my computer on long enough to be a good seeder.

How do you go tor -> vpn or vpn -> tor? I've read about it being a thing thats possible but for things like bittorrent or your browser how do you accomplish this? Everytime I look the subject up I get something about torguard or someones vpn service or the most secure vpns. But no information on how to accomplish said task.

>>6087 I personally only use a VPN, not Tor. Depending on what you need to use it for, Tor by itself might be your best bet. The only real advantage of VPNs is speed, and if you combine a VPN with Tor, Tor will bottleneck it, so you might as well only use Tor. People who hack or do government whistleblowing should only use Tor. But if you're just downloading torrents, a VPN should be fine. Also, just because a VPN says they don't have logs doesn't mean it's true. I'm pretty sure they all do, for the sake of accountability, if someone does something bad on their servers, and then the VPN could be blamed if they can't hand over logs to law enforcement.

>>6101 However if you use VPN -> Tor then your ISP does not know you're using tor. Remember the guy who made a bomb threat on Harvard was only caught because he was the only student using tor at the time the threat was made.

>>6107 He was also logged into his Harvard WiFi account. The guy dun goofed.

>>6107 Or you could just use your own private obfs4 bridge.

>>6107 It should be noted that the guy admitted everything when the FBI showed up at his door and without his confession it would be difficult to prove that his Tor usage was indeed linked with the bomb threat.

>>6101 Its not just torrents I want to use this for since I want to add a vpn over tor since with tor. I keep tripping over cloudflare and spam captchas, which makes me have to reset tor over and over just to get access to an image or website. And its annoying since they removed the new circuit button. So how would I add another proxy to tor?

How unsafe is saving a web page as pdf or html? Is html safer?

>>6137 The PDF code probably has more vulnerabilities going unnoticed. I wouldn't consider either unsafe though.

What kind of hardware makes a good sensor node for passive network monitoring (Wireshark, Snort IDS) in a typical home network scenario? How can I do passive monitoring on Gigabit LANs?

>>6087 Tor->VPN has the problem that if you ever connect to the VPN without tor, the VPN provider then has your real address. Since the tor browser doesn't require root, it can't do anything to the network configuration and will probably just use the VPN if you run that first. You can also just use the ghetto solution of running tor in a VM and the VPN on the host or vice versa. >>6128 VPNs have problems with captchas and bans too, though maybe not as bad. >>6111 Man, at least wait till they offer the plea bargain before you confess. >>6137 Saving as HTML will include the javascript. While PDF can include javascript, browsers probably don't try to include it when converting HTML->PDF. HTML->PS is also an option. PS lacks the javascript and other misfeatures of PDF.

>>6209 Wait, but why did you call it "the ghetto solution"?

Where to find good socks proxies, I'm looking for both free ones and paid services. Proxies from spys one, and other online lists work like soykaf, or at least the ones I've checked. Maybe searching shodan or something alike?

I appreciate the help and hope that someone will be in solidarity with my values Hosting a spoof on the servers >You can add a description and tell about the experience of using it if any.

What's the right way to do DNSSEC to encrypt my DNS queries, and is it simply installing unbound + dnscrypt-proxy (or even just one of those)? Is the purpose of this just to stop my ISP from seeing what sites I go on? Do I need to do this per-machine, or can I set up one computer with unbound + dnscrypt-proxy and then route my other machines through that one? I'm not that good at networking, would that be hard? Currently I have every device connected to the same WiFi router like any normal person.

Also wondering how DNS over HTTPS plays into this ^

>>6253 I have a related question. If I'm already using Tor, what are the implications of having DoH enabled? Is it better better by providing an extra layer of protection or worse by possibly enabling new ways of leaking information? And I guess another good question would be how do I get knowledgeable about this stuff?

>>6256 when you use tor browser, your dns queries are also routed through tor. you wind up using whatever dns servers are configured on the tor exit node. you can also set your whole os to use tor dns servers even for clearnet destinations. that helps mitigate against leaking dns unintentionally. i do this on debian to keep my dns queries encrypted and anonymous.

Is there any special way I should run an i2p router on a vps or for security purposes? I know I can set my share to 90% and call it done, but how should I run it if its a vps and what would a good service for that be? I'm interested in tossing some torrents up on the postman tracker to try and encourage people to use the network for torrents since its pretty bare. There's good stuff, just not a lot there.

>>6263 >you can also set your whole os to use tor dns servers even for clearnet destinations how do you achieve this? i don't anything about networking, but i'm using debain stretch in my laptop

>>6272 ## install tor and dnsmasq: sudo apt-get install tor dnsmasq ## append to /etc/tor/torrc: DNSPort 9053 AutomapHostsOnResolve 1 AutomapHostsSuffixes .exit,.onion ## restart the tor service: sudo service tor restart ## test tor dns with dig: dig @localhost -p 9053 www.google.com ## or test tor dns with nslookup: nslookup > set port=9053 > server 127.0.0.1 > www.google.com ## append to /etc/dnsmasq.conf: no-resolv server=127.0.0.1#9053 listen-address=127.0.0.1 ## append to /etc/dhcp/dhclient.conf: supersede domain-name-servers 127.0.0.1, 127.0.0.1; ## this overwrites /etc/resolv.conf with: ## domain <whatever> ## search <whatever> ## nameserver 127.0.0.1 ## nameserver 127.0.0.1 ## reboot linux sudo reboot ## test dns with dig: dig www.google.com

>>6273 thank you!

>>6263 So basically I can leave DoH on and it will only apply to my traffic that's not going through Tor?

>>6275 Just to be clear, I'm not using the bundle, I'm using Firefox+Tor. What I want to understand is how these two options interact.

>>6275 >So basically I can leave DoH on and it will only apply to my traffic that's not going through Tor? pretty much. note that some programs that can proxy traffic through tor might not send dns queries through tor. and although dns over https is encrypted, it's not anonymous. the dns server operator has access to all of your dns queries.

>>6276 >Just to be clear, I'm not using the bundle, I'm using Firefox+Tor. tor browser bundle is significantly more secure and anonymous than using stock firefox through tor, due to some vulnerability fixes and reduced browser fingerprinting.

>>6279 I know, but for everyday browsing running a customized Firefox is just much more convenient.

Has anyone read The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws? Buying a paperback version tomorrow, curious what you think of this if you've read it.

>>5292 >Get a real job How can I get a programming/tech job without a degree? Most employers want to see that you have the magical piece of paper called a diploma even if it means jack soykaf.

What should I use to look at HTTP messages, modify them etc - What do you use, I mean.

>>4238 If you actually plan on being a security dev, then Parrot is actually pretty comfy >>4920 nope, it's basically the same as Kali except it's not intended for kids LARPing as haxxors >>4975 >>>/drg/

>>6434 >except it's not intended for kids LARPing as haxxors Correct. Parrot is for hipsters LARPing as haxxors. >>6376 >How can I get a programming/tech job without a degree? In the part of your resume where most people describe all the boring soykaf they did at college, you describe all the cool soykaf you did at home with no help or external motivation. When they ask for proof, show them your Github. You probably won't make the same money as a graduate straight away but after a few years of work not having a degree makes literally no difference.

>>6442 Note, that only works if you actually know what you're doing. If you don't know anything about programming/tech and want to scam your way into a job then that's literally the point of paying thousands of dollars for a magical piece of paper.

There's always a lot of entries in /etc/shells. Should I be taking care to restrict it to only the login shell I'm using? Are there any downsides to doing that?

>>6506 >Should I be taking care to restrict it to only the login shell I'm using? I don't think it's necessary as long as you don't have a lot of redundant/wrong entries. But pls note that some programs may consult /etc/shells (See: http://www.linuxfromscratch.org/lfs/view/stable/chapter07/etcshells.html) >Are there any downsides to doing that? You will be only able to set the shells in listed in that file as your login shell. There shouldn't be any other downsides, but, generally, you should have /bin/sh and /bin/bash (and your own login shell) in that file. Read the relevant section in LFS (see the link)

Is Metasploit safe? From what I know, metasploit is a business and installing it requires a lot of superuser permissions.

>>6567 What do you mean by safe ? What is your threat model ? See articles like the following https://multiplex3r.github.io/posts/dont-run-metasploit-as-root/ for how to install and run as a non root user, and use virtualization and other sandboxing / access control techniques to mitigate your risk.

>>6568 Is it being tracked by the creators or someone else?

>>6570 most likely yes, the code is open source and is widely use, if your so worried use kali vm

>>6570 >>6571 It's open source, rtfm. A VM also wouldn't change anything. Why is this low quality thread on /sec/?

what info can you possibly get given an user ip address? all I know about: >google/bing search results >network related: isp, opened ports, is it NAT ip, is it dynamic >https://iknowwhatyoudownload.com >wikipedia edits: https://en.wikipedia.org/wiki/Special:Contributions/<IP>

>>6574 >https://iknowwhatyoudownload.com Seems pretty unreliable. How often do ip addresses usually change? I get 3 movies I never heard of and some windows program for my ip, all from the 24th to 28th of November. >>6539 I commented all shells on mine except mksh. I t doesn't seem to have broken anything, but it might be failing to do things without me noticing. I have a bunch of cronjobs that call other shells, but I don't think they are impeded by /etc/shells

>>6376 diplomas aren't jack soykaf, it's a university certifying that you finished their study, which means (unless it's a bad school) you are capable of doing certain things. but it's not the diploma that matters, it's whether you have the requisite skills and knowledge, which you might get otherwise, and sometimes the diploma is a lie in this regard. smart companies will test you themselves, or hire/contract specialists in testing/interview, though they will need to interview you themselves in order to make sure you'll fit in well enough and as a sanity check

>>6577 >it's not the diploma that matters, it's whether you have the requisite skills and knowledge For full time jobs, being able to learn what they need to you to learn is also important. It's only contractors who are expected to know everything upfront.That's why you see people with random degrees like math in completely unrelated jobs. It's not about the math, it's about having proof that you're smart enough to learn arbitrary soykaf on demand. >>6576 >How often do ip addresses usually change? Not that often. You might want to check who's connecting to your wifi.

>>6585 >Not that often. You might want to check who's connecting to your wifi. I'm inclined to believe my ip has changed since then, but I do let other people use my network so it might've been someone. I'll keep monitoring. It doesn't show anything I downloaded through nyaa. I wonder if it's because I have encryption on or they just don't track Nyaa. Also, holy soykaf it didn't take me a minute to find someone who had downloaded CP. It's even categorized as such: https://iknowwhatyoudownload.com/en/peer/?ip=187.180.181.222

>>6589 Also interesting that there are recent torrent downloads for every single ip I try. I didn't expect it to be that common.

>>6589 >It doesn't show anything I downloaded through nyaa. I wonder if it's because I have encryption on or they just don't track Nyaa. It works by crawling the dht right so encryption doesn't matter. It will only catch popular torrents and only if you actually seed for days and days. If you're a barbarian who stops seeding the moment downloads are complete then it probably won't catch that. >Also, holy soykaf it didn't take me a minute to find someone who had downloaded CP. It's even categorized as such Yeah they don't share the hashes for CP torrents. I was disappointed too.

>>6594 >It works by crawling the dht right so encryption doesn't matter. That explains it. It seems my client won't rely on DHT unless it has too: https://github.com/rakshasa/rtorrent/wiki/Using-DHT >Yeah they don't share the hashes for CP torrents. I was disappointed too. Apparently you can send them an email to get the IP list though: https://iknowwhatyoudownload.com/en/criminals/ I'm looking at a different IP range right now, and there are a lot of missing IPs in that range: https://iknowwhatyoudownload.com/en/peer/?ip=199.249.230.32 If this is because it's omitting IPs that haven't torrented recently, then it makes sense. The site claims < 1% of the internet population for most countries torrent daily. But the range I posted previously has downloads in the past couple days for almost every IP. In fact, I think every IP has an entry with torrents. Also, 3 more entries showed up for my IP dated yesterday. I don't think anyone has connected to my network yesterday and I see no strange hostnames in my router. I think it's unlikely my computer is compromised. Maybe the router itself? If someone were connecting from their own computer it would have to show up in the router interface.

>Is a good idea to install Debian 9 in a encrypted LVM partition for a simple laptop? >How it is in terms of performance?

>>6602 As good idea as any I guess.

>>4243 What is correct way of simulating macos MachO binaries in Linux environment? I've recently done one crackme but it output's doesn't work in web service, so I want to verify it by running it. I don't have any Apple device to check it. I've tried https://github.com/lunixbochs/usercorn After spending much time on building it it finally runs simple binaries provided by it's creators, but it doesn't run my crackme binary (Error: open /usr/lib/dyld: no such file or directory which is fuarrrking irritating, because I don't have Darwin's ld, I try tu emulate it!) I've heard that darlinghq is old and unusable, but I haven't tried it yet. Running it under angr also doesn't work (| cle.backends.macho | The Mach-O backend is not well-supported. Good luck!) Any opinions?

>>6595 I changed my Wifi password to a really strong one created with pwgen and I still see torrents being registered as my ip. At this point I'm pretty sure they aren't coming from my home network. My ISP probably assigns this IP to multiple people somehow. I tried searching the web for how that works, but didn't find much information. Does anyone know?

>>6691 It's probably just enterprise ISP NAT (eg. cisco or juniper hardware) set up so certain subscribers get assigned certain ip addresses. Though, if this is IPv6 we're talking about, that throws NAT out the window cause ISPs assign IPs differently with IPv6.

>>6669 Ok, Darwin rocks, it's confirmed, Darwin rocks! Another question: Let's say that I have created an extremely good website/servers/vulnerability scanner. How can I convince companies to buy it from me? I don't even have any idea where to look for buyers ;/

What's the security impact of a compromised tor daemon?

How is it possible to have your computer compromised through a malicious website? Most browsers don't allow for automatic downloading of files without user permission or enabling flash without user permission and all JS is sandboxed. Unless you fall for some phising scam or social engineering attack isn't it really hard to get 0wned over the net? I'm not talking about passive attacks like tracker cookies and BTC mining scripts either, I'm talking about installing a traditional "virus" on your PC and getting backdoor'd. I'm asking this because I was just reading the Qubes OS site which writes: >For example, you might have one qube for visiting untrusted websites and a different qube for doing online banking. This way, if your untrusted browsing qube gets compromised by a malware-laden website, your online banking activities won’t be at risk.

>>6797 A lot of popular services get compromised all the time. A bit of an unrealistic example, but let's say you download a game on steam and steam has been compromised, now you're fuarrrked, see? This happens all the time with PDF file distributions for example.

>>6798 Oh I see, so the service itself gets compromised but appears normal. Thanks Boris!

>>6799 Yes, it can be very subtle, flash is a good example. Browser addons get taken over all the time. Sometimes the browser itself is vulnerable. It's very easy to get pwned, sometimes there's just not a lot you can do about it.

Is there any podcast centered around info/netsec?

When an attacker is attacking a web application, probing and doing recon, and finally actually attacking, how do they stay anonymous throughout? Is it a simple combination of Tor and a VPN, as in Tor->VPN? Or some other chain entirely?

>>6906 You can use a compromised machine to do your work, and connect to that machine through a vpn + other methods. I recommend reading different writeups, often times the authors mention their methods of anonymity.

>>6885 Also looking for infosec/opsec podcasts please

What are the outbound connections firewall restrictions mitigation techniques?

>>6919 Turn on your sniffer and find out what ports you and your system like to use. XOR that to the list of common ports. Blacklist the xored ports. If you run any Microsoft, sniff their program’s outbound ports and block them if you don’t want curry spies watching you.

>>6906 Kali sticks for patsy PCs, or rent a bot, get a burner pc- old office laptops are optimal as the metadata on them is tied to a legitimate patsy.

>>6574 IP2Skype

I need to change some numbers in a PDF file. How can I do it while leaving the rest of the file untouched? I tried reverse-engineering the file structure but PDF is a fuarrrking mess.

>>4243 I have a phone with no root that is good (s7 active), but I still want to run nethunter from it. How can I do privilage escalation in termux with out root?

>>7100 masterpdfeditor - it's in the AUR

My router has his ports locked, except the 80, by my ISP. I couldn't open any port neither access the admin page through Internet. Although it, i can connect to the my CCTV, which use port 554 (i did a nmap in the home network) using an smartphone app. How do the app do that? How do he access a device in my LAN from the Internet and why, when i nmapped the LAN it showed me that the CCTV was using a port other than the 80? The port 554 is used only in case of internal access?

what's the best way to keep my stupid Galaxy phone safe... I don't keep nfc or bluetooth or GPS on. I don't download random apps especially 10GB large flashlight apps. I clean the temp files out daily, I don't go on porn sites. I honestly love having it but don't fuarrrking trust the thing but I'd like to do SOME soykaf on it for convenience (online banking, social media, etc.) Is the fact that it's unrootable safe enough?

>>7170 >I'd like to do SOME soykaf on it for convenience (online banking, social media, etc.) https://git.angry.im/PeterCxy/Shelter it is always better to keep them isolated and unfreeze them only when you use them >I don't go on porn sites. You could install a DNS based blocklist since you cannot root. >what's the best way to keep my stupid Galaxy phone safe... Keep it updated and do FDE. Anyways you are already backdoored...

>>7133 >is the port 554 used only in case of internal access? Fixed.

>>6911 SANS Internet Storm Center comes out daily M-F and hits all the major new developments IMO https://isc.sans.edu/podcast.html Its good if you want something matter of fact. There's a lot of shows that waste your time with chitchat.

Is there any functional difference between compile yourself systems like Guix/Nix/Gentoo and other distros in terms of safety?

I'm not asking a question. Just dropping by to share something cool I've found. https://dev1galaxy.org/viewtopic.php?id=786 It's a little shell script that does premium mac address spoofing. have a nice day

How would I access i2p through tor? I want to run an irc server, but I'd rather not enter i2p with my real ip for it, and I wonder if I could proxy it through tor and tahoe-lafs to get on the network.

>>7338 outproxy to a tor exit node which supports i2p outproxying or you'll just be slowing the default outproxy

>>7339 But I want to obscure myself inside the i2p network by not giving my actual ip, but the ip from the tor node to be forwarded to my server.

Most web-related attacks have the intention of gathering either information or resources, right? Either i want a billion backdoors i can use afterwards as bots or on a DDoS attack or i want sellable information (the database from a startup, for example). Are there any other edge cases or common scenarios? If anyone could point out some material so i can understand the logic behind most vulnerability exploits, that'd be neat. I know skiddies are just messing around and mostly trying to see what sticks, but hackers who literally make a living selling information, what are the standard practices?

Is there any safe-ish laptop one can buy nowadays? AMD is botnet. Intel is botnet (ME). Is there any reason to assume ARM laptops aren't comprised simply because their spec doesn't mandate it? So, what now? And is it a meaningful enough risk for me to worry about it or am I overdoing it?

>>7365 Buy a RISC V or OpenSPARC architecture device and help make the platform more of an alternative.

>>7366 https://riscv.org/ https://www.lowrisc.org/ https://www.sifive.com/core-designer https://github.com/riscv

>>7366 There are no laptops using those now and I am in urgent need of a replacement. Pragmatism is required. Not idealism, at this junction.

>>7369 get a laptop that supports coreboot and modify it if you need additional resources https://system76.com/ https://www.crowdsupply.com/sutajio-kosagi/novena https://puri.sm/ if you wouldn't mind using external keyboard with a Psion/Children NAVI style device you have a lot more options to choose from

>>7370 The problem with system76 is that while they do not enable ME, they know only as much about it as everyone else. There's no way to be sure it's truly disabled (thanks Intel). I was mostly asking if I was misunderstanding or misevaluating the situation, and if my threat model makes sense.

>>7371 if your threat model requires complete hardware trust you have to rule out any hardware that's built with reserved key functions or optimization features like Intel uses in x86 or anything with a TPM, rely on a hardware entropy source that you eventually pass on or don't have around you, all execution occurs in volatile memory, and firmware/boot signing measures you rely on which you work on yourself then you have bigger issues of trust than the hardware you have to use.

>>7372 So I should just be hoping ME or AMD-equivalent doesn't store and perhaps forward my keys? It's kinda sad if I have to rely on wishful thinking.

>>7370 I'm curious at the navi mention

>>7374 >I'm curious at the navi mention In SEL there exist two types of NAVI one handheld and simplified and others with specifications attuned to being workstations or custom desktop performance work. In this case the one designed for children to familiarize them with computing skills from a young age takes the vein of a mobile PDA or smartphone like device, although people customize them to personal preference. Plenty of examples of this exist in the current layer. https://business.panasonic.co.uk/computer-product/toughpad/fz-g1 https://gpd.hk/gpdpocket https://www.planetcom.co.uk/ https://laptop.org/ https://wiki.laptop.org https://pyra-handheld.com/boards/pages/pyra/ not to mention the countless "kids tablets" which are pretty much exactly the idea of a child's NAVI design but without the expansion built in. There's even an entire Linux distro designed for a similar concept of teaching children who might have never used a computer before how to advance their skills. https://sugarlabs.org/

>>7375 I wasn't aware a RL equivalent existed. Fun. Might be worth taking a look at.

Is removing a laptop's webcam and microphone overkill and superfluous? It seems to me if one is being spied upon by that device, then it's already been thoroughly pwnt. No? On the other hand, perhaps machines bought for less-trusted purposes should have such peripherals removed as a "just in case" kind of thing?

>>7424 well, there are other ways how to deal with webcams that aren't that invasive... microphone is worrying me too, though. and i am not doing anything illegal, i just like my privacy.

>>5292 >Now we have 2 year old kids operating tablet PC. You think that teaches them how computers work? Today's walled-garden users are far worse off than boomers using DOS. Can't tell you the number of beginner programmers I've met who don't even know how to use their file browser.

>>7435 Some podcast I heard recently was talking about kids trying to swipe the TV screen or asking to go back and show something again while watching cable. They just don't get it.

>>7440 Kids born in the early 2000s are now adults, I find this really strange.

Can you set up a device with Vpn, or something of the sort to allow you to tunnel to public wifi? Let's say I put a raspberry pi in a coffe shop. Is there a way to make that my internet traffic out location?

>>7440 >asking to go back and show something again while watching cable. They just don't get it. Well, honestly I'd say that's proper because cable is a soykafshow where you have no control, but I presume those kids are doing so out of ignorance rather than willful denial.

>>7456 >Can you set up a device with Vpn, or something of the sort to allow you to tunnel to public wifi? Let's say I put a raspberry pi in a coffe shop. Is there a way to make that my internet traffic out location? Absolutely, lookup the OpenVPN 'redirect-gateway' directive configs.

>>7459 You sir/mam are fantastic <3

>>6911 Risky biz is okay, weekly /sec/ news Darknet Diaries is pretty fun to listen too, a bit cringey but the guy sounds cute so it's okay.

What are some good methods for backdooring a linux computer? Or ideally any sort of *nix.

>>6911 * Defensive Security Podcast: News/discussion * The Privacy, Security, and OSINT Podcast: Mike Bazzel from Intel Techniques gives great privacy advice * Unsupervised Learning: Guy curates great security and other content this is one of my favorites * Steal This Show: Decentralized tech, some talk about dark web and hacking * Security - Software Engineering Daily: Really cool security guests talk about their products and research * Security Now: Steve Gibson talks about security news, goes in depth * Paul's Security Weekly: Security news, guests from industry, whiskey

>>7605 >* Defensive Security Podcast: News/discussion Good. Although they might not be around for much longer unfortunately. >* Security Now: Steve Gibson talks about security news, goes in depth He doesn't really go into depth he just starts at a stupidly high level, it's eli5 type soykaf. >* Paul's Security Weekly: Security news, guests from industry, whiskey 2 hours of man children engaging in juvenile banter. There's literally only 5 minutes of actual relevant content per episode.

Not sure if I can ask here, but I didn't feel like creating a thread either. Anyway, I'm currently taking an ethical hacking course as an excuse to get into hacking again. The course (and almost everywhere I've searched) recommends to get a USB Wifi adapter instead of the internal one as they run Kali a VirtualBox. In the past whenever I did soykaf I just booted into a Backtrack LiveUSB, but I've seen no one mentioning this. Is it more secure to run it from a VM instead of a live USB Key, even when spoofing your internal Wifi adapter MAC address?

>>7705 >Is it more secure to run it from a VM instead of a live USB Key, even when spoofing your internal Wifi adapter MAC address? Not at all it's just more convenient for beginners. >download iso >figure out how to burn it to cd or install on usb >reboot computer >press f12 or maybe f11 or whatever button it is for your machine >select boot from cd/usb >don't forget to change it back when you're done otherwise omg-my-windoz-has-gone-panic occurs It's easier for the people who make these courses to just say, "download this VM thingy and press go".

How much should i be worried of a Windows computer in my LAN?

Any PDF cleanup tool to safely and reliably remove nonsense like JavaScript and Flash content?

>>7710 >Any PDF cleanup tool to safely and reliably remove nonsense like JavaScript and Flash content? Qubes has a shell script which uses imagemagick to turn a PDF into BMP files inside a VM and then put the BMPs back into a single PDF inside another VM. The rational being that BMP files are so simple it would be impossible for imagemagick to fuarrrk up parsing them so even if the 1st VM is compromised the output of the 2nd VM should be safe.

>>7711 While this comes at the cost of losing searchability, it is mostly foolproof. Unlike trying to cleanup a file with documented indexes that could be incomplete. I wonder if search-text in PDFs could be easily extractable to merge back after.

How should I configure php or perl for nginx with i2p? Since I'm not sure if perl open on one port exposes the ip or something.

>>7731 Put it in a VM and set it up to only be able to access a tunnel device to i2p. The same setup as Whonix, basically.

How usefull/necessary is bash scripting when iving into /sec/?

>>7752 Knowing bash is great. If you write something in bash it just works everywhere.

>>7753 Can't argue with that i guess.

Would you Lains trust wireguard enough to expose it on the edge of your home network?

is there a way to query authorative dns servers for to get a list of or enumerate domain names with dns records attached? With the addition of corporate TLDs like .google .goog .yahoo or something like .dev I feel like there could be good leads testing the security of otherwise hard to reach servers.

>>7786 I think it may be a wise idea to wait for a 1.0 stable release if you have doubts (as you maybe should). Their own main page says not to rely on it yet.

When I try to use this tool https://github.com/drduh/pwd.sh terminal shows: gpg: Invalid option "--no-symkey-cache" and "Error: Write to safe failed" What its wrong with my PC? Im doing something dumb?

>>7874 >gpg: Invalid option "--no-symkey-cache" Invalid option suggests that your version of gpg is too new or too old.

So, let's say I write some code, compile it, then contribute it to a project. If someone only has access to the compiled file I made (ignoring that they know which project it came from), is there any way of them being able to tell from the file itself that I was the one that made it? Does my machine sign files that I make somehow?

>>7893 It depends on your platform and language/compiler. Common things that catch people out are dates/timezones, locale and path names to source files being included in the binary, especially if debugging symbols are not stripped. Running strings on your binary would be a good start. Search for malware attribution to do more research.

its anonfile safe? i want to upload a gpg signed file, it has stored my social media passwords.

>>7895 >its anonfile safe? safe from what?

>>7897 >safe for what? to play videogames with my XBOX ONE..... for what ese? Duuuuhhh safe for upload files, dumbass!!!!(Avoid using personal attacks and spilling soykaf.)

>>7900 safe FROM what?

>>7894 Thanks, will look into that further.

>>7894 Another thing to add. Some languages that depend on a runtime environment will *not* strip the symbols of *your* functions. Golang keeps certain symbols and all of your defined functions regardless of passing "-s" to "-gcflags". Protip: don't name soykaf "StealSystemToken" or "ShellcodeExec" Better yet, just obfuscate it.

>>7943 >Some languages that depend on a runtime environment will *not* strip the symbols of *your* functions. >Golang keeps certain symbols and all of your defined functions regardless of passing "-s" to "-gcflags". I'm a little confused. I was under the impression that Golang is a compiled language, and doesn't use a runtime environment. Could you clarify this point?

>>7949 Aa. Compiled/interpreted (and everything in between) and runtime support are orthogonal issues for programming languages. But most (i think) languages to provide runtime support for some of their features. E.g. Standard c library is kind of runtime for c. Go needs runtime to do garbage collection and cooperative multitasking.

How likely is your browser fingerprint to be used against you? Like under normal circumstances, not if your doing anything shady. I don't fully understand how it works, but I know it can be used to track where you go on the net. According to Panopticklick I have strong protection against web tracking.

Is there any /sec/ advantage to using a custom Android ROM over stock if I don't use any google apps? I am on a Motorola Moto G4+ which has a fairly lean stock ROM. If I just choose apps wisely, is there anything to be gained from choosing an AOSP ROM for instance? Also could I just achieve a similar result by rooting my phone and uninstalling google apps?

>>7951 >How likely is your browser fingerprint to be used against you? Like under normal circumstances, not if your doing anything shady. I don't fully understand how it works, but I know it can be used to track where you go on the net. For me, the issue isn't so much "what people can learn today and use against me today", it's "what people can learn about me today and use against me tomorrow". It doesn't even have to be illegal activities. Imagine that you're running for public office ten years from now, and your opponent gets ahold of your legal porn traffic history. What happens in that election?

I have an nmap question. In the nmap manual (https://nmap.org/book/man-host-discovery.html) it says that the default -sn option "consists of an ICMP echo request, TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp request by default." However, when I use the -sn flag for host discovery, it merely uses ARP requests/responses as discovery method. Is the manual outdated?

>>7981 >"The default host discovery done with -sn consists of an ICMP echo request, TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp request by default. When executed by an unprivileged user, only SYN packets are sent (using a connect call) to ports 80 and 443 on the target. When a privileged user tries to scan targets on a local ethernet network, ARP requests are used unless --send-ip was specified. The -sn option can be combined with any of the discovery probe types (the -P* options, excluding -Pn) for greater flexibility. If any of those probe type and port number options are used, the default probes are overridden. When strict firewalls are in place between the source host running Nmap and the target network, using those advanced techniques is recommended. Otherwise hosts could be missed when the firewall drops probes or their responses." Emphasis mine.

Anybody know of a good SCADA lab tutorial or where you can pick up cheap hardware?

Is it possible to set up a custom SSH to listen on port A and send from port B (with the related firewall rules for inbound/outbound traffic) ? OpenSSH is getting really bloated.