Beginner /sec/ projects thread

ITT: we discuss ways for beginner projects for noobs to dip their toes in the water. Post your starting work getting into security. Considering that it's the new year, on the /Sec/ board, noobs you want to learn should post their projects and blogs on here. Idea's for beginners to learn from! >working on a CTF, vulnhub, HTB? >Developing basic malware? (keyloggers, arp poisoners, phishing apps) >Downloading exploitdb apps and learning to exploit them. >Developing a plugin for a already made framework (burp, metasploit) Remember to document your findings and share your results so that other's can learn from it Lain!

wargames are probably the best place to start, but it really depends on your specific area of interest. https://www.hackthebox.eu/ https://microcorruption.com/login http://smashthestack.org/ http://pwnable.kr/ http://3564020356.org/deserve.htm http://roothack.org/ https://holidayhackchallenge.com/2016/ http://www.hackertest.net/ https://canyouhack.us/ http://www.amanhardikar.com/mindmaps/ForensicChallenges.html http://overthewire.org/wargames/ http://captf.com/practice-ctf/ Enjoy.

A Really good way of getting better is to just indulge in what you find interesting. For example I was really interested in phishing attacks so I just explored I found out where they where sending from, Which emailing list they bought, How the phishing site actually collects, The person behind the original phishing site Tracking down the location of the original creator Trying to reach contact with the person You can really go as far as you'd like, I went a bit overboard but it was really interesting and you start to learn how organisations in the background run. Plus corp people love this soykaf

>>6847 this, it's far easier to get good at what you love, and then work your way down the boring details you missed after you're already proficient at something.

>>6847 I tried by starting to reverse engineer some of my favorite web applications but failed miserably because websockets are so complicated.

>>6849 You're doing the equivalent of running a marathon after 10 years of not moving your leg. Start small, write a simple if else, compile, try to reverse engineer it. Knowledge is built like a pyramid, not like an elevator.

>>6845 how do i hack into hackthebox.eu ? I thought i found the token but what do i do with it? How do i hack past that login page?

>>7057 I didn't have to make a token, generate a invite code using web console get a rot13 string you decode use web dev tool in browser to make post request hope I helped....

>>7061 Thank you lain, i'm working my way through bandit rn but once i'm done i'll get into hackthebox.eu

>>6844 i want to make a version of backbox's anonymous function, except for trolling. i only really know python and bash, but i want to be able to make a program that will handle multiple accounts without them being identified as coming from the same computer. Essentially, i'd like to have three windows on my computer that, from, say twitter, will think that window 1 is a windows machine running edge, window 2 is a mac running safari, and window3 is an android running chrome, with 3 different associated accounts, along with individual mac addresses and maybe IP's, but i know that one is a bit harder What programs and modules do i need to handle that? eventually i'd like to be able to run view/tweet bots for social media

>>7101 Couldn't you just run it through proxychains and edit the useragent? Or, am I just being dumb...

>>7102 i lack any proxies RN because i'm a bit light on cash. It fuarrrking is like kicking dead whales down the beach. i figured that all the free web proxies would probably be blocked allready.

>>7103 Have you tried torchains most social media sites allow tor exit, if needing specific ip location isn't a problem.

>>6844 Why is everything focused on offensive security? Would be nice to have defensive beginner sec projects. Just some random ones I'm throwing out: > Intro to threat modeling ( https://www.eff.org/document/surveillance-self-defense-threat-modeling ) > Set up a password manager > Close/delete old accounts you no longer use > Configure multi-factor auth / u2f wherever possible > Start using a restricted user account for everyday tasks

>>7107 The problem with that, is that isn't much of a project. Here is a good blue team project, why not do a simple waf script? Something beginner friendly that might be usefull >something that detects automated sql/xss injects >bruteforce detector >rapid web crawler requests

>>7108 write your own waf rather than leveraging collective knowledge and experience of existing projects? no thanks although i do think setting up something like bro or suricata might be worthwhile. hell, spinning up a security onion instance would probably be a decent beginner project

sup doods I'm a 22 year old mostly self taught standard line of business asp.net web application developer who is very bored. Been doing basically the same thing since I graduated high school, I've written enough CRUD apps and I'm tired of playing front end framework du jour. Whats the fastest way to go from "familiar with the OWASP top 10" to getting gud at breaking and fixing soykaf? Should I pay for a course like OSCP? Are there any good free courses or cheaper books to get started?

>>7148 OSCP is great if you want the cert to quickly change industries. Highly recommended if you have experience in software dev and want to move into infosec. I was a software dev for a while before switching and I was pleasantly surprised at how far my previous experience carried me. The big thing is familiarity with the techniques and familiarity with the tools (or process to build your own) needed to exploit said vulnerability. A great place to start is (other than the OSCP labs) is vulnhub and CTF's like HTB. Most introductory stuff covers a lot of webapp soykaf nowadays. If you want to expedite your entrance into infosec, make a blog, do as many problems as you can, and just write *something*. I really can't recommend building a portfolio enough. Best of luck, lainon.

>>7152 Hey thanks a lot, friend.

>>7148 Start with CTFs then go to HTB/vulnhub then if you can do some of those boxes without help go for OSCP.

Do I have to be a webdev before tackling a book like The Web Applications Hackers Handbook? I've dabbled in programming, scripting, a little bit of Lisp, Python, JS but I've never done a real project. I really want to get into offsec web stuff but I'm trying to figure out the pre-reqs to all of this.

>>7363 knowing how php, mysql, html, js all work together to make web apps is a good background, if your just starting i recommend downloading juice shop web app. The thing about offsec is that it's all learn as you go.

>>7368 >that it's all learn as you go. Yeah for the most part. You pick up things quickly and remember them but the more you do it the more things you see that are nuanced. IMHO it's also mix of both not reinventing the wheel while still pushing yourself. You don't need to be a dba to exploit sqli but if you're solely reliant on sqlmap or something like that, that's bad.

>>6845 Thanks man

>>7335 Does OSCP expect you to have base knowledge to the level of completing those boxes without help? Or can one go into relatively new and get certified? I have completed many levels of Over The Wire and would like to move right into OSCP if possibl.

>>7567 You're expected to have a base knowledge and then some. It's a pretty big deal. You also need to have some good stamina, because it's a 24 hour long test.

>>7567 Completing basic levels from overthewire is not enough. Go on hackthebox website and learn how to do those challenges. Start with the boxes labeled easy and get used to those. After a a little while start hitting medium and hard boxes. Some boxes will have have walkthroughs posted online. Do not look at these until you have exhausted every trick you know and some time researching.

If your interested there is this guy on redd.it doing a pentest security youtube course that's actually really good! He does livestreams on twitch.tv https://www.youtube.com/channel/UC0ArlFuFYMpEewyRBzdLHiw

I got into security first by attending a CTF with friends that were a bit more well versed in this stuff than me. After that I worked on hack the box machines 24/7 because I have no life and it was fun. If you have an all right understanding of programming and unix learning on the job is the best way I think, instead of reading about it extensively or watching videos.

>>7568 I'll make sure to buy extra coffee. Thanks for the warning. >>7588 I'll make sure to complete as many of these as I feel necessary. Thanks.

Is it possible to get good at reverse engineering, pentesting and malware coding?

>>7803 practice... I don't know what you want me to say lain... I recommend picking one and sticking to it as your main, I'm not saying you can't dabble in the other two, but it's better to put most your focus on one rather than kinda have a mix of all. chances are if your doing pentesting your going to be automating alot of tasks so malware coding will be a part of that.

>>7804 >>7803 But doesnt pentesting involve malware coding and reverse engineering(to find vulnerabilities) anyway? This is like asking if you can learn pentesting, pentesting and pentesting

>>7803 Yes it is possible, see attached webm or https://www.youtube.com/watch?v=9vKG8-TnawY The Complete Guide to becoming Fullstack Reverse Engineer by Cody Brocious and the following attached PDFs Reversing : Secrets of Reverse Engineering by Eldad Eilam and Reverse Engineering for Beginners by Dennis Yurichev

>>7806 I see, thanks. I looked that first webm quickly and it says to learn assembly x86, i tought most OS nowadays are 64bits? Wouldnt assemblyx64 be better then?

>>7812 Not really , when learning Assembly for Reverse engineering, you start with X86 , not because it is the easiest to learn (that is PPC or MIPS), but because it is the most commonly used especially when you have code in Windows that falls back to 32 bit for backwards compatibility reasons. Also see the attached files and https://leotindall.com/tutorial/an-intro-to-x86_64-reverse-engineering/ https://security.stackexchange.com/questions/169291/x32-vs-x64-reverse-engineering-and-exploit-development and https://github.com/onethawt/reverseengineering-reading-list/blob/master/README.md for more information

>>7806 Ah, i see, thanks anon really, you've been really helpful. It will be a long way(specially since i am doing my major), but i will prevail(hopefully)

>>7805 most of the coding you do will be to automate tasks, or create plugins for tools already out there, or to improve a tool, reverse engineering is more inline with exploit dev, another field entirely, there are all specific skills. Pentesters audit security, both in website and networks, and sometimes physical engagements. Hope I helped.

>>6844 Those looking for an internship with full time contract opportunity or just looking for a cool thang to put on your git, I've got a project in need of a little tweak. If you are into cryptography & blockchain and ever heard about DSA, make yourselves known. Otherwise it's going up this 'outsourcing' github thing. To the beginners, I wish you can stay at it and learn to enjoy your craft.

>>7821 I'm interested, let me know a little more.

>>7822 Would love to. Busted my ass the past few months to get some big players to join the board, securing some larger investments and working on valuable partnerships. Funny enough, I still haven't found a decent dev or dev firm to actually work it out. Research mostly done and system architecture on paper. An interim would suit me the best and it'd be a sweet opportunity for u, cuz according to my financial forecast, we can keep this show on the road for 3 years if we meet our minimum goal. Let alone manage to produce a profit during these 3 years. Mail attached. Send me a CV or git repo and then we can schedule a call.

I'm re purposing an ultrabook from my college years into a wireless pentesting machine. The idea is to finally get to know Kali and the set of tools installed on it and getting an idea of what I wanted to do for quite a long time : Automating wireless attacks and faking access point. Last time I tried that was at least 5 years ago, when WEP APs were still popular, and WPA2 a very secure standard. I didn't get past arp poisoning my wlan and sniffing unencrypted data.

>>7148 I failed my first OSCP attempt because I could only afford the 30 day voucher. The irony is that I bought Virtual Hacking Labs after that so it came out to the same expense basically. Virtual Hacking Labs is a MUCH better put-together course than OSCP. OSCP's labs are more complex and interesting but they give you literally nothing to go on. VHL at least gives you hints for the lower-difficult machines, to ease you into it. OSCP's labs/exams are the Octagon. VHL's labs are your local dojo. Hope you give VHL a shot I recommend it to everyone I know. (No I don't work for them). You will like it as a web guy particularly because almost every single machine in VHL has a web vector.

I'm posting a few vulnhubs I did in my freetime, let me know what you think

I have a question guys. I've been trying to figure out how the fuarrrk to bruteforce web apps that use an anti-CRSF token. Burpsuite Pro has a built in tool but I can't afford it and OSCP doesn't allow it anyway. Are there any elegant solutions you guys have used?

>>8072 I don't think CSRF would stop you from bruteforcing, but editing the post request in repeater in burb might help, post the requests

>>8077 I'm away from my lab machine but I tried following g0tmi1k's guide at: https://blog.g0tmi1k.com/dvwa/login/ I'm very confident that I edited his scripts to suit my target, but when I run them, I get a bunch of code 400 responses because the script fails to generate a fresh CSRF token. It seems like it gets the token, and then uses one token for one password, rather than one password for one attempt. So I'm gonna keep playing with it.

>>8081 Sorry I meant >rather than one token for one attempt

>>7107 Does /sec/ recommends setting up my own password manager or using an existing one?

>>8176 if you find setting these kinds of things fun, then it is highly recommended from that perspective. and if you take your time to do it properly, you will also a lot. otherwise, there is very little to gain from using existing services like bitlocker.

I would recommend walking through some of live overflows stuff. In general gaining a low level understanding of OSI, doing some C programming/reversing. leanr to use nmap and wireshark. Learn how to use Scapy. Play HackTheBox. Watch thugcrowd. play around with hardware. Play around with various wireless soykaf. Learn about what an operating system is. Learn about BIOS/UEFI. Try to rememeber to have fun.

Learn Powershell.

>>8176 use existing one but also add something extra to your passwords that you dont enter into the password manager. i generate random password and then add my own password that can remain the same for all sites and never change. for example set your actual password to 48jak3MYPASSTHATILLALWAYSREMEMBER and only enter 48jak3 into password manager so if they get hacked you arent up soykaf creek

>>8205 Peppering your passwords, genious

>>8205 You know, that's a really good idea and I'm gonna start doing that. Thanks lainon, dunno why salting my own passwords never occurred to me :)

>>8190 im seconding this. this is actually great advice, live overflow is one of the better (if not one of the best) youtubers for beginners to learn about /sec/. he covers some great topics that many other YT shy away from.

I am doing HelloWorld CTF in HackerOne. I downloaded exe and loaded it into IDA Pro. Graph of functions as above. It looks like that strings i put into program are used by "print_flags" function. I cant call it from >IDC 1: Calling application is not supported by the current debugger Nor i cant call it from gdb Program received signal SIGSEGV, Segmentation fault. strlen () at ../sysdeps/x86_64/strlen.S:106 106in ../sysdeps/x86_64/strlen.S The program being debugged was signaled while in a function called from GDB. GDB remains in the frame where the signal was received. To change this behavior use "set unwindonsignal on". Evaluation of the expression containing the function (print_flags) will be abandoned. When the function is done executing, GDB will silently stop. Why is that so? How do i call function if all i have is exe?

Can't even remember where I asked last time so this will do. I set up my Raspberry Pi to disable Password Authentication over ssh PasswordAuthentication no ChallengeResponseAuthentication no And I have a port forwarding rule to forward an abirtary port (lets say it's port 12345) to my machine's static IP @ port 22. I've verified that ssh password login is disabled, but I'm still paranoid an attacker could get in. Is this sufficient security? Am I just being paranoid?

>>8281 You could use the client authorization mode using TOR. Basically creates a TOR hidden service for your port but you must edit your own torrc to contain the auth cookie inorder to connect to it. https://2019.www.torproject.org/docs/tor-onion-service.html.en#ClientAuthorization

>>8281 Make sure SSH stays patched. Make sure your other ports are not open. Patch your OS. Then you're in good shape. You could setup 2FA + logging and alerting on ssh connections if you're really paranoid.

i have a vm server (just died last night going to fix it soon) i would let you nerds vpn into my net and fuarrrk around with some of the servers i have up. currently running kioptrix 1-5 and a few others.

I learned early im better with social interactions, a clip board and stern look has gotten me places. i dont have the brains for for computer. Physical though i have gotten into many places. Im a photographer in a major city, if I want the shots i start slow and elevate.

I've decided to start learning by trying to break into my own things. I got the handshake for my router and I've noticed that FiOS routers follow a consistent "[word]\d{4}[word]\d{4}[word]" pattern. From the documentation I've read it sounds like Hashcat is only capable of combining two dictionaries, and John the Ripper is only capable of concatenating words without additional rules, if I'm reading how Prince works correctly. What's a good method for attacking passwords that you suspect have >2 words?

>>6844 i'm going to have to write a very simple kernal for an OS, is there any advice yall would give me about things i could focus on. i don't know much about security and the most ive ever dabbled with is using nmap to watch the devices on my parents network lol i just got an interest in security because i just started my first ever security focused course and it seems super interesting (it's a vulnerability analysis class taught by a somewhat accomplished offensive operations director at a local cybersec firm)

>>8363 I'll write you a port of Genex (Haskell package for permutation generation of regex inputs), should not take more than 5 hours.

Getting anonymous email up and running is a hot mess, can anyone recommend a good provider? I'd like to publish a Github profile with it, I want to neatly share some code with a lainion without compromising my identity. I'd totally take a riseup invite but anything that passes the Github email validation would be great.

>>8370 I mean I can't speak for how secure it is or anything, but cock.li is fine. Just use GPG/PGP for anything you care about. If it's not your server assume it's owned. They also have an onion mirror.

>>8372 Thank you! Cock.li is blacklisted by Gh for verification. but it worked to set up a Pm.ch account.

I'm working on learning Powershell empire and writing a quick article about it for the zine, but now the projects no longer supported is it worth it? Or, should I start working on another blog project to play around with?

I want to practice Python by making a little /sec/ project but I can't think of anything. Any suggestions?

>>9132 >port scanner >web scrapper / wappalizer clone >burb module >recon-ng module >arp poisoner >dir buster clone >login checker, bruteforcer the list is endless really...

>>9133 >>burb module Actually never heard of this, and google gives me nothing....

>>9132 There's a couple books that you might like, trying to remember their names. I think one was "Violent Python", and the other is "Python for Offensive Pentest". >>9135 Maybe they meant burp?

>>9135 I meant burp suite, as in the web application proxy tool https://portswigger.net/burp

>>9042 It's worth it imo for understanding what a good offense implant framework looked like in ~2016. I popped many a box via Empire back in the day, running everything in Powershell and in memory was so good at evading AV and other endpoint defenses. Then PSv5 came along and defenders started wising up. A shame its no longer supported, although it should be fairly stable.

>>9142 Thanks, I'll start working, I ran into a bit of trouble with some payloads.

>>9142 The beta of Empire 3.0 is here on the dev branch on github https://github.com/BC-SECURITY/Empire/blob/dev/README.md

Hey lains, do you know any good ways to practice online/irl social engineering with a low probability of getting v&, presuming I'm not a complete dumbass?

>>9453 your friends? people on the street?

>>9453 Defcon has a SE contest every year trying to get information that isn't illegal (OS info, main programs used, names of people, etc), I suppose you could use tor/proxychains to get into IRC and social engineer people there.

>>9453 some ways you can get good at it, as long as u don't use for bad things: >tell taxi drivers fake info, try to get a much info about them as you can >go on omegle/chatroulette and try to get information (introduce yourself as someone you are not, fabricate an entire identity, and backstory. If you have props, all the better). Another way to git good is to create fake tinder profiles using bluestacks or another android emulator, chat up people (men or women) and use profile pictures off google (protip: Flipping the image horizontally in MS paint can make the image unable to be reverse searched). Use a random identity generator to get information to populate your profile, and be sure to set "location" to someplace you actually know about (otherwise set it to someplace really far away with low probability of detection) I usually go to bars and completely lie about who I am and what I do, most of the time just to see how much rapport I can build with others, or see how much information they are willing to give me. I literally just try to see how good I am at convincing people I am not myself and practicing my acting skills, and it gives me something to waste time. Some tricks to keep in mind: >know the jargon of the role you are playing, people will see through your ruse if you can't at least provide some information. lack of proficiency can be explained by "I just started," but if you say you are pretending to be some kind of medical person and don't know what the word "hemostatic agent" is then you should probably rethink your story. Take points from your real life and twist them to craft your fake identity. Take a subject you know about and create a convenient truth for someone else to believe. Learn about your audience. (If you learned programming on lainchan, say you learned it from your uncle jack as a child, etc.) If you cant talk about it until they loose interest, they might see through your ruse. I have heard saying you are in boring industries like law or finance usually makes people loose interest in asking about your background, but cannot confirm. Easy things to make up stories about because of relative obscurity or abundance of information: >Warehouse jobs (know about safety, logistics, and machinery) >Factory Jobs (emphasis on knowing what kind of product you claim to produce) >Trucking (this one can easily be seen through if you do not do your homework) >Restaurants, Dishwashing, Janitorial (make sure you can talk about OSHA in the USA)

>>9142 >>9346 Can confirm Empire still works on many enterprise environments... If you can't afford or can't crack Cobalt Strike, it is THE red-teaming platform. And of course if the client drops you on the net, Empire + CrackMapExec will make pretty short work of the job

If your interested in practicing your osint skills https://www.sourcing.games/ is a good beginner site.

>>8363 Kinda late but that is wrong, John The RIpper is perfectly capable of bruteforcing with a pattern, though it is called a mask. You also have a hybrid mode where it uses dictionary and mask. Here is the documentation for anyone interested https://github.com/magnumripper/JohnTheRipper/blob/bleeding-jumbo/doc/MASK

ive enjoyed doing some web malware firefighting in the past, now have a good dev job and am thinking of doing firefighting again on weekends in order to get into the game there's plenty of malware ridden wordpress installs for me to fix up but i dunno where to start? make a site and buy an ad?

I don't know how beginner friendly this is, but I've just managed to reverse engineer the API an Android app uses with mitmproxy. My idea was using that API in a cron job to detect a certain condition and create a notification in my phone. In my case, I'm using it to detect when certain stores around me put special offers on food. I found it really interesting, here are the most relevant links I used in case anyone wants to try: * Set up mitmproxy with an Android emulator https://appiumpro.com/editions/63-capturing-android-emulator-network-traffic-with-appium * Install Play Store in the emulator (so that you can download and use the target app) https://medium.com/@dai_shi/installing-google-play-services-on-an-android-studio-emulator-fffceb2c28a1 Once you start getting traffic in mitmproxy, you can * Select a request * Type 'w' to enter export mode * Enter 'export.clip curl @focus' to copy the request as curl command Should I feel some sense of accomplishment over this, or am I just a script kiddie? ...

>>10948 A script kiddie is someone who uses programs/scripts made by other people made to attack computer systems. Reverse engineering is not malicious in itself.

Has anyone been doing any projects recently? I've just been doing htb, playing around with tools.

>>11401 Made a basic "encryption" program that requires three keys to unveil a string(just a+b+string=c). it is seperated into words, does an exclusive or on each character with another character that is around it, and is xor'ed with the words around that.

>>9453 Since you're asking us how to practice being a lying piece of sℎit I will presume you're a dumbass you fuarrrking embarassment.

>>11401 I also spend a lot of time on HTB. I'm waiting for my OSCP registration to finish, so I better continue to grind. I might set up a blog to publish writeups (among other things), and I'm trying to think about what things I could automate during a pentesting. But I'm focused on working on boxes and documenting everything since It still take me a day on average to own easy/medium boxes. Once I'll finish to root Admirer I'll try a hard box to see the difference

>>11417 >I'm trying to think about what things I could automate during a pentesting Nmap port scanning, parsing the results, fingerprinting/version detection, automatically launching related NSEs will probably save you a lot of time. I wasted a bunch of time on enumeration/recon when I was doing it.

As far as begginer projects go, I'd recommend compiling Linux from source. It's a lot easier than I thought but it's fun to see the shear amount of options availble.

I don't know much about security and I'm running a server with some basic services (I still got to install more soykaf) For now I got running >web server >mumble >vsftp >ssh >minecraft server for a friend I want to add more stuff to it (irc, meet.jitsi and eventually start programming client / server programs for fun) I try to always have good practices when I setup a new service, but how would I go about testing the security of my server ?

>>11438 I'm going to start with a few nmap aliases. I still use nmap only in the early steps of the enumeration process, but I guess it's because I don't get how powerful it can be. I was thinking about scripting curl for testing SQL injections or LFI/RFI, but I don't know if it will be accepted during the exam, since softwares like sqlmap and metasploit (the exploits at least) aren't allowed.

>>11450 For a basic infrastructure test, absolutely slam it with nmap, check what versions of software your running. Beyond that, basic pentest stuff, check what's happening with your web server, enumerate it, check for SQLi and XSS attacks

>>11450 What anon said, plus install searchsploit and look if the version of the service you installed have any exploits

>>11463 >>11464 Thx guys.

>>9453 Well Recently how do you practice social engineering with getting v& was asked on Darknet Diaries to the guy behind the social engineers toolkit , and he advised approaching strangers having a conversation and eliciting details about them that they might not ordinarily disclose. https://darknetdiaries.com/episode/69

>>11450 This. Run your own box. Harden it. Use your spare bandwidth to run a Tor Relay. Submit abuse complaints for brute force attempts on ssh.

Just wrote a simple 150 lines python ARP spoofer using scapy that automatically finds the gateway and lan hosts and spoofs them all. :D I will write DNS spoofer next or maybe DHCP starvation attack script Anyone have any more ideas?

>>11504 Here are some good idea's for into to practice getting, my starting advice is grabbing common password reset questions What is the first and last name of your first boyfriend or girlfriend? Which phone number do you remember most from your childhood? What was your favorite place to visit as a child? Who is your favorite actor, musician, or artist? What is the name of your favorite pet? In what city were you born? What high school did you attend? What is the name of your first school? What is your favorite movie? What is your mother's maiden name? What street did you grow up on? What was the make of your first car? When is your anniversary? What is your favorite color? What is your father's middle name? What is the name of your first grade teacher? What was your high school mascot? Which is your favorite web browser? what is your favorite website what is your favorite forum what is your favorite online platform what is your favorite social media website

>>11450 You could start looking into stuff like IDS/IPS, a WAF, etc. Also good to check out hardening guides for whatever OS/services you're running.

>>11767 >common password reset questions Did you fall in coma in 2006?

>>11767 My answer is: lcn8Ea8VY6NjlWYnQUmtO0eZNu9MGKNu5DquLXbS9eoQRnIby3TPhkYWOzmYwJDA And everytime different random string per every service. Works well.

>>11780 it's a suggestion for social engineering, to gather personal information, that being said, you would be shocked how many sites still use that, so does alot of ISP's for personal accounts

>>11787 >SocEng: "I just randomly generated a bunch of numbers and letters." >Call center wage slave: "Oh, okay, cool. I'll go ahead and reset your password for you now."

>>11443 nice way to teach nothing of value

Tryhackme is publishing networks to emulate actual business networks. I'm really excited! https://blog.tryhackme.com/introducing-networks/

>>11798 Really lovely solution to that problem, haha.

>>6844 Host a Tor Relay

>>11798 But... the social engineer would have to know it was a random combination of letters and numbers. How would they figure that out without seeing the answer or a lucky guess.

>>11935 >a lucky guess Sometimes that's all social engineering is. You wouldn't say this if you were targeting some normal person, but someone who is security minded is a lot more likely to use it. A good counter to this would be to generate a phrase using diceware. Human readable, but still random.

Ehhhh fuarrrking around with metasploit trying to learn how to pentest servers like a normal person Can't seem to find exploits that work though, any tips? Is the default list of exploits as limited as it seems, and how can I find more?

>>12373 Enumerate more, make sure its the correct exploit for the correct version. Read up how the exploit works most exploits have a blog post explaining what its doing if you search the CVE number. You may need to modify it a bit to get it working.

>>12373 Unless it's a memory corruption bug or something like deserialization, most publicly facing vulnerabilities are hard to find and require manual testing. Not everything is as simple as "find an exploit for X running on Y server," much to my disappointment when I started in infosec a while ago. The biggest piece of advice I can give you that took me from dumb skid to somewhat proficient is: >Consider the context Always look to the bigger picture. Sure, an FTP service may have a false positive to be vulnerable to some pre-baked script, but try to log in. What is the purpose for FTP on this server? Are/Is the application(s) hosted on it logging files to be retrieved by an admin? Is it running tomcat and FTP is how .war files are uploaded? Again, what is the purpose of the services open on this device. The same principle can be applied to internal network access. New folks will ask "What is *evasive* testing, how do you do *covert* blah blah blah," and my answer is always the same: Context and recon. It's not about the tools or scripts. There's a billion different tools that do, essentially, the same thing for some attack paths. Do you NEED to pop a box? Kerberoast? Dump LSASS? No? Then skip it. Intuition can't necessarily be taught or learned, but moving forward, do put a significance on scope, methodology, and context. Tl;dr: Context matters. Methodology matters. Persistence matters. Without those, over a prolonged period one runs the risk of being a turboskid.

>>12387 >Unless it's a memory corruption bug or something like deserialization What I mean by this is that hand-jamming those is going to be difficult. Like, could I spend some time writing/doing it myself? Sure. Do I need to be more considerate of my time and use a prebuilt tool/exploit? Probably, depending. Have I also at times spent more time trying to fuarrrk with barmie and ysoserial than it would have taken me to download the source and come up with my own object? Absolutely. Point being, scripts and tools can be handy. Knowing when and when not to apply them is crucial. Check these links out: https://www.bugcrowd.com/resources/webinars/bug-bounty-hunter-methodology-v3/ http://www.pentest-standard.org/index.php/Main_Page

Does anyone know of any sort of port scanning statistics aggregator? The SANS storm center shows the most common ports, but I want the opposite. I'm looking to move my ports somewhere in the high numbered ephemeral range, but would like to ensure that the volume of background scanning traffic is low. I'll likely be doing this in conjunction with port knocking of some sort. That way if there's some flaw in the port knocking daemon that leaves my super common port exposed, and I at least have a little bit of obscurity from the uncommon port. Layers and such.

>>12392 Most bots scan the entire port range anyways, so I don't using an uncommon port for a given service would you any good.

>>12415 In my experience the number of bots scanning for specific services and variants of their common ports (e.g. 3389, 3390, 13389, etc.) is easily 20:1 (if not more) compared to the number of bots doing scans of all 65k ports.

Infrastructure dude here, wanted to dip into RE as a hobby, what sort of knowledge do i need? Do i HAVE to learn C or can i dive into assembly?

>>12565 You dont have to learn C but it will help a lot. You will see tons of C library calls, and C ABI. As you RE , you might write C like psuedocode to understand.

>>12565 You can and should be able to write C programs to get the most out of a disassembly window. You at least want to be able both of the functions that are called and the way that control flow and data structures appear in your disassembler/debugger. This will help you scan larger codebases a LOT.

Anyone want to join HTB team? https://www_hackthebox_eu/teams/profile/3244

>>12661 I look into joining when I get a chance

A great beginner project is to create a C2 framework, with custom implants and conforming to good modular design. Some features: * gRPC, REST, etc backend API for registering and downloading implants * Custom message format, with Protobuf or a custom protocol * MVC (or similar) design for C2 * Registering implants and controlling multiple at a time, in groups, or individually * Traffic encryption (TLS, DH, maybe even just RSA or AES) * Staged payloads * VM Detection and more in-depth anti-reversing measures * Executable packing solution, or fileless method * Implant post exploitation (webcam, privilege escalation, screenshots, shellcode, keyloggers, password grabbers, etc) * Reverse proxy (easy to move C2s if the IP gets caught) This is a long list of features but you can really do any combination of the above, among others I'm leaving out. As you learn more about what to do then you can add those features and refactor the code. The order that they're written in is one order to follow to try and minimize the effort of refactoring, depending on how you go about things. Free free to suggest any other features/design decisions that would be relevant here.

I was wondering if there is any thorough course you Lainons could recommend? I have basic software development knowledge and was looking to get into the field first through a course comparable to what CS50x is, which is what I usually recommend for people who want to get started in programming, for it is very thorough and teaches the fundamentals so one can DYOR from there.

>>12672 What are you looking for? >general pentesting >reverse engineering >malware dev >SOC analyst/threat intel

>>12676 An introductory look on general pentesting/SOC analysis I'm not interested in malware dev and concerning reverse engineering I believe that's a skill required for SOC analysis right?

>>12676 malware dev stuff would be cool

>>12676 >>12681 i'd also rly love some malware dev stuff

>>12685 I know malware in golang is the knew hit thing, and powershell has been pretty popular. https://dl.hiva-network.com/Library/security/Black-Hat-Go_Go-Programming-For-Hackers-and-Pentesters.pdf https://posts.specterops.io/malware-development-pt-1-dynamic-module-loading-in-go-1121f07f3a5a https://0xpat.github.io/Malware_development_part_1/ here are some first steps if your interested!

>>12678 pentesting is good to see and understand logs, I would look up yara and some siems alienvault/snort are both free set it up in a small lab with vuln software from exploit db, attack the machine with some easy attacks, check logs on how to spot those attacks configure sense and repeat.

How do I into .Net malware?

>>12691 Learn to code dotnet & proceed as usual.

>>12699 I can code dotnet, but not malware.

>>12700 I mean, do I really need to go and re-learn C and ASM, to make traditional malware first?

>>12701 Depends on what sort of malware you want to make. There's a reason why such a huge chunk of it is written in system languages.

>>12702 Something that sells.

>>12707 Maybe a RAT, a keylogger or some kind of stealer.

>>12707 If you want something that sells, a RAT might work, but you should consider making a utility program like a crypter. You could create it and monetize that pretty easily. A similar utility would be a binder, which you could have some success selling.

>>12707 Lots of things sell. RATs will always sell, but good RATs are partially rootkits as well and for those you probably want to know some system language. Doesn't matter which one, as long as it can inline asm. You can also sell standalone rootkits. Permutation is used nearly everywhere, so as >>12709 says, making something like a packer or some permutation engine could work. But afaik, people usually write their own because freshness is important. Another thing you can do is write POCs for 0days. In any case, if you do something for money and not for fun, you're going to suck no matter how much you try. And this applies to malware, too ;)

I'm currently working on a web fuzzer/injection scanner in python. Currently planning on it being cli only, https support, with multithreaded scanning, and a simple ruleset to check if an injection works.

>>12713 what would you need inline asm for?

>>12715 Optimization for size - sometimes you have no other choice than to write assembly. Other than that nothing important, it's just that I like playing around. I guess you don't need it if you don't do crazy stuff (like writing code which runs below the system level, abusing undocumented instructions, etc.) because most things can be done in higher languages. With all this being said, it's less about inlining assembly than knowing how to write it. Maybe I shouldn't have written that in a thread aimed at beginners, my bad x) Different people, different things.

>>12716 >Optimization for size Motherfucking ransomware gangs be deploying entire VMs and bypassing AVs like a boss.

>>12717 >ransomware Unless you do it on the drive level (which requires elevated privileges anyway), you can write ransomware in most languages that you can think of. Ransomware is one of the simplest types of malware there are, right behind trojans. Cleverness and "novelty" ("novelty" being an overused buzzword) is what makes them fun. Very early bootkits (or BIOS/UEFI rootkits) are deployed into brutal environments so they usually have no other choice but to write in assembly. Don't take me wrong, whenever I say that something usually has some sort of restriction, it doesn't mean that it always has it. Traditional rootkits and viruses usually have them, but not a lot stops you from embedding several hand-crafted drivers into your image. As far as I know, this is what TDL did and people seemed to like it (though I don't remember if TDL used a dropper or not). Ironically, because TDL infects the MBR, it's also an example of requirement for small code. Mind you I'm probably confusing TDL with some other bootkit. :)

How many people itt actually have jobs in penetration testing (or something similar)?

>>12717 It's kinda sad that the state of security is such that this is a viable deployment method across an entire org. It was a really cool technique, don't get me wrong I'm not criticizing them. Just another reminder how soykaf modern "DFIR" strategy is. Getting soykaf to bypass AV is a joke nowadays. Cylance, CrowdStrike, SentinelOne... they all fuarrrking suck. If you can't bypass even defender, that's a you problem.

>>12761 I used to, now I do defense instead.

>>12761 I currently do pentesting for a living

been trying to create my own iplogger but soykaf doesnt embed what do

>>12766 You have a college degree? I'm currently taking my community college's cyber sec program and I think I might want to change. I'm thinking this degree will end up being a meme

>>12768 The degree is definitely a meme. I would just use what you learn in class and put it towards software projects that you can point to in a job interview. Once you break into the industry it barely matters anyway.

>>12766 Degrees are kinda meaningless unless you go govt. Even then, aptitude can make up for it. >I technically don't even have a high school degree >red team / windows developer for 5y Gotta put in the work tho

>>12768 I have a degree and only have a helpdesk job, it's a meme, and not worth the debt the fact I live in an area without alot of tech jobs are apart of it too.

>>12767 look on github for example code

>>12768 I find certs to be more worthwhile than a degree. Less expensive, more directly applicable, more consistent scope of knowledge, industry recognized.

>>6844 not exactly on the topic but if im a beginner what disk encryption should i use? im looking for something secure and reliable through minimalism

>>12714 >https://github.com/iwakura1ain/Fuzzit-Web-Scanner Alright, I got the basic functions working. Still need to implement multi-threading and ssl support.

>>12779 There's some programs that take a dual-front approach where you come out with a degree and multiple certifications. A lot of my coworkers have done Western Governors and seemed to like it, but I'd do more research if you're looking into it. Don't just take some rando's advice from an imageboard.

>>12901 LUKS or VeraCrypt depending on your needs.

>>12901 >what disk encryption should i use >>12943 >luks or veracrypt Luks is standard on Linux and easy to implement. You can choose between a few different encryption algorithms. I'd recommend AES 256, which may already be the default one used. Veracrypt is used on windows primarily. A while back it used to be used on Linux, but it was superseded by luks. I think it stopped being developed or something - not sure.

>>12956 >I'd recommend AES 256, which may already be the default one used. Defaults depend on how your distro compiles it (though most don't meddle with it). Here's mine: Default compiled-in device cipher parameters: loop-AES: aes, Key 256 bits plain: aes-cbc-essiv:sha256, Key: 256 bits, Password hashing: ripemd160 LUKS: aes-xts-plain64, Key: 256 bits, LUKS header hashing: sha256, RNG: /dev/random LUKS: Default keysize with XTS mode (two internal keys) will be doubled. To elaborate; Rijndael wasn't the most secure cipher in the AES competition. If you're super paranoid, you might as well go for Serpent (or AES(Serpent), though this is questionable). It was however "secure and fast enough". With the introduction of AES-NI you have little to no reason to use anything other than AES because other ciphers are several times slower. You can run a benchmark (with cryptsetup benchmark ) to see that with 512b keys, Rijndael with native instructions is about 4 times faster than Serpent or TwoFish (for both encryption and decryption). However, if you for some reason have AES-NI disabled in your kernel and can't change it (unlikely) or if your CPU doesn't have AES-NI (very unlikely), you'd probably be better off with Serpent. When it comes to key size, paranoia hits hard. I'll cite Jean-Philippe Aumasson's Serious Cryptography (page 88): Nevertheless, to ensure long-term security, you should choose 256-bit security or a bit less. Even in a worst-case scenario — the existence of quantum computers, see Chapter 14 — a 256-bit secure scheme is unlikely to be broken in the foreseeable future. More than 256 bits of security is practically unnecessary, except as a marketing device. As NIST cryptographer John Kelsey once put it, “The difference between 80 bits and 128 bits of key search is like the difference between a mission to Mars and a mission to Alpha Centauri. As far as I can see, there is no meaningful difference between 192-bit and 256-bit keys in terms of practical brute-force attacks; impossible is impossible.” >I think it stopped being developed or something - not sure. You're thinking of TrueCrypt. VeraCrypt is a maintained fork of TrueCrypt. Both VeraCrypt and LUKS are supported by dm-crypt, though most documentation focuses on LUKS. VeraCrypt GUI is definitely easier to use but you won't learn much from doing so. My recommendation goes to LUKS, too. Just like most other things, it's fairly easy once you get into it.

>>12964 Ah doi. That's right. I was thinking of truecrypt. Nice post btw : )

Hi there, been looking for a way to cut out bad habits of mine, including browsing twitch and reddit. In truth willpower should by my ultimate goal but I wanted to make a project out of it. Would it be secure to make use a local proxy to block outgoing requests to reddit and twitch? What are the security implications of having the proxy on a local rpi? pic unrelated.

>>13010 If you're running a DNS server, you could put an entry for those domains that just points to 127.0.0.1, rather than intercepting all traffic going through your network. If you're using DoH or DoT then that wouldn't work, unless you have a canary domain in place.

>>13011 >>13010 If you don't have a DNS server you can always just hack your hosts files to do the same thing. Its easy to undo but honestly all solutions like this are easy to undo.

>>13010 https://www.lainchan.org/%CE%A9/res/35210.html

>>12768 Pentester lain here. Yes, I do have a college degree, which I have conflicting opinions about. It was beneficial in several ways, somewhat because of the content learned, mostly because of the networking and people I met. While I wouldn't call my degree useless, (it did get me in the door at my first industry job, like it or not many places do want to see a college degree, the people I met, ability to go to BlackHat/DefCon and network more) I wouldn't say it was worth the almost-$100k bill. That's a lot of money, but I was able to pay it all off within a few years of working in the industry due to the generally high pay and saving a lot. However, there's nothing I got from the degree that you couldn't get with hard work. Anybody can push themselves to learn and network. In your case, I would say take the community college program. Much cheaper and it could provide you with some knowledge, allow you to meet people, and give you a piece of paper to get past recruiters. Any idea what you want to do in the field? I could offer more specific advice if you'd like. In general though, get as skilled as you can in an area that interests you AND is actually marketable. (Doing convoluted CTF crackmes is not useful unless you're trying to start as a reverse engineer, do real webapp testing or networking testing instead) And network as much as possible, even on twitter or whatever. Many people in this industry get jobs from friends and former coworkers.

I have OSCP, I'm a CS dropout from MENA. I have a lot of CTF achievements and HTB experience. Also a couple of bug bounties. Is it impossible to find a job abroad, preferably in EU? It seems like immigration is more and more strictly tied to a uni degree because of nativists. Most positions I apply for say that they can't sponsor visas or they require a degree for it. Some of them say that they need more experienced people.

>>13063 Coming from MENA to EU you're going to need a degree or a successful firm in your own country coming across to EU. Economic downturn will also reduce your odds of success.

>>6844 Picoctf is a free ctf that doesn't even require a valid email. Challenges start insanely easy and sclale up. Its worth doing if you have minimal ctf experience.

>>13084

>>13174 >>13084 are you just bumping?

>>12707 >>12708 >>12709 >>12713 Where is that kind of soykaf even sold? What kind of sums are we speaking of? Not interested in selling it but I always thought this kind of darknet marketplace was an invention of media

>>13650 Malware is mostly sold via forums, they usually have websites, same with a lot of "hack for hire" services are real, but they don't actually comeout and say "we do crime" they pretend to be valid pentest company or account recovery services.

>>7813 My primary assembly knowledge lies in z80 and ARM, and for most R/E soykaf I've had to do, this combined with IDA or Ghidra have carried me rather far, even when reversing soykaf for x86 and SuperH. The decompilers and architecture manuals go a long way, and most R/E isn't even assembly anymore, it's all C anyway.

>>13839 >The decompilers and architecture manuals go a long way, and most R/E isn't even assembly anymore, it's all C anyway. In my experience, Ghidra doesnt always accurately decompile to C. Is IDAs decompiler way better? I have used assembly a ton in reverse engineering.

>>13842 Nah, they're both about as good/bad. Ghidra's often touted as better, even. It should always be accurate if you get your stack and types right, though. Readable is a different matter...

>>13842 >>13843 Should also note that I wasn't saying general assembly knowledge isn't necessary/desireable, just that you don't often need to know the exact target architecture very well to get around.

Know-nothing here, read the bit from lainzine 5 about using a honeypot to catch and fuarrrk with random skiddies. It's making me wanna run my own honeypot just to see what I catch, but the only real security/network knowledge I have is from a cisco college course from half a decade ago. I got a raspi lying around that I could probably spin something up on. How do I do this without letting some asshole wreak havoc in my network?

>>14504 Segment it. Put honeypot in its own network zone (DMZ). If you are really paranoid, place additional firewall between you homenet and DMZ (Screened Subnet). Shouldnt be an issue. Plus honeypots don't usually actually allow attacker control, just simulated control.

>>14504 you already have entities to catch which is either several data companies or some people with great resources. instead of playing with skiddies, just set up a honeypot with the purpose of catching those who try to spy upon you. maybe something like a direct address that logs every visitor but you know it's only you who should have access over it since you never would even post it online. in an event you accessed the honeypot on a suspected service/provider/program/operatingsystem/device and get foreign entity access over that honeypot (two or more logged when there should be only you), you'd be surprised with what's been going on.

>>14504 buy a cheap vps no more than $5 a month and set one up, it will get auto scanned and you will collect tones of samples.

>>6844 Check out blocklist.de for free threat intelligence. Download the blocklist and ban, but more importantly, setup your server to report ssh brute force.

>>14522 Use an aggregator like FireHOL rather than one-off lists. https://iplists.firehol.org/

God, don't get into phishing, is so lame now. You can always clone a website and do some elaborate soykaf, but i only have seen dumb staff on sms and emails. It is worth for the learning experience and the fun but there are more attractive things where to start, like hid attacks

Subject is self-explanatory. New to all this, can any lains point me in the right direction?

>>14569 You could start cracking right away but honestly from what I've seen you're better off first learning how to set up your own web server/services and figuring out how it all works, but especially what to do to make it *secure* and what would be the issue if you didn't. Cracking web servers basically means you apply that knowledge to try to look for and abuse misconfigured servers, badly written programs and sloppy opsec to gain access to it. Hackthebox seems like a decent way to start but you require a VIP account to access machines with posted solutions (aside from the starting point machines) so ymmv.

Here is a good open "go at your own pace" course I'm doing the linux implant dev course and it's really good. I was wondering if we wanted to do a group learning using this as course work. https://hoppersroppers.org/

>>14668 Looks baddass. Thanks lain.

>>12685 what is this supposed to be??

>>14569 How did it was being SQL Injection without any previous knowledge of anything except a bit of Perl programming (yes I learned Perl first because I read online back in the day, before python went mainstream, that Perl was the go-to language to write exploits). It was a rough start though, had to do a lot of reading to get the hang of it at first but being super thirsty about being called a hacker made me power through it.

>>14887 set up a VPS, leave a few open ports, and watch them.

Does programming experience and general linux/OS knowledge help when starting in sec? I'm getting bored of programming and want to get into something more versatile.

>>14910 Probably

Lains... Is there a tool that autotypes your text and integrates seemlessly with normal operations? Don't want anyone fingerprinting my type patterns.

>>15011 i've been thinking about this for a while. what's your threat model? hiding from websites, local processes, or a rootkit? if a rootkit (most extreme threat model), you might want to build your own USB proxying device (as simple as programming/wiring and arduino; has the added benefit of being OS/machine-agnostic). for the other two threats, not sure of any existing software: if on linux, consider writing your own kernel module to accomplish this.

Is there any actual real world environments you can test on? I'm not talking CTF "find the base64 string in this picture using a stego tool" I mean a emulates an actual company network with common flaws?

>>15113 don't be pussy, just hax. if you want a test environment there are loads of VMs

>>15113 Sign up for a bug bounty program, find a company that gives you a good bit of freedom. Then you're typically free to do anything that doesn't impact other users.

>>15011 This is the project that Qubes uses: https://github.com/vmonaco/kloak

>>8347 give us a few examples of places where you got into? kind of curious. i am bad at social interactions, with a childish face and awkward demeanor so i kinda suck at passing off as someone who is just 'supposed' to be there.

honestly malware dev isnt the mystical soykaf people make it out to be assuming you're developing malware for windows, just think of what you want the malware to do, break it down into smaller pieces, and get to work. there's literally an API for windows soykaf

>do my first ctf on hackthebox >its rated as an easy >its actually really fuarrrking hard i am humbled

>>15699 don't forget unoffical syscalls an almost any malware github page

>>15891 hackthebox is all over the place. it's not actually that good of a resource, because half the "difficult" machines are just running gobuster for credentials and then doing some basic LPE pulled from google. There's no real red teaming going on, no interesting privesc, pivoting, or even real exploits in many ways. I could never get into it.

>>15895 >>15699 What is this API for WIndows called?

>>6844 Tryhackme is pretty handholdy and a nice way to ease in. Its what I've been using. Once I can start rooting boxes without peeking at the walk through I'm going to graduate to htb and just go from there. And honestly dipping your toes in and just trying to do boxes is really the only way you are going to learn.

>>15891 mfw i don't have a cute hacker gf to team up with for HTB challenges Why even live?

>>16075 Windows API What were you expecting... https://docs.microsoft.com/en-us/windows/win32/

This is a good beginners list of boxes to start. https://docs.google.com/spreadsheets/d/1dwSMIAPIam0PuRBkCiDI88pU3yzrqqHkDtBngUHNCw8/htmlview# Has the big 4 lab environments HTB, Tryhackme, OffSec ProvingGrounds, vulnhub.

>>16075 The userland level API is called the Win32 API The kernel level API is called the Native API or NTAPI

>>15891 i recently started doing the tryhackme beginner path and i got upto learning the basics about nmap before the next room hit me with a fat paywall requirement screen i have the mindset of not paying for things i can find free ways to do (learn in this case) so it really turned me off Tried the first "very easy" hackthebox like you did, pretty much was glued to the walkthrough on how to do it, had no idea where to go past scanning ports. I learned a little bit about SMB, SQL Servers, and reverse shelling, but that's it (and really just a little bit) I'm not sure if reading a walkthrough, then doing more thorough research about the things done afterwards is a healthy learning style. I'm sure most anyone here is better than me so I would like to hear what style of approach you took to get to where you are Anyhow I'll be sure to read more of this thread, but what are the good free sites to go to?

Guys, i managed to generate valid wordpress nounces. I know for a fact that a RCE vulnerability is present but I need a user first. Any way to create a new user with a valid nonce?

>>16166 Watch ipsec youtube videos and look at how he attacks different boxes based off their open ports. Read walkthroughs by high ranking HTB members like snowscan to get a better look at how more experienced CTF players attack these boxes. https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA https://snowscan.io/

If your looking for completely free sites you would want to do vulnhub, it's all linux boxes but all are downloaded locally than you use a hypervisor like virtualbox. It's ok to look at walkthoughs at the beginning If you don't know how to get started, as long as you take notes to get better. If you are a complete beginner, it might be worth looking into this. https://www.youtube.com/watch?v=WnN6dbos5u8

what's your password list of choice? rockyou.txt for brute forcing so far

>>16197 There is a new rockyou2021.txt from a new breach that has 8.4 billion passwords to try, might wanna take a look at that. https://cybernews.com/security/rockyou2021-alltime-largest-password-compilation-leaked/

>>16206 Sweet. Seems like it's not an adequate asset for bruteforcing tho. https://chris.partridge.tech/2021/rockyou2021.txt-a-short-summary/

hey lainons, anyone got some content/stuff to read up on about wifi cracking or how wifi works in general? i read up on the 4 way handshake but all my sources have been way to abstract i guess, id love to really grasp how a computer connects to a network

>>17296 I would install aircrack suite and mess with all the different tools until I started to feel like I understood what is going on.

>>11401 I've been making my own C2 infra. It's not anything super interesting but its the backbone to malware campaigns.

>>12688 Thanks lain, going to implement dynamic modules in the basic malware i've been working on.

This thread is 2 years old, man time flies when you soykafpost.

>>17296 As a very first step, you should be able to manually connect to your LAN. Log into the router and see what you can change. Some routers allow you to create a second SSID, where you can change parameters, such as encryption scheme, set up WEP and run aircrack-ng on it. If you have more than one device (say, a raspberry pi or a separate laptop) you could try to set up a hotspot or try to connect ad-hoc. You could do the last even if you have a recent handheld console like a PSP or 3DS.

>>7567 OSCP assumes some technical literacy, and that you've probably done a few beginner CTF's, but it's really an introduction to pentesting, what they teach you isn't cutting edge, they teach you enough to be useful, but not enough to be dangerous. that's what the other courses they offer are for

>>16166 I've completed almost every beginner box on HTB. Basically, it goes like this (generally speaking, of course): >scan domain via nmap >see if there are any hosts that attemp a re-direct. If so, add them to /etc/hosts. I.e. 10.10.4.15 differentdomain.htb >google every software version you get from your scan. 99% of the time it's related to the web host or some obscure port running an odd service. >If these return soykaf, scan the domains with gobuster to find hidden URLS/leaked creds/version leaks. Another thing: always CTRL^U on blank pages. Tons of HTB challenges leak php creds on "blank" pages. >Once you get foothold, always scan the /etc/passwd to see who's on the box >use linpeas/linenum if you're soykaf at looking in service directories for creds >Almost every pivot from user -> root relies on something from GTFOBins. Google if you don't know what that is. >To find out what binary you need to escape, attempt to run "sudo -l" when you have legitimate user account, not the web-server account Last tip: Never rely on brute forcing creds/logins. I'm certain like 99% of the boxes rely on hidden creds somewhere, a vulnerable web service, outdated software, or a leaked URL/vhost. Good luck.

>>6844 If you are in, or just got out of college https://www.cyberstartamerica.org/

>>17641 ah dang this is for americans only tho

also i wish i had the fuarrrking time to finally properly read up on cyber security and get into the field. i really cant find the time between uni, my job, doing stuff with friends and family, reading, trying to go out fishing.... its all some tiresome why do i only have that many hours in a day

>>17514 what exactly do you mean with "manually" if i may ask? like open up a terminal and try to connect to it without using my desktop enviroments GUI?

>>17654 >can't into hack mode >ngmi

>>17656 i know i know...it do be like that, i just wish i had the willpower and/or time to read up on mobile communications and networks. i just have to divide my hobbies onto the different days of the week but somehow i never get around to do that

would something like picrel be considered a good beginner project? I feel like I would learn a lot about API's and web scraping. anything that wouldn't work? or would work better? anyone done something similar before?

>>18068 I don't think so, you will likely have a horrible time trying to interface with these services using a bot. They all aggressively combat bots and are generally soykaf to use.

>>18068 You can try, I don't think they would let you do alot with a free version of a api key.

>>18068 This is pretty much what Pipl and PeopleDataLabs APIs are for.

One thing I don't understand is that if creating r-ware is so lucrative and easy (huge returns on making pretty straightforward code) why isn't everyone and their mother trying to make one? Is it actually more complicated than I think it is? Also with all of the autistic NEETs with all the time in the world, shouldn't r-ware be more widespread than it is now?

In the modern world, can i write malware in clear assembler?For Desktop

>>18412 If you have the skill set to write it then you also have the skill set to earn more than enough money to live comfortably completely legally. So why bother risking jail time?

>>18417 Because the legal way takes a lot of time to get into, at least that’s what I would say. Crime is just a sneaky shortcut for money

>>18417 But if someone do it for fun? Or this is suicide?

>>18422 Making ransomware is very easy and nothing special. The problem is trying to get it inside of your targets network.

And someone have OSCP resource?Book?Video?

>>18423 initial access depending on your target just takes a good amount of osint and phishing.

>>18424 Hide01.ir has the material

Heylain im learn C , Can u give me some project in sec?From easy to hard

>>19183 Are you learning c for exploit dev, sec related tooling, or for general use and you just want projects that will reinforce secure coding practice? Writing, exploiting, and fixing code that's vulnerable to a format string attack is a fun beginner task.

>>19186 i learn for RE. And want something outside book tasks

>>19191 What area of reversing are you interested in? Cracking? Modding? Closed source exploit dev? Malware analysis? I haven't used this in forever, but this site has some decent crackmes: https://crackmes.one

>>19196 Well im new but thing cracking and exploit dev

The library I tend to go to uses an unencrypted wifi network for internet access. As a noob, what can I do besides wiresharking it? Getting admin control of the router will probably not be possible unless I connect to the router through an ETH port, which seems not possible as I don't even know where the router itself is (tried to get into the router's IP adress and got nothing, and pinging it would only end in silence, as the packages didn't return)(all I see are hotspots that come out of the walls throughout the library)

>>19282 Scan its full TCP+UDP port range with nmap (or just write your own tool, it's not that hard). Also identify possible alternate wireless links (which may or may not broadcast SSID), then go after those. If you want ethernet access (prolly not helpful), unplug any ethernet cables from a hotspot, and plug yourself directly into those. If you worry about someone finding out, you could insert a switch between a hotspot and an ethernet port. Then plug yourself into that.

>>19298 I decided getting into the default gateway through the public computers and it allowed me to get into the log in screen. It's a UniFi Security Gateway. Doubt I can attack from the machines themselves, but I guess this is a good clue on the router itself.

>>19299 Also, came to the conclussion that maybe router access is determined by my MAC adress. So maybe if I spoof any of these computer's MAC adress I might be able to connect and bruteforce my way in.