Is there a widespread attack using Meltdown yet? I remember reading a while back that someone had a tool out, but nothing after that. Additionally, is there any major defenses that have been propped up to patch the vulnerability? Read about Google's software-based solution, don't know enough about it.
Isaiah Powell
>company might be giving everyone a few grand for whatever education or upskilling we want
Wew, looks like I'm doing OSCP
Blake Reyes
It's useless user, let it go But here, should probably be in OP as well:
Personally, I've started reading from the list, wahh first
Chase Allen
greentext time
>find site I want in >gather info >opensource cms with a bunch of addins >figure out specific versions of stuff >setup a local test environment >read shitty source for hours on end >find several SQLi >fucking WAF filters everything >spend what feels like an eternity trying to bypass WAF >find one SQLi that I can control through a path that takes b64 encoded data >WAF doesn't filter it >we're in business booooys >dump DB >setup system to continuously exfiltrate all the data I'm interested in >feels preddy gud >see admin mention he wants to replace the thing I'm using to get in >ohshit ohshit ohshit >more info gathering >full portscan reveals nothing new >spend the next month reading more shitty opensource code >wan't to gouge my eyes out, some of that shit is just absolutely shoddy code >spend more time reading through everything, trying shit out >finally find something useful, if I prepare one record juuuuuust right I can read local files as www- user without the WAF going haywire on me >more info gathering, got some new credentials, couldn't find a good use for them yet >it's been roughly 3 months since I started this project and I'm starting to get burned out
left out a lot of details, shit I tried that didn't lead anywhere and so on..
what do fellow hackermen? I'm kinda bummed out on my lack of progress, guess I should take a break and look over everything again with a fresh mind in a month or two
Nathaniel Robinson
the fun is when you find a CMS that isn't open source and find a LFI vulnerability to leak the source code and find more vulnerabilities. i did that once... homegrown CMS' tend to be a mess. i also found a commercial/proprietary CMS one time with a demo site with provided login credentials. i logged into it and had a poke around in the admin panel, it was pretty difficult to upload and get a shell to execute but i managed to to it via an unsanitised image upload feature for payment icon images/ like visa or paypal logos and that shit you'd see on a payment page.
i normally specialise in appsec stuff though so web security isn't really my strong suit.
Thanks for reminding me of the beer I put in the freezer.
Alexander Barnes
>It's useless user, let it go
you shut your mouth.
Ryder Barnes
How can someone be sure to remain undetected when they're hacking?
Evan Ortiz
you pretty much can't
Ryan Morales
google 'free proxies'
Bentley Gray
get behind 7 proxies
Nicholas Evans
Nice getting that shell up.
I can upload some files but the WAF immediately goes off on any executable extensions. There also seems to be a script in place that periodically scans certain file types for dodgy code (haven't looked too deep into it's ruleset yet) and warns the admin if it detects any modifications to existing executable files. Still I might put some more time into this, maybe if I can figure out a way to control the path where it uploads to a bit more I might be able to overwrite some other non- executable files that might allow me to interact with another part of the system or something.. dunno need to think this through a bit more.
Not detected by whom? Your ISP, the government? I guess you could route your traffic through as many systems as you possibly can and hope noone goes through the trouble of following the connections back to you. Maybe use a hacked wifi or something, no idea.
Or do you mean remain undetected by your target? In that case pay close attention to whatever is running on the system/network, build up a close enough copy of the environment and only ever do a move against the real system when your reasonably sure you won't be raising any red flags. Can be pretty hard though.
Andrew Murphy
>Your ISP, the government? What are the chances of these guys "detecting" you doing something like this without the target alerting them?
>pay close attention to whatever is running on the system/network Is this stuff easily visible?
How can I get more people in my life to take privacy and security seriously?
There is a woman that I am interested in, but she doesn't seem to listen to me. I've repeatedly told her to use a unique username, e-mail, and password on every service she uses, but she just says the stupid "I have nothing to hide" argument.
I liked the way she went out of her way to download Riot in order to communicate with me, but I find the fact that she isn't listening to me frustrating, and I don't like the fact she installs stupid apps on her phone despite me telling her not to because they're a security risk and essentially spyware.
I don't know what to do with her, she represents a security threat since she is not listening to me, but I like her. :(
Julian Garcia
>discord Fuck off and take your normie friends with you.
Michael Price
I think most people don't try to avoid alerting their targets. That's usually a losing bet. What you want to do is make it impossible for them to follow you back after being alerted.
>Is this stuff easily visible? Depends on what "stuff" you're doing and who you're attacking.
>not doing all your hacking in a coffee shop by stealing the WiFi from the tenant that lives above it so it's even harder to track
Brayden Green
You don't have friends, only criminal co-conspirators!
No just kidding, but maybe you're better off just ditching technology when talking to her? Just meet up with her, if you fancy her so much.
It's no use trying to convert people into tech-conscious people, most just don't give a hoot. Best you can do is say "I told you so" when they inevitably do get fucked in the ass.
Henry Rivera
Unfortunately user you can't convince someone to go out of their way if they just don't care. The problems of surveillance are a systemic one, meaning you only have power to change them on your own individual level. Educate where you can, but unless they're already interested in it your advice will fall on deaf ears. If you really want everyone around you to be free of surveillance, organize politically to end surveillance.
Mason Parker
>tails
Didn't some leak confirm that even so much as searching for Tails Linux gets you put on a list?
Austin Clark
so much as searching for tor puts you on a list.
It doesn't matter though. As long as you keep any real hacking secure, being on a list means fuck all.
Elijah King
I don't think trying to stay inconspicuous is a viable strategy today. All of us are probably on a few lists.
Brayden Bailey
>hacking >mister robot >"pentesting" >vulnhub ctfs and fuckin bandit
more like /skg/, scriptkiddy general. At least be honest with yourself.
Joshua Allen
>he doesn't watch mr. robot hope you've patched out your firewall kiddo, I'm booting up my KDE
Tyler Robinson
are you OP insulting yourself in order to bump the thread away form page 10?
it's funny, i actually enjoyed the show up until the first episode of season 3 when they showed that "hackerspace". most laughable shit i've ever seen.
I finished watching after season 1 because I had already begun to lose interest and heard it only went downhill. What's the 'hackerspace' bullshit? Season 1 was actually not horrible in terms of accuracy if you exaggerate the limits of possibility, besides hackers actually meeting up irl to do stuff.
Kevin Diaz
Wow it's really that old? I just found that image somewhere and thought it was made to trigger people. The more you know I guess. Respect to that old school then.
Jason Peterson
chainproxys socks5
Luke Robinson
not even kidding, here's what it was:
Elliot goes to a hackerspace. It's a dimly lit smoky filled room full of drunk crowds cheering at people typing quickly on computers, like it's a fucking starcraft tournament. Elliot explains to the audience what a CTF is. It was peak cringe.
Every hackerspace I've been to has been quiet as shit, with respectable people and decent lighting.
Jacob James
oh jeez, you can tell the writers were out of ideas.
Sorry if this sounds dumb though but what exactly do you mean by hackerspace? I haven't heard the term before - is it like a hackathon?
Lincoln Jenkins
It's a place for people into cybersecurity and penetration testing to meet up and try out scripts or fuck around with hardware. Think somewhere between a social club, a cafe, and a shared office. also lurk more.
Camden Moore
thanks user
Jace Wilson
Do I have to be a pr0 to join the community or can newfags apply?
Dylan Robinson
you're welcome to join, afterall everyone was a newfag once
Christian King
Great to hear. I'm not a total noob but compared to others i'm pretty green. I'll just lurk around and try to learn a thing or two.
Elijah Sanders
Is it worth following the guide on abatchy? I'm doing a degree on engineering so this stuff is way out of my field. My only real experience is a 4 month intro to networks course where we mucked around with wireshark and patch cables.
I want to learn this only out of interest. How much time would it take to go through that guide if I dedicate 3 hours a week
Mason Reed
kernel exploitation is great. how long it'll take for you to learn depends on a lot of things, and mainly relies on a strong background in computer architecture and knowledge of the platform you'll be exploiting; from hardware security features to how the operating system itself is designed architecturally.
if you haven't at least got a strong background in systems programming in a mid level language and assembly, i wouldn't even bother trying.
