/cyb/ + /sec/ - Cyberpunk and Cybersecurity General

Qt 3.14 edition

Previous thread:
/cyb/erpunk:
>The Cypherpunk Manifesto
activism.net/cypherpunk/manifesto.html
>The Cyberpunk Manifesto
project.cyberpunk.ru/idb/cyberpunk_manifesto.html

>What is Cyberpunk?
pastebin.com/hHN5cBXB

>Cyberpunk directory (Communities, Media, Readings)
pastebin.com/VAWNxkxH
Cyberpunk resources (Miscellaneous)
>pastebin.com/Dqfa6uXx

/cyb/ ftp: ftp://50.31.112.231/pub/
ftp://collectivecomputers.org:21212/Books/Cyberpunk/

/sec/urity:
>The Hacker Manifesto:
phrack.org/issues/7/3.html
>The Guerilla Open Access Manifesto:
archive.org/stream/GuerillaOpenAccessManifesto/Goamjuly2008_djvu.txt

>Why privacy matters
youtube.com/watch?v=pcSlowAhvUk
>Shit just got real
pastebin.com/rqrLK6X0

>Cybersecurity basics and armory
pastebin.com/rMw4WbhX
>Endware
endchan.xyz/os/res/32.html
>BBS archives
textfiles.com/index.html
>Various guides to get started
github.com/mayfrost/guides/

>Reference books (PW: ABD52oM8T1fghmY0)
mega.nz/#F!YigVhZCZ!RznVxTiA0iN-N6Ps01pEJw

Thread Archive: archive.rebeccablacktech.com/g/search/text//cyb/ /sec//

IRC:
Guide github.com/mayfrost/guides/blob/master/IRC.md
Join irc://irc.rizon.net:6697
SSL Required:
#Jow Forumspunk
#Jow Forumssec
#nfo

Schway SSH Textboard: [email protected] (port 22)

Attached: NoGhost_EveVenture.jpg (741x1100, 148K)

Other urls found in this thread:

archive.org/details/cyberpunkeducator
ctf.hackucf.org/challenges#Conditional 2
en.wikipedia.org/wiki/Billion_laughs_attack
tapas.io/episode/1352412
blog.haschek.at/2017/how-to-defend-your-website-with-zip-bombs.html
hackerfactor.com/blog/index.php?/archives/762-Attacked-Over-Tor.html
youtube.com/watch?v=Cc61C-VsTko
lwn.net/free
bbc.com/capital/story/20190301-how-screening-companies-are-monetising-your-dna
reuters.com/investigates/special-report/usa-politics-beto-orourke/
youtube.com/watch?v=_XdQugsDz8E
rclone.org/crypt/
opensecuritytraining.info/Training.html
packtpub.com/packt/offers/free-learning
reddit.com/r/Jow
twitter.com/NSFWRedditImage

/cyb/ Movies:
>The Machine (2013)
>Johnny Mnemonic (1995)
>The Matrix (1999)
>Chappie (2015)
>Elysium (2013)
>Virtuosity (1995)
>The Lawnmower Man (1992)
>Lawnmower Man 2: Beyond Cyberspace (1996)
>The Terminator (1984)
>Blade Runner (1982)
>TRON (1982)
>TRON: Legacy (2010)
>Escape from New York (1981)
>Escape from L.A. (1996)
>Rollerball (1975)
>RoboCop (1987)
>Nirvana (1997)
>Transcendence (2014)

/sec/ Movies:
>Sneakers (1992)
>The Net (1995)
>Takedown (2000)
>The Fifth Estate (2013)
>Blackhat (2015)
>Enemy of the State (1998)
>Hackers (1995)
>WarGames (1983)
>WarGames: The Dead Code (2008)
>Swordfish (2001)

Jow Forums Movies:
>Disconnect (2012)
>Antitrust (2001)
>Pirates of Silicon Valley (1999)
>Office Space (1999)
>Her (2013)

/cyb/ Documentaries:
>The Cyberpunk Educator archive.org/details/cyberpunkeducator
>The Internet's Own Boy: The Story of Aaron Swartz (2014)
>RiP: A Remix Manifesto (2009)
>TPB AFK: The Pirate Bay Away from Keyboard (2013)
>The Net - The Unabomber, LSD and the Internet (2003)

/sec/ Documentaries:
>Hackers: Wizards of the Electronic Age (1984)
>Hackers Wanted aka Can You Hack It ( (2009)
>New York City Hackers (2000)
>We Steal Secrets: The Story of WikiLeaks (2013)
>Citizenfour (2014)
>Terms and Conditions May Apply (2013)
>All Watched Over by Machines of Loving Grace (2011)
>Snowden (2016) [Biopic?]
>Zero Days (2016)

Jow Forums Documentaries:
>The Code (2001)
>Revolution OS (2001)
>BBS: The Documentary (2005)
>Get Lamp (2010)
>From Bedrooms to Billions (2014)

Series:
>Dark Angel (2000)
>Person of Interest (2011)
>The Expanse (2015)
>Mr. Robot (2015)

Attached: 1546557826704.jpg (1800x850, 396K)

Can anyone help with this CTF? ctf.hackucf.org/challenges#Conditional 2
So it compares arg1 to the hexcode 0xcafef00d, but im not sure how to actually make that je because it doesnt translate to ascii. I know its basic, but im not sure what im missing

Attached: 2019-03-14-162424_1920x1080_scrot.png (1920x1080, 2.06M)

Last thread: Open issues from last thread:

>For the Sec guys here... has any changes been made to the pft server?
>ftp://50.31.112.231/pub/
That was the reserve FTP site, the main site with all the information in a more structured form is still at ftp://collectivecomputers.org:21212/Books/Cyberpunk/

====

Still ongoing on cybergoth. BTW were cybergoths as black in clothing as goths? Search for cybergoth and you get a lot of neon colouring.

====

AEL: we forgot that one in the OP.

====

Zine at Any more information? See also open FAQ questions at

I need a fucking answer to this. Posted on stackoverflow, and /sqt/. Need answer now, so I can submit report. Please.

Let's say there's a parameter in the url: ?date=, which is set to a ?date=2019-03-14. Now, if we submit a massive amount of digits in there, for example: ?date=2019999999999999999999...999-03-14, submitting this brings a Network Protocol Error, the page doesn't load, and the site seems to get slower(though not sure this had anything to do with that).
Is there a specific name for this? Is it anything which would cause concern?

Also, last time submitted got a 504 status code repsonse from the website. Am I breaking their server? Anything?

>stackoverflow
Not comfy.

Anyway, this seems to be a form, of denial of service. It doesn't have to break the server entirely but slowing it down significantly can be enough to qualify.

One example is death by a billion laughs.
en.wikipedia.org/wiki/Billion_laughs_attack

A ZIP bomb, on the other hand, is likely to tank the server. It will most likely require a reboot. The FAQ mentions TOR warfare using ZIP bombs.

In military parlance there is a difference between a soft kill and a hard kill. That seems to apply also here.

I was seriously just going through the possible reports, reading about stackoverflows. Is this definitely what it is, though?
>A ZIP bomb, on the other hand, is likely to tank the server.
What's this? Should I do it? I'm safe if I'm using a bounty program, no? :/

>Is there a specific name for this?
probably a kind of denial of service, caused by badly handled user input.
>Is it anything which would cause concern?
probably not, but let's break it down, assuming that the language of the script is php.
They're probably using strtotime() or mktime() to parse the date to a timestamp or other format to handle your input.
Different versions of php could possibly return different output on error (like -1 or FALSE)
Let's say that the result of this is not checked, and is passed to a database query or some other function that does not expect that kind of result.
That's where the fuckup likely happens.

>tl;dr
sanitize all user inputs

Attached: 1552397821945.gif (616x338, 419K)

ZIP bombs are well known already, even Wikipedia has an entry about it. Those are handy for feeding to net intruders - give them something to chew on and watch them blow up.

>sanitize all user inputs
Always a good advice.

New episode of Cyberpunk (with a hint of Desertpunk) comics Sammy:
tapas.io/episode/1352412
It is getting weird.

also, you have to include a null byte at the end of your string.

Why not publish on the net, say, a year after original release?

"Corporate Cannibal"
youtube.com/watch?v=Cc61C-VsTko

Pleased to meet you, pleased to have you on my plate
Your meat is sweet to me
Your destiny
Your fate

You're my life support, your life is my sport

I'm a man-eating machine [x2]

You won't hear me laughing, as I terminate your day
You can't trace my footsteps, as I walk the other way

I can't get enough prey, pray for me [x2]
(I'm a man-eating machine)
Corporate cannibal, digital criminal
Corporate cannibal, eat you like an animal

Employer of the year, grandmaster of fear
My blood flows satanical,
Mechanical, masonical and chemical
Habitual ritual

I'm a man-eating machine.. [x2]

I deal in the market, every man, woman and child is a target
A closet full of faceless nameless pay more for less emptiness

I'll make you scrounge, in my executive lounge
You pay less tax, but I'll gain more back

My rules, you fools

We can play the money game
Greedgame, power game, stay insane
Lost in the cell, in this hell
Slave to the rhythm of the corporate prison

I'm a man-eating machine…
I can't get enough prey
Pray for me
Corporate cannibal…
Digital criminal…

I'll consume my consumers, with no sense of humour
I'll give you a uniform, chloroform
Sanatize, homogenize, vaporize… you

I'm the spark, make the world explode
I'm a man-eating machine, I'll make the world explode
Corporate cannibal…

Attached: 60721e6a-bae4-4779-9ff3-eb6c9eddad2c..png (2560x1600, 438K)

Wrong previous

fixed a mistake, now get segmentation fault
write does work if i don't push and call just before declaring the string

post your assembly code

More open questions in addition to .
Looking fo rinforamtion on Pic.

Attached: BB_Compendium.png (989x611, 41K)

not that user but absolute goldmine. I need to find more blogs of these

Haha, yes, the text is pretty Gibsonesque too:
>Bobby and Chuck were almost as fast. Bobby downloaded 8 of the 1 gig zip bombs and then vanished. Chuck could handle the 1 gig zip bombs, but couldn't handle a dozen of the two-gig bombs.

that's a truly shitty list

Have y'all read all of phrack magazine? That website in general is just woh.

Movie/TV suggestions-

"Deep Web" - Documentary regarding the case against Dread Pirate Roberts and the Silk Road.
"Operation Freedom Downtime" - documentary about Kevin Mitnick's time spent in solitary confinement awaiting trial and the cultural/media responses to hacking.
"Ghost in the Shell" - Anime is technology
"Metropolis" - The singularity, but, in a 1927 German Silent Film
"Altered Carbon" - If HBO had a Cyberpunk Noir

Attached: FB_IMG_1440948174673.jpg (960x960, 122K)

The last 3 are in the FAQ.

Made a how-to for learning assembly. It's a decent book but about a quarter of it is tangential and not really necessary. It's one of the few books that teaches amd64 though.

Attached: asm.png (1107x2793, 381K)

Ya got me

Attached: FB_IMG_1440948183408.jpg (960x960, 106K)

In many cases, especially in the embedded world, ARM is a more popular ISA. RISC-V is expected to make major inroads soon, WD is expected to have 3 RISC-V processors on each hard disk.

If you want to go full on retro there is the 6502 which 40+ years after introduction is selling 200 million units per year.

see

Attached: putkevinback.jpg (1200x348, 53K)

I have read bits and pieces.

And his reminds me that we still need the Dose Magazines. I have obtained full PDFs of issues 1, 2, and 3; but we are missing issue zero.

I have opened a new sub directory, Zines, under which I placed the 3 issues in TheDoseMagazine:
ftp://collectivecomputers.org:21212/Books/Cyberpunk/Zines/TheDoseMagazine/

Attached: TheDose4.jpg (904x1277, 576K)

i imagine if you know intel, it won't be hard to pick up ARM

Just a heads up that LWN releases the free versions on Thursdays and that has a section on security. The canonical URL for the free version is always
lwn.net/free
Two of the main features are /sec/ related:
>A container-confinement breakout: details on a recent container vulnerability.
>The Thunderclap vulnerabilities: the kernel remains vulnerable to hostile hardware.

hacking is as dead as the wild west

see, I'm liking this style, I'm even listening to some of the DJ's music. And like, this isn't so bad, I could get into this culture. Except, I have been stepping away from scene/goth because drugs. Drugs r bad. Or rather, are incompatible with my particular path to success.

Just reading up on format string vulnerability, why does the format string itself get on the stack so it's bytes can be accessed through stack offsets? Does it really push the whole string on there? Thought it was typical to push pointers to strings on to the stack?

yeah it's called penetration testing now

yes, printf does do that, on x86 at least. it pushes the string on the stack and then pops bytes as it interprets it

wait sorry i'm actually not sure. i think sometimes you have to pop enough bytes off the stack with %x to get to where the string is actually defined, where it's a local variable of the calling function (which means it's far up on the stack).

gross, why would i test penetration

yeah i remember now. the string is passed by reference as always. but if it's a local variable of a prior function frame, you can still get to it. in that case, it won't be that far away. you do enough %x's to get to it, and can use the width specifier to do arbitrary writes

Mean no offense to cyberpunk fags, i really love akira since i was a kid back then and it's plot telling how shit and gloomy the future is but seeing this red high rpm bike being referenced to hell fucking bothers me.

Thanks mate, ill give that a go

Awesome. Thank you for sharing, user.

My accomplishments of the week: Got into hackthisbox.eu and solved 4 stenos so far. Settled on Kali KDE, and am excited about what I will learn, but also realize that I know fuckall, because even the easiest retired machine I didn't know what to do on, without watching a walkthrough. Tips?

I was in the same boat, i still know fuck all, just a little bit more than i used to. Honestly just google things, and if you do use a walkthrough, only use it to get over what you are stuck on, and then keep going without the walkthrough.
LiveOverflow on youtube is pretty good when it comes to tutorials and explanations of recent big exploits. The first big step is really just teaching yourself how to learn.

Well, now's the perfect time to figure where to go after Jow Forums gets Chinawalled by politicians. Will the answer always be IRC?

>Jow Forums gets Chinawalled by politicians
What?

>chinawalled

Entirely depends on how the server is handling the parameter. 504 Just means the website tried to give your parameter to something and never heard back. All in all it's not likely you're damaging the website.

China has its firewall, and after the shooting today they're going to port it over to America.

Well, probably.

Jow Forums is regularly in the news so firewalling it will be hard.

=== /sec/ News:
Code is not just running on computers, DNA is the code for cells:
>BBC - Capital - Who’s making money from your DNA?
bbc.com/capital/story/20190301-how-screening-companies-are-monetising-your-dna
>If you’ve ever sent off your DNA to an ancestry or health-screening company for analysis, chances are your DNA data will be shared with third parties for medical research or even for solving crime, unless you’ve specifically asked the company not to do so.
Probably very few do, fewer than read the fine print. And fine print there is:

>She rejects the idea that customers don’t understand whether they are agreeing to share their data, pointing to a “very explicit” three-part consent document that asks whether customers want to consent to research, and whether they consent to this research being shared with third parties. The key thing, she says, is that their research relies on people answering survey questions. “Their genetic information, if they don’t provide the survey information… is really not interesting to us. So not only do they knowingly consent, they have to affirmatively participate in these studies.”
Essentially yet another click through.

add anime to the list:
ghost in the shell
akira
ergo proxy
texhnolyze
serial experiments lain
psycho pass
steins;gate
cowboy bebop

I really hope the gobbermint shutsdown Jow Forums

>ghost in the shell
>akira
Both are in the FAQ
>ergo proxy
Why? It sure is post modernism overload but I don't see the /cyb/ angle.
>texhnolyze
>serial experiments lain
Also in the FAQ.
>psycho pass
>steins;gate
>cowboy bebop
Why x 3 ?

>Why? It sure is post modernism overload but I don't see the /cyb/ angle.
Not same user but that part of "Perfect citizen" really got me hard.

>>ergo proxy
>Why? It sure is post modernism overload but I don't see the /cyb/ angle.
This, so much this. Ergo Proxy has no components of cyberpunk except for the androids.

Not sure I see how, can you tell us more?

it's more likely their web server is forking a process to deal with your request, and that process then crashes. the web server itself isn't affected.

Hey lads, I don't want to shit up the thread too much but I'm just looking for advice. I don't know shit about IT or PC's in general but after some research Cybersec really jumped out at me as an interesting field, I decided to enroll back into school for an associates in it and to pick up some certs because I'm sitting here directionless at 25 and I need to start heading towards a career. What are some tips you guys could give a newbie trying to get into the field? Have any of you went to school for it? If so, did it help? My associates comes with 5 vouchers for any certs, which ones are key?

The /sec/ FAQ on the FTP site is a good start. And keep in mind that this can be a really intense job.

i graduated with a BS in CS, but i could only get jobs with data science and software development crap, so i went straight back to get a masters in a CS program tailored for cybersecurity. i'm glad i did. this stuff's way more interesting and i have cybersecurity internships lined up so i can get work experience.

If you're paying for your own certs, don't get the GIAC ones. they're way overpriced. OSCP is good for penetration testing and CISSP is good for managers, other than that I don't know

Thank you lads, I can handle intense, and I'm ready for a "big boy" job. I just can't keep working part time at a grocery store forever. I think the way it works is that I have any 5 covered under tuition and then I get discounts on any I take afterwards (I'm going to be attending a tech centric school) so I figured I should make 3 the basic ones (A+, Net+ and Sec+) unless those don't carry any wait in cybersec. All the jobs I've looked at here in Virginia say they either want certs a bachelors or both though

Where in VA are you? University of Richmond and VCU offer good courses for certs from what I hear. There's also a cybersec group/hacker group that meets in Richmond every third Thurs of each month (or something like that.)

Looks like Beto O'Rourke is gonna get some credit in /sec/ circles:
reuters.com/investigates/special-report/usa-politics-beto-orourke/

>While a teenager, O’Rourke acknowledged in an exclusive interview, he belonged to the oldest group of computer hackers in U.S. history.

>The hugely influential Cult of the Dead Cow, jokingly named after an abandoned Texas slaughterhouse, is notorious for releasing tools that allowed ordinary people to hack computers running Microsoft’s Windows. It’s also known for inventing the word “hacktivism” to describe human-rights-driven security work.

>Members of the group have protected O’Rourke’s secret for decades, reluctant to compromise his political viability. Now, in a series of interviews, CDC members have acknowledged O’Rourke as one of their own. In all, more than a dozen members of the group agreed to be named for the first time in a book about the hacking group by this reporter that is scheduled to be published in June by Public Affairs. O’Rourke was interviewed early in his run for the Senate.

What a world we live in. This headline fresh from Slashdot:
>Consumer Groups Want To Tax Facebook To Save Journalism (vice.com)
When will we read
>Consumer Groups Want To Tax Journalism To Save the Truth (onion?.com)

Virginia Beach at the moment, though we're probably gonna move after school. My brother and I are both heading to ECPI since we know a couple of people who had good luck after graduating there and from everything I can see online their degrees aren't worthless

>Japan's buddhist robot preacher
youtube.com/watch?v=_XdQugsDz8E

>In Japan a spiritual robot is making the teachings of Buddha more easily understandable. Preaching in the Kodaiji Temple in Kyoto, the aluminum and silicone robot priest stands almost two metres tall. Its creators hope it will encourage people to take more of an interest in Buddhism.

I'm looking for a good zero-knowledge encrypted cloud storage. What are my options?
I have been eyeing pCloud lifetime 2TB for one-time payment, but that seems expensive for amount of data that probably won't be enough in a few years.
Is there a software that could store data securely on botnet services like Google Drive?

rclone.org/crypt/

Cashing out hacked paypal accs on tor. Monero, tails and decentralised exchange the cyberpunk way or is the gov already a step ahead?

No shit, I'm in Williamsburg not far from you, small world. If you're looking at ECPI, I'd also rec looking at Community Colleges in VA, some good programs. May be worth looking into taking some night courses at them. VCU and UofR also offer online courses relating to comp sci that (I think) have lower tuition for in-state students.

No kidding? We go down there every summer for Busch Gardens, Colonial Williamsburg is fun too. I actually went to a local community college for a bit (TCC) for general science before I had this career epiphany, but I didn't know if a degree from them was worth as much as one from a specialized school. On the bright side my gen Ed class credits will transfer which is gonna save me a decent chunk of dosh.

So I have to be on the road a lot right now, and instead of taking the plebtop with me I'm thinking of SSHing through phone.
Any terminal emulator or ssh thingy for android?
that has ssh-keygen so that I don't have to log in manually all the time.

I usee the free version of JuiceSSH and I've been pretty happy with it.

Looks alright, thanks.

It is possible to learn cyber security online?
It will be possible to find a job after?

opensecuritytraining.info/Training.html

get a cert like OSCP after for employers

So, today's packpub freebie is pic related, seems like an interesting video which could be of interest for many here.

packtpub.com/packt/offers/free-learning

Attached: freebie.png (810x1000, 59K)

I mean, it was 8ch that had the OG thread and had the muh pedo hitpieces against it recently

Apparently the chinz got firewalled in NZ
reddit.com/r/Jow Forums/comments/b1aqz4/pol_member_commits_mass_shooting_in_new_zealand/

>also yes, i know, plebbit

Desperate late nite page 9 bump

Attached: 1527264738748.png (657x527, 25K)

New Zealand authorities demanded that the video footage and other ephemera be removed from the Internet, so while websites like Twitter and Scribd complied, 22/23chan, KiwiFarms, and other sites where it was not possible to remove the footage were firewalled and made inaccessible.

Fun fact: Apparently US law enforcement and other PDs have reached out to the Farms in an attempt to get copies of the video since it's being taken offline everywhere else.

Sunrise again.

Attached: _.gif (1152x1152, 2.55M)

sauce?

Attached: atmos.jpg (3996x2250, 864K)

> What are some tips you guys could give a newbie trying to get into the field?
Realize that to be good at infosec, you have to understand the technology itself. If you want to be good with development and application security, study those. If you want to focus with network security, start with networks. I wouldn't recommend A+. Network+ is ok.
> Have any of you went to school for it? If so, did it help?
I went to school for computer forensics. I'm in a different area (crypto and wireless) but I'd say the experience and exposure definitely helped.
> My associates comes with 5 vouchers for any certs, which ones are key?
Start off with the associates and a good general infosec cert. If you are planning to work with the fedgov/dod, look into DoD regulation 8570, it outlines what certs are required for what level of positions. Take time to look into each aspect of infosec (application/development, crypto, networking, etc) and find which interests you the most. The field is broad and you can't be an expert in all things, especially at the start. Pick a niche after you get the basics.
>General certs that required little to no work experience (pick one)
Sec +, SSCP, GSEC
>PenTest
OSCP is still the best, although CEH is more recognized by the government, although it's a sham really.
>Information Assurance
CAP (RMF focused)
>Necessary once you are in the field
CISSP
>Wireless networking
CWSP, GAWN

apparently it's made by someone called waneella

Attached: waneella_1.gif (540x960, 347K)

It’s not it’s just not as fun or easy as it used to be

How do you buy monero with PayPal?

How do I expand my knowledge of interwebz? I just finished Network +. What would be the next step?