/cyb/ + /sec/ - CYBERPUNK/CYBERSECURITY GENERAL

70k entry? Not bad user

Fuck you im doing infra and im only getting 68

I guess you should practice again. Asking for the solution here won't really help you.

1. It's highly unlikely you will encounter the same set of machines.
2. Move on from those mistakes. You're just gonna beat yourself up.

Now if you say you want to know how to solve those boxes so the next time you are in a similar position you would know what to do, then you would do better to refining your methodology than focusing on particular scenarios. This is much more beneficial and more practical than memorizing steps on how to crack a particular box.

Which are you taking? Better not a meme one. Sans is already meme as it is. Looks good on a CV though.

What's the best antivirus software?

you do cisco stuff?

Common Sense™, antivirus is dead.
krebsonsecurity.com/2014/05/antivirus-is-dead-long-live-antivirus/

I'm much cyber, but how can I be [more] punk?

Go out and do shit. If you’re trying to go real punk, maybe try some drugs get some shady friends.

METH AND NO SHOWERS THEN START FIGHTS WITH STRANGERS

this smoke some phat rocks cunt

Make decisions based more on what is right than on what is legal.
And wear a leather jacket with spiked shoulders.

rn is hot, so I guess I'll make a t-shirt like that

fuck guys I'm gonna get outed as a noob for sure at DEFCON

what do?

That's fine. Just enjoy it

it will be fine user, there will be many more like you, just have fun and learn along the way, everybody was a noob at some point
Wish i was you desu, i've been wanting to go to defcon for a while now, but i live too far away

Hey anons, I'm new to /cyb/, what is the general consensus on lainposting?
Also, should the OP be updated with this video on why privacy matters? I think it's just as good as glenn's speech, and it gives practical examples of happenings and headlines to illustrate the point
invidio.us/watch?v=Hjspu7QV7O0

Attached: 1564231745912.gif (500x357, 1005K)

>It's highly unlikely you will encounter the same set of machines.
I came across the same ones twice

Same set? Same 4 machines? (BO shousl always be there)

Same 4. Different BO. First BO I did had more than 20 bad characters. Was crazy. This one has legit 4. Other than that the boxes were the exact same. These feel way fucking harder than the cyb3rsick dumps said the old boxes were.

Oh lucky you then. BO is the same challenge everytime, practically speaking od course. Yeah I guess they're different after the leaks. I took mine before it happened

excellent video fren. thamx for sharing. i think this is better than the greenwald video precisely for the reasons you stated. examples like the ones in the vid you posted help to drive the point home about why it matters. im downloading it to add to my personal off-line achive. of you have others, by all means please post.

Attached: ba053670-b20e-4857-a03f-19fd904adc98.gif (1000x1200, 1.14M)

Ah well. Im going to spend the next few weeks living inside metapsloitable 2 and 3 and see what I can learn there.

I have run through pretty much every box in the ippsec HTB recommended list; honestly a HTB vip sub was not as valuable as I thought it was going to be. I found a bunch of them to be replicas of things in the offsec labs.

that guy's whole cannel is based. big corps are the enemy of the people imo.

Attached: 7d96f39a-55b1-4317-8048-5e93658b76f9..png (2560x1521, 1.9M)

Fuck off and study more you faggot. Trying to cheat on Offsec tests should be a bannable offense here

Ah really? How many did you do in the actual labs though?

Is there a way to protect my identity while making Youtube videos? Obviously I wouldn't show my face, but what about the voice? Due to the content I'm going to create, doxxing is a very real threat that I need to be aware of.

>use a vpn.

But seriously, not sure how you're going to go about making them that there is a probability of leaking PII. Can you elaborate more on what you want to do? There are creators who seem to exclusively use simulators. Have you thought about using one?

34. Pivoting did not interest me as I knew it would not be in the exam. Got all of the big 4, they weren’t too bad at all.

Improve your course materials then fuckhead. Yeah Im calling you out; the videos I got sent in May were recorded I fucking 2013. Your exam boxes and the labs have nothing in common. Your company is straight up ripping people off, and this retake price increase coupled with the boxes that are legit not covered in your material means YOU are the scum, not me.

Eh that's fair. Not many like completing the labs for the sake of completeness. Most do as much as they can because they are anxious about the exams. Though there are some interesting machines in the other networks though.

I don't work for Offsec but I do have my OSCP/E. If you really did get 34+4 in the PWK labs, the exam machines should not have been a problem for you. They are nowhere near as technically challenging as the labs.

If you thought you were going to go into the exam and copypasta your lab notes to win your cert, you are retarded. Cheating is not the answer to your problem. Cheaters degrade the value of lab-based certifications. If you have beef go take it up with Offsec directly instead of whining in /cyb/ looking for handouts.

Yeah I've thought of using a simulator but I don't think I've ever heard one that sounded like a real human voice. I was wondering if there's some program that alters your voice in a way that still sounds natural, but simply a bit different from how you normally sound. Another option that came to my mind is to hire someone to record the video for me on Fiverr. He would probably do a better job than me anyway, since I don't even have a good microphone.

>use a vpn
Thankfully I don't have to worry about the government coming after me, so using my real ip should be fine.

>Can you elaborate more on what you want to do?
I just want to speak the truth about a few things that the mainstream media rarely talk about, and unfortunately there are lots of people who're gonna hate me for it.

Yo do you have plans to take OSEE?

Hmmm if you want to limit your footprint then it makes sense to use a simulator rather than paying someone shouldn't it? The last thing you should be worrying about is familiarity if your priority is anonymity.

Hey /cyb/. I'm not a programmer but I've been banging my head on this ctf called microcorruption. It's basically using assembly to find vulnerabilities in the code for each level. I got along on through buffer overflow and format string vulnerabilities levels just by doing my research online, but I've started levels now that require heap overflows. I've tried to read some material on how chunks, malloc and free works, but it's melting my brain trying to make it work in practice. Anyone recommends something a layman like me might pick up too better understand how overflows and UAFs actually work? Chunk headers specifically have been giving me hell

>do have my OSCP/E
You have the old machines. What you said is correct; for the old machines. I have read all the dumps for the old ones. The new ones are way above what you had. Fucking mempodipper, unrealIRC remote roots, black hole one shot root, tomcat system shells; do I need to go on? The old exams were more in line with what the labs had to offer.

The only one I’ll give you credit for is the blowfish decrypter; that one isn’t something immediately obvious. But you seriously don’t know what the new ones are like. You can’t compare.

Well, as far as I know, you don't need to use your real name on Fiverr, and all payments are processed by them on their platform, so the guy I hire would never know my real identity. I'm not 100% sure about this though.

Doesn't liveoverflow have a tutorial about this? I remember he also recommends doing these challenges too. Though his videos about heap exploitation is not that good but it's a nice start. You can also try doing protostar

If that's the case then go for it. Keep us updated maybe?

Does that matter though? Shouldn't passing rely more on the student's developed skills and methodology? If what you say is true then determination and correct application of the lessons should allow you to overcome the exams

>You have the old machines

Nigger I fucking tested both my exams in the last three months. Don't talk to me like you know shit. Study for your fucking exam.

When I have time

>correct application of the lessons should allow you to overcome the exams
Are you the same dude who has his OSCE? Because if so I urge you to have another look at your PWK materials. They do not teach lessons. There is so much extranous shit in there just to pad it out a bit. I got more out of Georgia weidmans hands on hacking when I got that a few years ago. Hackers playbook has better methodologies. Offsec don’t offer lessons in their pwk; they say that’s what the lab is for. If there is a serious disconnect between the labs (server 2019 in exams and some fucking windows 2000 boxes in the lab) then the lessons from the labs don’t apply to the exam. So where does this learning come from?

Not really the same guy though I also have osce. Yeah they don't I'll give you that. Offsec likes this arms-crossed approach that is frustrating and kind of dickish. So when I mean methodology, it's what you think is the best approach appropriate to the situations you face. Most of the time if you are doing random attacks that you have little confidence but high hopes with then those efforts are better put in doing more recon and reviewing what information that was already gathered. It is more worthwhile to do the latter. In the end all you have to rely on is yourself. The materials are just there as references but ultimately stuff that you will abandon once you have built up a robust methodology on your own.

Guys can you give a list of recommended tools to learn well when aiming for OSCP? I'm reading "Learn Ethical Hacking From Scratch Your Stepping Stone To Penetration Testing 2018" but since it's not geared to OSCP, tooling is all over the place.
What would you recommend?

it's definetely nmap, metasploit, - what else?

the forward/back pointers are messing you up or what?

>google
>python/ability to read and modify code when required
>msfvenom
>powershell

I cannot overstate how important it is for you to get good at powershell. Can’t do much windows enum without being able to use PS.

understood about powershell. Any other tips you could give for someone starting out?

Also, though it may be kind of scope, would you mind sharing your methodology?

There are thousands who passed and wrote about it (albeit in a humble-bragging way) in their blog. Look for these, they're a dime a dozen

I find hackthebox challenges a good learning resource, but you need to find the boxes rated as realistic and not the ctf boxes.
It will help you familiarize yourself with tooling at your own pace, try to complete them without meterpreter session handling etc like you would for oscp

thanks for the tips guys. Since the scope of the exam is quite large and foreign to me, I find myself looking for some `secret way` to learn effectively, but thats mostly BS and I understand. Read > lab the newly learned methods > repeat is the way to go

>Hey anons, I'm new to /cyb/,
Welcome aboard!
>what is the general consensus on lainposting?
Lain is as close to a patron saint of Cyb as you can come..

I think the 'secret way to learn' is enjoying learning and being passionate about wanting to improve. Just learn at your own pace and read/watch/practice as many different foothold and privesc techniques as you can.

The others who try and cheat with walkthroughs will find themselves found out as frauds real quick in industry when they are expected to use their skills.

Yes, there is something called voice fingerprinting. Your problem does not end there, for even if you write the text and then use a synthetic voice you are still vulnerable to stylometric analysis.

>stylometric analysis.
Just put your words through google translate a few times to get a few strange passages and wrong words thrown in there

Push your script through an uwu translator and read it aloud in the faggiest voice you can muster

some actual advice
buy this
amazon.com/ROLAND-VT-3-Vocal-effect-processors/dp/B00J61Y4TM
its a lot of fun

The gf wants to call our son Lain

>server 2019 in exams and some fucking windows 2000 boxes in the lab

It doesn't matter, you fucking brainlet. OSCP is all about methodology, not what exploits you've memorised.

Attached: 1561678804064.gif (320x240, 2.87M)

You can pre-pend public keys in your authorized_keys file with parameters and settings to further secure your environment, like only allowing your private key to be used from a trusted source IP, or 'restrict' to force prevent things like port forwarding, X11 forwarding, pty allocation and more! Or you can specify a series of commands to run and then kill the session.
Learned something? Share something!

Attached: neat.png (496x483, 343K)

Does she know Lain was a girl? Or is she planning "gender reassignment"?

Attached: major_motoko_kusanagi_cosplay_by_elenasamko_db5zdu6-fullview.jpg (900x1358, 162K)

what is pre-pend

le bump

The opposite of append.

/cyb/, I must admit that I'm pretty fucking thankful for the fact that I live in a third world corrupt shithole, where the internet is still pretty much the wild west it was in the days of old, where nobody cares what you do and the government doesn't give two shits if you torrent movies or stream cheese pizza. I've always viewed it as a bad thing and dreamed about going to the Land of the Free, where the chicks are hot and the life is high, but now I realize how cucked you actually are. Thank you /cyb/ for making me a little less miserable about not being as "lucky" as to be born in the first world.
/blog

Attached: MV5BYzMyYmY5OWItNWI3ZS00ZWZlLWIxYzYtYjNlZDYwM2ZjZDcwXkEyXkFqcGdeQXVyMzMzMTExNzI@._V1_SY1000_CR0,0,70 (707x1000, 88K)

is that a movie, seems cool how is it

now to my question. i am from a borderline third world country, very interested in infosex(hehe get it). is there any remote work available or should i just be a webdev for remote work. i am not looking for a lot of money i would be very content with say 25k usd/year. btw i am second year of college i ve time to prepare

It's a B-movie from Uganda. My friends and I watch these sometimes when we're drunk (we're slavs btw). I've the poster saved because I though it looked cool.

I'm also 2nd year in college and did a lot of webdev shit this year. The amount of money you reel is proportional to the amount of work you put in, obviously. If you got the time go for it, but don't put it at a higher priority than your studies, as webdev isn't exactly the most marketable skill, surely not worth as much as a college degree.

what methodology? using the same powershell and bash tricks over and over? do sysvol or ntds.dit change?

are you south slavic
ako jesi da pozdravim brata
where do you find your gigs
thanks for answering me brate

I have a quick question about AES.
When the round keys are being generated, the current word Wi is set to Wi-n XOR'd with SubWord(RotWord(Wi-1)) XOR'd with the round constant corresponding to i/N; when i > N and (i mod N) = 0.
These RotWord and SubWord functions respectively rotate the given word left one byte and replace the bytes of the word with their S-box entries.

My question is, do these operations affect the global state of the keys, i.e does Wi-1 actually get altered? Or do they just use temporary arguments? I guess another way of wording it is if they're pass-by-value or by reference.

>where do you find your gigs
unironically, stackoverflov and reddit. other similar social media sites should work too. people make posts when they're looking for a coder. say you're an up-and-coming developer, or that you're doing it as an honorary job and you should get some gigs. i'm not sure if the money would be enough for you (for i didn't even keep track of my income, i just did it because i was bored with college, also i've never had money issues, spending a bit less than 200 eur per month including bills and rent, with the average paycheck here being 300)

also yes, i'm from the balkans

what's the thread challenge?

thanks any subreddits and where exactly on stackoverflow
this is now a /balk/ thread

also yes more than enough money

Find the Scavenger Hunt table in the contest area Friday morning.

Here it is:

Attached: CyberGoths.jpg (1600x1262, 293K)

cheating is an exploit, faggot

GSEC. Then I'm planning on going for GCIH and GCIA and then GSE

It's so fucking big its hard to know what to focus on.

Noted, it's gonna be a late night tonight (my flight gets in at 7pm and I've got employer "parties" until 1am), but what time should I try to be there?

Also, anything in particular I'm supposed to be keeping an eye out for?

idk if anyone cares about the ftp anymore but laptophackingcoffee.org/doku.php?id=wiki:resources has a good list of resources and Malware Unicorn should probably redirect to github.com/zigzig122468/securedorg.github.io current link doesnt work

=== /sec/ News:
You would have thought dating apps would take privacy seriously, some more tan other? Nope.
>Gay dating apps still leaking location data
bbc.com/news/technology-49265245
>Some of the most popular gay dating apps, including Grindr, Romeo and Recon, have been exposing the exact location of their users.
>In a demonstration for BBC News, cyber-security researchers were able to generate a map of users across London, revealing their precise locations.

How many will be blackmailed over this?

oh man i hope some politicians and celebrities get burned xD

Does anyone in these threads actually work in information security? Just curious for a headcount.

vice.com/en_us/article/3kxzk9/exclusive-critical-us-election-systems-have-been-left-exposed-online-despite-official-denials

Does anyone doubt that this is being done on purpose by local election boards to let hackers meddle? I know we joke about how stupid some of the network admins are, but this is outright criminal. In Georgia, they are dragging their feet, not subpoena'ing hard drive images for election systems, probably because they know what forensics will show.

i secure hot dogs and burgers and know some things about them so yes

Attached: definintely not a jew .jpg (1080x1152, 126K)

I'm inclined to believe it's more about inertia ("We could work on getting more secure machines....but that would mean another 4 years of vendor proposals, reviews, bidding, meetings etc.") with a healthy double-scoop of quiet corruption than out of some nefarious "We must make sure the Correct Candidate wins City Councilman Seat 4 in Lower Bumfuck!" plotting. That said, it would not entirely surprise me if "improvable" election results were considered less of an issue than they should be.

this is Europes version of juggalos. hahaha look how fucking ridiculous they look.

What are some other conventions besides DEFCON?

also, how do I get IT experience while I'm still in college?

Yes. I work for a global cybersecurity consulting firm.

That's a meme cert. Might as well go for GCIH or GPEN if you're employer is willing to pay and you're planning to take anyway.

Yep, I started out in this field though I wanted to be in dev once. Glad I stuck to this in the end.