[ cyb / tech / λ / layer ] [ zzz / drg / lit / diy / art ] [ w / rpg / r ] [ q ] [ / ] [ popular / ???? / rules / radio / $$ / news ] [ volafile / uboa / sushi / LainTV / lewd ]

cyb - cyberpunk

“There will come a time when it isn't "They're spying on me through my phone", anymore. Eventually, it will be, "My phone is spying on me.””
Name
Email
Subject
Comment
File
Password (For file deletion.)
BUY LAINCHAN STICKERS HERE

STREAM » LainTV « STREAM
[Return][Go to bottom]

File: 1435223004517.jpg (181.57 KB, 1280x720, HackingGeneral.jpg) ImgOps Exif iqdb

 No.12423[Last 50 Posts]

Thread theme: https://www.youtube.com/watch?v=c6tQzMhqhLc

>College Course General howto https://www.cs.fsu.edu/~redwood/OffensiveComputerSecurity/lectures.html
books needed for course Web application handbook and Hacking the art of exploitation

>hacking bootcamp mostly web appication: https://pentesterlab.com/

>Free online courses: http://www.cybrary.it

>Wargames
hack.me
https://exploit-exercises.com/
https://www.vulnhub.com/

for reversing, we have a thread for that already!
>>

 No.12432

>Free online courses: HTTP://WWW.CYBRARY.IT
Found a torrent of the videos in kat.cr, here's the magnet.
magnet:?xt=urn:btih:2B7B15B62698BAC811819FE2DD74EB04029785FE&dn=cybrary+penetration+testing+and+ethical+hacking&tr=udp%3A%2F%2Fopen.demonii.com%3A1337%2Fannounce

>>

 No.12476

i am presently watching the fsu lecture series.

do you know where to find the homework associated with it or can it be gathered from the lectures themselves?

>>

 No.12493

best way for a complete beginner to learn tcp/ip?

>>

 No.12494

>>12493
Play around with Wireshark, try understanding how different network applications work.

>>

 No.12497

>>12493
lots of ways
i recommend if you like watching videos cybrary has a good networking and ccna course and download packettracer and play around with that

or like >>12494 said, you can play on packet tracer, but i would start by googling the layer 7 tcp/ip and study how they work together and what protocols work on what layers

>>

 No.12506

>>12493
I learned a whole bunch about UDP and DNS by writing a malicious DNS server to attack a vulnerable "host" tool. It passed the results straight to printf, meaning you could use %p and that to do a format string exploit.

I wrote a server that responded to all queries with an MX record for a bunch of %p's and some shellcode my resident shellcoder wrote. Picked through many DNS packets in Wireshark to get that one right. I could probably rattle off the structure of an MX response from memory by now,

Point I'm trying to make is, learning by doing is pretty effective method for me. Might be for you too.

>>

 No.12507

This is the cyberpunk board I need. Thanks folks

>>

 No.12540

File: 1435603519719.pdf (13.52 MB, The Web Application Hacker….pdf)

The Web Application Hacker's Handbook is an amazing resource for webapp security. I recommend buying a physical copy as well.

>>

 No.12673

File: 1435911503769.pdf (8.5 MB, Python Hacking Essentials ….pdf)

Anyone read this? I just downloaded it and from the first glance it looks neat.

>>

 No.12676

File: 1435932547475.pdf (20.02 MB, Web Penetration Testing wi….pdf)

>>12673
thanks, here i'll bump with more web app,

also, lainons with better skill, please help us who are not as skilled as you!

>>

 No.12679

>>12676
This site is p neat for this subject
http://www.ebooks-share.net/search/hacking
I haven't made an account, so I just torrent the .pdfs that pique my interest

>>

 No.12683

>From 0x90 to 0x4c454554, a journey into exploitation.
http://pastebin.com/3Qtw6JQw

>Hacking the Art of Exploitation 2e
https://leaksource.files.wordpress.com/2014/08/hacking-the-art-of-exploitation.pdf

>Black Hat Python
https://archive.org/stream/pdfy-rJnW-pPgiHK61dok/Black%20Hat%20Python,%20Python%20Programming%20for%20Hackers_djvu.txt


and remember lainons, have fun with it!

>>

 No.12787

If I wanted to specifically learn how to access networks/information without being detected, what should I study? Network Security? What else?

>>

 No.12789

>>12787
>If I wanted to specifically learn how to access networks/information without being detected, what should I study? Network Security? What else?
Just learn to program well.

>>

 No.12794

File: 1436241323179.jpg (166.22 KB, 583x736, 1390783187500.jpg) ImgOps Exif iqdb

>>12787
learn both windows and linux internals

you should also know basic ccna and routing ( networking 201)

learn how to use a rootkit and use it well, ( this is the think that keeps your back doors hidden)

and learn about logging and how system logs and how to remove them

if it's just "sniffing off the wire", google popular sniffers and learn how to use them. bonus points if you lookup sslstrip

>protip, most admins can't read logs well so if you can modify them well, your in good shape

>>

 No.12802

Thread theme should be this instead:
https://www.youtube.com/watch?v=-Fz85FE0KtQ

>>

 No.12827

File: 1436310070958.pdf (4.86 MB, metaspoloit toolkit.PDF)

Metasploit toolkit

>>

 No.13013

web pen-testing workshop: https://www.youtube.com/watch?v=rNkR1Joz4eU

>>

 No.13100

powerful thread. thank you

>>

 No.13268

archive of the old general
http://lainchan-hacking-general-1.neocities.org/cyb/res/1372.html

>>

 No.13435

File: 1437885244575.png (608.82 KB, 1280x720, SteinsGame.png) ImgOps iqdb

Hey, i was thinking about building vuln machines, Then exporting them here for you to use in a hyper visor to hack!

Would anyone be interested?
If so, what would you like to see?
>themes
>exploit types

Would anyone like this idea?

>>

 No.13444

>>13435
You mean giving us machines to practice hacking on? If so, that would be amazing.

>>

 No.13446

>>13444
That would be the idea!

>>

 No.13448

>>13435
Yeah, that would be best proof of superiority of our community.

>>

 No.13449

File: 1437920906802.jpg (21.51 KB, 640x350, gits-sac_batou032.jpg) ImgOps Exif iqdb

>>13448
Lainchan is becoming the best chan ever.

>>

 No.13462

>>13435
That would be amazing. We could then have some competitions too

>>

 No.13468

File: 1437943424938.jpg (73.16 KB, 498x576, consider.jpg) ImgOps Exif iqdb

I'm >>13435
it would be a virtual hard drive you would import into your vm software

>>13462
The thing about CFT games is the fact that A. You would need a vpn or set up a vpn on your own network and B. the server level equipment or the pricetag of serious equipment

>>

 No.13471

>>13435
>themes
It doesn't matter what you pick as long as you put interesting material inside for who ever can manage to break in.

Since you have a weeb image, here's a weeb idea.

The Future Gadgets Lab web server. The server could have backups of Daru's VN save files, high res pictures of the LHC, cropped pictures of him to hide his fat, emails between him and girls, bookmarks, history, and so on. The vulnerabilities could just be something picked off of the OWASP top ten list. Final goal is to get on Mr. Braun's computer.

Yeah, it's a lot of work and I don't expect anyone to do something like this for free, but hey, ideas!

>>

 No.13472

I already had a idea for the first one but i will take your recommendation into consideration!

>>

 No.13473

File: 1437949221604.gif (66.87 KB, 600x400, holo2.gif) ImgOps iqdb

>>13468
Why would they need anything better than a cheapo web server?

>>

 No.13474

>>13473
simply because the fact that hacking someones cheapo server (if hosted by someone else) isn't just hacking that person but also the person hosting them...which is illegal.

one could argue that we could use are own computers and use port forwarding,

>>

 No.13475

>>13474
>simply because the fact that hacking someones cheapo server (if hosted by someone else) isn't just hacking that person but also the person hosting them...which is illegal.
Can I get some proof of this?

>>

 No.13476

>>13475
it, like a lot of internet laws, is a grey area depending on who you ask.

>>

 No.13477

Many people don't find use for their Raspberry Pis, so if somebody have one he can "donate" it to our community as a target. More experienced hacker can just have control over them and adjust their security to different levels of hacking know-hows.
Unfortunately, I am poorfag so I can not afford one now, but in few weeks I will move from my 7 years old machine to ThinkPad. I will think about my desktop as training server for lainons.
Maybe it's just silly idea, good thing I am anonym.

>>

 No.13478

File: 1437959351128.gif (646.94 KB, 320x240, trippykaka.gif) ImgOps iqdb

Speaking of hosting a CTF, if you guys want something completely different you can create a server for this

http://www.pwnadventure.com/

>>

 No.13479

>>13475
Nice share!

>>

 No.13502

File: 1438119298139.png (195.83 KB, 512x512, 1424200734779-0.png) ImgOps iqdb

I really want to pursue a career in cyber security but I often feel like I lack some very basic vocabulary or skill set that would really set me on this path.

Seriously, help me unfuarrrk my life. Where should I go?

>>

 No.13503

>>13502
Depends,
you can go the route of certs
>A+
>Net+
>Sec+

or you can get a cyber operations degree from a 4 year college (assuming your in the usa)

https://www.nsa.gov/ia/academic_outreach/nat_cae/institutions.shtml

One good way i find a lot of people doing now is they start in Network admin then switch over to Cyber Sec.

Hope i helped you!

>>

 No.13504

File: 1438120956082.jpg (71.59 KB, 720x720, 1424201236709-2.jpg) ImgOps Exif iqdb

>>13503
Yes! Plus, looking over this thread a bit more thoroughly, I see there's actually loads of useful information here. I need to be less of a crybaby. Thank you!

>>

 No.13548

>>13502
No need to fret, Cybernon. Jargin is attained through immersion. The more involved you become in the subject, the more vernacular you attain.

>>

 No.13571

File: 1438377117154.jpg (123.29 KB, 643x580, 0jthE.jpg) ImgOps Exif iqdb

Hacking huh? Sounds pretty edgy. Any of you glitterboys actually have any good stories to tell? Aside from the romance of "le anon-a-moose" I imagine that most exploits end up being the downloading of files that were behind pay walls and the occasional defacing of a web page.

For stories, I would like to know how others were caught in the past and best practices for how not to get v&.

>>

 No.13574

>>13571
NSA pls

>>

 No.13575

https://soylentnews.org/article.pl?sid=15/07/31/1246229

related.

>>

 No.13576

>>13571
Is the physical stealing of hdd and planting of these considered hacking?

>>

 No.13637

Do I need to learn programming first to start becoming a 1337 hacker, or can I pick things up as I go?

>>

 No.13659

>>13637
yes

the easiest thing you could do is look for sql injections which only requires you to know what a string is an a tiny bit of sql, but for advanced variants of SQL injections it will become relevant how the server-side code (php, ruby, ..) escapes url parameters (makes them safe to pass them to the WhateverSQL database)

looking for basic cross site scripting attacks is also pretty easy but requires knowledge of how browsers work, so javascript and html is a must

if you don't enjoy programming you will never have the patience to work in computer security anway..

>>

 No.13660

File: 1438557404979.jpg (34.05 KB, 489x479, 1400888422504.jpg) ImgOps Exif iqdb

>>13637
yes and no, with modern tools out you can break into most secure places without needing programming, however you will be very limited on what you can do, and it will make it MUCH harder in the long run,

basically learn it, it will make life much easier for you!

>>

 No.13778

hey im >>13435 Just wanted to let you know that I haven't had much time to work on it, i've been with family and friends for the past few weeks so i didn't get a chance to work on it, im starting back up now!

>>

 No.13780

>>13778
take your time anon

>>

 No.13783

>>13435
/cyb/ theme plz.

>>

 No.13850

>>13637
"hackers" who don't know how to program are referred to as script kiddies.

>>

 No.13854

Does anyone have any books or anything phishing related? My waifu is curious about creating a facebook mock up.

>>

 No.13864

>>13854
Look up S.E.T.

>>

 No.13865

File: 1439314045547.jpg (5.79 KB, 261x148, NYYNNB.jpg) ImgOps Exif iqdb

>>13864
fucking nice anon, thanks

>>

 No.13869

Kali 2.0 is released

>>

 No.13880

kali 2.0 looks like its full of bloatware. I'm sticking with the old kali.

>>

 No.13882

>>13869
>>13880
Either of you used Blackarch?

>>

 No.13887

>>13882
I have not. I would however like an opinion on it from someone that has.

>>

 No.13895

>>13880
Hm, like what? Not defending it, just curious. As someone who used backtrack since 2.0 I thought it went downhill after it dropped the slackware base but I understand that they did that to add features.

>>

 No.13901

>>13880
There's Kali Light.

>>

 No.13908

>>13880
Personally I'd rather install the tools that Kali gives in my own distro than install a bloated one.

>>

 No.13909

At what point is it better to make your own tools vs using existing ones?

>>

 No.13912

>>13909
at the point where the existing tools don't suffice anymore I guess.
or if you think you have a more efficient way of doing things.

>>

 No.13917

Have you lainons heard of the NSA Playset? Their a suite of open source tools being created that mimic the NSA tools that were leaked. Really interesting project with great DIY instructions on building them yourself. They have a couple contributors but if your interested maybe you can also help them out.

http://www.nsaplayset.org/

this is where they communicate https://groups.google.com/forum/#!forum/nsaplayset yeah yeah i know google.

>>

 No.14030

>>13917
porcupine masqurade looks fuarrrking cool as hell, gonna give that one a go.

>>

 No.14142

hey i was wondering if its possible to hack into smart phones like lets say iphone. Could you ssh in the iphone and install some software , or would you have to use some other software to do so.

>>

 No.14143

>>14142
Back when jailbreaking just got started when you jailbreak your idevice it would auto install a ssh service it a default password, Nowadays it's a bit more difficult.

>Mobile hackers handbook.
http://www.droidsec.cn/wp-content/uploads/2015/04/the_mobile_hackers_handbook.pdf

>>

 No.14144

File: 1440187127856.jpg (61.08 KB, 408x408, 1435906956327.jpg) ImgOps Exif iqdb

We need a lainchan hacking irc channel

>>

 No.14154

>>14144

You always could set it up.

>>

 No.14156

>>14154
But we need a good name. That's all that matters, really.

>>

 No.14157

>>14156
>6c61696e?

>>

 No.14158

>>14156
>Protocol7?

>>

 No.14161

>>14156
>thats all that matters.

So the "hacking" part doesnt matter?

>>

 No.14166

>>14156
Cyberia?

>>

 No.14167

>>14156
>>14166
There was recruiting for something similar, #ClubCyberia a while ago. It never really took off because most users were inexperienced and those who were well-versed didn't want to teach.

>>

 No.14168

>>14166
Cyberrhea**

>>

 No.14177

>>14161
lolno

>>

 No.14180

>>12423

Don't know why this hasn't been posted yet but
http://www.opensecuritytraining.info/Training.html

great site chock full of classes and tons of information.
Learned a lot here.
good luck lainons


>>

 No.14245

https://www.coursera.org/course/softwaresec

Just finished the first project of this course which involved exploiting a toy C program with a bunch of memory-based vulnerabilities. The lectures are dry as fuarrrk, but the material seems good so far as a starting point (assuming you already know C and a bit of assembly).

>>

 No.14249

i dumped a few docs on my soykaf, might upload more later

emn.soykaf.org

>>

 No.14250

>>14249
You might want to hide the executables so Google won't flag the site as malware. Put them in a password protected zip or something.

>>

 No.14251

>>13576
>Is the physical stealing of hdd and planting of these considered hacking?
psychically sneaking into places or abusing tech support is just as effective as buying expensive remote exploits on the black market except much easier if you don't get caught

there is people whose job is doing exactly that

>>13503
did you just literally link to the nsa? fuarrrk you man... what if someone accidentally clicks on it? you think that's a good idea? he will get flagged in their DB as "interested in cyber security"

>>13571
> I imagine that most exploits end up being the downloading of files that were behind pay walls and the occasional defacing of a web page.
yes, but if someone did something more he should probably not post it here anyway :P
>best practices for how not to get v&.
*strict opsec
*never talk about it

>>

 No.14263

>>13571
the only hacking i do is on my own network.

>tfw to much of a gitterboy to hack a corp,
>tfw i'll never be /cyb/

>>

 No.14264

File: 1440531103173.jpg (126.42 KB, 632x695, 140617081.3_mn[1].jpg) ImgOps Exif iqdb

>>12683
LOL


>>

 No.14465

>>14264
Odakle se javljas zemljace?

>>

 No.14495

>>13476
>it, like a lot of internet laws, is a grey area depending on who you ask.
Unless you ask, you know, a lawyer about a specific act in a specific jurisdiction.

Asking random anons on the internet about unspecified acts performed by an unspecified party in an unspecified jurisdiction against another unspecified party in another unspecified jurisdiction is not going to get you precise legal answers.

>>

 No.14507

>>13435
vulnhub.com

>>

 No.14524

>>14495
>Unless you ask, you know, a lawyer about a specific act in a specific jurisdiction.

Most hacking laws are based on case law, some people only get a year while someone who did the same crime can get 20 years in solitary.

>see grey hat hacking

>>

 No.14558

>>14524
Whether it's illegal or not has nothing to do with the sentencing. In many cases it's clear-cut, but the letter of the law is often not enforced until it's handy to do so.

By writing wide-ranging laws they can prosecute anyone at any time.

http://www.threefeloniesaday.com/Youtoo/tabid/86/Default.aspx

>>

 No.14574

>>12540
I got a physical copy of this book o: !
Some random dude gave it to me randomly, that's how I got interested in hacking

>>

 No.14885

>tfw want to start and learn but have no technical knowledge

>>

 No.14890

>>14465
338FF8517489E276539E0151F8761CA353ED048D96D7D2899F002B6E33E490701943E26F14D3 -- dodaj me na toxu

>>

 No.14902

>>14885
there is a lot of intro level stuff you just have to read the thread

>>

 No.14934

>>14902
man fucnigga i cant code for shit

i just wanna be like the mr.robot kid
what languages do i need to learn
fuc man i wanna be maximum lock down privsec real hard /cyb/ gangsta soykaf
fuckin dig me outta dis ditch help me out here

>>

 No.14939

>>14934
>i just wanna be like the mr.robot kid
Take an acting lesson. Get a job as an actor in a film about hacking. Then the IT people that work for the studio will create almost plausible hacking scenarios to make you look cool (but only if they're paid enough).

Start with installing Linux or BSD, begin learning C, x86 assembly and maybe ARM. You have to learn how to tell a computer what to do before you can begin hacking. Downloading metasploit won't even get you very far if you don't know how to make a payload or utilize the remote system.

IIRC, on more than one occasion the Mr. Robit skid literally guesses passwords to "hack" people. wow. Much /cyb/, So 1337.

>>

 No.14983

Bumping this so more people can see it just in case it was missed. Thanks to all the contributors!

>>

 No.14986

>>14939
thats real chill

should i start with c, assembly or arm?

I am still in university

>>

 No.14990

>>14934
alright skid, i'm guessing you don't actually want to put any effort into learning how anything actually works, but because lainchan's that fuarrrking awesome i'll throw you a bone, because heaven forbid you clearly you can't use a basic search engine.

What to you want to do?
>Run a botnet (http://searchsecurity.techtarget.com/definition/botnet)
Your gonna want to start with a RAT (remote administration tool) these are the botnet toys that you see in big cybercrime rings in russia and china, and thanks to slave coders in india and california they are simple point and click toys!(mostly tricking people to run malware). In the end, your still a skid for using RATS.

>Zeus
The so far the crimering fav, mostly because the source code got released and it caused billions of spinoff's such as sphinx and gameover.

>SHARK
Pretty good, has a navigation tool and you can also mess with the other person's computer simple and easy to use.

>Dark comet
A Syrian Government favorite as it was used to spy and take down all sorts of Anon skids and protesters and track their every move, has a few gag tools and is great

>poison Ivy
Personally i don't like it but it has been considered the AK-47 of hacking tools

>But lainon, i want to hax da gibsun, and no one is falling for muh malwarz
Alright, malware and social engineering not your strong suit, that cool Elliot (mock a fat nobody) Alderson didn't like talking to people too.

>Kali 2.0
a Debian OS with a bunch of tools and repository full of 1337 tools (basic linux skills required)

>metasploit w/ armitage
considering your skipping kali because you never heard that think called linux yet for some reason everyone is using it but you, and you don't want to feel out of the party, well you are in luck! Metasploit w/ armitage is a simple point and click with automated exploit finder, and you don't have to touch that scary command prompt, because heaven forbid you learn something new or useful.


If you want to know how to hack for real, you need to learn how a computer works, how it talks to other computers on a network, and how to exploit it. If you really want answers, you will find them not ask someone to spoon feed you. The hacker community is great and we help each other learn, however we don't help people who can't even try.

Sorry if they're any typo's it's 2am when i posted this

>>

 No.14992

>>14990
Is 2am for me too
I do want to learn, but all that stuff can be so intimidating

I know some basic stuff, already use a Linux.
I have no idea where to start the real haxxorz coding

>>

 No.14993

>>14934
look ignore the (valid) links and information people present you if you're not willing to learn the basics.
using scripts and programs other people wrote without knowing how they work, to do actual hacking will only land you in prison or fuarrrked by more powerful people.

there is no easy way, there's only an easy into getting fuarrrked yourself.
what do you want to 'hack' anyway?

>>

 No.14994

>>14993
forgive the multiple errors in that reaction

>>

 No.14997

>>14993
I just told you I wanted to learn and not be a skiddie!

>>

 No.15000

>>14997
-learn bash scripting, while learning your linux system (a.k.a. learn to be a sysadmin)
-read a book on networks
-learn a programming language
-learn some assembly (it'll teach you how computers really work) or just learn how computers work.
-pick a target and start learning everything there is to know (see what protocols it uses, what language it uses, how the program works) and then maybe you'll find a new exploit. Try to break it, fiddle around, poke it, come up with things the programmer didn't come up with.

what you'll mostly be doing is this however:
-take the scripts and programs of others and try to learn how they work/what they do and use them to target people with shitty security.
--------
I'm not gonna spoonfeed you specific books because part of the journey is being resourceful and finding stuff on your own. nobody is going to hold your hand.

>>

 No.15001

>>15000
>-take the scripts and programs of others and try to learn how they work/what they do and use them to target people with shitty security.
but don't be an asshole though. respect other people's privacy and etc etc.
the world already has enough shitheads in it.

>>

 No.15003

>>15001
Yeah, Sony is an EvilCorp, and deserve all the pwnage they get. OTOH dumping ashleymadison.com was a dick move by someone who got buttmad after his wife cheated.

>>

 No.15004

>>15000
What language
What book S
Im getting major anxiety right now man I can't i cabby I cabby I can't I can't I can't

>>

 No.15005

>>15004
I put those steps in order (deviate by all means). use a search engine and get going, the other steps will follow automatically.
There are lots of good guides on bash and linux if you just perform a simple search query.

>>

 No.15026

just try to learn as much as possible, firstly about tcp/ip, commands, ports... Read every tech book that you'll find, try to play with sniffers
Be curious how it works

>>

 No.15027

>>15004
If your getting anxiety from an imageboard tutorial, most likely you won't be able too.

we already told you what to do, and yet you seem unable to learn/put in the effort.

if this is your best, you're not going to make it.

>>

 No.15028

>>15027
So I bash it up, then read I DUNNO WHAT BOOK then I learn I dunno what language

You want me to read computers for dummies and learn python
will that make me a whiz kid

>>

 No.15029

>>15028
if you really have no fuarrrkING CLUE, goto www.cybrary.it do the following 3 FIRST
>A+
>Networking+
>Linux+

Next these
>Security+
>Penetration Testing and Ethical hacking
>computer Hacking and forensics
>Python for security professionals

than these
>Advance hacking
>cryptography
>your picks


If you can't do that you can try to do a state sponsored school for /cyb/er security.

If you can't watch video's and take notes YOU ARE BEYOND HELP.

>>

 No.15076

File: 1441827260671.pdf (3.03 MB, Penetration Testing with P….pdf)

>tfw need to look up guides once every couple levels when doing bandit on overthewire
Makes me feel pretty soykaffy, tbh.

>inb4 >Perl

>>

 No.15078

>>15076
same here, just dont lose motivation. Those guides are written to be red.

>>

 No.15079

>>15078
Every time you look at the guide, do two levels without one. It's how I try to play.

>>

 No.15102

Have to take a programming class
should I learn Java, C or C ++?
What's more useful to this kind of stuff?

>>

 No.15105

>>15102
I'd say all of them but I guess Java has more exploits.

>>

 No.15108

>>15105
I'd like to learn them all but in terms of college classes I just don't have the space for it
My major while involving programming doesn't involve it so much that I can learn C and C++ as well

>>

 No.15149

>>15108
What major?

>>

 No.15151

>>15149
geomatics

>>

 No.15172

>>14990
I don't see how being a script kiddy is a bad thing. The people who know how to hack have made it so easy for everyone else to that there is no reason to learn. Not that learning is a bad thing.

>>

 No.15198

File: 1441992334721.jpg (336.94 KB, 988x1510, NoMouth.jpg) ImgOps Exif iqdb

>>15172
People like this are the reason hackerculture is dying.

saying there is no reason to learn will make it so only fewer and fewer people contribute, over time people won't contribute anything at all.

https://www.youtube.com/watch?v=Yo4oP2eyDtI

there was a article i read about most hackers can't even do sqli without tools, which are
a) easy to detect
b) can't get to as far as you think

>>

 No.15214

>>15172
>I don't see how being a script kiddy is a bad thing
It isn't per se, but it isn't an alternative to actually knowing your soykaf.

A skiddie is to a cracker as a bloke that can drive a car is to the engineer that designed it.

Being an engineer isn't a step up from knowing how to drive, it's a completely different thing; and knowing how to drive isn't an alternative to being an engineer.

>>

 No.15215

>>15172
Being too lazy to do a learn how to actually do a thing is detestable

>>

 No.15217

>>15215
This is exactly it. Well said.

>>

 No.15257

For pentest practicing on a vulnerable virtual machine, there is already a solution, called metasploitable. Find The Hacker Playbook 2 and RedTeamFieldManual. They're both amazing books. As far as learning to program vs. being a script kiddie... Look, most professional pen testers can barely hack together a shell script. 90% of vulnerabilities that are published are found by researchers. Most "Professional Hackers" just convert PoCs of published vulns to another language that they can use. It's all a bunch of bullsoykaf elitism. That being said, knowing python, ruby, c++, java, php, and java script are all helpful, and each has it's use in a hackers toolkit. All that being said, you can hack using currently available programs. Just know that IDS's and AV companies also know about/scan for these. Being able to modify them is vital. In order to do that without being able to code, you have to understand HOW they work. (And admittedly at least the syntax of the language) If you really want to stay cutting edge, watch hacker con videos on youtube. Most importantly, this one: https://youtu.be/9XaYdCdwiWU

>>

 No.15445

Metasploit: The Penetration Tester's Guide
Hacking: The Art of Exploitation, 2nd Edition
Black Hat Python: Python Programming for Hackers and Pentesters
Practical Packet Analysis: Using Wireshark to Solve Real-World Network Problems
C Programming: A Modern Approach
How Linux Works
The Practice of Network Security Monitoring: Understanding Incident Detection and Response
Rtfm
Network Flow Analysis
Jumping into C++
Practical Reverse Engineering
Gray Hat Python
Practical Malware Analysis
Violent Python

Rate my reading stack. Prob will take me about a year to get through it all. I currently have a basic familiarity with Linux and know some interpreted languages (I do webdev stuff). Goals are to be able to gain access to consumer computers with an IP, get into Linux servers and gain an understanding of networking, to see what's possible.

>>

 No.15457

>>15445
These are all really good lainon, however don't forget to apply them, that where the real skill comes out.

>>

 No.15461

>>15445
Just as >>15457 said, reading is nothing without applying. Make sure you practice everything you learn and try to apply it in things you do and the code you write.

>>

 No.15678

Are cybrary videos flash? Is there a way to get the A+ videos without registering, or at least without flash?

>>

 No.15689

>>15678
>Are cybrary videos flash?
yes

>Is there a way to get the A+ videos without registering,
no

>, or at least without flash?
no

>>

 No.15690

>>15678
There was a torrent around, check a couple trackers.

>>

 No.15697

>>15690
All I found is this: http://metasearch.torrentproject.com/#!search=cybrary
Guess it's time to download flash.

>>

 No.15698

>>15678
Have you tried using something like youtube-dl? Also, when I go on the site on my android phone it can play them, so try changing your useragent to android.

>>

 No.15699

>>15697
Here's the magnet.

>>

 No.15701

>>15698

Just wanted to get on the record to say

== YOUTUBE-DL ALL THE THINGS ==

There.

>>

 No.15704

>>15698
I did, youtube-dl says it's an unsupported URL. How would I do the useragent thing? I really do need these computer lessons...
>>15699
Transmission says it's corrupt?

>>

 No.15710

alright people
i installed emacs23
now i'm using learn C the hard way
any thing else I should read or do?
don't really have any resources for x86 assembly or ARM down the road

>>

 No.15711

>>15710
First I would suggest that you take a look at this first:
http://savannah.c3sl.ufpr.br//pgubook/ProgrammingGroundUp-1-0-booksize.pdf

It will give a nice introduction to how a computer work and might be sufficient so you can dive in one of these:


http://binary-auditing.com/
http://beginners.re/>>15710

>>

 No.15717

>>15711
I started reading that book a while ago, but got tired when I couldn't test the code in x86-64. Othat than that it's a great book, so do you know a way I could fix it? My problem was specifically with pushl and popl, and .code32 or --32 didn't work.

>>

 No.15718

>>15717 I'm not >>15710 btw.

>>

 No.15719

>>15704
I didn't try the magnet, I copied it from kickass.to.
torrentz.eu is a good search too.

>>

 No.15720

>>15719
Oh, I'm guessing you mean this one: >>12432 and it got a part cut from pasting it as an email.
Thanks, but that torrent only includes the course "Penetration Testing and Ethical Hacking" and I'm looking for the A+ one.

>>

 No.15723

>>15720
That's the one, I didn't know they were different things, sorry.

>>

 No.15726

>>12493
Eat some addys and read TCP/IP Illustrated.

>>

 No.16052

Hey /HG/ You plan to write a tutorial for the zine?

>>

 No.16061

Juicy, easy to follow pwnage of an anti-virus product. Bonus points for clever usage of command line, check it out http://googleprojectzero.blogspot.de/2015/09/kaspersky-mo-unpackers-mo-problems.html?m=1

>>

 No.16090

Does anyone browse null byte?
http://null-byte.wonderhowto.com/

>>

 No.17233

Hey, i'm doing a CTF and my whole network is all web server / app stuff, any advice Lainion's

>>

 No.17248

>>15678
hack it

>>

 No.17253

>>15076
I'm looking to get into overthewire pretty soon. I've been avoiding it because I'm a newb and a bit paranoid about ssh-ing into someone else's server.
I don't even know if a server is capable of exploiting the client but I've been unreasonably nervous about it.

>>

 No.17271

>>17253
Just use a VM. It's perfect for Kali.

>>

 No.17290

>>14990
is poison ivy seriously a windows program? fuarrrking why m8

>>

 No.17460

>>17290
It's a RAT designed for Windows. No soykaf it's a Windows program, why would it not be?

FFS

>>

 No.17469

Checkout wechall.net for wargames. It regroups most other webistes.

>>

 No.17636

File: 1444976468994.pdf (4.7 MB, csapp.pdf)

Seeing as peeps keep mentioning the usefulness of learning the inner working of a computer, here's Computer Systems for a Programmer's Perspective.

Its a good read, enjoy!

>>

 No.17639

anybody save the social engineering thread?

>>

 No.17644

>>17639
Soykaf, no, but I do have some of the books.

Feel free to make a new thread about it!

>>

 No.17649

>>17644
This is why this chan needs a temporary archive like 4chan. It's too easy to not save a thread because posts are so infrequent that you wait and and check (likely forget) periodically to see if there any new posts so you can save it at when it's most content heavy. Too bad that's when it fuarrrking dies.

>>

 No.17981

i made a tiny thing today
http://141.255.164.34/

>>

 No.18498

File: 1446227616928.png (347.45 KB, 1920x1080, l33thax.png) ImgOps iqdb

Am I doing this right?

>>

 No.18701

>>17639

I saved something about hacking at humans from that thread that I tried to post more than once in this thread, is there anything beyond selecting files to place below in the box? That's what I have been doing, but it isn't posting...its my first pdf to post, don't hate, honest mistakes.

>>

 No.18722

>>18701
Could you upload somewhere else and link it here?

>>

 No.18906

>>18722
Its up in volafile, the only pdf in there, since I obviously didn't think to put the name to it as I haven't looked at it myself yet, but its Soc Eng: Art of Human Hacking.

>>

 No.18949

File: 1446984366416.jpg (116.61 KB, 1280x720, 2450.jpg) ImgOps Exif iqdb

>>17981
OS: Unix (Samba 3.6.6)
| Name: WORKGROUP\Unknown
|_ System time: 2015-11-08 12:02:36 UTC-5

Close 135,445 please

>>

 No.19009

i just competed at a local ctf
i got killed because it was mostly full of people who didn't even know basic security

regardless it was lots of fun!

any CTF stories Lain?

>>

 No.19039

>>15198
People calling other people skiddies as a kneejerk response is what's killing the community. The majority of situtuations you'll ifnd yourself in if you ever manage to try to run a personal army op is this: A bunch of ideas guys egging on a few somewhat competent individuals. While all the dissenting opinions are being shot down with "shut up skiddy."

As cyb as you think hacking is, it's a rather boring exercise in patience. 99% of the time you'll either have an automated script fuzzing for low hanging fruit, and the %0.9 is weeding past false positives, while the %0.01 are actual success rates for something that isn't absolutely trivial.

>>

 No.19088

Great read for noobs flew by on HN today https://blog.filippo.io/the-sad-state-of-smtp-encryption/

>>

 No.19100

>People calling other people skiddies as a kneejerk response is what's killing the community.
How? It only gets script kiddies to fuarrrk off. And nobody likes them anyway.

>The majority of situtuations you'll ifnd yourself in if you ever manage to try to run a personal army op is this: A bunch of ideas guys egging on a few somewhat competent individuals. While all the dissenting opinions are being shot down with "shut up skiddy."
Wow, so if I'm a massive script kiddy trying to "run a personal army op" then I can expect to be egged on by other script kiddies and telling people who disagree with me to shutup? How surprising!

>As cyb as you think hacking is, it's a rather boring exercise in patience. 99% of the time you'll either have an automated script fuzzing for low hanging fruit, and the %0.9 is weeding past false positives, while the %0.01 are actual success rates for something that isn't absolutely trivial.
Maybe if your job is auditing things, or if you're a script kiddie and that's all you know how to do.

>>

 No.19106

File: 1447315091001.png (2.86 MB, 1920x1080, lockscreen.png) ImgOps iqdb

>>19039

>As cyb as you think hacking is, it's a rather boring exercise in patience. 99% of the time you'll either have an automated script fuzzing for low hanging fruit, and the %0.9 is weeding past false positives, while the %0.01 are actual success rates for something that isn't absolutely trivial.

If hacking is this boring for you, you need to find a different pastime.

I have lost track of hours sitting balls-deep in assembly, lost in the massive puzzle that is reverse-engineering. There is nothing more stimulating figuring out with exploits work, fine-tuning them, revising shellcode, all in pursuit of that dopamine-soaked moment when you get shell on the box.

Hacking is by far the most rewarding hobby I have. It doesn't sound like anything you described.

>>

 No.19127

Learn
http://www.drpaulcarter.com/pcasm/

>>

 No.19130

>>19106
You sound like someone speaking fiction, that's nothing like hacking in real life.

>lost in the massive puzzle that is reverse-engineering
Reverse engineering is pretty easy, it's not some huge mystical puzzle. And what's

>fine tuning an exploit
You've probably never developed an exploit in your life, what the fuarrrk is "fine tuning"?

>Reversing shellcode
now I think you're just using buzzwords.

I've been in the computer security industry for five years and have been hacking soykaf since I was 12. NONE of it is like you described, unless I'm trying to impress girls at the bar or something.

>>

 No.19134

list of past ctf's with various challenges!
ranging from crypto to offsec, reverse engineering.

>>

 No.19153

>>19130
19106 wrote 'revising shellcode',
not reversing.

>>

 No.19168

>>19106
Assembly is a pretty good language, I read a book on COBOL a while back that was some 1000 pages long. But yeah assembly is something a lot of people need to read over if they want to get familiar with hacking stuff

>>

 No.19172

>>19168
It depends on what type of hacking you're trying to get in to. If you're looking to develop exploits in software and reverse-engineer shit, then yes, you'll need to pick up a book on 80x86 ASM, whatever syntax suits you better.

If you just want to use other people's exploits or publicly known exploits to wreck servers, then you don't need to know any of that. It all depends.

>>

 No.19214

a directory of recordings from various infosec/hacking cons:
https://infocon.org/

>>

 No.19219

>>13435
Wouldn't making an img of a hdd (with windows/anything else vulnerable installed) and uploading it somewhere be easier?
You could run it in a vm, and lots of people have old towers lying around so they could put the img on their own hardware, and do it in sortof hardmode.

Or am I missing some sort of point here?

>>

 No.19224

>>15214
But what where you before you knew your soykaf? I mean, I'm just a 15 year old skiddie, and I'd like to grow above being one, if that's possible.
I'm studying for the CAE linux+ exams (I already knew most of what I saw in the A+ exams), I guess I'm sufficient in PHP, and I sorta know regexp'es and stuff, I've also read clean code, the pragmatic programmer, basic mathematics by serge lang, and some other books on compsci, programming and maths. What would the next step in de-skiddy-ing be?

>>

 No.19323

File: 1447578630435.png (144.01 KB, 469x344, 5013510 _2bd928200fce70514….png) ImgOps iqdb

>>19130
Fine tuning an exploit would be removing any bad characters in your shellcode (0xff and 0x00 come to mind) as well as making it more stable. Sometimes you need to add a jmp instruction to somewhere with more space to work with. Developing an exploit from a vulnerability you found requires fine-tuning. Its the difference between a program crash and actually getting shell on the target.

Reread my post. I didn't say reversing, I said revising, for the same reasons as above. Shellcode can be too large, requiring stub code or an entire rewrite for more elegant approach.

Both exploit fine-tuning and shellcode revising are essential not only for exploit development, but also if you pull down exploits from a public website. Even the public exploit rarely work without some re-working, which requires you to kind of know what you are doing.

In short, exploits don't just happen.There is still a lot to do even after you notice a vulnerability. I don't get why you are so angry. If you don't like it, you should probably stop doing it. The whole process is fun and exciting to me, but maybe it's just a job to you.

Also, if you know a bar where there are girls who are impressed by this kind of stuff, please share the info. That bar sounds awesome.

>>

 No.19325

File: 1447579296327.jpg (112.18 KB, 775x1029, touching.jpg) ImgOps Exif iqdb

>>19323
>Also, if you know a bar where there are girls who are impressed by this kind of stuff, please share the info. That bar sounds awesome.

I second this, I'll be very interested to know where to find decent girls interested in CS and security

>>

 No.19340

>>19323
>If you know a bar where there are girls who are impressed by this kind of stuff
I know plenty of gay bars where people would be interested in this stuff if you're feeling adventurous.

>>

 No.19345

>>19224
Participate in CTFs. Do past CTFs. Read writeups. Read papers, blog posts, practice on hackmes. Read about opsec.

>>

 No.19527

>be me
>12 years old
>"I wanna be a supa 1337 h4x0r!"
>start by learning Objectionable-C
>big mistake
>anyway...
>fast forward a few months
>I've wised up a bit at this point, still don't know soykaf about actual compsec
>mfw I find out about SSH
>feellikeaboss.jpg
>quickly learn it's not invincible
>fast forward some more
>find out about open ports and ssh for phones
>well then
>keep learning
>find more cases of ultimate hax that aren't so great
>untill you learn more about them

Moral of the story is that trying to find the ultimate hack is for plebs. Don't be a skid, learn about computers if you wanna hack them. Also, Objective-C is like kicking dead whales down the beach .

>>

 No.19679

I need help from someone who knows whats going on.
I am starting on Shellcoders Handbook and I am already experiencing difficulties on chapter 2 overflow.c
The idea is that I have to put the adress of call to return_input into adress after function return_input ends.

   0x08048422 <+0>:push   %ebp
   0x08048423 <+1>:mov    %esp,%ebp
   0x08048425 <+3>:and    $0xfffffff8,%esp
   0x08048428 <+6>:call   0x8048404 <return_input>
   0x0804842d <+11>:mov    $0x0,%eax
   0x08048432 <+16>:leave  
   0x08048433 <+17>:ret    


   0x08048404 <+0>:push   %ebp
   0x08048405 <+1>:mov    %esp,%ebp
   0x08048407 <+3>:sub    $0x28,%esp
   0x0804840a <+6>:lea    -0x1e(%ebp),%eax
   0x0804840d <+9>:mov    %eax,(%esp)
   0x08048410 <+12>:call   0x8048310 <gets@plt>
   0x08048415 <+17>:lea    -0x1e(%ebp),%eax
   0x08048418 <+20>:mov    %eax,(%esp)
   0x0804841b <+23>:call   0x8048320 <puts@plt>
   0x08048420 <+28>:leave  
   0x08048421 <+29>:ret

Basically what I need to do is put "\x28\x84\x04\x08" at end of 36 A's as piped input to ./overflow. Whenever I do that I just get segmentation failure and it doesn't return the input twice but just once.
Am I putting too much/little of A's? Am I fuarrrking up something?
I already had to do -fno-stack-pointer to allow me to smash the stack, is there any other flag I need to put up?
Thanks in advance

>>

 No.19680

>>19679
here's the overflow.c

void return_input (void)
{ 
   char array[30]; 

   gets (array); 
   printf("%s\n", array); 
}


main() 
{ 
   return_input(); 

   return 0; 
}

>>

 No.19681

>>19679
>>19680
Okay, yea, I fixed the problem
I was putting too many A's (had to put 34 instead of 36)

>>

 No.19683

>>17233
That's a very vague question anon. What exactly do you need advice on?

>>

 No.19684

http://hacking-lab.com/

>>

 No.19778

If you're going through Shellcoder's handbook and are experiencing problems with Address space layout randomization(different stack pointer address every time) just simply do

sudo /sbin/sysctl -w kernel.randomize_va_space=0


Delete Post [ ]
[ cyb / tech / λ / layer ] [ zzz / drg / lit / diy / art ] [ w / rpg / r ] [ q ] [ / ] [ popular / ???? / rules / radio / $$ / news ] [ volafile / uboa / sushi / LainTV / lewd ]
[ Return / Go to top /