/hmg/ Hackerman General

WTB OSCP videos

n /hmg/ we discuss pentesting, ctfs, exploits, and general being a hackerman.

Resources:

VM/CTFs:
overthewire.org/wargames/bandit/
>easy beginner bullshit

vulnhub.com/
>prebroken images to work on.

hackthebox.eu/
>super secret club

Tools:
kali.org/
>meme dragon distro but it just werks

metasploit.com/
>scriptkiddie starting point and swiss army knife

Tutorials/Guides:
abatchy.com/2017/03/how-to-prepare-for-pwkoscp-noob
>From zero to OSCP-hero rough outline

youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA
>IppSec, video guides for retired HTB VMs.

Certs:
eccouncil.org/programs/certified-ethical-hacker-ceh/
>CEH, only looks good a resume to non-technical in HR

offensive-security.com/information-security-certifications/oscp-offensive-security-certified-professional/
>OSCP, the big dick swinging exam, 24 hours to own 5 machines and a further 24 hours to write up a report detailing your methods.

Other urls found in this thread:

github.com/spacehuhn/wifi_ducky
0x00sec.org/t/shared-thoughts-after-6-years-in-pentesting/2492
nostarch.com/idapro2.htm
software.intel.com/sites/default/files/managed/39/c5/325462-sdm-vol-1-2abcd-3abcd.pdf
s000.tinyupload.com/download.php?file_id=09447120265968076057&t=0944712026596807605755485
ibm.com/developerworks/community/files/form/anonymous/api/library/635ec0e2-2989-4663-82d2-3488f9d16dd8/document/09d6ec5f-ff2f-4901-8d44-05d10e848bc5/media
twitter.com/AnonBabble

>WTB OSCP videos
This times a million.

What if there's a Bandit Level 26 → Level 27 but it's hidden or something?

Certs are for skid retards anyone doing vr will laugh at you if you talk about them

Researcher here. Largely had quite the opposite experience. People with OSCP and comparable certs typically have a decent knowledge baseline that we can estimate.
Anyone else just doesn't get hired. No time to laugh at people for trying to better themselves professionally.

the bandit series isnt difficult enough to do that. id say thatd be some black sun type shit

also this

yall could like i dunno

fucking pay for the course?

Not ready for that yet, will be paying for it eventually

i'm taking it this summer if i don't get the internship i'm aiming at

I will eventually. The trouble is that I don't have the time to pay that much money for so little lab access time. But I still want to learn their stuff.

>I don't have the time to pay that much money for so little lab access time
>I don't have the time to pay that much money
>don't have the time to pay that much money

Sorry, I'll clarify for you. I don't have enough time to dedicate within a 30-day period to justify spending 800 bucks right now. Better?

>Better?
much.

but not a single person who has acheived oscp whose put writeups up has ever said a month is anywhere close to enough lab time

not him, if i take it i plan on spending 3 months. i estimate my iq's near 145 so i might risk 1 month

>i estimate my iq's near 145
r9gay pls go

No

I feel like my best option is to wait until I'm between jobs, save up money to live on for a good while, then study all day every day.

i'm not pulling that number out of my ass, i got 3 standard deviations above average on the GRE's verbal section and 2 on the math. i figure grad school applicants are generally ~115 IQ so that'd make my IQ be between 145 and 160 depending on math vs verbal

And I've got a 12 inch cock that ejaculates 100 dollar bills.

why would i lie? where do you expect socially awkward max-int people to post except the chons

No idea we're on the chons you tell me.

runt

Go away and study

...

Noice

Fuck I love that image

>I feel like my best option is to wait until I'm between jobs, save up money to live on for a good while, then study all day every day
god man i have the same thought. its kinda lame that while currently working i cant dedicate the time required to work on my future..

Who CySA+ here?


I know its a meme but companies like it.

how is this different than the /cyb/ + /sec/ thread?

>how is this different than the /cyb/ + /sec/ thread?

>In /hmg/ we discuss pentesting, ctfs, exploits, and general being a hackerman.

isn't that exactly what the other general is used for as well?

>Get CySA+ in September (Still have card that says CSA+, I'm a cool kid)
>Put it on resumes and talk to employers at job fairs about it
>Nobody knew what CSA+ was

Where are you at where people actually know?

How does a person get an entry level position if you have no experience with infosec at all? I'm a writer right now looking to transition.

Is it best to contribute to opensource projects, get the OSCP and start putting out my resume?

>isn't that exactly what the other general is used for as well?
this is a thread for pentesting, CTFs and being a hackerman.

the other thread is a cyberpunk and cyber security thread.

other than they both use computers, they arent even slightly related as threads.

all of that falls under cyber security, this is just an even more specific general that should be a post in the other thread

>all of that falls under cyber security
and the keyboard is part of the computer, yet pcbg and mkg both exist. fuck off you annoying cunt.

I see your point but very few (if any) people on Sup Forums actually have the knowledge to post in this thread enough to warrant it. Why not just merge with the more general general, which gets some attention?

not really.

99% of the other thread is wanking off.

people here are actually doing CTFs and working on CERTs.

I asked in /sec/ about advice on taking my CISSP and got told to do CTFs.... (CISSP is a fucking management exam....)

because that general is dogshit. i dont want more attention, i dont want a more general thread. i want a niche thread for people who know. i dont give a fuck if its over most peoples head, i dont want to see a hundred times a day "DURR BOTNET" "HURR 14 EYEZ" "WHAT IS MOST CYBERPUNK PHONE?????!!" "HOW TO BEGIN IN SEC WITHOUT READING ANY OF THE RESOURCES PEOPLE HAVE SPPONFED ME????"

i dunno if youve ever spent any time in there, but i migrated away from it. its death in january was the best thing its produced since they scared away maderas and the three other poeple who know something about sec.

Stopped by my local microcenter to pick up some shit, and decided to pick up a uno. My leonardo seems to be shitting out on me.

Anyways
>working on project involving Radio Frequency
>Grabbed some transceivers off of ebay
>Transceiver supports 315Mhz
>Made quick jammer
>actually works
>couldn't lock/unlock my car
>2009 automobile.

Only did testing today, no code writing, lazy Wednesday for me.

nice work. i too have a shitty knock off aurdino clone, and im gonna try make something like a rubber ducky

With hak5 using Teensy board, in reality all you actually need is arduino with ATmega32u4

Wifi ducky might be something you can try
>github.com/spacehuhn/wifi_ducky

any arduino**

interesting, I wasn't aware the other general was so bad. how long has this one been around? i haven't seen it before. hopefully it takes off.

>I wasn't aware the other general was so bad
its bad enough it made the author of this piece, which was retweeted by the fucking grugq to disappear from us.

0x00sec.org/t/shared-thoughts-after-6-years-in-pentesting/2492

>how long has this one been around?
about a week, maybe two or so.

>hopefully it takes off.
ill force it to. ive made about 7 or 8 threads of it now. every day there isnt one ill make a new one because i love the chat.

Cissp is useless

You work for a shit contractor go apply to azimuth or tob and see where those certs take you

Keep it up user. Junior majoring in IT here and I'm fascinated by all this stuff. Although I'm still scrub-level, I'm reading all you're feeding as much as possible. Thanks for the info.

>Cissp is useless for my chosen field
Stop being so broad. Sec is more than vr.

CISSP is good proof you know the lay of the land and get the "big picture" of how security fits into the overall workflow of the business.

CISSP is also still a big name and opens a lot of doors for you just by nature of having it.

Understanding the point of the material helps you actually get meaningful changes made toward's your Company's practices. Without it in a lot of companies Security is just the boy who cried wolf until the company gets Equifax'd.

wrong bitch anything that isn't vr is """"security""""

not him but you mean VR as in virtual reality?

vuln research

Lmao you're a bug hunter. You're QA. If you arent a pen tester why come in here? This isn't a sec thread, it's a pentesting thread.

finding 0day is literally the only real security field sorry your cissp didn't teach you any technical skills

Lmao you're a bug hunter. You're QA. If you arent a pen tester why come in here? This isn't a sec thread, it's a pentesting thread.

>runs metasploit
>IMMA HACKUH NOW GUYS :DD
get a real job

>me get cissp from devry now me REAL hacker u goin 2 defcon??

not all pentesters have to be skid losers, try working for a real firm like ioactive or mwr or isecpartners

running nmap isn't a real job and requires no technical skill

its a real job if im employed and someone is paying me to do it.

i dunno what it is thats got you so salty, but shit dude thanks for bumping my thread :^)

have some pride in your work running tools other people made is pathetic

No it isn't.

Being able to turn the results you've found into a coherent report you can deliver to your client so they can avoid getting pwned by a skiddie is though.

But keep on living in your mother's basement "searching for 0 days" in loli games to sell the Russian Mafia for GBP.

shit dude i didnt realise you did your work on a machine you soldered together yourself and wrote an os in machine code for it. must be a pain in the arse not being able to use gcc since someone else wrote it :)

>implying i even work on a computer
you're an absolute brainlet aren't you, lmfao if u aren't popping boxes by using hardware repeaters you made urself idk what to tell you

>if u aren't popping boxes by using hardware repeaters you made urself idk what to tell yo
i bet you dont even generate your own fucking electricity you absolute amateur.

r8 my collectiion plz

feed me moar

sysadmin -----> pentesting/sec consulting.
should I make the jump to malware/exploitation research and development?
talked to some guys that claim they make mucho bucks (200k+) at AV companies, doing malware research and such......

tyty

>r8 my collectiion plz
fuck you

how many have you read?

It's less of a meme than CEH

>using electricity
what year do u think this is??
>mitnick
delete everything u've downloaded and start over retard

>>using electricity
2cyber5me

Fuck I've been bested boys

But for real vulnerable man, whats some good books to get into? I'd like to develop cheats for a few games that give me the shits and maybe a bug bounty every now and then

nostarch.com/idapro2.htm
software.intel.com/sites/default/files/managed/39/c5/325462-sdm-vol-1-2abcd-3abcd.pdf

All minus malware related.
lol why u mad? got it earlier on in the career and social engineering has generally helped me more than conventional techniques. weakest link n all

P.S. 5 years background in InfoSec

Certs

CompTIA - Network+; Security+; Linux+
Cisco - CCENT; CCNA:Routing and Switching; CCNA:Security; CCNP:Security
Juniper - JNCIA:Junos; JNCIS:SEC
Others - ISACA-CISA; RHCSA; RHCE; SANS-GSEC; EC Council-CEH

Yeah got CEH instead of OSCP cauz gubiment contracts and gubiment don't know shit and wants CEH.

wow nice certs too bad they mean nothing
maybe you'll be a sharepoint admin

Can I spoof spi with a raspberry pi for physical access exploits? Like key injection?

What's the best config for pwning? Got a couple 0 W's laying around w/ displays

had to get them cauz high school dropout and went into millitary. meh I spent no money on them and they helped me out early in the career.

definitely wouldn't tell anyone to go on a convoluted path like I did but had little prospects so had to make the best of a situation

hahahaha funny you mention sharepoint. did a bit of citrix admin, but wasn't my cup of tea

I dig it I dig it

Ty

Actually yeah you can

anyone?

>anyone doing vr will laugh at you if you talk about them
You're putting the cart before the horse. Of course someone in research won't talk about certs; they don't need to break into the industry, because they are already in it. Why would they talk about things to help them get a job when they have one?

>All minus malware related
And what areas do you feel weak in after digesting all those books?

I think I mainly lack in the hardware/deeper technical networking side. My GSEC helped a LOT but I didn't get too much of a deep or technical knowledge from my certs not having a degree and all.
The certs and my roles have taught me how to use tools but that's it, I don't know about how and why they work. just werks meme


As I said, I'm considering making a switch over to exploit development and research so I'm going through the Reverse Engineering and Malware books I have and a few other basic books like OS Concepts.

but anything that can even help me, even if its furthering netsec/infosec knowledge and not necessarily malware/exploit stuff would be great.

>mfw interning for one of those firms this summer

If you really had a 145-160 IQ you’d realize how stupid you sound right now.

>I think I mainly lack in the hardware/deeper technical networking side.
Do you have a more specific topic? Im more than happy to recommend books but I find it interesting you've gone through so many and don't know how your tools work, since a few of the ones in your arsenal are coding and RE.

s000.tinyupload.com/download.php?file_id=09447120265968076057&t=0944712026596807605755485


PWK PDF, not quite the OSCP videos but it's all I can give

Hackerman reporting 🧐

You a good dude

What did you do today to prove your status as a hackerman?

ibm.com/developerworks/community/files/form/anonymous/api/library/635ec0e2-2989-4663-82d2-3488f9d16dd8/document/09d6ec5f-ff2f-4901-8d44-05d10e848bc5/media

IBM has provided a copy of web app hackers handbook. Thanks IBM!

Just for you, here are the PWK/OSCP videos

magnet:?xt=urn:btih:f91feb6d2ea93f1c3c03b6be52051c2df72da1b7&dn=CERTCOLLECTION+-+BASELINE+-+SANS+%26+Offensive-Security&tr=udp%3A//tracker.coppersurfer.tk%3A6969&tr=udp%3A//tracker.zer0day.to%3A1337&tr=udp%3A//public.popcorn-tracker.org%3A6969&tr=udp%3A//tracker.leechers-paradise.org%3A6969&tr=udp%3A//explodie.org%3A6969

Better collate this shit into a pasta for next thread

i'm gonna download and seed this shit

It's called vulnerability, not "vuln".
>le kool abbreviation
>do I fit in yet?

YAAAAS

Sweet. Thank you.

i don't mention that in public because i know people would think it's douchey but it's relevant because IQ improves learning rate, and i may be able to get away with only paying for a month. doesn't really matter whether you think it sounds stupid

Did you even study?

it is possible to show the entire profil ( with posts & likes ) of a facebook profil who blocked you ?
Without Hacking - i know stalkscan, but didn't work for the all posts

homosexual detected

Does anyone know if there is much of a difference between these older videos and videos regarding new versions of Kali?