/hmg/ - Hackerman General

In /hmg/ we discuss pentesting, ctfs, exploits, and general being a hackerman.

Resources:

VM/CTFs:
overthewire.org/wargames/bandit/
>easy beginner bullshit

vulnhub.com/
>prebroken images to work on.

hackthebox.eu/
>super secret club

Tools:
kali.org/
>meme dragon distro but it just werks

metasploit.com/
>scriptkiddie starting point and swiss army knife

Tutorials/Guides:
abatchy.com/2017/03/how-to-prepare-for-pwkoscp-noob
s3ctur.wordpress.com/2017/06/19/breaking-into-infosec-a-beginners-curriculum/
>From zero to OSCP-hero rough outline, and how to infosec.

youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA
>IppSec, video guides for retired HTB VMs.

Certs:
eccouncil.org/programs/certified-ethical-hacker-ceh/
>CEH, only looks good a resume to non-technical in HR

offensive-security.com/information-security-certifications/oscp-offensive-security-certified-professional/
>OSCP, the big dick swinging exam, 24 hours to own 5 machines and a further 24 hours to write up a report detailing your methods.

Community:
IRC: #Sup Forumssec @ rizon.net
Discord: discord.gg/3Y7Mr52
Matrix/Riot: riot.im/app/#/group/ hmg:matrix.org

Previous thread:

Other urls found in this thread:

theintercept.com/2018/03/06/leaked-files-show-how-nsa-tracks-other-countries-hackers/
firedrop.com/23f2d9de7281c2afabf9ccb0ddf1eddb
tor.stackexchange.com/questions/16807/why-do-bridges-collapse
youtu.be/nHhf7mGgD8c
npr.org/sections/money/2015/01/09/376164768/episode-596-johnny-mnemonic-s-secret-door
twitter.com/SFWRedditGifs

Current state of /hmg/

> discord
MAXIMUM CRINGE

How deep can Sup Forums fall?

discord was basically designed for larpers, it's a natural fit for this thread

Das rite.
You're free to join us anytime, user!

theintercept.com/2018/03/06/leaked-files-show-how-nsa-tracks-other-countries-hackers/

I wonder who these darkhotel targets are.

>how Russia tracks every move and communication of the NSA script kiddies

So you be sayin, Russia haxx Egnos so they're always 10 step ahead?
Damn, that's like 5th Dimensional Chapayev.

How can Linux be hacked remotely?

Beginner here.
Currently reading Hacking the Art of Exploitation
I'm currently in chapter 3 but some of the code samples dont seem to work, for example:
#include
#include

int main(int argc, char *argv[]) {
int value = 5;
char buffer_one[8], buffer_two[8];
strcpy(buffer_one, "one"); /* Put "one" into buffer_one. */
strcpy(buffer_two, "two"); /* Put "two" into buffer_two. */

printf("[BEFORE] buffer_two is at %p and contains \'%s\'\n", buffer_two, buffer_two);
printf("[BEFORE] buffer_one is at %p and contains \'%s\'\n", buffer_one, buffer_one);
printf("[BEFORE] value is at %p and is %d (0x%08x)\n", &value, value, value);

printf("\n[STRCPY] copying %d bytes into buffer_two\n\n", strlen(argv[1]));
strcpy(buffer_two, argv[1]); /* Copy first argument into buffer_two. */

printf("[AFTER] buffer_two is at %p and contains \'%s\'\n", buffer_two, buffer_two);
printf("[AFTER] buffer_one is at %p and contains \'%s\'\n", buffer_one, buffer_one);
printf("[AFTER] value is at %p and is %d (0x%08x)\n", &value, value, value);
}

When run with 1234567890 as the argument, the last two numbers are suppose to overflow into buffer_one but they dont.
So is this book still relevant?
Or am I just an idiot worrying over nothing and should just understand the overall idea behind it and continue reading?

>Discord
>Matrix/Riot

So this is how a general dies. Send my regards to the cyberpunk/cybersecurity threads that came before. Holy LARPing Christ.

How to remain user now that Tor is compromised? Inb4 VPN meme

Get some good habits, and search for a non backdoored CPU (gl with that), TOR is US Navy so what's the point. Try i2p? Zeronet is a meme too.

Contribute or fuck off. You're still the same salty faggot aren't you? Pathetic really.

>code from a book written in 2003 doesn't work

Concepts are still relevant, check which versions your using.

Who /Department of Energy CDC/ here?

It's the second edition, I'm pretty sure that's the latest edition. I'll continue reading it then.

Not a yank, but I got a question for ya:

The Department of Energy security clearance required to access Top Secret Restricted Data, Formerly Restricted Data, and National Security Information, as well as Secret Restricted Data, is a Q Clearance.

what did they mean by this? what could possibly happen if someone, lets say china/iran/russia finds their way to DoE network infrastructure?

t. illiterate in USA memes.

Use the ubuntu .iso that comes with it, you can download it at nostarch site.

Not him, but I tried DLing the .iso from NoStarch and shit didn't work, no seeders or w/e.

Here's a mirror: firedrop.com/23f2d9de7281c2afabf9ccb0ddf1eddb

been doing CTFs and want to practice writing reports, anyone got any resources or templates for writing reports?

Had enough seeders when i tried few days ago.

>is this book still relevant

Yes. It's all about the concepts. I'm about 3/4 through it. Found the beginning a bit slow but still a really great and informative read.

Oh, good to know then.

The internet is US Navy.

...

I once stole someone's password by secretly filming them and analyzing their hand movements on the keyboard.

Am I a hacker?

LOL, easily

Dude idk I'm just going to a cyber security competition they are hosting.

You can't remain user. The only option is to hide in plain sight, add some facebook and reddit in your history and nobody will give a fuck about you.
The people who use tools and VPN's are already on a categorized watchlist.

Yup, completely untraceable and smart, actually.

like how?

Steal all the energy

give one example, that would happen exclusively on linux on an up to date system

>wanted to set up piratebox on a raspberry pi 1
>either the wifi adapter or just the whole system is too shit

pi 1s don't have wireless IIRC, you need an adapter

I did, but only have some ancient 802.11g ones which don't seem to support AP mode well

Will do, thanks for the help. I appreciate it.

I'll read on then. And I felt the same, but i guess thats the gist of it, learning how everything works. Thats why I got so excited when I got to the point of stack overflows, because I could see that knowledge in use. Thanks for replying.

pirate boxes are a meme anyway unless you live in some tech city, most people just connect since it's open then they can't get internet so they disconnect

anyone?

Can anyone explain this?
tor.stackexchange.com/questions/16807/why-do-bridges-collapse

Which is the to go freelance website in this field?

at least use IRC like an oldfag

"We" do that too. Ham radio guys who track satellites have mapped the course of several "anonymous" satellites. Apparently they are capable of basically, sniffing communications from other satellites.I guess tapping into the physical backbone of the internet wasn't enough.

WHY IS HE SO FUCKING UGLY!?

Hey, hey, cut it.

Thread's back I can shill my video! Hackthebox Node.

youtu.be/nHhf7mGgD8c

How to learn hardware hacking and where to start ?

Learn ee

Yes but where to start ?

Plug a battery into a light?
IDK what to tell you, you're trying to enter an extremely complex field when you don't even understand the basics of how that field works

I have a question Hackerman. I know a lot of anons on g despise Apple, but is IOS on Iphones secure or is it easy to exploit.

t. brainlet

it's no more secure than a well configured android phone, but could be less secure since hypothetically apple could have added backdoors or vulns to it, so it could be equal or worse, main reason it's actually secure is because it's a walled garden

iOS exploits are worth far more than Android exploits, and it's generally regarded to be way more difficult

It's not anymore but since half of the population is still using Android 5.0.
It's hard to exploit pixel 2s pretty much like newest iphones.

The Nexus/pixel line is the only decent one, and even then
The rest is an absolute shit show, vendors add tons of useless kernel modules that get popped all the time

npr.org/sections/money/2015/01/09/376164768/episode-596-johnny-mnemonic-s-secret-door

I'm not going to watch this while I'm at work, I'm sure it's something like 'apple had backdoors in their phones!!!!!'
If so, do you think your Huawei phone is better? It's widely known in the VR community that apple phones are more secure, there's features like secure enclave that has absolutely nothing similar on android

???
read

I didn't see they had a transcript available

The most secure knowledge is your own

Is the cybersec community on the verge of dying?

I get the feeling that it's getting there. :(

I think you mean infosec and no it's thriving, why do you feel like it's dying?

Well it's more to do with a gripe that I have of not finding like-minded cybersec enthusiasts irl.

>Why do you think the Internet exists, you dunce?

Yeah, but I find the experience much more thrilling if I can actually meetup with people rather than stick your head on IRC and Discord channels all day.

Eh, it's a podcast dude, you just have to listen.
The story is better than that though.

google search for local infosec cons or hackerspaces

they manage the nuclear stockpile and do fusion research. if you go after that stuff you'd better have the russians or chinese to cover your ass.