/hmg/ - Hackerman General

In /hmg/ we discuss pentesting, ctfs, exploits, and general being a hackerman.

Resources:

VM/CTFs:
overthewire.org/wargames/bandit/
>easy beginner bullshit

vulnhub.com/
>prebroken images to work on.

hackthebox.eu/
>super secret club

Tools:
kali.org/
>meme dragon distro but it just werks

metasploit.com/
>scriptkiddie starting point and swiss army knife

Tutorials/Guides:
abatchy.com/2017/03/how-to-prepare-for-pwkoscp-noob
s3ctur.wordpress.com/2017/06/19/breaking-into-infosec-a-beginners-curriculum/
>From zero to OSCP-hero rough outline, and how to infosec.

youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA
>IppSec, video guides for retired HTB VMs.

Certs:
eccouncil.org/programs/certified-ethical-hacker-ceh/
>CEH, only looks good a resume to non-technical in HR

offensive-security.com/information-security-certifications/oscp-offensive-security-certified-professional/
>OSCP, the big dick swinging exam, 24 hours to own 5 machines and a further 24 hours to write up a report detailing your methods.

Community:
IRC: #Sup Forumssec @ rizon.net
Matrix/Riot: riot.im/app/#/group/ hmg:matrix.org

Attached: 1497200856225s.jpg (250x250, 9K)

did you notice that Sup Forums has gone full http?

Huh? It's https for me right now. What are talking about?

You know you can just do https:// before typing th e link, right?

What does it take to be a hackerman, anons?

Attached: robot-shutdown-630x354.jpg (630x354, 48K)

Understanding programming, networking, assembly, c, hell even python.

But OP has most of what you need to get started.

In settings, you can Miscellaneous -> Always Use HTTPS

Or just install HTTPS everywhere like a normal person.

guys im getting very good at hacking (ddosed my friend) and i want to have a cool hacker name. i was thinking something like 'gh0st_killer' or 'shad0w_slay3r'

>go thru my neighbours bins
>now I know where he lives

fucking retard LOL

what did you fucking say to me? *eyes start to glow red* *laughs* you made a mistake using an unsecured connection because now I can find your IP and ruin your life

*laughs more* I just got your IP and now I am using a program to track you down

Not responding? I guess youre too much of a pussy. but we'll see what happens when i post all your information to Sup Forums.

I learned something today

sry i was just jokeing Sir, life is boreing at my Cubical

can't join the irc wat do

it was ssl shit

recommend me some closed headphones max 200 merkels

general purpose: music

What books should I read? Recommend me: networking, security, languages, etc. books, please.

bump
can't ignore quads

I have an old Dell Latitude XT3 with Windows 8.
Want to start fresh on Linux Mint. Can't boot from USB since the BIOS is admin protected. Anything I can do? I can log in, I just don't have admin privileges.

be able to find a tutorial for what you want to do on youtube

oops i thought this was /hpg/. sorry my fellow hackermen

pursuing my CEH over the next month bc my work will basically pay for anything. Any other recommendations?

In a noc job now with a CCNA

Attached: hackerman_sombra_by_glimmercape-dapb4jz.jpg (1135x703, 165K)

oscp

do you know what a general timeline for preparing to pass the oscp would be with at minimum CEH level knowledge?

Most stuff I read online is people talking about how hard it is, but I take that with a grain of salt

hard to say since certs don't really show skill level (IMO) I'd say just look into mock oscp exams or watch people doing it then gauge from there

how to become a security engineer:

1. The Web Application Hacker's Handbook
Probably the first book you want to read; this will teach you the core mindset you need for finding security flaws in web applications as well as give a very strong foundation for the different classes of vulnerabilities.

2. The Mobile Application Hacker's Handbook
Good supplement to #1 for application security, obviously focused on mobile apps.

3. The Art of Software Security Assessment
The bible of the security industry. Especially instructive for source code review.

4. Security Engineering (Ron Anderson)
Supplements #3. Very instructive for injecting security into the overall SDLC and designing secure software.

5. The Tangled Web
Excellent historical background and good high level overview of many information security topics. Every engineer should read this, even if they don't work in security.

6. Gray Hat Python
Very hands on, good introduction to aspects of reverse engineering and the typical work an e.g. security consultant will do at a top firm.

7. Practical Malware Analysis
Very good introduction to malware analysis.

8. Practical Reverse Engineering
This book, along with #9 will teach you everything you need to know to effectively reverse engineer software for security-focused analysis.

9. Reversing: Secrets of Reverse Engineering

cont.

10. The IDA Pro Book
You'll want this if you have any plan to work with IDA Pro at all, which is the gold standard for decompiling and reversing software.

11. The Shellcoder's Handbook
If you'd like to write exploits after you're done reversing software to find an exploitable bug, this is a good book to pick up.

12. Cryptography Engineering
Very solid and broad introduction to cryptography. Every engineer should read this, even if they don't work in security.

13. Introduction to Modern Cryptography
This book, along with #14 is what you want to read if you're going to work as a cryptographer or cryptanalyst professionally.

14. Handbook of Applied Cryptography

Theoretically, these books should resolve your known-unknowns and your unknown-unknowns. Anyone who reads and works through the list should be capable of designing secure software, finding errors in white and black box source code reviews and finding errors in white and black box penetration tests.

Thanks

You're doing god's work, user.

Somebody please put this on a pastebin.

god bless you user

Is pic related a good starting point or is it better to start off with the more specialised books? I've been reading through it lately and I'm kind of beginning to feel like perhaps it'd be better to get a broader knowledge of specific things first of all rather than just going through a bit of everything.

Attached: file.png (385x499, 351K)

I'm doing the beta test for CompTIA's Pentest+. What's Sup Forumss thoughts on it?

Hey, thanks for replying.
>1. The Web Application Hacker's Handbook
Good shit. I started reading this a few weeks ago. I'm glad you mentioned it, because it seems a bit outdated, no? It's definitely good so far, and I think most of the material still holds for today.