/cyb/ + /sec/: Cyberpunk and Cybersecurity General:

Do you people think you're tough guys?

>>61893073
I'm as hard as calculus is for you.

>>61893065
>Thank you other OP.
All g, didn't mean to make a duplicate doe

im asking about bunsenlabs
>>61893079
im planing on using on my main os

A total noob in cybersec.
What do IT security analysts use for their resources in their workplace?

>>61893261
Oh ok, is there really no x86 amd64 versions? It sounds quite strange to have the i386 and i686 instead of the x names..

But otherwise those won't make a difference; it's for support for CPU architectures, not the system architecture, if that makes sense.

>>61893268
Sorry? You mean what SIEMs are in use?

>>61893574
Yeah, what SIEMs are in use, what security tools do they use? Etc . Also wha knowledge/skills are required to be in that position.

Thanks

>>61893648
Have you at all tried googling any of these questions? Or applying a single ounce of effort into finding out what you're asking?

>>61893648
I hate this word, we used to use splunk and tripwire to do this and called it log aggrigation and now we do the same thing but call it something new.

>>61893261
you are better off making a bigger more mainstream os your main like debian or arch or good ol memey gentoo

Is there such thing as modern phreaking?

>>61894714
Hacking the Cable Modem:
>https://www.nostarch.com/cablemodem.htm

>>61894771
>17 dollars

>>61894771
>paying for an ebook
Absolutely not /cyb/

Put boards.systemspace.link off of the pastebin, its dead and the community collapsed after six10 left the discord.

Last I read was the article about Shenzen. Did I miss too much after that?

goddammit people just because its night doesn't mean you cant reply to a /cyb/ thread.

>>61893073
Yes

>>61893065
Can we get /cyb/ related infographics please.

>>61895653
I hope that I'm not the only anon that misses the infographics, and flow charts.

>>61893065
Pretty comfy looking dystopia. Reminds me of that scene of Shimomira in that Kevin Mitnick film Takedown/Track Down where he has a babe in his bed and gets up to check his computers.

Very comfy.

>>61893073
For you
>>61894887
Pirate it then you fag
Still waiting on aliexpress shipping. Might order some more equipment on Amazon in the meantime. Does anyone have anything below $35 they would want reverse engineered?

>>61895686
They were one of the reasons I used to hunt and patrol /b/ was for infograph dump threads

File: crypto.png (642KB, 2200x4200px) Image search: [Google]

642KB, 2200x4200px

>>61895653

>>61896654
Good start

>>61896654
Keep it flowing anon.

A few threads ago another anon dumper porn tier infographics, like the one with the van and the lab.

Just a reminder that we are now at 53 voters in the straw poll

http://www.strawpoll.me/13665376

So far we have a total European dominance. Weird.

>>61897360
Vores. I would like to contribute more the the threads but I can only so with the /cyb/ parts and there are rarely any discussions about that

>>61897360
I'm not really surprised. Under my POV, EU & NA business culture and education are from different to really different depending on the context. Based on that, I tend to think in EU /sec/ is done by other ways, and that affects how people that doesn't work on it but they're learning see it because of the different requeriments (if I'm straying away from the point just say it)

It also could be that because of attacks and how govts reacts to them, we have a different feeling about our /sec/ and mostly to our privacy.

Just an opinion, of course.

>>61897427
I left the /sec/ field years ago and most of my contributions are only /cyb/.

>>61897445
Considering WWII it is really strange how Germany is far more pro freedom, UK wants to monitor everyone and Italy demands zero anonymity.

Then again, it has been said that we can only learn from history that those who should have learned from history never do.

Reagan/Thatcher gave us the soil for /cyb/ to grow into daylight. Today we have Trump/May and a similar mood in society.

>>61897587
>Trump/May
and turnbull

>The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia

Also reminder of the FTP site:

ftp://collectivecomputers.org:21212/Cyberpunk/
password: guest

Upload enabled, also big thanks to anon uploading excellent images (new).

>>61898480
>password: guest
/sec/ can do better than this

File: 1496013683055.jpg (2MB, 1920x960px) Image search: [Google]

2MB, 1920x960px

>>61898480
this is nice

>>61898480
bruss are you at all keeping tabs on whats in this ftp?

theres some stuff im debating opening but i think its literal actual not a joke sinkposting

>>61899009
>sinkposting
?

>>61899470
The kind of stuff someone would like to have a conversation with you about, in a place you don't want to be.

File: bd3c5d35e612a26a9c605a58f3fd74dee81c2b8bbef82a8c3902a1aad26dd175.jpg (41KB, 596x650px) Image search: [Google]

41KB, 596x650px

Two unrelated questions.
1. What year or decade do you see "cyberpunk" becoming a reality? Right now most of the world is just low tech, low life. Where do you think it'll start? (my bets are on East Africa)
2. What's the difference between dystopian and cyberpunk?

File: hqdefault (2).jpg (11KB, 480x360px) Image search: [Google]

11KB, 480x360px

Are number stations still used by spooks, or is it all just a ruse?

>>61899660
it was always a ruse so youll stop looking inside regular broadcasts

how does sql map compare to havij? is sqlmap better?

>>61899568
I would say from 2020 maybe. My best bet is still asia since it is so far ahead. I know africa is being developed at high speed but still.
The difference between cyberpunk and dystopia is that cyberpunk isnt dystopic for the rich and powerful

>>61895227
No, you didn't miss much after that. You could of course view the old thread using the link in OP post.

There are at least two news anons posting here, but it is a bit quiet now.

File: 481-293-32hex-9ha59DF3kR94XOR.jpg (59KB, 1600x1200px) Image search: [Google]

59KB, 1600x1200px

>>61899009
>>61899470
>>61899521
Fresh off the press.

File: 10301158.jpg (15KB, 258x258px) Image search: [Google]

15KB, 258x258px

>>61901381

>>61901381
spooky

>>61901381
I checked it, it's legit.

>>61901381
It's time to abandon this thread

File: MORE.jpg (249KB, 904x573px) Image search: [Google]

249KB, 904x573px

>>61901381
>>61901381

>>61901381
Someone post the real image, just so I know I didn't click on pizza.

File: 1502269570754.jpg (28KB, 480x457px) Image search: [Google]

28KB, 480x457px

I wanted to create a database for all my passwords
Would it suffice to create that database in keepass, lock it with a keepass key file, and then save it all to an encrypted microsd card?
Any other safety measures/methods of securing it you'd recommend?

File: repress64-42koa4L59dQwXOR-392.jpg (501KB, 2000x2000px) Image search: [Google]

501KB, 2000x2000px

Here's one of my favorites.

>>61901381
MODS THIS IS NOT A DRILL

>>61901381
So I followed the file name, but what does 481-293 mean?

>>61901381
wat

>>61901857
Discrete cosine transform.

>>61901805
>501kb
I don't think so, Pedro.

>>61901872
Oh shit I completely forgot about that, thanks.

>>61901381
>>61901899
>>61901872
>>61901857
What the fuck, this is actually sink posting.
>>61901791
We all did.

File: ClownSuicide.gif (4MB, 270x263px) Image search: [Google]

4MB, 270x263px

>>61901381
>>61901805
I don't understand this meme.

>>61898535
It should be "russianhacker".

>>61901381
Why did you have to fucking kill this thread.

>>61901804
Honestly I don't know if it's save, but I do it. I keep all of my stuff in a keepass .kpd and have a cronjob to upload it to a bunch of different clouds every day.

>>61901941
The first sink post is a steganographied jpeg with hidden CP. If you reverse it, you get the original CP image.

I could find anything with the second one though. It's too big.

File: 1472347256277.png (770KB, 580x799px) Image search: [Google]

770KB, 580x799px

>>61901980
what the fuck

>>61902002

Welcome to /cyb/.

File: 1465222960783.jpg (64KB, 618x576px) Image search: [Google]

64KB, 618x576px

>>61902019
This is just larping, right?

>>61901980
thank you for your insight, anon

>ctrl+f dnscrypt
>0 results

why is that

>>61902064
>>61902002
>>61901941
Reverse the image yourself pal.
>>61901381
3DPG.

>>61902064
Where do you think you are?

>>61902083
No.

>>61901381
This really vans my me.

>>61902113
Then I guess you'll forever live in doubt whether or not the FBI now tracks the packets originating from the IPs of you and every other poster in this thread.

File: 1452793520586.jpg (9KB, 342x342px) Image search: [Google]

9KB, 342x342px

>>61902135
The FBI tracks everyone on this website anyway.

>>61901381
this is real.

>>61901805
this isn't

yw

>>61902145
:^)
Pro-tip: FTP link has more sinks.

>>61902083
Not planning on reversing that one but how do you do this in general. I know in theory it's about encrypting an image and then hiding that encrypted data in the compression of another image but I am lost on how to implement it in practice.

>>61901381
MODS MODS MODS

>>61902064
Welcome to /cyb/+/sec/
Welcome to freedom

>>61902236
kys

>>61902174
Me neither. But if someone were to, in theory, reverse said image, they could use:
https://pequalsnp-team.github.io/cheatsheet/steganography-101
http://www.guillermito2.net/stegano/index.html
to start their journey.

>>61902250
>he doesn't know about zeronet
or
>freenet
or
>i2p
>etc

>>61901381
>>61902269
Stop

>>61902267
I host all of my sinks on Fidonet.

What the fuck is going on in this thread

>>61902320
Larpers

>>61902255
Thanks friend.
>>61902320
Panic and learning.

>>61902341
That's really gay

>>61899660
Still in use
http://www.bbc.com/future/story/20170801-the-ghostly-radio-station-that-no-one-claims-to-run

Question, I hope my english don't fuck it up.

So, if you open or save any image of the steganography ones, you can be point as the aware holder or both images, or if someone will want to point you out they should prove you decodified it?

>>61902809
Because of how the law works possession alone counts even if you haven't decoded it. What you are describing would be considered as part of intent.

Is the HTTP upload method the most sensible way to share images in XMPP? Wouldn't the HTTP server be vulnerable to crawlers and other shit?

ayo can someone hit me up with an animal-themed sink if you know what i mean

>>61902341
>LOL LARPERS! :D
>In thread almost everyone is sharing good information, or asking good questions.
If that is your definition of a LARPer, then it really isn't an insult.

>ctrl+f dnscrypt
>0 results

why is that

>>61904904
because it has been mentioned a billion times in past threads?

>>61904904
what is it though

So does anybody have network information on North Korea? I just wonder what kind of OS's their computers are running (Kim Jong Linux?), or if any of their devices are public facing. I imagine only top government officials have access to legitimate non-state run Internet.

>>61905387
>Kim Jong Linux
Almost, google "red star OS"

>>61905387
https://nknetobserver.github.io/

>>61905429
CCC presentation on RedStar OS.
https://media.ccc.de/v/32c3-7174-lifting_the_fog_on_red_star_os

The Red Star itself can be downloaded here
https://thepiratebay.org/torrent/18110300/DPRK_Red_Star_OS_3.0_%28Desktop%29
https://thepiratebay.org/torrent/18110301/DPRK_Red_Star_OS_3.0_%28Server%29
The torrent claims to have the very first leak of the server version.

>>61906049
Ah here's another torrent for the server:
https://thepiratebay.org/torrent/10280206

>>61903650
Xmpp is a bad choice anyway since there's plenty of metasploit exploits that focus on it

File: evr.png (1MB, 640x1832px) Image search: [Google]

1MB, 640x1832px

These threads are one of the only reasons I come to this website. They have a comfy feel to them.

>>61907142
>DELET THIS
That is not comfy, that makes me scared to get a job in the realm

>>61907142
me too

>>61907142
Who are those 2 guys at the end in the "What I got" column? The face of the guy at the left feels similar, but no idea who both are.

>>61907236
Diffie and Hellman nigga

>>61907142
not even a picture of snowden, just the hollywood psyop movie

Is it viable to reverse engineer a 22MB windows PE binary?
My attack plan is as follows:
- Identify embedded libraries through fixed interface signatures, this will reduce the amount of code to decompile
- trace systemcalls to divide code into blocks, all code between two syscalls can be summarized as one action
- generate obfuscated C with decompilers like boomerang or radare or ollydbg to get an overview of all control structures

Any other suggestions on how to approach this?

>>61907327
Wait...why are those two on the bad side? CA management wouldn't function without them

>>61907418
>implying it wasn't actually a really good movie

>>61907142
It's do accurate it kills me

>>61893268
A book about doing real work - "How to win friends and influence people". Nothing else needed

>>61893090

lol this response is EVERYTHING

>>61893065
>no fitted sheet on bed
ishygddt

>>61894714
I haven't seen this word in a long time

>>61908967
Fuck your faggy fitted sheets Constanza

>>61907631

what are your goals with the binary, just figuring out what it does or trying to find bugs? ida flirt can help with finding libraries. hexrays can decompile back to something c like so you don't spend years reading asm. why you need to map systemcalls into individual actions is beyond me.

>>61894714

you can still use pbx bugs all around the world because the pstn still runs on copper lines. voip hacking is a thing.

>>61901381
i dont get it desu?

So I installed bunsinlabs linux distro on my computer. It is desban based but I have a few questions. How do I increase security of it. I already did the lvm encryption.

How do I install themes?
Can I install steam?

In the office tab there is an option about google drive when I click on it, it opens up the web versions. How do I remove this? I want jewgle free device

>>61909865
There is no point in increasing security if you're going to install a backdoor/proprietary spyware like Steam anyways.

>>61909888
Hrm really... am I better off just pirating the few games I want to play?

>>61909905
Yes you're better off, but they're still closed source which means they could always be just as much spyware as Google is. Look into open source games like Open Morrowind if your really need to be a gaymer.

>>61909865

there are tons of "securing linux" docs out there and nist has a good one. don't worry about steam.

>>61909915
Im really just going to play the original battlefront skyrim and maybe some emulators

>>61909979
Cut battlefront and Skyrim and only use open source emulators. OpenMW is just Skyrim but better and not for retards.

>>61909964
>don't worry about steam
t. Gabriel Newell

>>61910281
How about he NOT cut out the games he fucking wants to play

What kind of fucking suggestion is that, you unjustifiably paranoid mongoloid

>>61899704
>>61899704
>>61899704
>>61899704
>>61899704
Hello can I have an answer please and not the bait sink posters

There's nothing in this thread the real shit is in the ftp server

How can I have an sql injector discussion please

>>61910513
>unjustifiably paranoid mongoloid
What fucking general do you think we're in, nigger?
If you want to be secure, don't use proprietary software. Otherwise, there's no reason to worry about "hardening" your Linux distro. Get the fuck out of my general right fucking now.

>>61910650
>my general
who died and made you king?

>>61909865
Forget about trying to secure an os with software like steam on it. May as well just dual boot into windows for that

>>61910741
This is my fucking general. Get. Out.

>>61911412
No it's not you cunt, I fucking made it

>>61909905
use a separate computer if you're really worried about it. the "secure" computer doesn't need to be beefy and not having the new CPU spyware like IME would probably help.

>>61911429
And I made the pastebins and have consistently owned these threads for years. You think that just because you beat me to an OP thread that you can pretend you're the leader around here? FUCK. OFF.

>>61911412
I nominate myself as qtKing of /cyb/

>>61911473
>>61911429
>>61911412
Why is anonymous fighting with himself?

>>61911488
heil fuhrer qtking

>>61911473
These threads haven't been here for years.

>>61911626
Let's play spot the newfaggot.

>>61893065
Cyberpunk has nothing to do with cybersecurity.

File: Untitled.png (2KB, 353x40px) Image search: [Google]

2KB, 353x40px

>>61911961

>>61912425
I never claimed to be a 4chan mod. I simply am banning you from my thread like a bouncer kicking one out of his club.

>>61906892
Can you then recommend some alternatives to it?

>like there is any, i'm not touching whatsapp and irc is dead man walking

>>61909101
ida is too expensive for me, my goal is to get a general overview of what it does

File: Frederic_bennett_golem_city_reveal.jpg (846KB, 1920x1079px) Image search: [Google]

846KB, 1920x1079px

I am interested in sec and recently got really into cyberpunk [spoiler] thanks to these generals[/spoiler], I've played DE:MD a few days ago and came into Golem City and loved the vibe. Can you guys recommend me some games with similar vibes/themes as displayed there?
Also what would you guys deem as typical /cyb/ fashion? [spoiler]I know that there are threads on infinichan /cyber/ but they are slow and nitpicky[/spoiler]

>>61913771
>DE:MD
What

>>61913824
Deus Ex:Mankind Divided

>>61913771
Fashion-wise, I'd look into techwear.
It's clothing based around function that can be as casual or out-there as you like.

>>61913771
If you want a pure cyb game, can't go past shadowrun returns

>>61893065
Hey, if yall wanna download guns, I'm currenly seeding the FOSSCAD Megapack v4.8

magnet:?xt=urn:btih:359050ec1608f8fd8b0d9fbf66ffe7dc02672acc&dn=FOSSCAD%5FMEGA%5FPACK%5Fv4.8%5F%28Ishikawa%29.zip&tr=udp%3A%2F%2Ftracker.leechers-paradise.org%3A6969&tr=udp%3A%2F%2Fzer0day.ch%3A1337&tr=udp%3A%2F%2Fopen.demonii.com%3A1337&tr=udp%3A%2F%2Ftracker.coppersurfer.tk%3A6969&tr=udp%3A%2F%2Fexodus.desync.com%3A6969

>>61901381
Kill yourself.

>>61911524
Agree with this for the lulz

>>61914046
Not that anon, but I'm rearely into that mechanic of gmes. Strategy, like isometric etc etc But I had a really really nice time with Shadowrun.

I would fucking play it everyday if I would have it in mobile, I think the format fits perfect.

>>61913731
Just get the demo version if you're against pirating.

>>61914046
dont those have magic and shit in them?

>>61915009
Ofc it does, it's an rpg at its core

>>61914218
>wanna download guns
YOU WOULDNT DOWNLOAD A CAR

1424 bump

File: 1486717237233.jpg (109KB, 540x960px) Image search: [Google]

109KB, 540x960px

>>61901381
>Yfw post your sink threads were steno'd CP the whole time

>>61911645
I don't even remember these threads. I remember fucko threads though.

Should I all in Bitcoin?

Against non-APT entities, what are things to look for when considering phone security? Are whole manufacturers out? Are whole OS's? Is buying in a brick and mortar store in the developed world any more reliable than a chinese reseller on ebay?

Hard mode: no "don't have a phone" answers.

>>61910650
>>61911412
>>61911473
good to know you are the reason /sec/ sucks
now kys

>>61917234
He's right tho. Go back to windows if you want to play videogames.

>>61917303
you could also have VMs and a GPU passthrough setup

>>61917352
have you ever done that? it requires lots of work and specific pc build

>>61917378
no, but I just bought a new CPU (ryzen 1600) to do just that... I need to buy the rest, though, after doing the research on the mobo

>>61898480
Mucho grassy ass

File: akira_by_yonaz[1].jpg (495KB, 900x539px) Image search: [Google]

495KB, 900x539px

>>61893065

>>61917765
how do you plan to do it? you'd need a secondary gpu linux or vnc into it?

>>61906892
Maybe for public xmpp but if you control it, it is the best medium.

Http upload is a shit name. It still uses omemo and tls encryption. It's only http uploaded to the server where it is saved. Tls wraps the upload so if you use unencrypted xmpp the image is plaintext on the server.

>>61918242
>two GPUs, a shitty one for the desktop, a powerful one for other stuff (gayming, cracking pws, etc)
>mobo that supports GPU passthrough
>KVM setup (AFAIU, it's how you do it) + bunch of VMs

So you want to play vidya but you want to be /cybsec/ to?

Containers or just encrypt a partition you use for games then use a firewall to block outgoing traffic (lol use iptables retard) or disable internet connection. Seriously not hard to safely use proprietary software.

>>61918286
even a shitty one will huge a huge powerdraw

>>61918286
have a huge powerdraw

>>61913940
You have to be fit for that to look good on you and you are posting a transgender support board.

>>61913940
If you're not model tier facial wise then just wear what you're confident and comfortable in. If you want to look good dress more 'formally'. Otherwise if you're not legitimately attractive or rich you can't pull off unique styles.

>>61914896
I'm not against pirating, but I'm afraid of malware. If people can crack ida then they also could embed viruses in it.
Unless there is a crack that is verified.

>>61918493
? I only need one that supports 2x1080p, even integrated GPUs will do it these days, and they don't use much power, so some random, cheap PCIe GPU will do just fine
although I'm not really sure if I should buy 2 GPUs, though..

>>61918763
will ryzen ever have an igpu though? a through away cheap gpu still needs a large power draw pcie slot

>>61918272
But if I self-host my own XMPP server, can some fucker still get my dick pics because of that open HTTP server or is it practically impossible?

>>61918823
No you're fine if you use certs and omemo

>>61918747
VM or use hopper/radare2/binary ninja.

>>61918774
ryzen APUs are coming in Q4 2017 or 2018, I've heard

anyone got a security+ pdf? post link pls

>>61914218
What's the legality of having these files in the US?

File: 1*L6xUogC8N3ZCWFL3n5cNiQ.png (101KB, 1221x622px) Image search: [Google]

101KB, 1221x622px

have you guys seen this?

>guy used bing to search for bittrex
>targeted add that pretended its link
>clicked it
>looked like bittrex so entered credentials
>waited for 2FA and entered it
>lost $130,000

>>61921115
heres the article
https://medium.com/@junaidlive/2fa-wont-save-you-from-phishing-5fe426c34c5b

File: stalenhag_hand.jpg (160KB, 1020x688px) Image search: [Google]

160KB, 1020x688px

Is a heap use-after-free vulnerability a big problem if the application with that vulnerability isn't easily accessible to remote attackers? For example, a use-after-free vulnerability in a media player?

I see that vulnerability written about a lot in regards to web browsers, but not so much with any other kinds of software and was wondering why that was.

>>61921246
>Is a heap use-after-free vulnerability a big problem if the application with that vulnerability isn't easily accessible to remote attackers? For example, a use-after-free vulnerability in a media player?
yes it is: https://www.google.com/search?q=use-after-free+mp4

>>61921246
>I see that vulnerability written about a lot in regards to web browsers, but not so much with any other kinds of software and was wondering why that was.
because browsers are popular software, and exploits for them are rewarded highly...

>>61893261
why would you do it?

>>61921417
I figured that popularity was one factor, but was thinking that another factor might be because it's realistic for an attacker to remotely exploit the browser through a malicious website whereas something like a media conversion utility or music player would be less readily exposed to attacker controlled code.

I thought maybe this was the reason why vulnerabilities in that less accessible software would be less serious or not written about as much.

Why is the concept of airgapping mission critical devices or computers that don't need to be networked seemingly beyond so many people?

>>61921676
"What is a computer without internet?"

>>61921676
Ever tried to get someone to trade away convenience to gain security? Much less inconvenient things than airgapping are like pulling teeth to get people to use.

>>61921676
Convenience most likely. I remember reading a story of a security engineer attending a conference on industrial control systems and someone who managed a hydro power plant proudly showed the guy his iPhone with a live display of the plant control system. He explained that he could manage various things at the plant remotely from his phone while at home. The security engineer was horrified...

>>61893090
I had to take calculus 3 times :(

File: 1477891998772.jpg (246KB, 300x419px) Image search: [Google]

246KB, 300x419px

How do you feel about the Justice Department demanding IP addresses of people visiting anti-Trump websites? Is it even constitutional? As much as I don't give two shits about ANTIFA, I'm terrified that this might set an awful precedent and twisted around by future administrations to target people that oppose harmful legislations.

>>61921115
so he got phished
what happen to using bookmarks man

>>61908967
They dirtied it, quite obviously.

>>61921135
>BRAKING NEWS: NORMIE LEFT BATTERED AND BAFFLED

>>61921508
there are tons of PoCs for UAF vulns in, say, vlc

>>61922140
bit harsh
I can see it happening to me
not really, I dont see me using bing, but I am arogant when it comes to 2FA and think I am safe as hell
on a day after drunken night I could see myself doing stupid shit

>>61922266
local UAFs, or not necessarily remote, at least

>>61921950
What is going on in those websites? Death threats, violence, and such towards the president are illegal as far as I know, so it would be within the jurisdiction of the law to do it.

I have a degree it networking.
I have a good understanding of how networks work.
I can code in C,C++,Java,Python and Javascript.

I can't for the life of me get into hacking.
Most website that claim to """teach""" or offer test environments are literally just 20 different versions of "lol we hid the password in a html comment!".

Could I get some real advice as to how turn my skills into employment?
I looked at what the OP posted and it's a long list of what looks to be total newbie "this is what a bit is" stuff or what I talk about above, unrealistic stuff.

>>61894771
>>61894871
>>61894887
http://index-of.es/Magazines/EN-Hacking%20The%20Cable%20Modem.pdf

>>61921246
A lot of underlying libraries are still used on servers if it's in one of those.
>>61922376
Start doing ctfs. A lot of hacking really is just knowing more about the codebase and configuration file then the people using them. You won't find passwords in HTML files often anymore, but you will find local file inclusions because of misconfiguration.

>>61922376
Read Web Application Hacking Handbook and start doing ctfs/wargames.

>>61922376
If you want to learn web exploitation, you should buy some books.
A good test environment you can setup on your own box is called DVWA (Damn Vulnerable Web Application.)
As for books:
Begin look at things like XSS, SQLi, CSRF, LFI, etc. Read OWASP pages. Use Google.
http://www.lulu.com/spotlight/owasp

>>61922376
SQL Injection

>>61922376
https://www.owasp.org/index.php/Category:Vulnerability

>>61904928
Should be on top of OP on these threads imo.
ISPs hijacking dns to show up ads are pretty annoying.

>>61921950
>I'm terrified that this might set an awful precedent and twisted around by future administrations to target people
And you'd be right to be worried. Any time the government wants to do something, think of what someone actively malicious and out to persecute you could do with that power.

Then again by fighting this Dreamhost is essentially admitting that they have the data the government is after. They shouldn't; this should be like the Signal case where the government asked for a huge pile of records and the company responded saying "Yeah, we can't give any of that to you because we don't collect or retain any of that info". Bruce Schneier wrote an article on this (I think last year sometime) about how companies need to start treating data as toxic waste instead of something to be hoarded.

>>61922376
https://youtu.be/gYOy7CGpPIU
Is a great video if a bit old. It's from a guy who sounds like he was in your situation.

>>61922727
they were hit by a preservation order, so if they did get rid of it now, it'd be worse for them i presume.
probably don't want to lie on the sword for some leftist niche site, so they are fighting it rather than give it up willingly.
too bad they can't take the lavabit route for when the gov't wanted the keys to all emails just to get snowden.

is Firefox by itself with addons secure without sending any telemetry or information out? Had a look at icecat and palemoon but the sound doesn't seem to work at all.

>>61898480
Hey, i am getting "550 Home directory does not exist" on uname: guest; password: guest...
What am i missing?

>>61923106
username Anonymous

>>61923144
Still, same error.

>>61923318
this

>>61922376
tl;dr: hacking is taking advantage of ANY type of vulnerability (say, missing controls, misconfigurations, bad programming practices, shitty vulnerable libraries/functions that weren't well thought when designed, and so on)

basically, you have to remember many types of vulnerabilities, as well as know which ones are the most common ones out there, and use them. from the simplest ones (e.g., where you can see, say, the name/version of the server being used by a website), to the most complex ones (say, multiple memory corruption vulns chained together).

the idea is not only to know they exist, but how they actually work... also, you have to be creative and keep learning stuff by reading how other people finds and exploits stuff

>>61918372
>>61918372
>>61918372
This is a clever man

Going full gnu because you don't know how to sandbox is retarded

>>61918774
>cheap gpu still needs a large power draw
Where the fuck did you get this idea from

>>61921420
It's Linux. Why are you've questioning someone who wants to run it as their main?

>inb4 why don't you run X distro like a real man hurrr

>>61921760
This is a bad story

>>61911123
>>61911469
>>61909888
Ok guys Ill just use steam for my desktop and just play emulators on my laptop

So how do I got about securing linux? I just got response on to not install steam. I already encrypted the lvm which I guess is encrypting the hard drive. I did mostly everything in the pastebin but im not sure how to secure the os it self.

Oh on unrelated topic on my desktop I want to dual boot windows and linux.
I have 120gig ssd and 2 terrrabyte harddrives

Im going to use the ssd to dual boot windows and linux but I want to use each terabyte hard drive with each os. How do I do this?

>>61922277
What part of >>61922140 aren't you getting? You've just proven his point even further

>>61923106
>>61923318
>>61923397
Are you people opening it in a browser or in an actual ftp client

>>61922951
>they were hit by a preservation order, so if they did get rid of it now, it'd be worse for them i presume.
Yeah but it's over six months after the fact. Even if they got an order, that data should have been long gone months ago. There's no reason to keep a list of every IP that visits a particular website for anywhere near this long a time.

>>61923869
>So how do I got about securing linux?
Step one is to answer the question "secure against what?" The one step that's gonna be pretty universal no matter what your threat model is is good patch discipline.

>>61923480
https://www.gnu.org/philosophy/words-to-avoid.en.html#Hacker

"A hacker is someone who enjoys playful cleverness—not necessarily with computers. The programmers in the old MIT free software community of the 60s and 70s referred to themselves as hackers. Around 1980, journalists who discovered the hacker community mistakenly took the term to mean “security breaker.”

Please don't spread this mistake. People who break security are “crackers.”"

>>61921729
>>61921760
Those both pretty much make sense. It's just that the recent ransomware attacks spreading on company networks like an STI at a swinger's club got me wondering why some of these systems are even networked, and why they're networked 24/7.

>>61913230
wire is a decent centralized alternative

>>61923947
Secure against ISPs average joes my school (I need to use the laptop on the school wifi).

>>61919322
Hopper and binary ninja are both (expensive) proprietary software.
I'm learning radare2 but its interface is quite convoluted

>>61924448
>opendns on modem
>use vpn
>that's literally it

The fact you've got Linux means the average joe won't bother. ISP protection isn't really on the os itself. Configure your modem to use an alternative, non isp provided DNS, use a vpn, maybe Pia? That's a popular choice.

As long as you don't have apache, tomcat, vsftp or anything running 247 while at school, ain't shit scrubs are gonna be able to jack into

>>61924463
100 freedom dollars is worth it for these sorts of tools. Radare2 is great as well, but it has a lot of quirks that prevent it from being my go to tool.

>>61901381
how to reverse this, apparently there's hidden CP, I wanna learn how to do this for knowledge sake
idk how

>>61924822
Read the thread again.

>>61921115
That's one of the oldest phishing methods on the internet when it comes to search engines.

>>61923947
yeah I'm not fighting you on that. for sure they don't need logs that long. but always a shot in the dark trusting companies and the logs they keep and don't keep and for how long.

>>61924519
i was thinking more along the line of the school tracking my laptop or something using the network.

curious my school uses those network servers where you log in to the wifi with your student number and such.

is where a way to mask my identidy while im on it? I kind of want to run a seedbox with my rasberry pi. Probably cant but its really becuase my school been cracking down on students for stupid stuff like googling porn or whatever. I just dont want to get tracked as a precaution.

>>6192172
If people only knew the huge external/internal gaps I see everyday in the networks of clients...
Even after I exploit LLMNR, NetBIOS over TCP, WPAD, SMBv1 and SMBv2...even after I abusing the shit out of SNMPv1 and/or V2 with default or well publicized default credentials/strings...issues that make you feel like you are trapped in 2011...

WHen you see the same opening you gained ingress by in the last engagement still almost wide open (maybe the same outdated version of software running a company site, but a particularly vulnerable plugin was updated), but now that IP/domain is part of the exceptions list...

Even after popping things like PLCs or other network services/appliances with default, hardcoded creds available all over the internet...

When you've used classical Pass the Hash (via PSExec) for the upteenth time in 2017...

Or when the objectves of the engagement are met, and you try to throw IT a bone and get detected, so you start getting really loud in the network, only to realize later that not only did IT miss it, but there was a SOC employed who missed everything as well...

The final response/answer is always akin to "we had taken your report into consideration, but we had found that <insert reason stating why improvement is not financially viable or does not fit into a current development cycle>".

There are companies out there who have been brutalized by malware like ShamoonA and B, Brickerbot and Wannacry/EternalBlue/DOublePulsar exploits...some by all of these...yet they will employ patches, update AV/AM DAT files, but not make changes to the protocols/services/open ports that are the real issue.

I love my profession, but that is something they rarely teach those going into InfoSec: how to deal constructively with the indifference to security inherent in 90% of the people (customers, non InfoSec co-workers) you will interact with (especially those who outright lie or minimize results when you are not around).

>>61921729
>My comment above was in agreement with this anon...I fucked that part up

Long live this thread...I love this place.

So I got bunsenlabs (based of desbain) installed on my laptop but I dont know how to get the root account working. During the installation it didnt ask for a root password.

I know I can acess root using sudo -i
But im trying to install a theme and I cant get it to copy the file to themes

>>61926315
not really relevant to this thread

>>61926315
Stop asking your shit here, go to /fltg/, you stopped being on point with the thread when you were done asking for help with installing bunsenlabs securely.

In a heap exploitation attack, you need to have the ability to spray the heap in the target program by using a scripting language like JavaScript, ActionScript, VBScript, etc. But, what if the program has no way for the attacker to use one of those scripting languages to spray the heap?

If you're the attacker, are you out of options for successfully executing shellcode at that point? Or is there some other kind of more advanced technique you can employ if you're trying to develop an exploit and you know that there is a heap vulnerability (double free, use-after-free, overflow, etc)?

>>61923528
post one for me to inspect and pass judgement upon then

>>61925761
>i was thinking more along the line of the school tracking my laptop or something using the network.
That is why you use a vpn

File: cyb anime 5.jpg (43KB, 720x480px) Image search: [Google]

43KB, 720x480px

>>61914660
Stellaris is a pretty good Grand Strategy game centered around space. Not to cyberpunk but a good space game in general

>>61924838
couldnt figure it out desu

>>61926390

spraying the heap is just about preparing the layout of the heap so you have a reliable location for your shellcode despite aslr. there are ways to manipulate the heap in other applications, but you'll probably have to figure out how the heap works and how the application allocates memory. chances are you'll need a couple of bugs that give you write and read exploit primitives, but which don't crash the application.

>>61927257
Ahhh okay, thanks for clarifying the use of spraying the heap. I've gotten to the point in my vulnerability research/exploit dev studies where I'm attempting heap exploit things and it's pretty complicated.

I recently discovered a problem in a piece of software which read from a freed object then crashed and was wondering what the impact of that would be if you don't have a way of writing to the heap as well.

I imagine if you could write to the heap some shellcode then read from it you would be able to execute arbitrary code, but without the write you would just have a possible information disclosure vulnerability.

>>61927694

how many memory allocations before the allocation of the freed object you end up reading from? if you can control the allocations before the uaf object then you should be able to control the heap.

how do yall post on 4chan with noscript and and a vpn?

I use a paid vpn and it's ip banned on 4chan and this website requires javascript. Is there some l33t m3gh@h@ck3r way to get around this?

>>61927796
After the crash, I checked the software with AddressSanitizer. The output said it was a use-after-free and that there was a read of size 2 located inside a 9-byte region. I've spent most of today attempting to decipher what the possible security impact of that is (since heap exploits are relatively new to me). The allocation is being done by a realloc function.

I'm not sure at the moment how many allocations are performed before the allocation of the freed object, but I will try and see if I can control the prior allocations. I wasn't aware of this method, thanks!

>>61925830
>The final response/answer is always akin to "we had taken your report into consideration, but we had found that <insert reason stating why improvement is not financially viable or does not fit into a current development cycle>".
At least you know you'll always have a job

>>61926315
try su root

>>61926411
What the fuck are you talking about

>>61928011

you won't be able to do much with a small read and controlling the heap just means you'll be able to place shellcode there. check the stack trace to see what functions are called before the read to figure out if you can do anything with the read data.

>>61928422
Yeah, I thought it seemed pretty limited. I'll do what you suggested and inspect the stack trace for functions called before the read to see if I can leverage it further. Thanks a lot!

>>61923945
I use Chrome to read and mc to upload.

And why page 9??

Any tips for quickly finding overflows in my own codebase? If I want to automate my job what should I be doing?

>>61908967
>my wife complains that I dislodge the fitted sheet in my sleep
>no ride-or-die techno babe to fuck on a bare mattress in cyber-squalor
why even live

So guys, whats the best VPN provider nowdays?
I currently got PIA, seems to work okayish, but been thinking of trying some other provider.

>>61894887
>hurr durr pirate everything
are you 12?
supporting the community is punk and also cyb when you are paying online. use bitcoin if you have to get your rocks off.

>>61930311
I would recommend you use a real ftp client

>>61925761
Change mac address and use that browser addon that changes your browser fingerprint. Don't use or do anything that will directly link to you unless through a vpn or proxy.

>>61928199
True that...like I said, I love my job.

There are clients who I test that have pretty tight security...these clients are usually situated in industries that are getting well regulated, like in the industrial and energy sectors where ANSI/IEC/ISA zones and conduit, "defense in depth" standards/philosophies are slowly graduating toward the norm.

Professional blackhat to hobbyist , this is such a interesting time to be involved in these arts.

>>61931624
What is wrong with Chrome and mc? Both can connect to FTP servers.

>>61930436
One proven way of finding some common vulnerabilities in your code is through fuzzing. You can compile with American Fuzzy Lop and fuzz for a few days to root out some overflows.

http://lcamtuf.coredump.cx/afl/

>>61932460
>this is such a interesting time to be involved in these arts
Amen to that. Some truly incredible things have happened in the computer security field. Seeing things like cybersecurity becoming a new domain of warfare, Stuxnet, Internet of Things botnets, zero day markets, it's crazy.

I'd like to know what the people who were hacking when it was just a nerdy hobby in the 90s think of things now, it must be surreal to witness.

How can I be a 1337 hacker?

>>61935402
get your self a pair of programming socks and a copy of sicp

File: 1502464245139.jpg (224KB, 800x800px) Image search: [Google]

224KB, 800x800px

Whats a good instructional for learning to red team? Im a paranoid brainlet
>>61893090
>Hated calc and ended up losing my chance to become an astrophysicist due to it
>ended up learning it on my own anyways while trying to become a software dev
>Now really want to drop everything and go become a physicist, but already 23
Fuck

>>61898535
>/sec/ can do better than this
Check out the history behind it, it never had anything to do with /sec/.

>>61899009
>bruss are you at all keeping tabs on whats in this ftp?
I had a look a while ago and it was kosher then. Not that I looked for steganographic stuff mind you.

>>61899568
>1. What year or decade do you see "cyberpunk" becoming a reality?
I'd say it is pretty much here already. The full on cyberspace vision is not here yet but they are working on that. The tongue interface can be used - check the FAQ.

>Right now most of the world is just low tech, low life. Where do you think it'll start? (my bets are on East Africa)
As they say, the future is already here it is just not evenly distributed.

>2. What's the difference between dystopian and cyberpunk?
Cyberpunk is a sub set of dystopia.

File: 1470942996054.gif (441KB, 1100x582px) Image search: [Google]

441KB, 1100x582px

>>61935978
I agree, we already live in a Cyberpunk World, and the tech is "slowly" catching up to it.
The Wired is essentially everything and can be access with just smartphone.
Things are getting more automated by the year and "megacorps" (google, microsoft, apple, facebook) are taking control of more and more information.

Obviously is not (yet) like in the books/games/movies, but honestly, it seems we are getting closer to that. In a few years from now, I could see things looking more and more like for example Transmetropolitan.

It's weird, exciting and worrying at the same time.

File: FSB_Moscow.jpg (38KB, 675x450px) Image search: [Google]

38KB, 675x450px

>>61893065
Hello there. Stupid question, but /sec/ question nonetheless - what do you think is the European/Middle East capital of hackers?
Râmnicu Vâlcea, Romania?
https://www.wired.com/2011/01/ff_hackerville_romania/
Kiev, Ukraine?
https://www.nytimes.com/2017/08/16/world/europe/russia-ukraine-malware-hacking-witness.html
Moscow, St. Petersburg, Russia
(pic related)
Tel Aviv, Isreal
http://www.businessinsider.com/opisrael-hackers-2014-4?IR=T
Any others?
If one was to make a /sec/ pilgrimage to the said locations to experience /sec/ culture, which towns/cities would you suggest?

>>61936754
*That was supposed to be Moscow OR St Petersburg..

>>61935950
>already 23

You faggot, you're still really young. Some people don't go to college until 40.

I'm getting a new job and the role is cyber security.

What's the best material to get red pilled on it all fast!?

>>61936823
>>61893065

I'll be posting the next thread as soon as this one hits the bump limit.

>>61935950
>Now really want to drop everything and go become a physicist, but already 23
Physics job market is good if you do a PhD. It is a long slog but worth it.

I did that.

File: Poll_cybsec3.png (64KB, 663x1166px) Image search: [Google]

64KB, 663x1166px

At last we reached 100 votes. http://www.strawpoll.me/13665376/r

And Europe rules this thread.

>>61937880
310 posts will be reached in a few hours. We are entering the quiteness of the European night.

>>61936754
Israel has a lot of hot stuff but is not exactly advertising it.

>>61936082
>It's weird, exciting and worrying at the same time.
Knowledge is power - more true than ever before. At the same time we depend on more and more tech that an ever decreasing number of people truly understand.

>>61935978
>>Right now most of the world is just low tech, low life. Where do you think it'll start? (my bets are on East Africa)
>As they say, the future is already here it is just not evenly distributed.
I agree, examples like Shenzen or some parts in Africa or Asia where the electronics are treated as raw meat gives us some great examples of what we have been becoming this last years.

>>61937988
>http://www.strawpoll.me/13665376/r
So many lurkers.

>>61937988
darn europeans

File: 1501660521398.jpg (399KB, 600x835px) Image search: [Google]

399KB, 600x835px

>>61937988
30 people posting in the discussion, nice!

>>61938492
I think we've had more people than that in the past.

>>61937988
>>61938517
>100 people low-sec enough to volunteer their board use to strawpoll/curse/twitch/amazon
there's more than that in the thread, that's just the LARPers

>>61934142

from what i've heard, they hate modern exploit development because of all the compiler/os protections. imagine hacking on dos in 16 bit real mode where you can jump or write anywhere by default then switching to 64 bit long mode with aslr/nx/emet/canaries. it takes forever to find and develop exploits now, but all the script kiddy tools have made it easier than ever to pop the easy to midlevel stuff. the cybercrime market used to be friends trading exploits/rootkits and now there's a billion dollar industry around computer fraud and abuse.

>>61936754
>Râmnicu Vâlcea, Romania
I'm always surprised of how the supposedly "movies things" end up being true, like criminals avoiding justice just because of how it is made, or because they don't give a fuck.

Seems like I'm still too naive.

>>61937988
>/sec/ is literally volunteering data mining info

How far the mighty have fallen...

File: stickers.jpg (192KB, 1920x1080px) Image search: [Google]

192KB, 1920x1080px

>People post in this thread and UNIRONICALLY aren't using a FOSS bootloader to launch their FOSS OS

Nice botnet, champ.

File: TtuOSNI.jpg (143KB, 500x782px) Image search: [Google]

143KB, 500x782px

>>61939043
>https://www.wired.com/2011/01/ff_hackerville_romania/
Romania is in the EU. Russia, on the other hand, has an essentially "look the other way" policy for cybercrime conducted by its citizens beyond the boarders. It is fucking infuriating.

>>61937988
Another 3 anons joined in, thanks!

>>61938086
>Shenzen
Also Taiwan is pretty hot. You can buy resistors and other components from shops as if these were carrots. Akihabara is of course always worth a visit. I bought stuff there years ago, cool place.

>>61938192
Yup. And we have 97 posters here so far. I guess the /sec/ crowd have second thoughts about voting.

>>61938419
Nah, we save this thread from early 404.

>>61938517
Probably. We are building momentum though.

>>61939085
Remember this is both /sec/ and /cyb/. While /cyb/ connects to net using a huge Yagi to tap into a distant neighbour's WIFI the /sec/ will probably not touch strawpoll.

Just a reminder that Redox is progressing
https://www.redox-os.org/news/this-week-in-redox-28/

And 9front is a bit slower.

>>61936823
>What's the best material to get red pilled on it all fast!?
Why don't you go buy a fucking book and study, you piece of shit fuckwit.

>using redpilled in the wrong context as an unironic adjective and verb
>thinking you can learn security quickly

You aren't going to make it

>>61894680
But bunsenlabs is based off of Debian? It is basically debian with its own repositories and defaults.

File: old_computer.png (338KB, 580x435px) Image search: [Google]

338KB, 580x435px

What is the most /cyb/ linux distro? I think Alpine Linux and Gentoo are contenders.

>cloudflare shutting down "hatespeech"
>ICANN refusing to authorize registrars based on political beliefs
we're fucked

>>61937880
>>61937988
MAKE NEW THREAD
QUICKLY

>>61940376
Alpine is the most /cyb/ and /sec/ distro.

>>61940583
This is what lefties yearn for.

>>61940671
>akira
>>61940668
>>61940662
>>61940583
>>61940376
>>61940203
>>61940116
The thread is dead, long live the thread: >>61940808