News

Before I begin - everything about this should be totally and completely ethical at it's core. I'm not saying this as any sort of legal coverage, or to not get somehow sued if any of you screw up, this is genuinely how it should be. The idea here is information security. I'll say it again. information security. The whole point is to make the world a better place. This isn't for your reckless amusement and shot at recognition with your friends. This is for the betterment of human civilisation. Use your knowledge to solve real-world issues. There's no singular all-determining path to 'hacking', as it comes from knowledge from all areas that eventually coalesce into a general intuition. Although this is true, there are still two common rapid learning paths to 'hacking'. I'll try not to use too many technical terms. The first is the simple, effortless and result-instant path. This involves watching youtube videos with green and black thumbnails with an occasional anonymous mask on top teaching you how to download well-known tools used by thousands daily - or in other words the 'Kali Linux Copy Pasterino Skidder'. You might do something slightly amusing and gain bit of recognition and self-esteem from your friends. Your hacks will be 'real', but anybody that knows anything would dislike you as they all know all you ever did was use a few premade tools. The communities for this sort of shallow result-oriented field include r/HowToHack and probably r/hacking as of now. The second option, however, is much more intensive, rewarding, and mentally demanding. It is also much more fun, if you find the right people to do it with. It involves learning everything from memory interaction with machine code to high level networking - all while you're trying to break into something. This is where Capture the Flag, or 'CTF' hacking comes into play, where you compete with other individuals/teams with the goal of exploiting a service for a string of text (the flag), which is then submitted for a set amount of points. It is essentially competitive hacking. Through CTF you learn literally everything there is about the digital world, in a rather intense but exciting way. Almost all the creators/finders of major exploits have dabbled in CTF in some way/form, and almost all of them have helped solve real-world issues. However, it does take a lot of work though, as CTF becomes much more difficult as you progress through harder challenges. Some require mathematics to break encryption, and others require you to think like no one has before. If you are able to do well in a CTF competition, there is no doubt that you should be able to find exploits and create tools for yourself with relative ease. The CTF community is filled with smart people who can't give two shits about elitist mask wearing twitter hackers, instead they are genuine nerds that love screwing with machines. There's too much to explain, so I will post a few links below where you can begin your journey. Remember - this stuff is not easy if you don't know much, so google everything, question everything, and sooner or later you'll be down the rabbit hole far enough to be enjoying yourself. CTF is real life and online, you will meet people, make new friends, and potentially find your future. What is CTF? (this channel is gold, use it) - https://www.youtube.com/watch?v=8ev9ZX9J45A More on /u/liveoverflow, http://www.liveoverflow.com is hands down one of the best places to learn, along with r/liveoverflow CTF compact guide - https://ctf101.org/ Upcoming CTF events online/irl, live team scores - https://ctftime.org/ What is CTF? - https://ctftime.org/ctf-wtf/ Full list of all CTF challenge websites - http://captf.com/practice-ctf/ > be careful of the tool oriented offensivesec oscp ctf's, they teach you hardly anything compared to these ones and almost always require the use of metasploit or some other program which does all the work for you. http://pwnable.tw/ (a newer set of high quality pwnable challenges) http://pwnable.kr/ (one of the more popular recent wargamming sets of challenges) https://picoctf.com/ (Designed for high school students while the event is usually new every year, it's left online and has a great difficulty progression) https://microcorruption.com/login (one of the best interfaces, a good difficulty curve and introduction to low-level reverse engineering, specifically on an MSP430) http://ctflearn.com/ (a new CTF based learning platform with user-contributed challenges) http://reversing.kr/ http://hax.tor.hu/ https://w3challs.com/ https://pwn0.com/ https://io.netgarage.org/ http://ringzer0team.com/ http://www.hellboundhackers.org/ http://www.overthewire.org/wargames/ http://counterhack.net/Counter_Hack/Challenges.html http://www.hackthissite.org/ http://vulnhub.com/ http://ctf.komodosec.com https://maxkersten.nl/binary-analysis-course/ (suggested by /u/ThisIsLibra, a practical binary analysis course) https://pwnadventure.com (suggested by /u/startnowstop) http://picoctf.com is very good if you are just touching the water. and finally, r/netsec - where real world vulnerabilities are shared. submitted by /u/SlickLibro [link] [comments]
https://www.reddit.com/r/hacking/comments/a3oicn/how_to_start_hacking_the_ultimate_two_path_guide/

Sub banner contest 2024

Zeekill: From teenage cyber-thug to Europe’s most wanted. Julius Kivimäki's imprisonment for blackmailing therapy patients brings to an end an 11-year cyber-crime spree that started when he rose to prominence in a network of anarchic teen hacking gangs.

Sad

Google Ads at its finest

MOST are such a disappointment!

Reverse shelling a router - Good watch

Use Case of Kali Linus on Raspberry Pi

Lost my job, 4 months to break into cyber security

any way to speed up hydra?

Why was Mitnick caught?

Why I don’t play Red Team anymore.

Elite Russian hackers breach Scholz’s German socialist party

Are smart ledlights a security risk?

Looking for a OSINT tool

I would like to re-create the device from this video. Thoughts?

Looking for a Tool

Windows Password Bypass Tool That Doesn't Modify System Files

One password to rule them all

Windows Password Bypass Tool That Doesn't Modify System Files

Built a Python script that maps all of the connections shared by a given number of internal links from any accessible website on the Internet. Those relationships are returned as a JSON file, and finally visualized using a D3 network graph. Link to the GitHub repo in the comments.

Cracking Into Password Requirements

Hijack DLLs through proxying

One of Europe’s most wanted cyber criminals has been jailed for attempting to blackmail 33,000 people whose confidential therapy notes he stole. Julius Kivimäki obtained them after breaking into the databases of Finland’s largest psychotherapy company, Vastaamo.

SiegedSec just hacked the Westboro Baptist Church :3

exploit.education - provides a variety of resources that can be used to learn about vulnerability analysis, exploit development, software debugging, binary analysis, and general cyber security issues.

Whats a great course on Udemy to learning code for beginners?

reddit.com/r/cybersecurity

2024-04-29T00:00:12+00:00

Mentorship Monday - Post All Career, Education and Job questions here!

CVE question

Building an SOC From Scratch: The Importance of Documentation and Network Segmentation

Iranian hackers pose as journalists to push backdoor malware

How deep into certifications should you go at “entry level?”

Half of Americans Support TikTok Ban, Poll Finds

GPOs and DC DDOS

CIRCIA Requirements Go Too Far

How-To Install and Setup: Azure Arc, (AMA) Azure Monitor Agent and (DCR) Data Collection Rules for sending Linux Syslog to Sentinel for Threat Hunting and Security Monitoring with AuditD

I think I blew my last interview

Cybersecurity Stash: Your One-Stop Directory for Security Tools and Resources!

Best Practices for Setting Up an Enterprise Simulation Network

What after TPRM?

Is SOC 2 Report Sufficient for Vendor Risk Management?

Penetration Test Legality

Has anyone ever been a Cybersecurity Champion for their company/department?

Jobs being outsourced

https://www.reddit.com/r/cyber »

Hello everyone, I work for a pretty large MSSP in SOC in the U.S. I'm closing in on almost 3 years here, a couple months ago I was promoted to senior security analyst. I noticed a trend starting early last year, the company starting doing layoffs at first for the tier 1 soc roles and helpdesk, not all of them but a good amount, then after a week or so we were introduced to new team members for the same roles that were laid off but they were based in India. Then in Sept of last year, layoffs again, this time tier 2 where I was at, at the time. Same thing a week later more teammates from India. Finally once I was promoted a couple months ago to a senior I thought I would be safe. 2 weeks ago, again layoffs announced, this time some of our security engineers and software engineers, you can see the cycle here, surprise, the following week those roles were replaced by people in India. Now almost 40% of my team is based out of India in the SOC, I know with our helpdesk the figure is higher, and with engineering its probably somewhere in the 20%. To be honest without disrespecting anyone, ever since the arrival of the employees from India, our quality of work has declined drastically, I am continually having to intervene on tickets worked by them, which is taking more time from myself having to work on high priority situations, we are constantly having miscommunication issues and it has made work much more difficult then it needs to be. Customers are filing more complaints then ever, some of our application projects for engineering that were due to be released months ago have been pushed for a further timeframe of 5 to 6 months. We had some of our biggest clients telling us that they will have to think carefully if they will want to renew their contract with us. One of the main reasons I went into cybersecurity and spent so much time on education and certifications was because I was being told and led to believe this is a secure field for job risk. I understand a corporation's main goal is to generate profit. But I thought roles in this industry would be more inclined to not be outsourced due to the nature of security data that US companies would be inclined to not have that data accessible overseas. So I can see the writing on the wall, either the company will start laying off the seniors and replacing us for cheaper labor or they will want us to stay here to oversee the environment. Doesn't matter to me though because I don't want to work at this company anymore due to the reasons I stated above. I am continually seeing headlines of these tech layoffs but one of the main backings of these that isn't talked about enough in my opinion is outsourcing. So as I brush up my resume to start looking for another job, which sucks to think about because I genuinely enjoyed working at this company previously. I think to myself and hopefully I can gain some insight from all of you, what roles in the security field are less prone to outsourcing? I am mostly experienced in blue team/defense security and incident response, should I start looking at red team? cloud security? application security? or a specific industry in security? Etc. security is a vast field so I would love any input from you. submitted by /u/Arminius001 [link] [comments]
https://www.reddit.com/r/cybersecurity/comments/1cjau8v/jobs_being_outsourced/

Half of Americans Support TikTok Ban, Poll Finds

Question on correlation rules/detections development

Need answer for the question asked in interview

Help with a project that does make sense ?

https://www.reddit.com/r/cyber »

Hello sorry for the long post but my brother asked if i could put a post out here to see if anyone knows how to do this Project or really where he could find a good tutorial that can teach him how this works and how to do it. His professors told him off and wont help him at all, he's trying to get it himself. I've tried to help him but I don't work with this stuff much as I'm studying a different field in tech but have been trying my best to help him. Below is the project and what they want him to do, also any recommendations on what software to use? "This project will test your ability to ethically hack into a target system. You may use all of your accumulated knowledge and ability to compromise the target and locate useful information on it. You will also create a document that illustrates your tools, techniques, approaches, exploits, and resulting data. START THE SYSTEM HACKING TARGET VM Add the downloaded System Hacking Target virtual machine to VMware and start it. You will not log into the system. Instead, it will be the target of your ethical hacking work. TOOLS AND ATTACK VMS You may use any tools and new or pre-built Vms for this project. Helpful tools from this class, which may help on this project, include: • Nmap • OpenVAS • Nikto • BurpSuite • ZAP • Metasploit • John the Ripper • Hashcat • Kali Linux You may use any other tools. Be sure to document and explain all tools’ use. RECONNAISSANCE Perform reconnaissance to learn all you can about the target VM, without hacking into it. Summarize any services you feel may be exploitable, as well as information that helps to identify the type of system the target it running. System Hacking Project Page 1 of 3 FLAGS 11 flags have been dispersed through various locations in the target VM. They are clearly labeled, and you will recognize them when you encounter them. You must find 6 of the flags through your ethical hacking efforts. Each additional flag that you locate, over 6, will earn you an extra credit point on this project. Be sure to document each flag you find and where you locate it. Additionally, if the flag contains encrypted text, you must decode it to receive credit. EXPLOITS Successfully perform 5 separate exploits to gain access to the target system. You need to document the process you used for each exploit – your thought process, the tools you used, the results you saw. PASSWORD COMPROMISE After successfully exploiting the target, obtain the password hashes for the following users. • klog • msfadmin • postgres • root • service • sys • user Once those password hashes are obtained, crack them and identify each of the compromised user’s passwords. For extra credit, identify the MySQL database service root user’s password." Again thank you all for taking the time to even read this and we arent looking for someone to do this ourselves we are just lost on what needs to be done and we can't really find anything to help us and was wondering if anyone else has anything we can watch, read, etc. submitted by /u/clone10001 [link] [comments]
https://www.reddit.com/r/cybersecurity/comments/1ckf6b0/help_with_a_project_that_does_make_sense/

Microsoft E5/E3 for users.

Another major pharmacy chain shuts following possible cyberattack

SOC analyst - Engineer transition

Seeking advice on what to branch into / what to know for cyber security / cloud security roles

Book recommendations for Quantum Computing in Cyber Security