The DMZ

12:37 PM

@forest I occasionally use Tor, but it has such a performance impact it's just not useful for me

@RoryAlsop Same for me, I only use it when I really want my traffic to be as anonymous as possible

@Joshua.J Go to sleep!

Anonymous

I can't.

Anonymous

I'm at work, lol.

Anonymous

Well; I've got the rest of the day to study.

Anonymous

My CCNA Sec retake is on the 4th Oct so.

Anonymous

12:48 PM

I think I got it this time.

Anonymous

I'm very excited to start my OSCP journey after this ^_^

Oh, when do you plan to take the OSCP lab?

Anonymous

Well, my exam is on the 4h Oct for my CCNA Security, so as long as I pass that.

Anonymous

From the 4th Oct - 4th Nov I am going to have a "rest" period.

Anonymous

But it won't actually be a rest period, it will be a lot of HTB labs and reading, etc.

Anonymous

12:55 PM

Then I am going to buy my material sometime in between that because it usually is around a 10-20 waiting peroid.

Anonymous

Probably going for the 3 months of labs.

Anonymous

So hopefully around late Jan / Early Feb I will pass OSCP.

Anonymous

Which is just in time for my contract expiration here :D

Anonymous

That's the plan anyways..

1:11 PM

I'm not sure I'll be able to pass it that early :o

I'm still under the impression that I have a lot of work to do before going for it

Anonymous

One thing I will say, I wouldn't discredit yourself because of what others have said on the Internet about the OSCP.

Anonymous

I am not saying it isn't tough because it is. But I know a lot of people that have said - "when it comes down to it, the Internet loves to exaggerate the OSCPs difficulty"

Anonymous

And there is quite a lot of truth to that, in the Off-Sec certification hierarchy it is considered an entry level pen-testing cert.

Anonymous

And in the wider community, it is a junior pen-test role cert. So I would try to not listen to the blogs you read that say things like "OSCP is so difficult, you need a year of pen-testing before you take it" because I believe that to be false.

Anonymous

All you need is some nice general knowledge of pen-testing and enough time in the labs, and a lot of time you can dedicate and you will ace it.

Anonymous

1:16 PM

Besides, most people fail their first time, I've not taken it so I cannot confirm but I expect I will fail first time too! The great thing is, the re-takes are so cheap so if you fail it just adds to the experience.

@BenoitEsnard As you are a web developer, you may already have knowledge of python, bash script and TCP/IP. So you should go for it I guess :)

Anonymous

//rant over.

@daya I do, but I have a lack of knowledge in reverse-engineering, privilege escalation, pivoting, modern cryptography, steganography, networking, forensics & application exploiting (via buffer overflow etc.) :(

That's a lot to learn

As far as I'm aware, OSCP don't have web challenges

Anonymous

When doing labs and before you get labs I would focus on learning that BoF then.

Anonymous

If you can nail that lab in the first two hours you're off to a very good start.

Anonymous

1:19 PM

I wouldn't worry too much about Steg & Crypto, AFAIK there isn't much of that in the exam.

Anonymous

Networking, I don't think you need to have any super knowledge in it, just be aware of how things connect, etc.

@BenoitEsnard they will also train you before attempting the exam,.am I right?

Anonymous

The most important thing for OSCP is being comfortable with hacking tools.

Anonymous

And as you've probably heard a lot : enumerate, enumerate, enumerate some more then enumerate some more and more.

@daya You are! But that training costs money, so I prefer training before taking it. :D

Anonymous

1:21 PM

Benoit, here - offensive-security.com/documentation/…

@Joshua.J I'm reading that a lot at the moment

Anonymous

I think that will ease your list of how much you think you need to know for the OSCP.

But I'm not sure what enumerate means in non-web contexts

I've just found this article: blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation , does it mean that I have to try every command until I found some vulnerable app / misconfiguration?

@Joshua.J Thanks, I'll have a look!

Anonymous

What it means is you need to really be good at information gathering.

Anonymous

For example, say you have a box that is running a web-server.

Anonymous

1:23 PM

You would use a web-dir scanner and find all the directories you possibly can find.

Anonymous

And then you load them all up you read the source code, you mess around with the page.

Anonymous

Its just about gathering any information you can in order to benefit you.

Anonymous

System versions. Addresses, services.

Exactly

Anonymous

Also Benoit, there are tools that basically run all those commands for you.

Anonymous

1:24 PM

Let me find it.

Anonymous

@BenoitEsnard github.com/rebootuser/LinEnum

Anonymous

That is a really nice tool.

Anonymous

The part that scares me the most about OSCP, you can only use Metasploit once.

Anonymous

So you really, really need to save it for when you're in a very sticky situation.

How do they know you're using it? :o

Anonymous

1:30 PM

They proctor the exams now.

Anonymous

But, basically from your writeup they will know.

Anonymous

So you need a firm understanding of exploits, how to modify them and what they're doing.

Other tools are allowed?

Anonymous

You cannot just pop all the boxes using Metasploit.

Anonymous

Yeah you can use any other tools pretty much, but you can only use Metasploit once.

1:32 PM

That sounds like an arbitrary rule to me

Anonymous

It's actually a good restriction, else if you could just do all the boxes with Metasploit the exam would be much easier.

I understand why they've set it, but why once and not zero?

Doesn't Metasploit have any concurrent tool?

Anonymous

I guess it's just to be fair.

Anonymous

Because two of the boxes are seen as incredibly difficult, so they want to give students a get out of jail free card if you will.

I don't know how to use Metasploit anyway :D

Anonymous

1:33 PM

Have you done the MSFU course by OffSec?

Anonymous

I highly recommend it, it's a great course.

Anonymous

offensive-security.com/metasploit-unleashed

Anonymous

Free as well :D

Anonymous

But, it is good that you cannot just MSF the whole exam.

Anonymous

Else all you would need is the version number of the vulnerable service and a quick five minute Google.

Anonymous

1:34 PM

And you would root every box, lol.

Anonymous

But in general Benoit, I wouldn't be so put off by the whole Internet say "OSCP is so insanely difficult you need X years to do it"

can i cat the ruby exploit code and rewrite it in python instead of running mstf :D?!

Anonymous

You really don't, you just need to dedicate time and effort.

Anonymous

I am not actually sure HamZa, I think the general rule on using MSF in OSCP is you can use it for one box, but for the rest of the boxes you need to come up with exploits yourself.

Anonymous

But they don't expect you to re-write the whole exploit without help.

Anonymous

1:38 PM

You're allowed Google, etc.

Anonymous

They just don't want people doing this.

Anonymous

> msfconsole

Anonymous

> use insert payload here

Anonymous

> set rhost x.x.x.x

Anonymous

> set lhost x.x.x.x

Anonymous

1:40 PM

> set lport x.x.x.x

Anonymous

> run

a colleague of mine told me they want you to know basic buffer overflow, how you can search for exploit code, edit it and compile it etc...

so yeah, that pretty much sounds like what you're saying

Anonymous

Because it shows no skill, other than you can Google a version number and find a pre-baked payload and just send it.

Anonymous

Yeah, the BoF stuff is very basic for OSCP.

Anonymous

But what they want is someone who actually takes time to understand an exploit and research it a little.

Anonymous

1:41 PM

Its not a perfect system.

Anonymous

But it works better than allowing you to pop every box with MSF.

BoF = buffer overflow?

Anonymous

Yeah :p

@Joshua.J Okay, thanks for that advice. :D

Anonymous

No worries, as someone who wants to take the OSCP in a few months and does quite a lot of HTB.

Anonymous

1:43 PM

I find it sad how exaggerated the exam difficulty is.

I'm now in the top 1000 on Root-Me btw

I'm quite impatient to do the CTF next week-end

I personally don't like HTB boxes because it sounds to me like "hey, here's a box, perform some NMAP to it, msf, ..., profit"
I'd rather much like PWNing challenges in CTFs that require some advanced analysis with rev-tools

^ not just HTB boxes, but any kind of similar challenges

HTB is hackthebox.eu ? How good is it?

Anonymous

It's good if you use it properly.

Anonymous

If you just do what HamZa said, don't bother.

1:46 PM

i don't use it :P

Anonymous

If you actually read about the exploits, try to understand them, re-write them a little.

Anonymous

Then it is a great platform.

@Joshua.J eh, nice approach!

Anonymous

But if you're just going to nmap, dirb then MSF you're wasting your time.

Anonymous

Because that isn't "hacking" or pen-testing.

Anonymous

1:47 PM

Its just being a pro at Google.

Anonymous

And sadly a lot of the community are like that.

Anonymous

Just little script kiddies that dont want to learn they just think its cool, which is just really toxic and frustrating at times.

Anonymous

IMO; the worst part about HTB is the community, they really ruin how good the platform is.

Well, tbh I don't really care about the community

@Joshua.J i can tell you that some clients here literally just want you to scan&fuzz it with general tools with the amount of money/time they want you to spend on the project...

1:48 PM

I go on challenge websites to find challenges :P

Anonymous

Oh of course HamZa,

Anonymous

But in general, that isn't teaching you anything.

Anonymous

So if you're going to use HTB in that way you might as well not bother.

I guess clients don't want you to learn anything

Anonymous

Exactly.

Anonymous

1:49 PM

But for your own benefit if you're going to use HTB you do need to dedicate time to reading about the exploits.

@Joshua.J well i thought that "the challenge" was to get root no matter what

Anonymous

Well, HamZa it's a matter of perspective.

Anonymous

A lot of the users on HTB are 12 year old children, with a computer and no desire to learn that just want to be "L33T"

well honestly, i don't see how someone can read "exploits" if they dont know some basic assembly, programming, computer architecture etc...

Anonymous

Me on the other hand (and other users I am sure) are there to learn.

Anonymous

1:51 PM

I couldn't care less about my profile rank or how many flags I have.

unless we have a different definition of exploit

Anonymous

I just want to learn what something is doing and then be able to confidently write about that in my writeup.

Learning is fun

Hacking is fun

Anonymous

Anyway, the overall point is Benoit, if you're going to use HTB then I advise that when you're using MSF to get the flag, you do a lot more reading on the exploit.

But I also think that competition is fun :P

Anonymous

1:52 PM

Don't just do what most users do and go "well thats me done I found the payload in MSF"

Anonymous

Because at that point you're not learning...

Anonymous

@HamZa Plus, most of the challenges on HTB end up being some kind of web stuff or something along those lines.

Anonymous

I mean, there are other boxes that aren't but in general, the same recipe can be applied to get the flags for the boxes.

Well, on Root-Me I always make my own scripts, even when some are available online

Anonymous

Which is why HTB is bad if you don't do your research on the exploit.

Anonymous

1:54 PM

Anyways, I'm a believer in the service is sometimes what you make of it, these sites can be very good for learning if you actually take time to understand what the exploit you send to the device is doing - if you don't then you're wasting your time.

Anonymous

shrugs - I need to get back to CCNA-Sec study, take care.

Thanks for the discussion!

Anonymous

On a final note, if you're worried about not having enough knowledge, take some time to do more Root-Me, HTB, etc and then buy three months.

Anonymous

Three months in the official labs should be more than enough time to learn what you need, watch all the videos twice if you have to, read the hand guide and just go smash it - if you fail it's 60 EUR to re-take so just take some more learning time and smash it outta' the park the next time :)

A Khan

2:09 PM

What's your HTB rank btw?

3:19 PM

@Joshua.J will you join us next weekend for the CTF?

3:34 PM

@TomK. Is it also for beginners?

Because in IceCTF I didn't really managed to capture any flag :(

@daya i think you haven't focused on the easy challenges in icectf

I did!

@Hamza In web application, i hadn't nod idea what to do

but in some like crypto and miscealleanous I thought I was really close but didn't manged to complete

well dragon sector (the organizers of the CTF event) are one of the top ranking teams in the past years (first in 2018 for now!)
https://ctftime.org/stats/

I guess the level is hard to predict as there isn't a previous event for comparison. Since Dragon Sector is a seasoned team, there will be hard ones for sure. But also, many CTFs explicitly feature beginner challenges

so yeah, theoretically it should be much harder
but it depends on the organizers
sometimes they add a few entry level challenges

3:44 PM

Anyway, I will try these CTF's after gaining more knowledge

@daya start with root-me or some other ctf/challenge websites that runs all year

There's nothing wrong with gaining knowledge through failing at CTFs

4

^ this

so many times i get stuck at a ctf challenge, then i read the writeups
So good to see where I failed, sometimes i was pretty close and sometimes i was blatantly far but still good learning experience

Okay :)

@HamZa write-ups always make me feel amazed at how smart some people are. I mean, I used to teach hacking of networks and unix systems and always thought I was smart... but that was a long time ago :-)

3:48 PM

@RoryAlsop well i came to the conclusion that everyone is "smart" in their own way.

@HamZa I have resigned myself to the fact that at least I can hire smart folks and have a team that is pretty damn good

even as I continue to age :-)

I'm pretty sure somewhere in the CTF description it says that there will be a mix of difficulty levels

hehe

There's a danger of only reading write-ups and never participating in CTFs. Becaue you get the feeling, that people plow through challenges, but in reality it is just "less failing over time" until you stop failing and finally get that flag.

@TomK. and then you go to harder CTFs and the cycle starts again :P

3:54 PM

@RoryAlsop: can you pin that meta post please? security.meta.stackexchange.com/questions/3057/…

Until the end of the week-end. :)

Ha, was just about to ask that

+1, since the post isn't "hot" anymore

I don't know why it's not in featured anymore, maybe the site has automatically dropped it since it was too old?

good catch

probably

Anyway, it's good that you made it so early @TomK.

AFAICS it wasn't ever featured, just displayed as hot meta q due to upvotes

3:55 PM

yeah, I'm totally hyped already :>

It's easier to find people / prepare ourselves

well, we'll see how many people will be there

Btw, has any of you ever participated in hash cracking challenges?

where's the challenge in that?

besides from having a good cracking rig

optimizing algorithms?

Yeah, hash cracking mainly uses "rules" made by people when creating their passwords

Optimizing rules + wordlists can be a challenge

contest-2018.korelogic.com/intro.html

4:00 PM

but you are still cracking on your own rig?

I use my GPU

But if you have a rig you can use it of course :P

Not sure how useful it is, though.

You can also rent some GPUs online

mmh

I'd read the article about it, but doesn't interest me enough to participate :>

however this answer from @schroeder is very interesting

I'd love to read more about that

4:31 PM

I want that paper now!

5:11 PM

@BenoitEsnard done. Best remind me when to un-feature it :-)

@RoryAlsop Is it okay to flag the post for such things or should that be raised in chat instead?

Easiest in chat. If you @ me or one of the other mods we get the ping even if we aren't in chat at the moment

@RoryAlsop I'll remind you. :) Thanks!

Why doesn't SE chat have a @mods feature?

Anonymous

@TomK. I will be bashing out NA Sec studies.

Anonymous

But I will join the next one :p

Anonymous

5:22 PM

I can't evaluate how useful I will be though.

6:23 PM

Haha @Anders, I've just noticed your edit! I was wondering what the fuck was going on with all those reputation changes :D

@everyone: do you see the CTF post in the featured div?

Not yet, it's likely due to caching

6:42 PM

That's my guess too

9:20 PM

It looks like only one featured meta post gets to be in the div. And there is already the one about the site design... I'll look at it and see what I can do

Code Golf has 2 featured posts atm: codegolf.stackexchange.com

Not sure if that helps though