Can you give a quick list of popular attacks on each OSI layer? Like L7: wireless sniffing

A bit like this: us-cert.gov/sites/default/files/publications/…

I think I can replace most Burp Suite basic usage with just Python. So far, I haven't even learnt to use Burp much at all. Pretty much anything where Burp is suggested, I can do with just using F12 -> Network in firefox and copying the request details to a python script. Burp has been kinda slow for me with the GUI and throttling. The only reason I may use Burp for now would be for its plugins/extensions.

not sure what you are trying to say @JohnZhau

Just my experience with Burp so far

@JohnZhau Burp has a lot of uses. For one, being able to modify a request on the fly without the browser interfering is very valuable. Another very useful tool that Burp offers is the Repeater, where you can quickly replay a request and manually edit everything (endpoint, cookie, parameters, headers, etc.)

The Intruder is another useful tool, which allows you to quickly throw a set of data against a HTTP endpoint. You can use it to check if there was brute-force protection, account lockouts, etc...

Sure, all these things can be automated, but imagine you only have 5 days to pentest a web application, do you want to waste time writing a python script from scratch that sends a wordlist to an endpoint at a specific position in a HTTP request, or do you want to be able to press CTRL+I, select the insertion point, select the list and click "Go"?

It's the unfortunate reality of penetration testing that in a lot of projects, you have way too little time to test everything extensively. And as such, every little tool that helps you save time is much appreciated.

Another good example is the Burp Decoder. Sure, Burp isn't the only tool that allows you to encode a string to an URI string or decode some Base64 data. But it has the advantage that it's right inside the tool you're already using. It means I only need to press a shortcut to convert something from one format to another, instead of having to go to a different program.

Usually, you only whip out custom scripts when you really have something to gain from it.

Career Choice Tip: Cybercrime is Mostly Boring - Krebs on Security

I guess that's a good thing...?

@FireQuacker You can see this in action with all kinds of CS:GO aimbots

Users are exceptionally whiny and devs ban anyone who criticizes them

Which is really funny. I really like seeing CS:GO cheaters get triggered

@FireQuacker I find the conclusion of this not too convincing. People go into cybercrime for two reasons: for fame and for money. But the fame you get is mostly from other people in cybercrime. Hackers in real life or in tv shows aren't cool. Script kiddies don't read the news. They read and believe what their friends on the same discord server say.

and your skid friends will be really proud if you deface the website of some official institution or when you dox the owner of the minecraft server that you dislike

I guess the economy of the country the perpetrator resides in also plays a role in this (to tie in with the monetary incentive). I guess this is a reason why russia and china are such prominent sources of attackers - because comparatively, cybercrime pays a lot more than a regular 9 to 5

And also India with the almost stereotypical tech support scam. I guess if I had the chance to earn magnitudes more via illicit means and had very little to fear in terms or law enforcement, then there is a strong incentive to go into cybercrime

When hiring for cybersecurity roles and using a recruiter, how much difference is there in using specialized headhunters specific to GRC and infosec vs general recruiters?

My gut says a lot given the technical nature of the role and specific knowledge, but want to check as our team at work is hiring and we are thinking of using recruiting firms

@Anthony I was on the job hunt recently and sent my cv to several recruiters and I have to say: the one that I was the most comfortable and pleased with, was the one who was specialized in infosec jobs

a big plus that I didn't really see before, they are able to see which roles really fit for the candidate and the company. so for instance: I told my recruiter that I applied for some positions and I was wondering why he didn't tell me about those. he then explained to me, that he knew from interviewing the company and me that I didn't bring enough skills in a certain area or would need too much induction to be considered at all. so that was a real timesaver for all parties involved

I doubt that someone who wasn't specialized would've seen these important details

@TomK. Are you comfortable with naming a few companies that I may reach out to? We have a 2 role for a cybersecurity intellugence analyst , and 1 spot on soon to be red team

this was in germany, not sure if this would be of any help

Evening folks! Given remote work nature due to covid 19 , how have other people been handling physical security at office especially for contractors and other non FT employees? Almost has a security incident today on this...

Lost badges, disabling upon termination etc.