@JonathanMusso how good and familiar are you with shell coding?

@AviD What was that now?

@Simon what was what when?

Soon I'll be calling you Mr. (removed).

@LucasKauffman Ok thank you. I will look for that. I am new to the Linux world, started learning about it this last year. I have not done a whole lot of shell coding, mostly simple commands to get around Linux. Security is something I have always wanted to learn about, I spoke with some individuals on Quora from Germany and they recommended OSCE.

@JonathanMusso Shell coding as in writing assembly code not shell coding as in bash :p

@LucasKauffman Ok, none haha.

@JonathanMusso if you only just learned about Linux I'd go with the "beginner" one as it will already be handful :p

@JonathanMusso Learn assembly imhk

Imho*

@MarkHulkalo I wouldn't start with assembly TBH, C is about as low-level as is needed initially

@LucasKauffman Ok, I have been reading this as well amazon.ca/The-Basics-Hacking-Penetration-Testing/dp/1597496553 but that is where my knowledge ends.

C? Great. I have had some experience with that.

Assembly knowledge is perfect for reverse engineering and finding vulnerabilities. There are multiple ways to do it, including monitoring the traffic that goes in and out of the program. But assembly really helps

pls Assembly

@MarkHulkalo sure, I just wouldn't start there

hi Simon

Huhm, it's pretty much where I started :(

@MarkHulkalo it's a complex field on it's own and whilst helpful to security research especially it's not essential to get started

Why don't you start at the lowest level and make your own electricity to power your PC too?

@JonathanMusso Hi there

@MarkHulkalo so you have a leg up in the security stuff, great but absent that I wouldn't have started there :)

@MarkHulkalo to be fair for pentesting you don't need assembly knowledge unless you are modifying exploits

True, it's not essential to get started.

@LucasKauffman Explain please. I mean, using automated tools is one thing, but... I mean, are there actual tools that do this for you?

You're making me feel like a fogey.

do you have any go to resources on assembly?

Pen testing programs that write shellcode for you? Or have some kind of default payload?

@ThomasPornin, does the bear approve of this Crypto.SE Law.SE community ad?

@MarkHulkalo pentesting is not just about shellcode

the new season #DaysOfOurDMZ has been cancelled because you're all boring and nobody wants to watch a bunch of geeks talk about crypto

in fact, its a very small subset thereof

@kalina Damn it!

@kalina pls

@kalina somebody actually talks about crypto here!?

@kalina SIMONS HAVING MY BABY

WAT

WAT?!

in other news, #BigBangTheory has been renewed for season 92 but that's because they don't talk about crypto

I'M GONNA HAVE A BROTHER?!?

OMG so it's an @Ohnana @kalina @Simon love-triangle now

aaaand here's the 4th part of the love-square

nobody ever talks about serious things in here! this is the DMZ!

yesss the room is off topic again

@kalina well, if it was completely clueless and a whole lot more narcissistic, it would be just like #Scorpion, and that got picked up for another season.

Is this season the one where we find out that ohnuhnuh is my mother too?

Or is that too much drama at once?

@Ohnana you're welcome ;)

@SEJPM I approve of bears, generally.

@AviD I really don't have much experience pentesting with applications that do the job for you. So yeah, any recommendations?

@ThomasPornin Yeah but that bear is not pretty at all.

It looks fogey as F.

@MarkHulkalo define "pentesting"

@MarkHulkalo cobalt strike (the free version) is a good place to dabble in a wide variety of skills

@AviD well basically, when a man and a woman like each other...

@AviD ( ͡° ͜ʖ ͡°)

@kalina pffft

veil evasion, nikto, nmap (essential IMHO),

@Simon GTFO

@Simon Your lack of taste is as appalling as your mistreatment of grammar.

dayum

@ThomasPornin What's wrong with my grammar now?!?

OH COME ON DON'T STAR THAT

pornin bringing the heat

NO, THAT

NOT THIS

@MarkHulkalo One does not simply use automated tools to pentest. Pentesting is more than launching tools. You will need to learn web applications, databases, Linux, Windows and most and foremost: thinking outside of the box

@LucasKauffman or even, think about what the box is made out of

@LucasKauffman I know those thingies. Like all of them. I just thought there was some weird tools that automated it which I wasn't aware of

think about the box itself, not just inside or outside it.

@AviD And understand that the people would like you to think the box is made out of something, which in fact it is not

@MarkHulkalo there are, but depending on your defintion of pentest, they would only automate a small part of it.

@LucasKauffman Also, your avatar is distracting me because it means "f your mother" in Chinese.

@MarkHulkalo pls, you can't automate pentesting, it requires passion and skill

Well it's a common word to say that and avoid being censored

@kalina pls pentesting is a fallacy

@MarkHulkalo no shellcoding and exploit modification is done with Notepad++ and using Imunity or GDB :p or if you have cash you can use IDA Pro

for example, if we are talking about pentesting web applications, then there are plenty of web scanners, but that is like maybe 12% of the work.

I love IDA Pro

also, vulnerability scanning != pentesting.

@AviD And how useful would Assembly be to pentest web apps?

ask @RоryMcCune for his blog post on that...

@Simon exactly.

@Simon shellcode?

this is great :D

@Ohnana in a web application?

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA!!!!!

@Adi wooooooooooooooooooooooooo

@Adi Woohoo, congrats!

@Adi NICE!

@Adi Congrats

@LucasKauffman idk maybe it's old as balls and the programmer sucks

@Adi congratulations!

@Adi wooo

Thanks, guys! Man I feel great!!!

@Adi woot! congrats

and girls

@Adi fwiw I've always found you offensive, but now it's official!

lulz

@kalina I like you too

@Ohnana then you wouldnt need shellcode, you can just upload a PHP file.

@Adi <3

PEE H PEE

DYNAMITE

Finally I can get some sleep!

@AviD idk man i've seen weirder shit

@Adi how was the course?

I should take that course. Link it

@MarkHulkalo How polite, you must be American.

@MarkHulkalo offensive-security.com/information-security-training/…

@Simon "The course, motherfucker, link it"

@MarkHulkalo and offensive-security.com/information-security-certifications/…

@JonathanMusso Fantastic!

@kalina It was damn close to that, yes.

Very challenging, very interesting. I learned a lot

Thank you, everyone

I had a look at that course and didn't understand what was required of me so I guess I'm not cut out for computers

Seems expensive. Maybe I'll just hack their website and steal the certificates

gl hf dd ds

ggwp

Then the FBI will show up at my house and kick the crap out of me and put me in gitmo

@kalina you need to be able to pwn n00bs like a 1337 h4xx0r

@MarkHulkalo is that like github?

@Adi great! if you don't mind me asking, what was your experience before taking the course?

@RоryMcCune but I do that by walking up to them while they're using their PC, smiling real cute like and then sitting on their lap and just using their PC, all this hacking and compiling and scanning nonsense is just a bit out there

And then you do the pls dance.

@RоryMcCune Hahahahahahahahahahaha.

@JonathanMusso Holistic security knowledge. Nothing specialized.

@Simon the pls dance isn't really appropriate while sat on somebody's lap

SAYS WHO?

says me

@kalina That sounds hot. Don't sit on my lap, though. You might break my legs.

@kalina yeah well it's likely no co-incidence that the best social engineer I know is a lady

o

there are standards that must be adhered to

@MarkHulkalo did you just call me fat

LOL

omg lol

@kalina No, I'm like Joker from Mass Effect.

pls you're only 1% as awesome as joker from Mass Effect

(dodged a bullet or ten, I think)

if you're lucky

@JonathanMusso I had some basic experience with offensive security

but yeah, very basic

@RоryMcCune That only works against losers :(

@MarkHulkalo I think you mean "most men"

@MarkHulkalo no being nice and smiling at people and talking to them works on a lot of people

@Adi alright thanks, I am hoping to take the same course. what sort of lab time did you purchase and how many hours did you put in roughly?

@MarkHulkalo the only people immune are those who don't find you attractive and those in a relationship who genuinely wouldn't cheat and are quite serious about it

For those not on FF: google.ca/#q=a+long+time+ago+in+a+galaxy+far+far+away

@kalina I disagree. For example, a woman that's out of your league and is attractive, and is approaching you for information. You know it's fake and can easily turn it against her, for example, misdirection.

I can't go into it any more than that, but yeah, it can backfire :p

@MarkHulkalo You must be fugly.

@RоryMcCune Maybe, I guess. I think I'm thinking a bit deeper than that

@MarkHulkalo I don't love their pricing.

@Simon the fugliest ever.

o

@MarkHulkalo I wouldn't when we're making general statements about the efficacy of Social engineering, it's not about specific people but about general trends

Yeah, social engineering in general is extremely effective, I'll agree. I just meant a bit deeper.

And women can be really good at it, if the target is dumb enough

i have to spend a lot of time with someone to actually be attracted so ppl trying to pull that bullshit on me is super obvious

+10 charisma resistance

@kalina Did you see how sexist he is? He's saying that women are better because they're women, not because they're skilled.

@Ohnana Exactly. Falling in love with you after two weeks? Please.

@Ohnana +10 Perception

@MarkHulkalo that's a better description

@Simon sadly a decent portion of that is probably true, I did start off by saying that not being attracted is a valid resistance

@Simon Well who is going to trust a guy that does that? He'd be a creep to most people. A clingy creep.

o

@MarkHulkalo cough mitnick cough

ROFL

Okay, you win

@MarkHulkalo idk, lesbians and gay men are also good at this

it's about compatibility

I really should go to the doctor and get my cough looked at

what about Frank Abignale

@Ohnana Agreed, but I'm immediately suspicious of most people

he had great success socially engineering men as well as women

Yeah, he was legendary

Gay men always want my ween, I've got some sort of super power.

@kalina how long have you had it?

Okay, it works both ways then. I concede victory.

@MarkHulkalo it's all about giving people what they want -- sex, money, power, confidence, whatever

@kalina describe your cough. Dry?

@Ohnana And donuts.

oh boy it's Dr. DMZ

@Ohnana you can take what you want and still be immune to it.

@Ohnana I think it's called honeypotting or honeydicking

pls

@MarkHulkalo the former is a technical term

@MarkHulkalo convenient

@kalina if you've had it longer than a week, please see a doctor.

Especially if it isn't improving

and if you're hacking up blood see a doctor today

it seems to occur whenever I need to convey some information that is seemingly on topic but overlooked by those active in this chat room where I'm the least on topic individual present

@kalina Some might say there is a relation between the two.

@kalina sigh, that was too subtle for this room :op

HEY I REPLIED TO IT

@Simon you're a relation between the two

o

Dammit, kalina

I'M RELATED TO SIMON?

OH MY GOSH

WAT

suicides

@kalina yeah he's your brother/cousin/uncle

@kalina i see, is this cough related to your inability to be direct? :P

does the pls dance

@Ohnana kalina.... unable to be direct.....

lol

@Simon bro stop being humiliating

Lol

pls sis am a free man

Wait a minute, weren't they. .. Uh...

I'm in #Alabama

@Simon if u keep dancing like that we can no longer be related

@MarkHulkalo the DMZ does strange things to men and women alike

does the pls dance like there's no tomorrow

What does ROP mean in this context? ^^

return oriented programming

@DavidFreitag Return Oriented Programming

That's what I thought

Thanks

@kalina and you say you're not good at computers

I'm not

@DavidFreitag corelan.be/index.php/2010/06/16/…

I know nothing

She's just good at Google.

I am exceptionally good at Google

@DavidFreitag BTW if you've not seen sockpuppet.org/issue-79-file-0xb-foxport-hht-hacking.txt.html you might be interested

Like when she found out the capacity of a local club here and roro thought it meant that she played there.

like pls roro it's the second google link

@RоryMcCune I live at the bottom of the ocean, chances are I've never seen it :b

@DavidFreitag dovid you've dropped your cap: d

@Simon I think it's more that it's so seemless it looks like I know what I'm talking about

@Simon in 2 seconds look just 'cause you are trying to un-remember your night of disappointment in that club with @kalina doesn't mean it didn't happen

or, alternatively, I do know a lot of things and I'm misdirecting you with the whole Google thing

wat

@Simon Hmm?

@DavidFreitag YOU FORGOT YOUR CAP

Here: d:b

I really wish wikipedia would stop begging for money

@RоryMcCune actually it's more than he realized it was me but I managed to avoid him all night

and then denial because if he accepts it, it means he's been nasty to me lots and he doesn't want to face the truth

@kalina ahh I thought this was the reason why, the other day, you knew the size of his pony

@DavidFreitag Me too. How dare they try to stay alive.

@kalina that you'd encountered and been disappointed by it, in that club

wot

I might donate some day, but I don't like nag screens.

@MarkHulkalo Well I already donated $200 to them in the past

$200?

So you would think the prompts would be small and not take up half the fucking screen

@DavidFreitag servers aint cheap son

That's like $200,000 in non-Dovid money

Wikipedia is worth millions, they don't need money

they definitely don't need money 18 times a year

That's a whole lotta cash, Dovid.

EVERYBODY JUST HAVE GOOD GOOD TIME

maybe they should stop paying their execs so much money

They just need to suck it up and start advertising

@DavidFreitag NOOOOOOOOOOO

oh god NO

they might as well

@kalina Their founder needs a new yacht. The old one is so 2015.5

@Ohnana Use adblock you tool

adverts would be less intrusive than their begging banners

^^^

@DavidFreitag it's not about seeing the ads

@Ohnana I don't really care what it's about

makeuseof.com/tag/wikipedia-millions-bank-beg <-- Wikipedia ain't short of cash

Because those stupid fucking banners make me never want to visit the damn site ever again

and they don't spend most of the money on servers

i don't care about that, it's the whole "we advertise on your site, we can squeeze your balls to make you remove content we don't like"

@Ohnana I hate that. They self censor for China

Or at least they're trying to.

@Ohnana you're missing the point, Wikipedia have been begging for money for years and haven't needed it for most of those, they are basically advertising already but skipping out the middle tier

@MarkHulkalo are they?

They're trying to. The founder flew to China to ask it to get unblocked

Just like Zuckerberg was doing

@kalina they're advertising themselves -- it's when you start bringing in companies with vested interests that it gets sticky

Unblocking in China means censorship.

Oh god what did I start

WWW

When I was living in China, most juicy stuff on Wikipedia was censored.

nobody world wide webs anymore

"juicy stuff on wikipedia"

let's ponder those words for a moment

Tiananmen Massacre for example.

Information about political leaders, party members

Stuff about what Map Zedong really did, etc

I've searched but I'm unable to find the parallel dimension in which encyclopaedias contain juicy information

time to scan the deep web (of dimensions)

All of that stuff was censored. Either replaced with a tame version, or blocked

do u even vpn bro

Of course.

you sure?

My wife didn't believe me about the Tiananmen Massacre until I connected to the VPN and showed her that stuff, plus some cultural revolution craziness

I used the VPN to show her the difference between Chinese and American internet. To show her what gets censored, etc

the VPN?

Yar

interesting

"organic oranges"

WTF @Ohnana

i'm pretty sure having a baby halves your intelligence

@MarkHulkalo Well Mark, you may think you are safe, but I am in fact not a llama, but a secret undercover chinese agent which has now seen you are a dissident and against our great country!

Babies should not play with oranges. They lack the teeth to chew it uo

@Ohnana what's wrong with organic oranges?

@LucasKauffman Considering your avatar means "fuck your mother" in Chinese, I already knew!

Alpaca in Chinese, said with different tones, means that.

@kalina the line between organic and not is complete bullshit a lot of the time

We actually had students being arrested who were identified as corporate spies by the Belgian state security :p

@MarkHulkalo CIBAI

Cibai?

@Ohnana sure but growing oranges without pesticides and fungicides is a real thing that happens

Yeah and nobody is pointing out that an 8 month old baby can choke on oranges...?

@MarkHulkalo It's Hokkien, check it out

They have maybe a couple teeth

@MarkHulkalo that would be some mouth in order to fit something that size in it

I am not convinced I could fit something that size in my mouth

@MarkHulkalo if they've got the teeth to rip pieces off they've got the teeth to chew it

unhinge my jaw or something maybe

@kalina they can break chunks off it

@Ohnana taking a couple chunks off is different than being able to properly chew it.

it's not like oranges are well known for requiring intense chewing

dear god, i'm making fun of someone fretting over a fucking orange, not asking for the conversation to come here!

RAAAGH

/tromps back under bridge

sets fire to the bridge

@MarkHulkalo so your wife is from China, what province?

@LucasKauffman heilongjiang province

Harbin

@kalina surprised it took you this long

...

@MarkHulkalo oh that's close to North Korea :o

@kalina - - -

I'm surprised I dropped three epic comments that could easily be misunderstood and none of them got stars

@LucasKauffman Ever been there?

NORTH KOREA, BEST KOREA

@MarkHulkalo No but I want to visit the DPRK

It's a beautiful country, I encourage you to visit.

Just be careful....

Wonsan is beautiful in the summer and spring

I'm actually pondering about doing a trip taking the Transiberian express through Moscow to Bejing and then travel to the DPRK after wards

@MarkHulkalo You've been to the DPRK?

@Ohnana what are you saying about @AviD?

If they let you in Wonsan, go to the hills and chillax

@LucasKauffman Dunno

@RoryAlsop hhhhhmmmmmmm???

insulting his intelligence like that

you know he has about a thousand kids

@MarkHulkalo I would also want to visit Chernobyl

Try Harder: offensive-security.com/wp-content/uploads/2015/01/…

@LucasKauffman In Wonsan, near the ocean during the summer / spring, it's most beautiful. There are really nice flowers growing there... And the hills overlooking the ocean are dreamy.

@RoryAlsop cough

But uh, it's kind of hard to ignore all the crap going on. If they even let you see it

@MarkHulkalo Are you in fact a North Korean :o?

Nope.