This forum is in archive mode. You will not be able to post new content.

Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - Jackal

Pages: [1] 2 3
1
Hacking and Security / Re: Your Hacking Routine
« on: January 22, 2016, 10:52:38 PM »
Still makes me less deserving than 20 year olds who wana learn sec but can't break into Metasploitable VMs. On top of that for a suggestion if you listen to me after you kick out the idiots and make sure they can do the network stuff set up some snort rules up in this bitch and see what they can do to bypass it also move them over to Web App testing have them break real webapps. Another thing why are you hacking VMs when like you're in a University which is the perfect practice network because it's large and wide open the network is as big and complex as a large corporations you have massive infrastructure where many of the servers are just puppet or ansible or whatever managed so they are all the same you have appliances in your way in various segments however due to the open culture and shit it's easier to handle and it's more realistic than VMs.

2
Hacking and Security / Re: Your Hacking Routine
« on: January 22, 2016, 10:25:26 PM »
I am sorry I just don't like computer science students who claim they want to learn x yet they never do jack squat outside the classroom that really really pisses me off I've beat up kids for that shit like bad when I should be shaking their hands because they are the next generation of incompetent developers and admins responsible for my livelihood.

3
Hacking and Security / Re: Your Hacking Routine
« on: January 22, 2016, 10:21:03 PM »
I am sorry but  really I don't consider anyone who doesn't know assembly a talented hacker let alone a bunch of college kids who have problems hacking intentionally vulnerable VMs while on the same fucking network as them. Seriously a 12 year old could run friggin hydra and portscan the network for ssh and crack it nmap the bitch and searchsploiting it until you find a metasploit module because unfortunately none of your retards can fix up exploits on exploit db or modify POCs to make them workable. If those people were talented they wouldn't have trouble with such trivial shit honestly I think you're hung up on all the millenial feel good bs to kick the idiots out.

4
Hacking and Security / Re: Your Hacking Routine
« on: January 22, 2016, 10:12:07 PM »
I know I am a dick which is why I've had so many cookies stolen from me already but like if they are computer science majors and they want to go into cyber security and they can't fucking port scan or pass crack they don't know, how to sniff traffic, they are not smart and they do not want to learn I could do all that when I was a 12 year old script kiddie.

5
Scripting Languages / Python Module suggestions for me
« on: January 22, 2016, 04:00:39 AM »
Well I use both but normally I like Ruby much better because I mean it has metasploit, ronin, better web testing libraries, I can run other language programs with no hassle, good regexps. But unfortunately it's not as popular as Python for sec because fucking RAILS ruined the community. So I went on PyPi and looked at the sheer volume of sec modules. Now I use yari and obfuscator a lot when I use snakes but I decided to pick up LibForensics, WDT, steganopi just because I don't have ruby substitutes for those. Can yall tell me some other good mods to play with you can't find in Ruby.

6
Hacking and Security / Re: Your Hacking Routine
« on: January 22, 2016, 03:52:53 AM »
Honestly I hate the way pentesters do shit as well but I understand why they do what they do I wouldn't trust 60 percent of them. Why don't you just force them all to read a book on Kali and practice 300 some pages and being a tool monkey isn't that hard  and kick them out if they don't you don't want retards weighing you down. Ironically I'm not much older than you if not younger and I never had a college education or learned a single algorithm and I do pretty well for myself. But really man don't let that all inclusive faggy open campus feel good bullshit weigh you down. There are always more faggots on campus who saw Mr. Robot and now they want to be hackers and have mommy and daddy drop 10 grand a semester to be bad at it. I'm sure if you're any good some of them will listen keep them discard the rest you have no use for people who suck or don't want to learn.

7
Hacking and Security / Re: Your Hacking Routine
« on: January 22, 2016, 01:30:44 AM »
Long story short in the real world Web Apps  and Social Engineering to get in + Systems administration to know what you're doing and like weeks and weeks of recon

8
Hacking and Security / Re: Your Hacking Routine
« on: January 22, 2016, 01:28:36 AM »
Well I have to tell you practice VMs at your local uni are very different from the real thing. Mostly in the sense that like you dont have any SOC on your ass, you can't just run Nessus and portscan away outside of the DMZ assuming you could without it being obvious like chances are most of the good stuff is behind the ASA. I've found that writing scripts to do passive recon on their job boards, XSSing employees, doing a lot of recon on the web apps and spidering them and writing automated test cases in advanced, knowing what to look for from job boards for example ASP.NET but with an MVC that would mean I can't really out right dork it I can use the harvester and whatweb or WAD it for info then after I get enough recon on all the web apps I map all their domains what datacenters their shit is hosted on their clients who the people working are their employers I write some XSS bots to target the people with my smtp servers or fake fbs and linked ins.  I also write an automated test case for the web apps I see hoping for a server side vuln. Either way doing both at a time generally gets me in the passive recon I did before on the Job Boards help a lot why because I read documentation on the type of stuff they use I will know their back end DB commands I will know the directory structure of the web platforms they use I will know what network services they use so I already have a plan and then I just sit and wait and chip away at the network enjoying how soft it is but not being too loud leaving obfuscated malware, scripts, and cron jobs in my wake slowly but surely. Long story short like if your college is good they will teach you fuzzing and assembly and different attacks maybe some snort rules that's the best case scenario and that's considered really good. However penetration tests are nothing like real attacks in my opinion especially in a university environment because it's noisy, the client side vector is usually removed, and malware is not allowed. You have time limits that force you to do things no competent blackhat would. Long story short it really depends on what you want to do like if you want to be a skilled attacker in the literal approach you can't be so dependent on brute force if you want to be a tool monkey for a firm go ahead I'm not calling you stupid I'm being honest because I used to be noisy and rush that didn't get me anything good.

9
The only real job i had that I liked was as a Reverse Engineering intern granted I wasn't paid a crazy amount of money but I liked it because I got to work with some smart people and got to do some crazy shit. Which is really my end game doing work with smart people doing crazy shit I don't work with anyone in my current occupation but I do crazy shit

But the whole idea of groveling to some idiot in HR to hire me just so I can do group and user management all day and waiting like 3 years before I can even touch a serious configuration file doesn't float my boat.

Staff Note: No double posting, use the edit or modify button

10
Would it be worth it if I already make good money? I don't really care about the financial aspect of things but were you put into challenging situations that you enjoy?

11
Hacking and Security / Re: Using a self-written message system as C&C
« on: January 16, 2016, 09:56:25 PM »
That's true but like we have to be specific here and well what bothers me in the corporate world is like assuming the have a well configured ASA a lot of the evasion techniques in the famous paper insertion, evasion, and DOS won't work so well when it comes to that but like you set up some solid key management for your command and control traffic  and do the error handling technique I put above  it can work well I also would think he should educate himself with windows and linux kernel internals before he attempts it. I think  but I prefer the reverse connection approach better in terms of shear stealth (most malware authors would agree)and chances are law enforcement in many eastern european countries won't exactly collaborate well (they are forwardig servers either way) with US law enforcement. The main issue I'd have with the general idea  is self encryption and decryption which is a major concern for any competent malware author. Why because we are going to have a list for legitimate C&C servers and any asshole analyst can simply just run the malware dynamically and then see where the traffic is going and put it up on a domain blacklist for the malware so you should constantly expand your C&C servers and update infected hosts with said lists. The main problem I have with the whole tor idea and using it as a service on the the infected host along with tor is another blackhat who is skilled with reversing can find such a thing out and take advantage of the backdoor present and simply write a script to send commands to that port why because you cant set up a proper filter for C&C when tor is in the equation and its running as a service sure people can do that with the linux idea I posted but like that thing is a beta idea for me. Sorry for my heatedness on the subject I don't come from these kind of places I usually hang out on Hell, Antichat, exploit.in so my posts will run loose on the ethics.

So really I don't think tor would be a good idea if you don't want your malware to be used as a backdoor for others. Unless you are using very specific relays or regular socks4 proxy chain

12
NumPy and Sci Py well my engineering friends swear by it. Clojure and R a lot of data scientists use it so it's good for math.
Haskell because as the guys said it's used by mathemeticians and it's so fun to code in like I have been influenced by it tremendously all of my code is as purely functional as possible

13
NumPy, MatLab, R, Haskell, Clojure

14
Yeah I know that but like the main part of the job is like managing big infrastructure with load balancing, config management, and shit like that

15
Hacking and Security / Re: Using a self-written message system as C&C
« on: January 16, 2016, 03:42:52 AM »
no1xxv depends how he's using tor but from a windows malware point of view i dunno if it's the smartest idea because like sure you can use the communications means as c&c to host and use tor and not get caught and like that's the easy way but if he were targeting companies and the sys admin ran a port scan and sees a sketch port open on a windows work station where like there shouldn't be any ports open it's a fucked up situation but then again like you can use port 60 000 or some shit so no one will notice but I dunno I find the whole reverse shell thing better for windows trojans even though it's harder to implement from a dev and sys admin position. Still like shit should not depend soley on tor if tor doesn't work because it's firewalled you should write some error handling that will implement a regular socks4 proxy or make a chain of transparent http proxies after tor.

Pages: [1] 2 3


Want to be here? Contact Ande, Factionwars or Kulverstukas on the forum or at IRC.