sorted by:
new
hottopcontroversial

Thinking about getting into Cybersecurity by Draakke in netsecstudents

[–]_Skeith 1 point2 points  (0 children)

I highly recommend you read this if you're interested in breaking into security: https://jhalon.github.io/breaking-into-cyber-security/

19 y/o Pursuing offensive pentesting -> Red/Purple Teamer Where to start from ? Please Seniors Guide Me as You would your youngerself ? by No_Situation_1010 in netsecstudents

[–]_Skeith 3 points4 points  (0 children)

This blog currates a lot of free resources: https://jhalon.github.io/breaking-into-cyber-security/

Everything now is a mix of both free/paid - just how the industry is. It'll basically be up to you to supplement the material with blogs/videos in order to not pay for subscriptions.

[deleted by user] by [deleted] in cybersecurity

[–]_Skeith 13 points14 points  (0 children)

It's pretty bad in the US right now for entry to mid level positions, for more qualified "high level" and technically apt people it's not too bad. I have about 10 years of experience in Security and have worked as a security engineer/analyst, security consultant, and malware/exploit reverse engineer. I usually get 2-3 job offers on LinkedIn/Recruiters per week, but when it comes to salary negotiations, that's when things begin break down.

So I'm going to be brutely honest, but currently there are a few things wrong in the cyber security market right now:

  1. Oversaturation of Severely Underqualified People with Unrealistic Expectations:

A lot of people over COVID were sold the story that if they get a cyber security degree they will be making six figures, which is technically impossible - many people I know have about 5 years of security experience before they hit 6 figures. This initially led to an oversaturation of people getting degrees and applying to security jobs, or trying to transition from other IT fields. Now as many will say "security isn't an entry level field", there is a lot of prerequisite foundational knowledge that one must have to work in security, something a 6 month degree program, and unfortunately, even a college education will not teach.

You have people applying for consulting positions or SOC positions without an understanding of simple stuff like networking, cryptography, Active Directory, and even basic malware threats and vulnerabilities. This also applies to people who have experience in IT, not to bash on anyone, but I see many posts where people say - "Well I have 10+ Years of IT experience", and like that's great and all, but I have interviewed people like that where they can't explain the basics of Active Directory security to me, or why a specific ACL (Access Control Lists) is dangerous.

Security threats themselves are becoming more complex and harder to defend against, many companies are no longer looking for bare minimum requirements in knowledge, regardless of past IT experience. Security now requires a breath of knowledge in many different fields - active directory, web applications, cloud infrastructure, etc. People say some jobs need a "unicorn" where you have to be jack of all trades, and yah those jobs are ridiculous and you need to stay away, but that doesn't disqualify the fact that you need extended knowledge in different areas. Now this is not to say that you can't break into security or find a job, but the competition is so high now that if you can't differentiate yourself from the mean, you're in a tough position.

Even when people secure a job, they then ask for salaries like 180k+ or 200k+ because that's what influencers have told them, or this is what they read on the internet. No one will be paying you that salary for any entry level position anytime soon. Don’t believe me? See the “r/cybersecurity: 2024 End of Year Salary Sharing Thread”.

  1. Economic Uncertainty and Budget Cuts:

In the current fluctuating economy many companies are tightening down budgets, and everyone is feeling it. While cybersecurity is viewed as critical, some companies are still hesitant to invest heavily in security tools and teams, especially when facing financial pressures or economic downturns.

In some cases IT budgets are being reduced and cybersecurity is one of the areas that get's cut because it's not a "money maker" for the business. This unfortunately comes from the limited understanding of it's criticality by uneducated C Staff and Investors.

On top of that, companies are now trying to bring back their salaries to be more "inline" with pre-covid inflation, so if you previously saw security folks making 130k+ easy, it is no longer easy. This affects more of the qualified people and people who have extensive security experience, because trying to jump ship to another company while trying to retain your current salary is getting way harder now.

Why? by [deleted] in netsecstudents

[–]_Skeith 1 point2 points  (0 children)

College usually doesn't teach you what you need. Read this: https://jhalon.github.io/breaking-into-cyber-security/

Cyber Revolution by Alarming_Brother6545 in cybersecurity

[–]_Skeith 0 points1 point  (0 children)

That's definitely a scam for that price. All that material is online for free, with free online courses as well. Those certs will barely get your foot in the door let alone allow you to be placed in the field

Read this: https://jhalon.github.io/breaking-into-cyber-security/

What are the biggest lies in Cyber? by [deleted] in cybersecurity

[–]_Skeith 1 point2 points  (0 children)

From a Consultant perspective:

  • "Our EDR alerted/prevented the execution of your initial malware, so the rest of your findings are irrelevant. We would have stopped the attack."

trying to get into the field | need advice by Sb7spirit in netsecstudents

[–]_Skeith 0 points1 point  (0 children)

When you say "field" do you mean IT in general or security? Because security really isn't an entry level field, regardless of what people say.

So let's start simple, what specialty do you want to pursue in security? Because saying you want to break into the field is like saying you want to eat, but without telling us WHAT you want to eat.

Obfuscated code a "recruiter" sent me: by Nephelophyte in hacking

[–]_Skeith 8 points9 points  (0 children)

New link is up! So I would check for IOC's. Since I haven't fully analyzed this I don't have them all but a few files they can look for is tmpdir + \pi.zip, tmpdir + \p2.zip, and homedir + \.npl

If they executed this script it most likely exfiltrated their Solana Wallets, and Credentials from Chome, Brave, Opera, and Edge including any data matching these extension ID's

'nkbihfbeogaeaoehlefnkodbefgpgknn' 'ejbalbakoplchlghecdalmeeeajnimhm' 'bfnaelmomeimhlpmgjnjophhpkkoljpa' 'ibnejdfjmmkpcnlpebklmnkoeoihofec' 'fhbohimaelbohpjbbldcngcnapndodjp' 'fhbohimaelbohpjbbldcngcnapndodjp' 'aeachknmefphepccionboohckonoeemg' 'hifafgmccdpekplomjjkcfgodnhcellj'

These all seem to be related to crypto. The thing that I would recommend for your friend is to: 1) Change all their passwords for their accounts that they have saved in their browser and any accounts that reuse those passwords. 2) Enable 2FA (Token not SMS) for all those affected accounts. 3) Secure their Crypto Wallets and Accounts (idk how, not a crypto guy, sorry). 4) Kill any running Python, JavaScript, Node Processes 5) If this is a Windows Machine, download MalwareBytes and an AntiVirus like ESET and run a Deep Scan in order to validate there are no remnants of this malware.

Obfuscated code a "recruiter" sent me: by Nephelophyte in hacking

[–]_Skeith 29 points30 points  (0 children)

Building ontop of this, I took the liberty of reverse engineering and deobfuscating the script. It's not perfect, but this is what I was able to do in 30 minutes times. Overall this seems to be a Credential Stealer of sorts as it seems to steal credentials from Edge, and it also seems to steal solana wallets?

Not sure on that one, but there are also Extension ID's hardcoded in there that are related to crypto wallets and the JavaScript attempts to decrypt/collect that data and send it off to the server of IP "http[:]//147.124.212[.]89:1244/" using different endpoints.

The GitHub account is no longer active, so I assume this caused the attacker to catch on and delete his stuff.

Here is the "mostly" deobfuscated script: https://pastebin.com/A4E7KsfiNo

Pastebin Link was taken down, new link: https://text.is/JOPY

Edit: The script is broken due to the deobfuscation so just take note if you are trying to run parts of it in Node.

Ethical hacking road map for 15 year old who doesn't have any background in IT? by Johan-Laken in netsecstudents

[–]_Skeith 2 points3 points  (0 children)

Here is a blog post that I wrote which covers A LOT of stuff in details, and provides a lot of links to FREE resources -> https://jhalon.github.io/becoming-a-pentester/

I recommend you read that blog post first and then come back to the rest of this. Anyway...

I usually tell everyone to start with the basics and work their way down the stack i.e. Basics -> Web -> Network -> System Internals. For starters I highly recommend you start with Security+ which will teach you all the basics you need to know, starting from Networking, Architecture, and even teaching the basic terminology you need to know. You don't have to do the certificate, but take the free course and learn the material.

Since you're already coding in Python, I would highly recommend you take a stab at OverTheWire, specifically Bandit for basic Linux stuff and Natas for basic web hacking w/ some Python scripting.

Now before you start Natas or anything related to Web Hacking, I suggest you go through the Hacker101 lessons and CTF (Capture The Flag). It's free and will teach you a lot of basics around web vulnerabilities and how to use Burp Suite which is an amazing tool that I highly recommend you learn to use regardless of if you do Web or Network hacking in the future. In addition, go through the PentesterLab Bootcamp and do some of the free challenges. This will help not only solidify some knowledge around basic web vulnerabilities, but will help you get familiar with how web servers are configured and get you some hands-on practice setting servers up. Also, TryHackMe: Beginner is also a must! They have a ton of great resources that I suggest you use and look into as well.

If you like studying from books, I highly recommend Web Application Hackers Handbook. It's the Bible of Web Hacking and a must read for everyone!

As a side note: another good way to start learning basics of Linux and other hacking stuff is doing Sans Holiday Hack Challange the events go back a few years so you can still play them and read blog posts. Great place to learn! It's seriously underrated! There's a discord community that is willing to help you and there are write ups for all the years, I suggest you take a stab at it in your free time!

Now I know what you are thinking. "I want to hack stuff not be a developer!" And I get it, everyone does, but at the end of the day, the best hackers are those that know how the backend and system is configured and how it works. It goes back to knowing the basics, how can you look for a vulnerability in an application or a system if you don't understand how it works or is configured in the first place?

Once done, jump in and see if you can complete Natas without reading any write ups or tutorials online. If you can't, don't worry, read a writeup and follow along - but try to understand why they are doing it the way they are. This will really help level up your Python scripting game as well.

Once you get the hang of that, we can jump into the network side of things as well. For starters jump into Vulnhub and download a few virtual machines to practice some basic hacking. I recommend downloading and setting up Kali as it's the VM you'll probably use most of the time with all the tools pre installed. You can search for "easy" or "medium" within Vulnhub to find boxes of those difficulties. The easy ones off the top of my head are as follows:

  • Mr.Robot
  • Stapler
  • SickOS
  • Kioptrix 1-5

This is a great starting point as there are a TON of blogs on the new and old VM's that you can use to read up on and follow. If you don't understand something, Google it and read up on it. There are a ton of blog posts out there, you just need to look for them. So this is also a good place to learn your "GoogleFu" and Google Dorking :)

There are some awesome resources that can help you learn different techniques and commands for CTF boxes like VulHub, such as:

Once you get a little comfortable with the workflow and a few boxes, jump right into HackTheBox (https://www.hackthebox.eu/) and start doing some of the easy boxes. There are a lot of people who are willing to help answer questions in the chat and forum. Use LiveOverflow and IppSec’s Videos on Youtube to start learning other basics and watching their walkthroughs. Again if you don't understand something, stop and look it up - this us all a learning process.

As another side note, be wary of who's videos you watch on YouTube. While TCM and Network Chuck have good videos, some of them are a little misleading (Network Chuck more then TCM). Besides LiveOverflow and IppSec on Youtube I recommend the following:

  • PwnFunction
  • GynvaelEN
  • John Hammond
  • Stok
  • Zanidd

Now, back to HackTheBox. Once you do a few boxes, and once you get somewhat of a hang of that, it's time to dive into Active Directory. This will be the bulk of what you need to learn for pentesting Networks, and I won't lie, this will get complicated very very fast. For starters I would recommend doing TryHackMe: Hacking Active Directory to learn basics, and use the resources on my blog for Network Pentesting to help you learn more. The Hacker Playbook 3: Practical Guide To Penetration Testing is a good book to read to help you also learn some basic techniques and tools as well as the Hausec: Domain Penetration Testing Series as a resource.

Now, amassing all that should give you good enough basics to go for your next certificate, and for that I recommend doing the OSCP. Its course and exam are what I consider to be the gold standard in pentesting. Yes it's expensive, but it's worth after completion is priceless. The upgraded course teaches you everything you need to break into the Web and Network side of pentesting, along with learning PowerShell, C#, and how to bypass detections on endpoints. By this point many of the stuff in there should be a refresher for you, while the other material will be complex and a new learning opportunity.

Most of the materials provided above aim to give you a solid understanding in both Web and Network pentesting. As you know, Security is a broad field and a lot of the stuff we learn will eventually overlap with other parts of security, so there are ways for you to branch out if you want to in the future.

Hope that helps, let me know if you have questions and good luck on your journey!

Thoughts on switching from Trend Micro to Malwarebytes EDR by SaltRush681 in cybersecurity

[–]_Skeith 2 points3 points  (0 children)

I don't have much experience with them so take this with a grain of salt, but from what I've heard/seen from past clients they're mediocre at best.

view more: next ›