Storytime thread
lainchan / sec

----------------------------------------------------------------------
Hagbard Celine · 2017-04-23 03:33

Story time thread

Share your experiences and stories about how you popped boxes and
shells
>First time hacking
>read a few intro to pentesting books
>Easy.jpg
>download a vm that says easy difficulty
>get on kali start scanning easy machine
>nmap, metasploit aux, smtp user enum for about 30 minutes
>get emails from contact page
>alright lets try bruteforcing some users
>spends 45 minutes trying to crack user passes
>struggle.jpg
>why can't I get this
>check common passwords
>"Try their username"
>bruteforces again
>mfw it takes me 4.5 hours get access to something that should have
been a 5 second guess

----------------------------------------------------------------------
Unknown · 2017-04-23 07:16

>>231
I have a stupid beginner story as well
>start doing overthewire.com wargames
>blaze through the first few levels of bandit since the first few
things are standard file stuff
>reach the level that requires you to deal with hidden files
>ezpz, ls -a, cd .hidden
>cd: hidden: No such file or directory
>try to escape the . character, nope
>spend 20 minutes searching how to cd into a hidden directory, get
nothing
>take a closer look at output of ls -a
>the color of the "folder" is slightly different from the . and ..
folders
>it was a file, not a folder

----------------------------------------------------------------------
J.C. Denton · 2017-04-23 15:19

>>236
This made me laugh.

----------------------------------------------------------------------
Nobody important · 2017-04-23 17:45

>>236
took me 3 minutes to understand it...

----------------------------------------------------------------------
Void · 2017-04-23 21:07

>>236
golden!

----------------------------------------------------------------------
Cutter · 2017-04-24 01:38

>>236
I EXACTLY know that feel!

----------------------------------------------------------------------
Switch · 2017-04-24 19:11

>nmap server, nothing interesting
>run dirsearch while checking the webapp
>download webapp
>start reading code, finding for vulns
>find one reflected SQLi but it won't work on the webapps
configuration
>hours pass
>give up
>look at output of dirsearch
>there is literally a file called upload.php that's not part of the
webapp
skipping information discovery leads to wasted time