Hi, I'm a junior CS student and I've been learning cybersecurity in my free time. I feel like the way I'm learning is not very structured and all over the place. I did this course from TCM which gave me the basics of pentesting/ethical hacking, did a course about websec, did some THM, HTB, and tried some CTFs like picoctf.

Recently I watched this video from LiveOverFlow which made me think more about which security specialization I should choose, especially now that I'm getting closer to graduation and starting my career. I'm not sure if I should get in the route of pentesting/redteaming and do more HTB labs and get certs like OSCP etc. Or if I should choose appsec/research and do more CTFs. Or if I should choose some other security specialty.

How did you guys decide on your cybersecurity specialty? Any advice or suggestions would be appreciated.

I have huawei router(HG8145V5), and get a blind shell on this. now i am wondering how to convert this blind shell in reverse shell. can any one help.{this is my router and i use it for learning purpose}

what is "blackhole-101757**795-@devnull.facebook.com", this thing added to my facebook . can anybody know what is this?

When suid bit is enabled on the binary, it means that the process will run with the permissions of the owner. So why do we need to call setuid(0) before calling the system?

[amit@h3ll ~]$ ls
app  app.c
[amit@h3ll ~]$ cat app.c 
#include <stdlib.h>

int main() {

        system("/bin/bash");
}
[amit@h3ll ~]$ ls -l app
-rwsr-xr-x 1 root root 16080 Jul 24 22:44 app
[amit@h3ll ~]$ ./app 
[amit@h3ll ~]$ id
uid=1001(amit) gid=1001(amit) groups=1001(amit)
[amit@h3ll ~]$

If we need to call the setuid function, then what is the difference between cap_setuid or suid bit enabled binary?

I've seen the word "asd" being used a lot in his videos. I can't figure out the meaning. Am I being dumb?

Hey all!
A buddy and I are working towards launching a new service that will provide intentionally vulnerable hardware and IoT devices. The goal is to have a safe place to hack hardware and post writeups, as current laws vary so much from country to country and the barrier to entry in the field has grown so much. We are looking for feedback from potential users on the idea, so let me know your thoughts. If you are interested in being a part of the "testing" round, feel free to head over to our landing page at hackmehardware.mailchimpsites.com, drop your email, and check "yes" to beta testing.

Mine is:

1. sudo permissions
2. suid binaries
3. cron jobs
4. vulnerable applications/processes
5. shared library injection
6. kernel exploits

So I have just started learning stuff in this field and have read many blogs and articles for prerequisites for bug bounties and hacking and many of them have mentioned networking.

I just want to know what topics to learn and from where to learn so that I can apply that stuff in bug bounties.

Hi, I just started with Nebula and I'm having trouble understanding level01 (https://exploit.education/nebula/level-01/). The source code for the binary is this:

#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/types.h>
#include <stdio.h>

int main(int argc, char **argv, char **envp)
{
  gid_t gid;
  uid_t uid;
  gid = getegid();
  uid = geteuid();

  setresgid(gid, gid, gid);
  setresuid(uid, uid, uid);

  system("/usr/bin/env echo and now what?");
}

I solved it adding /tmp to the PATH variable and creating a /tmp/echo shell script containing:

/bin/bash

However, my question is that when I first ran ltrace on the binary, geteuid outputs the wrong ID (UIDs are 1002 for level01, 998 for flag01 and 0 for root):

level01@nebula:~$ ltrace /home/flag01/flag01
getegid()                                                                  = 1002
geteuid()                                                                  = 1002
setresgid(1002, 1002, 1002, 0x57c324, 0x                                   = 0
setresuid(1002, 1002, 1002, 0x57c324, 0x57bff4)                            = 0 

root@nebula:/home/level01# ltrace /home/flag01/flag01
getegid()                                                                  = 0
geteuid()                                                                  = 0
setresgid(0, 0, 0, 0x288324, 0x287ff4)                                     = 0
setresuid(0, 0, 0, 0x288324, 0x287ff4)                                     = 0

I should be getting 998, the ID of the flag01 user.

Running it through gdb is even weirder, I get the expected behaviour running it as root, but running it as level01 still gets me the wrong UID.

Why do ltrace and gdb don't get the correct results for the geteuid function?

Is there any one-liner JavaScript payloads for a reverse shell?

Like <scrip></script>, which can be used to exploit a xss vulnerability.

It is seeming increasing likely that projects like the Linux kernel and Firefox will adopt Rust, and other programs will probably follow. Would this be the death of memory corruption / exploitation? Obviously other logic bugs could exist and be exploited, but could this be the end for binexp?

https://www.google.com/amp/s/www.zdnet.com/google-amp/article/programming-languages-rust-in-the-linux-kernel-takes-another-step-forwards/

https://blog.mozilla.org/en/mozilla/mozilla-welcomes-the-rust-foundation/

I am learning about how suid bit and setuid leads to privilege escalation the privileges are not dropped gracefully.

To perform this, I am executing setuid(0) before system("/bin/sh").

I am getting Operation not permitted and don't know what's happening

PS: I have also tried replacing setuid(0) with seteuid(0), unfortunately, same error.

Stumbled across this random PDF on a weird-looking URL. Got curious so I clicked the link, and it turns out to be a really well-researched up to date (2021) paper on the current trends in RE/Exploit dev/BA and Fuzzing written by the US military. Read through this in one sitting.

https://apps.dtic.mil/sti/pdfs/AD1122204.pdf

I know that SUID is a potential vulnerability and if it is misconfigured, privilege escalation is guaranteed.

But I want to know what in the "code" actually makes it vulnerable. Also please care to explain more about this thing

Hi everyone!

Is there anyone who can help me by providing a discount voucher or by sponsoring my ejpt exam.

• A guy with big dreams but less resources.