+ Reply to Thread
Page 2 of 7 First 12 3456 ... Last
Results 26 to 50 of 166
  1. Senior Member YFZblu's Avatar
    Join Date
    Nov 2011
    Posts
    1,423

    Certifications
    A+, N+, S+, CCNA, CCNA:Sec, GSEC, GCIH, GCFE
    #26
    Quote Originally Posted by NovaHax View Post
    It worked better for me to read through the PDFs at the same time as watching the videos (since they pretty much follow the same track).
    Same - I am much more comfortable reading the material and hashing it out internally. For whatever reason I find myself getting distracted / sleepy during video presentation, unless I'm totally clueless about a topic and absolutely need the hand-holding (which I'm sure will happen many times in the next 28 days).
    Reply With Quote Quote  

  2. SS -->
  3. Senior Member YFZblu's Avatar
    Join Date
    Nov 2011
    Posts
    1,423

    Certifications
    A+, N+, S+, CCNA, CCNA:Sec, GSEC, GCIH, GCFE
    #27
    Woke up a bit early to get some bash scripting done
    Reply With Quote Quote  

  4. California Kid JoJoCal19's Avatar
    Join Date
    Mar 2009
    Location
    Jacksonville, FL
    Posts
    2,324

    Certifications
    CISSP, CISM, CISA, CRISC, GCIA, GSEC, CEHv8, CHFIv8, ITIL-F, MSISA, BSBA
    #28
    I wish I could do this course/cert sooner than later but I'm pretty booked for certs this year. I will definitely be starting it January next year.
    Have: CISSP, CISM, CISA, CRISC, GCIA, GSEC, CEHv8, CHFIv8, ITIL-F, BSBA - University of Florida, MSISA - WGU
    Currently Working On: MS Cybersecurity, Learning Python
    Next Up:​ None
    Reading:​ Python Crash Course
    Reply With Quote Quote  

  5. Netzwerksicherheit Master Of Puppets's Avatar
    Join Date
    Jan 2013
    Location
    /dev/null
    Posts
    1,175

    Certifications
    CCNA R&S, CCNA Security, CCNP R&S, CCNP Security
    #29
    Check out tldp.org for some bash. I liked it when I was learning it.
    Reply With Quote Quote  

  6. Senior Member YFZblu's Avatar
    Join Date
    Nov 2011
    Posts
    1,423

    Certifications
    A+, N+, S+, CCNA, CCNA:Sec, GSEC, GCIH, GCFE
    #30
    Nice - Browsing it now, thanks!

    Sidenote: There was a very small piece of regex-fu during the bash section, it's worthwhile to know the most common and basic syntax. For this I like to visit http://www.regexone.com
    Last edited by YFZblu; 04-22-2014 at 04:55 PM.
    Reply With Quote Quote  

  7. Audentis Fortuna Iuvat veritas_libertas's Avatar
    Join Date
    Feb 2009
    Posts
    5,652

    Certifications
    eCPPT, GPEN, GWAPT, GCIH, CISSP, CCNA (expired), MCTS
    #31
    Good stuff. I'll be following this thread...
    Currently working on: Resting
    Reply With Quote Quote  

  8. Senior Member
    Join Date
    Oct 2013
    Location
    Washington DC
    Posts
    498

    Certifications
    OSCP, eMAPT, eWPT, CISSP, GPEN, GWAPT, GCIH, GCIA, GSEC, CEH, CNDA, ECSA, CHFI, Sec+, Net+
    #32
    Quote Originally Posted by YFZblu View Post
    Awesome resource man. This is awesome.
    Reply With Quote Quote  

  9. Junior Member
    Join Date
    Nov 2006
    Posts
    7

    Certifications
    MCP,MSCA,CCNA(R&S)(Wireless),ASPT,OSCP
    #33
    Hey YFZblu , have a look at --> Bash Scripting 101 for Pen Testers by Lee Baird: Hack3rcon 3 09 Bash Scripting 101 for Pen Testers Lee Baird - YouTube
    also check Mike website Offensive Security's PWB and OSCP -- My Experience | Security SiftSecurity Sift "his scripts" are rocks just focus on this section " Organize and pre-compile your exploits " THIS HELPED ME A LOT just download it and go through it .
    Reply With Quote Quote  

  10. Senior Member
    Join Date
    Oct 2012
    Location
    Lexington, KY
    Posts
    534

    Certifications
    CISSP, GMON
    #34
    Couple of other links that might be worthwhile:

    Cheat Sheets | pentestmonkey

    MDwiki or http://www.amazon.com/Rtfm-Red-Team-.../dp/1494295504 is kinda the same thing.

    Most of the bash I have been doing in the labs is really basic stuff to take a list of IP's generated by nmap/grep/cat/cut/sort then run some tool against it. Just one liners, really. I do wish I knew more about web stuff going in - like how php files work on a basic level would be helpful for sure. Otherwise it is all about finding a seam or weakness, then doing research to see what you can do with it. Enumeration of all the things is important!

    Also, don't try to make things too complicated, esp. on the easier boxes. If a basic exploit that you think might work, doesn't, don't jump into trying to find some higher level one. Take some time to make sure you are doing things correctly and maybe ping an admin on IRC. Despite their rep, they will help you if you have already done your homework, put in time on the box, and can ask specific questions or ask for specific guidance. They might not give you an answer, but can help guide your research.
    Last edited by wes allen; 04-22-2014 at 11:21 PM.
    Reply With Quote Quote  

  11. Senior Member YFZblu's Avatar
    Join Date
    Nov 2011
    Posts
    1,423

    Certifications
    A+, N+, S+, CCNA, CCNA:Sec, GSEC, GCIH, GCFE
    #35
    Ugh, things were crazy at work this week. It will be nice to deep dive this weekend... I still need to finish the bash exercise, I'll tackle that tonight.
    Reply With Quote Quote  

  12. Senior Member YFZblu's Avatar
    Join Date
    Nov 2011
    Posts
    1,423

    Certifications
    A+, N+, S+, CCNA, CCNA:Sec, GSEC, GCIH, GCFE
    #36
    Running through the netcat section - I got some good netcat exposure last year during my GCIH track, so this is good review.

    Also, I had my first technical issue. The Windows 7 lab machine died when I attempted to close my netcat connection....then my VPN went down. Now I'm trying to re-connect, but the negotiation is failing. Going to wait about 15 minutes and try again. 1337 troubleshooting skills at play here.
    Last edited by YFZblu; 04-24-2014 at 04:41 PM.
    Reply With Quote Quote  

  13. Senior Member YFZblu's Avatar
    Join Date
    Nov 2011
    Posts
    1,423

    Certifications
    A+, N+, S+, CCNA, CCNA:Sec, GSEC, GCIH, GCFE
    #37
    Note for those in the future - Download the 32-bit Kali image; it's important for the buffer overflow labs later on. I originally installed 64-bit, and I'm having to re-download everything today.
    Reply With Quote Quote  

  14. Senior Member YFZblu's Avatar
    Join Date
    Nov 2011
    Posts
    1,423

    Certifications
    A+, N+, S+, CCNA, CCNA:Sec, GSEC, GCIH, GCFE
    #38
    So I reinstalled Kali, and my VPN is working properly...back to netcat
    Reply With Quote Quote  

  15. Netzwerksicherheit Master Of Puppets's Avatar
    Join Date
    Jan 2013
    Location
    /dev/null
    Posts
    1,175

    Certifications
    CCNA R&S, CCNA Security, CCNP R&S, CCNP Security
    #39
    Ha, interesting. I had no idea about the 32-bit image.
    Reply With Quote Quote  

  16. Senior Member
    Join Date
    Mar 2014
    Posts
    617

    Certifications
    Alphabet-soup
    #40
    That's why we said to make sure and check the forums. There's a sticky in the forums with this information and the image that was used when creating the course, so everything should work 100% with it.
    Reply With Quote Quote  

  17. Senior Member YFZblu's Avatar
    Join Date
    Nov 2011
    Posts
    1,423

    Certifications
    A+, N+, S+, CCNA, CCNA:Sec, GSEC, GCIH, GCFE
    #41
    Quote Originally Posted by BlackBeret View Post
    That's why we said to make sure and check the forums.
    Actually, I was the only one to bring up the forums in this thread - if you re-read it, I stated that I browsed the forums early on; at that point I had already downloaded my 64-bit image and it wouldn't have mattered.

    In any event, it only cost me an hour and wasn't really an issue.
    Reply With Quote Quote  

  18. Senior Member
    Join Date
    Oct 2013
    Location
    Washington DC
    Posts
    498

    Certifications
    OSCP, eMAPT, eWPT, CISSP, GPEN, GWAPT, GCIH, GCIA, GSEC, CEH, CNDA, ECSA, CHFI, Sec+, Net+
    #42
    Quote Originally Posted by YFZblu View Post

    In any event, it only cost me an hour and wasn't really an issue.
    Better now than during the exam. I lost about an hour on the exam because I had been using Kali during the course, but the PWB exam required that I used Backtrack (this was during the time period after the release of Kali, but before the release of PWK). I didn't know this until I got my exam details, once the exam had already started. I spent the first hour spinning up a new VM with BTK and migrating my stuff to it from my Kali box
    Reply With Quote Quote  

  19. Senior Member YFZblu's Avatar
    Join Date
    Nov 2011
    Posts
    1,423

    Certifications
    A+, N+, S+, CCNA, CCNA:Sec, GSEC, GCIH, GCFE
    #43
    Good point!

    Going back in time today to refine document some exercises I completed. I've been putting it off a bit, but I need to get into the documentation mindset for the certification challenge.

    Then it's on to active recon..
    Reply With Quote Quote  

  20. Senior Member
    Join Date
    Apr 2012
    Posts
    230

    Certifications
    A+, Security+, CCENT, C|EH, GCFE, GCFA, GREM
    #44
    Hey YFZblu,
    I'm going through the labs right now too. I highly recommend using a program called Shutter for taking screenshots of your progress while you go. I'd never used it before the course, but it has some pretty neat features that have saved me some time in my documentation. It's in the Kali repositories, so you can just 'apt-get install shutter' from your shell.
    Reply With Quote Quote  

  21. Senior Member YFZblu's Avatar
    Join Date
    Nov 2011
    Posts
    1,423

    Certifications
    A+, N+, S+, CCNA, CCNA:Sec, GSEC, GCIH, GCFE
    #45
    Downloaded - Looks great, thank you
    Reply With Quote Quote  

  22. Senior Member Nyblizzard's Avatar
    Join Date
    Jan 2013
    Location
    South Florida
    Posts
    310

    Certifications
    A+, Network+, Project+, Security+, Hyper-V, MCSA: Windows 7
    #46
    Love the thread so far
    O
    /|\
    / \
    Reply With Quote Quote  

  23. Senior Member YFZblu's Avatar
    Join Date
    Nov 2011
    Posts
    1,423

    Certifications
    A+, N+, S+, CCNA, CCNA:Sec, GSEC, GCIH, GCFE
    #47
    So, I've been wrestling with my 'ping sweep' Bash script on and off, for a couple days now. Initially, this was it:

    Code:
    prefix="192.168.13" && for ip in {200..254}; do ping -c 1 -W 1 $prefix.$ip |grep 'from' > pingsweep.txt; done
    The problem was, every time I would check the pingsweep.txt file, it would be empty. I was literally driving myself insane trying to figure this out...I finally discovered the proper way to Google this problem, and found my answer; the redirect isn't part of the script logic, it takes place afterwards (after the 'done' statement). I slowly backed the razor blade away from my wrist and continued on...Ultimately the proper way to do this one is with multithreading for speed and regex matching to create a cleaner txt file. Unfortunately I'll have to get to that later.

    So yeah - I've had some growing pains scripting in bash. It's super useful (obviously), I'll definitely dive deeper after the course.

    Here's the correct version:

    Code:
    prefix="192.168.13" && for ip in {200..254}; do ping -c 1  -W 1 $prefix.$ip |grep 'from'; done > pingsweep.txt
    Last edited by YFZblu; 04-25-2014 at 11:48 PM.
    Reply With Quote Quote  

  24. Senior Member YFZblu's Avatar
    Join Date
    Nov 2011
    Posts
    1,423

    Certifications
    A+, N+, S+, CCNA, CCNA:Sec, GSEC, GCIH, GCFE
    #48
    For those interested, here is my Python source for the same script:

    Code:
    #!/usr/bin/bash
    
    import subprocess
    
    hosts = []
    prefix = "192.168.13."
    
    for ip in range(200,255):
        hosts.append(prefix + str(ip))
    
    for item in hosts:
        try:
            print subprocess.check_output('ping -c 1 -W 1 ' + item + ' |grep "from"; done', shell=True)
        except:
            pass
    **Note: Like the previous example, it's important not to include any redirection in the script itself. The redirection takes place at the CLI. Example: python script.py > pingsweep.txt

    Once again, since I'm not using nmap, I would want this multithreaded for speed, with regex matching to make the txt file clean. I'll likely go back and tighten all of these projects up at the end.
    Last edited by YFZblu; 04-25-2014 at 11:50 PM.
    Reply With Quote Quote  

  25. Senior Member
    Join Date
    Oct 2013
    Location
    Washington DC
    Posts
    498

    Certifications
    OSCP, eMAPT, eWPT, CISSP, GPEN, GWAPT, GCIH, GCIA, GSEC, CEH, CNDA, ECSA, CHFI, Sec+, Net+
    #49
    While Bash and Python can be extremely useful in your pentesting career...you aren't going to use many (probably not any) homegrown scripts for the exam. If you are giving yourself 30 days...do not dwell there too long. Take good notes and take time after the exam to improve your scripting Kung Fu. If you want to meet your deadline...focus the bulk of your time on Nmap, Metasploit, exploit script modification (from existing exploit-db scripts), and exploit development (ONLY to the extent covered in the course material......this is a deep rabbit hole that you can easily get lost in).

    Hope all is going well...and hope the sleepless nights are not becoming too much... I'm cheering for you man.

    **Side Note** - I know that you have your sights set on completion within thirty days. This is indeed an admirable goal and I truly hope you make it. But just so you know...there is not a one of us on here (who is familiar with the course/exam) that will judge you if you decide to extend. An OSCP who took 90 days has the same title as one who took 30 days. Most importantly, don't forget to have fun. I would imagine that you might get easily stressed with that kind of deadline. Hell, I got stressed in my 90 day subscription. Remember, you are taking this cert to embark on a career path that is a hell of a lot of fun. But only as long as you allow it to be that. Work hard, but don't forget to crack open a beer every once in a while. Cheers
    Reply With Quote Quote  

  26. Senior Member YFZblu's Avatar
    Join Date
    Nov 2011
    Posts
    1,423

    Certifications
    A+, N+, S+, CCNA, CCNA:Sec, GSEC, GCIH, GCFE
    #50
    Thanks for the encouragement NovaHax, and I complete agree with you; I spent far too much time on the scripting.

    I pushed ahead through passive recon to active recon, dns enumeration, and NMAP scanning. Really great material so far, I'll post a better update when I have more to report! Just grinding through it right now
    Reply With Quote Quote  

+ Reply to Thread
Page 2 of 7 First 12 3456 ... Last

Social Networking & Bookmarks