so when you go hunting for cyber stuff

[tehfishman@ioc.exchange]

@neurovagrant man i yell "GOT 'EM" whenever i use rsync correctly on the first try and don't accidentally create `/destname/destname/`

[neurovagrant@masto.deoan.org]

@tehfishman too relatable

[winterknight1337@infosec.exchange]

@neurovagrant I’ve definitely said “I’m in” when I get into stuff.

[neurovagrant@masto.deoan.org]

@winterknight1337 as one does

[viss@mastodon.social]

@neurovagrant @winterknight1337 15 years into attacker mode, i still get a rush and go 'oh fuck! holy shit holy shit!' at first shell.

[winterknight1337@infosec.exchange]

@Viss @neurovagrant same goes when you know you’ve fucked up on a stealth and you know you’re being hunted next

[viss@mastodon.social]

@winterknight1337 @neurovagrant oh its .. hard.. not to fuck up these days.

you know that addage that says "the blueteam has to defend 100% of the castle and all the redteam needs to find is a tiny crack in the wall"?

well that shit turns upside down the moment you get shell.

you make *ONE MISTAKE* and your entire c2 infra chain burns down. dns, domains, hosts, payloads, c2s, certs - all of it. which in many cases takes WEEKS to setup. ESPECIALLY if youre going after macs.

[viss@mastodon.social]

@winterknight1337 @neurovagrant so my advice to attackers is .. bring lure grenades. all that shit you see in the movies where they go "hey we need a diversion" - thats real. you can do that on a redteam gig >:D

i mean, dont blow anything up (unless they let you?) - but keep in mind some shit you can do to draw attention away from some anomalous thing youre doing by creating a big huge distraction somewhere else

[neurovagrant@masto.deoan.org]

ya gotta find joy and dopamine where ya can

[quatermasstools@infosec.exchange]

@neurovagrant “We got one!”

[krypt3ia@infosec.exchange]

@neurovagrant The dog totally gets it when I do.