Sabza

Sitting is the new smoking.
#MoveDaily #HealthyHabits #FitnessMotivation #ActiveLifestyle #HealthFirst
Music: Prismatica (Revisited)
Musician: Lake Isabel (from Audiio)
URL: https://youtu.be/N6ED9j3ZYOs?feature= https://video.nostr.build/53cdb75e1a59e301b2c0885cffd3eb817073bd0ead411f90fd0538be277c33bb.mp4 shared

2025-08-30 23:40:25 GMT

If you don't control money, money controls you. https://video.nostr.build/1f003fe537e453d43a487b96e768180fc1418e7203e42592f8b215cb9c7e4274.mp4

2025-08-14 14:38:07 GMT

Consistency beats motivation.n https://video.nostr.build/cb3f49480a04296e56cec4dc3ed3f299baac9e6f97748beabde9664f2f83eee8.mp4

2025-08-14 14:02:24 GMT

Results follow consistency. https://image.nostr.build/8bc4250f3199af97365d1ecdb9db80a5c8ad282fb615bca7ccb2ac084d2cb085.jpg https://image.nostr.build/1a050dd1695f6320ffa4dd68f119e7cf34ba64be0ed1446bacf3a11d173d394f.jpg https://image.nostr.build/812893abe60f6b21cd516d3298ea22c8ed6b6804b04537fe43750246e27c5531.jpg https://image.nostr.build/181267c7c22dedfca53106823100ba22b7f64b6448ab4312772d791b26e8a65b.jpg https://image.nostr.build/3846c56d58316a09586e862bbb3fddae328863106913e6daf2f279ddc48594cc.jpg

2025-08-14 13:38:27 GMT

- reply

If you want results, keep showing up.

2025-08-14 13:38:15 GMT

- reply

Small, repeated actions beat big, rare efforts.

2025-08-14 13:38:04 GMT

- reply

Motivation is a spark. Consistency is the fire.

2025-08-14 13:37:47 GMT

- reply

You need consistency.

2025-08-14 13:37:33 GMT

You don’t need more motivation.

2025-08-14 13:32:04 GMT

Most people fail not because they can’t start… but because they can’t keep going.
They chase a goal for a week, maybe a month, then quit when it’s no longer exciting.
Here’s the truth: real results come from doing the work on the days you least want to.
It’s the unglamorous, repeatable actions that stack into progress.
Stop chasing motivation.
Build consistency.
That’s where change happens.

2025-08-14 13:25:30 GMT

Inconsistency is the fastest way to stay stuck exactly where you are.

2025-08-13 14:33:29 GMT

Clarity comes from doing. https://image.nostr.build/d4de98b80defca0687822440e6bcae732a81e9d8471307706c120200dedc6567.jpg https://image.nostr.build/dc9f41750ef8823bc7750b4ec8613882a26ce07823ad9428408e1f41058fc485.jpg https://image.nostr.build/1b580ae6c2b8129d37593700154c5e31896b12c5772ee1644f31ec187a7a2ba6.jpg https://image.nostr.build/e65bdd389cae3ba57ed5c3ecd1f673ecb0c488d122b707880f9559dc8101e655.jpg https://image.nostr.build/489ce3037eb8d2edfc0d3a7f6c57eb82fcd5c603f33bddf6b75209e4de2038db.jpg https://image.nostr.build/76422685c13c356fb870b7cf077e078a162818d5156ef7bcd20a1e6cac953a4c.jpg

2025-08-13 14:00:30 GMT

Thinking won’t finish the job. https://video.nostr.build/0e3e2aad77844484601100b0cc3cd54ef9cc7a2f5772528d156aa026e7a7b6d5.mp4

2025-08-13 13:50:29 GMT

- reply

Action gives you answers that thinking never will.

2025-08-13 13:50:20 GMT

- reply

The cure? Move before you feel ready.

2025-08-13 13:50:08 GMT

- reply

Fear hides inside overthinking.

2025-08-13 13:49:55 GMT

- reply

It feels like you’re preparing… but you’re actually delaying.

2025-08-13 13:49:40 GMT

Overthinking is a silent killer of dreams.

2025-08-13 13:45:21 GMT

Overthinking steals more opportunities than bad decisions ever will.
It convinces you to wait for more information, more certainty, more signs, until the chance is gone.
Most people don’t fail because they act too soon; they fail because they never act at all.
Your first move doesn’t have to be perfect.
It just has to exist.
Take one step. See what happens. Adjust as you go.
Clarity comes from movement, not endless mental loops.

2025-08-13 13:39:39 GMT

Overthinking feels productive… but it’s just procrastination in a smarter outfit.

2025-08-12 09:01:17 GMT

Discipline is built, not found. https://video.nostr.build/2fce8916b8b9c04ff203cb7cb784a3fb53b378582adf432874cb503003b5576e.mp4

2025-08-12 05:35:20 GMT

- reply

Update… https://image.nostr.build/215245549eefe226f559042ab685540043a17e1178515c2d0e5611acb6da0fa4.jpg https://image.nostr.build/799486b4b54e216ee2d25b1efe432b2db99415bd6ccd4a680e76dc592af30d63.jpg https://image.nostr.build/394fb0612a085fbec1f05f82f078d64f69b1a78d2b3b4b9090a1ff8c4169a9c1.jpg https://image.nostr.build/1c5beeda360d4e7242c460fcadc941c52a2f592b60cfbecc675f546d794f6275.jpg

2025-08-12 05:23:52 GMT

Win the battle with yourself. https://image.nostr.build/215245549eefe226f559042ab685540043a17e1178515c2d0e5611acb6da0fa4.jpg https://image.nostr.build/fee9170ddc60ab6da3379b0a120b67ae21cb6665425b04bed07306997054472c.jpg https://image.nostr.build/b6cc0a76b87a49ccd59e273f64d580d3fbfa4a58efff4651d62033e573358277.jpg https://image.nostr.build/b2a0a4ce263fea2264a9360dfafe42dca8997134ebf450c911730a2692eba766.jpg

2025-08-12 05:08:52 GMT

- reply

The win isn’t the task itself… it’s who you become by keeping it.

2025-08-12 05:08:37 GMT

- reply

Start with something small, and do it no matter what.

2025-08-12 05:08:09 GMT

- reply

Self-discipline is how you keep your own trust.

2025-08-12 05:07:41 GMT

- reply

That includes yourself.

2025-08-12 05:07:19 GMT

You can’t trust someone who constantly breaks promises to you.

2025-08-12 05:00:45 GMT

Self-discipline is keeping the promises you make to yourself, even when nobody’s watching.
The problem is most people treat their own word as optional.
But every time you skip what you said you’d do, you chip away at your self-respect.
Every time you follow through, you build trust with yourself.
The solution? Start with one small non-negotiable task every day and never miss it.

2025-08-12 04:48:33 GMT

If you only act when you feel like it, you’ll never get far.

2025-08-11 13:27:04 GMT

The “right time” to start anything is a myth.
Waiting only builds the habit of waiting.
Start small. Learn fast. Build momentum.
#MoneyMindset #SideHustleLife #FinancialFreedom #HustleCulture #BuildYourDream https://video.nostr.build/dcc508032068528579a337984629266a971eb6bb24bb8e5076d0c7a7229efd4b.mp4

2025-08-11 09:34:02 GMT

Stop waiting for the “right time” to start your side hustle.
The habit of waiting only makes it harder to begin.
Start small. Learn fast. Build momentum.
#MoneyMindset #SideHustleLife #FinancialFreedom #HustleCulture #BuildYourDream https://image.nostr.build/031482f314f849e685874309925d5e7a8ad4fd0dc54ae8873fe1e30b93875727.jpg https://image.nostr.build/64516c6ccf95c41b83f350755f875a9d9b0fc2cecd09cf833e3ed5201e63ea7f.jpg https://image.nostr.build/a7246c17b034427e12b84629eacd46f7f5b4f2bc28c2c5fa7c2bd416e8aad2af.jpg https://image.nostr.build/a069b845cb380179f6f5b913a94eb468499f9c4722af26fd715d2b8fd732bbb9.jpg https://image.nostr.build/b02da9a59971f737d80d964fb267d1990f8e61de3f091d9a9583ef78738e4125.jpg

2025-08-11 08:05:41 GMT

- reply

Perfect conditions don’t exist. Start small. Start now.

2025-08-11 08:05:18 GMT

- reply

Two things hustles teach fast:
1. Money moves to the proactive
2. Progress happens faster through action than planning

2025-08-11 08:04:36 GMT

- reply

Every day spent delaying is a day of missed earning, learning, and momentum.

2025-08-11 08:03:55 GMT

- reply

There is no perfect time. You’ll always be busy, tired, unsure, or scared. That’s normal.

2025-08-11 08:03:34 GMT

Most people wait for the “right time” to start a side hustle. Here’s the hard truth… 🧵

2025-08-11 06:39:01 GMT

Most people wait for the “right time” to start a side hustle. The truth? That time doesn’t exist.
There will always be distractions, doubts, and reasons to delay. But every day spent waiting is a day of lost opportunity, a day that could’ve been used to earn, learn, and build momentum.
Side hustles teach two lessons very quickly:
1. Money moves to the proactive.
2. Progress happens faster through action than planning.
The conditions don’t have to be perfect. They never will be. Start small. Start now.

2025-08-10 15:33:48 GMT

Life doesn’t get easier, you get stronger.
Resilience is not pretending that nothing hurts you. It’s facing the pain, learning from it, and refusing to let it stop you.
Every setback is a test:
♡ Will you quit?
♡ Or will you adapt?
♡ Will you let this define you, or refine you?
The truth is, resilience is built in the dark. When no one is watching. When you’re tempted to give up but don’t.
Keep getting up. Keep showing up. You’re harder to break than you think.

2025-08-10 15:28:38 GMT

You can’t control the storm, but you can control the comeback.

2025-08-10 15:21:39 GMT

When life hits, resilience is your comeback fuel. #Resilience #Mindset #Growth https://video.nostr.build/001200365124115eda3f7728d6f6ae1c99c1368144326e2cc97ae46a42a0790c.mp4

2025-06-30 15:17:07 GMT

- reply

🤣🤣🤣 in that case you should definitely listen to him

2025-06-30 12:11:13 GMT

- reply

Don't give up, anon.

2025-06-29 11:15:36 GMT

- reply

#nevent1q…gdsk

2025-06-29 11:15:13 GMT

- reply

Teach me, father 😂 I’m tryna catch up!

2025-06-29 10:38:00 GMT

- reply

I use Amethyst.

2025-06-29 06:55:52 GMT

I laughed at this scene like a madman 🤣🤣🤣.
#theblacklist #blacklist #series #netflix #nostr
https://video.nostr.build/2928479ea18b749b132e365eb9a890f77dc012eafe5ed5a2193376b3f3fa859c.mp4

2025-06-29 06:30:12 GMT

- reply

When I first started using nostr about a month ago, I was told primal is the best and so I used it. But it had so many bugs, it wouldn't even start on my device sometimes… I had no choice but to change.

2025-06-28 18:54:49 GMT

- reply

that’s one way to say “a fancy time machine for your terrible code decisions.”

2025-06-28 18:46:47 GMT

- reply

Starting with our own minds, our families, our health, our local communities. The money is sound, now let’s make sure the people are too.

2025-06-28 18:38:19 GMT

- reply

Gm! Nothing is as picturesque as nature.

2025-06-28 17:20:42 GMT

- reply

This is rock bottom, my day has no choice but to go up now. 🤣
I'm glad to help!

2025-06-28 17:16:48 GMT

- reply

We spend our lives chasing money, power, validation… then one day you trip over your cat, spill your coffee, and remember the universe doesn’t care.
Breathe. Laugh. Pray.
In the end, all we really own is how lightly we carried it all… haha.
#nevent1q…mc3x

2025-06-28 17:14:08 GMT

I just tripped over my cat and spilled my coffee… this life.

2025-06-28 16:58:07 GMT

- reply

Being a hacker is nice.

2025-06-28 16:42:17 GMT

- reply

Because that's how he himself operates, he just does things.

2025-06-27 13:43:56 GMT

- reply

2013 I was 8 years old. 😭

2025-06-27 13:21:29 GMT

- reply

2025-06-27 11:44:56 GMT

- reply

Home Alone?

2025-06-27 10:55:38 GMT

- reply

Nostr is the wild west for freedom-minded builders.

2025-06-27 08:57:57 GMT

- reply

I think snort is ok on the web

2025-06-26 06:45:07 GMT

- reply

I only agree with this because the real Nelson Mandela during apartheid in South Africa was fighting for complete liberation of the blacks. But when "he got out", he settled for something way inferior than what he'd originally went to prison for.
The Freedom Charter they had written up with his folks in the ANC was never implemented.

2025-06-25 21:22:39 GMT

- reply

Haha, fair play 😂 at least you walked away with profits and stories. Most just get screenshots, regrets, and a Discord full of hopium. It’s rough out there… “the trenches,” as they call it.

2025-06-25 21:02:56 GMT

- reply

People keep thinking "this time" it'll be different. That "this" coin is the one. Then they lose it all… again!
What really gets me is it’s not just the scammers. It’s their enablers… the crowds cheering it on, hyping garbage, dragging others down with them. That’s what makes me mad.

2025-06-25 20:46:23 GMT

- reply

They will dump on the people.

2025-06-25 13:09:47 GMT

- reply

Thanks for context, I didn't know that barclaycard only refers to the credit card. Now this makes some sense, to me atleast …
By the way, many people clearly don't only stack sats without leverage, they buy everything from shitcoins to memecoins.

2025-06-25 13:03:38 GMT

- reply

Oh what the hell? This is so profound!

2025-06-25 13:01:11 GMT

- reply

I needn't any more proof that "you can just do things".

2025-06-25 09:01:30 GMT

- reply

Nice! Congrats on finishing your degree 🥳. Security and hacking are awesome fields… there's so much to learn and do! As I'm sure you will also discover.

2025-06-25 08:42:08 GMT

- reply

I'm glad you like it Nico

2025-06-25 08:32:50 GMT

- reply

Least not for Iran but for the people of Iran.

2025-06-25 08:26:18 GMT

- reply

That’s it! My full Ethical Hacking Notebook.
Keep learning, keep practicing, stay ethical.
Use this knowledge to protect and build.
Thanks for following along.
#nevent1q…s0r7
#hacking #nostr #infosec #ctf #vibecoding

2025-06-25 08:21:33 GMT

- reply

Part 21 of my Ethical Hacking Notebook
Staying Sharp
>>> CTFs (Capture the Flags)
• Best hands-on practice for real-world scenarios
• Platforms: TryHackMe, HackTheBox, PicoCTF, Root-Me
• Web, crypto, forensics, reverse engineering, pwn
• Write your own challenges to deepen skills
>>> Bug bounties and forums
• Hunt on HackerOne, Bugcrowd, Integrity, YesWeHack
• Start small: subdomain takeovers, misconfigs, IDORs
• Report properly and ethically
• Learn from disclosure reports and writeups
• Lurk on places like Exploit-DB, 0x00sec, and Reddit’s r/netsec
>>> Custom scripts and automation
• Bash, Python, PowerShell
• Automate recon, scanning, fuzzing, reporting
• Build tools for your workflow
• Try using AI to speed up code ideas and test logic
>>> Nostr as your hacker network
• Post findings, tools, reports
• Build reputation without relying on gatekeepers
• Connect with real builders and independent minds
• Use your pubkey like your hacker CV
Hacking isn’t something you learn once. You keep the edge by using it daily. Stay curious. Stay useful. Stay sharp.
#nevent1q…hc9g
#hacking #nostr #infosec #ctf #neverstoplearning

2025-06-25 08:19:23 GMT

- reply

Part 20 of my Ethical Hacking Notebook
Certs and Paths
>>> CEH vs OSCP vs real-world skills
• CEH (Certified Ethical Hacker)
– Good intro, multiple choice
– Broad, but not deep
– HR-friendly, not hacker-approved
• OSCP (Offensive Security Certified Professional)
– Hands-on, real pentesting labs
– 24-hour exam with active exploitation
– Respected in the field
• Real-world skills
– CTFs, labs, bug bounties
– Custom tooling, scripting
– Working with teams and handling real clients
>>> Building a hacker portfolio
• Show, don’t tell — post walkthroughs, writeups, code
• Public GitHub or self-hosted blog
• Share CTF solves and findings (even basic ones)
• Record short demo videos of your process
• Nostr is your publishing tool now. Own your content
Pick certs wisely, but build skills relentlessly. Paper is proof. Skill is power.
Part 21 next: Staying Sharp
#nevent1q…jcs0
#hacking #nostr #infosec #ctf #career

2025-06-25 08:17:41 GMT

- reply

Part 19 of my Ethical Hacking Notebook
Red Team Ops
>>> Engagement planning
• Define objectives — exfil data, gain domain admin, test response
• Scope matters — legal, technical, physical boundaries
• Rules of engagement (ROE) — what’s off-limits, emergency contacts
• Timeline and coordination with Blue Team if it's a purple exercise
>>> OPSEC and evasion
• Use burner infrastructure — VPS, emails, domains, C2 servers
• Obfuscate payloads — `msfvenom`, `donut`, `sliver`, custom packers
• Blend in — mimic normal user behavior, scheduled tasks, valid certs
• Encrypt traffic and rotate endpoints
• Limit use of loud tools like `nmap`, avoid signature-based detections
>>> Real-life simulation tips
• Focus on realism — target what real attackers would
• Use phishing, physical access, and social engineering if allowed
• Document everything — timeline, techniques, outcomes
• Deliver impact, not noise
Red teaming is about testing people, process, and tech. Simulate the threat, stay professional.
Part 20 next: Certs and Paths
#nevent1q…xsch
#hacking #nostr #infosec #ctf #redteam

2025-06-25 08:15:44 GMT

- reply

Part 18 of my Ethical Hacking Notebook
Bypassing AI and ML Security
>>> Attacking ML models
• Poisoning — tamper with training data to influence behavior
• Evasion — craft inputs that trick the model at runtime
• Inversion — extract sensitive data from the model
• Model stealing — replicate a model by observing outputs
>>> Adversarial examples
• Slight input changes that confuse the model
• Example: change a few pixels and a stop sign becomes a toaster to a classifier
• Tools: CleverHans, Foolbox, ART (Adversarial Robustness Toolbox)
• Used to test model resilience or bypass AI-based defenses
>>> AI in cyber defense
• Behavior-based detection — flagging anomalies, not signatures
• AI for spam filtering, malware detection, intrusion response
• Limitations:
– Models can be biased, blind to novel attacks
– Attackers can game the training data
– Explainability is still a challenge
AI can be guard dog or backdoor. Learn both sides.
Part 19 next: Red Team Ops
#nevent1q…w2n3
#hacking #nostr #infosec #ctf #AI #mlsec

2025-06-25 08:14:04 GMT

- reply

Part 17 of my Ethical Hacking Notebook
Hacking Smart Contracts and Web3
>>> Solidity 101 for hackers
• Smart contracts are self-executing code on the blockchain
• Written mostly in Solidity (for Ethereum)
• Deployed code is public and immutable
• Functions can be abused if logic is flawed
>>> Common smart contract flaws
• Reentrancy — external calls before state updates
• Integer overflows/underflows — older Solidity versions
• Access control — `onlyOwner` not enforced properly
• Front-running — observable mempool transactions
• Unchecked external calls — no error handling
>>> Tools for smart contract testing
• Mythril — symbolic execution and security analysis
• Slither — static analysis and linting
• Echidna — fuzzing engine
• Remix IDE — good for reading and testing bytecode manually
• Tenderly, Ethernaut, and foundry for deeper testing and CTF-style learning
Web3 adds new tech but brings old mistakes. Logic, math, and access control still rule the game.
Part 18 next: Bypassing AI and ML Security
#nevent1q…jzpz
#hacking #nostr #infosec #ctf #web3 #solidity

2025-06-25 08:11:11 GMT

- reply

Part 16 of my Ethical Hacking Notebook
Defensive Thinking
>>> How hackers get caught
• No OPSEC — using personal accounts, IPs, emails
• Sloppy persistence — leaving shells and files behind
• Poor timing — scanning or attacking during work hours
• Talking too much — bragging online, sharing payloads
• Logs never lie — unless you know how to clean them, and even then, SIEMs catch patterns
>>> Building better security as a builder
• Least privilege — no one should have more access than they need
• Defense in depth — firewalls, monitoring, segmentation, strong auth
• Patch early, patch often
• Use secure defaults, kill exposed ports
• Assume breach and build with recovery in mind
>>> Purple team perspectives
• Red team = offensive, Blue team = defensive
• Purple team blends both — red shows the gaps, blue learns and patches
• Collaboration makes both sides better
• Your hacking experience makes you a better defender
Being dangerous means knowing how to protect what matters too.
Part 17 next: Hacking Smart Contracts and Web3
#nevent1q…6la5
#hacking #nostr #infosec #ctf #vibecoding

2025-06-25 08:09:28 GMT

- reply

Part 15 of my Ethical Hacking Notebook
Vulnerability Reporting
>>> Responsible disclosure
• Always give vendors time to fix before going public
• Stick to agreed timelines
• Never exploit for profit or clout
• Respect NDAs and scopes of engagement
>>> Writing clear, actionable reports
• Use simple, direct language
• Include:
– Summary of the issue
– Steps to reproduce
– Impact and risk level
– Suggested fix or mitigation
• Add screenshots, payloads, and log samples
• Use CVSS (Common Vulnerability Scoring System) if needed
>>> What makes a good report
• Short but complete
• Easy to verify
• Focused on value, not technical showing off
• Helps defenders actually fix the problem
A solid report is proof you’re not just a hacker, you’re a professional.
Part 16 next: Defensive Thinking
#nevent1q…svt0
#hacking #nostr #infosec #ctf #vibecoding

2025-06-25 08:06:44 GMT

- reply

Part 14 of my Ethical Hacking Notebook
Physical Security Bypass
>>> Lockpicking
• Practice on pin tumbler locks, not real client environments
• Tools: pick sets, tension wrenches, bump keys
• Skill requires feel, not just knowledge
• Legal only on locks you own or have explicit permission to test
>>> Rubber Ducky and BadUSB
• Rubber Ducky: emulates a keyboard, runs payloads instantly
• Scripted keystrokes to open terminals, download malware, create users
• BadUSB (like Flipper Zero or custom devices): firmware modified USBs
• Use to bypass locked screens or launch reverse shells
>>> Social engineering basics
• Exploit trust, fear, or urgency to gain access
• Pretexting, phishing, tailgating, fake uniforms, phone calls
• People are often the weakest link
• Always get permission for SE tests. Set strict limits and safety words
Hacking physical space takes a different kind of finesse. Know how to get in, but also how to stay ethical doing it.
Part 15 next: Vulnerability Reporting
#nevent1q…n4xu
#hacking #nostr #infosec #ctf #vibecoding

2025-06-25 08:04:45 GMT

- reply

Part 13 of my Ethical Hacking Notebook
Wireless Attacks
>>> WiFi cracking (WEP, WPA2, WPA3)
• WEP — easily broken using `aircrack-ng` after packet capture
• WPA2 — capture handshake with `airodump-ng`, crack with `aircrack-ng` or `hashcat`
• WPA3 — harder due to Simultaneous Authentication of Equals (SAE), but not bulletproof
• Always monitor for PMKID leaks and bad password hygiene
>>> Evil twin and deauth attacks
• Clone a legitimate access point to trick users into connecting
• Use `airbase-ng`, `wifiphisher`, or custom setups
• Deauth clients from real AP using `aireplay-ng`
• Capture credentials or force captive portal interaction
>>> Bluetooth/NFC hacking
• Scan with `bluetoothctl`, `hcitool`, `bluelog`
• Exploit with tools like `bluediving`, `carwhisperer`, `gatttool`
• NFC attacks use readers like ACR122U and tools like `libnfc`
• Look for default pairings, weak encryption, and exposed metadata
Wireless is noisy. Always test in isolated environments and know the legal limits.
Part 14 next: Physical Security Bypass
#nevent1q…tk90
#hacking #nostr #infosec #ctf #vibecoding

2025-06-25 06:46:29 GMT

- reply

Why are you gay? 😂

2025-06-25 06:11:11 GMT

- reply

Part 12 of my Ethical Hacking Notebook
Covering Your Tracks
>>> Clearing logs
• Delete or edit logs where your actions show up
• Linux:
– `/var/log/auth.log`, `/var/log/syslog`, `~/.bash_history`
– `echo > ~/.bash_history` or use `unset HISTFILE`
• Windows:
– Use Event Viewer or `wevtutil` to clear logs
– `Clear-EventLog -LogName Security` in PowerShell
>>> Anti-forensics basics
• Use fileless techniques (in-memory execution)
• Avoid touching disk if possible
• Wipe tools after use
• Rename binaries or run from RAM drives
• Timestomp to alter file creation/mod times
>>> Staying ethical while simulating the worst
• Only simulate log deletion, don’t hide actions from clients
• Leave audit trails in real engagements for transparency
• Never remove logs in a real-world test unless explicitly allowed
• Use red team techniques, but act like a whitehat
Covering tracks is about showing what a real attacker could do, not hiding your own work.
Part 13 next: Wireless Attacks
#nevent1q…eylj
#hacking #nostr #infosec #ctf #vibecoding

2025-06-25 06:08:08 GMT

- reply

Part 11 of my Ethical Hacking Notebook
Maintaining Access
>>> Web shells and reverse shells
• Web shells: upload scripts like `php-reverse-shell.php`
• Reverse shells: target connects back to your listener
– Use `nc -lvnp 4444` or Metasploit’s `multi/handler`
• Encode or obfuscate to bypass detection
• Try multiple shells: bash, PowerShell, Python
>>> Persistence techniques
>>>> Windows
• Add new user to administrators group
• Set registry key to auto-run payload
• Use `schtasks` or `wmic` to schedule execution
• WMI event subscriptions for stealth
>>>> Linux
• Edit crontab to re-launch payload
• Add SSH key to `~/.ssh/authorized_keys`
• Modify bashrc/profile to spawn shell
• Replace system binaries with trojans (dangerous, for labs only)
Persistence helps simulate real threat actors. Use it ethically and document everything.
Part 12 next: Covering Your Tracks
#nevent1q…zdcx
#hacking #nostr #infosec #ctf #vibecoding

2025-06-25 06:02:46 GMT

- reply

Part 10 of my Ethical Hacking Notebook
System Hacking
>>> Windows vs Linux attacks
>>>> Windows
• Common targets: SMB, RDP, Active Directory
• Use tools like `mimikatz`, `crackmapexec`, `BloodHound`
• Privilege escalation through misconfigurations, weak services, token abuse
• Registry, PowerShell, and scheduled tasks are key areas
>>>> Linux
• Enumerate users, suid binaries, crontabs, and services
• Tools: `linpeas.sh`, `linux-exploit-suggester`, `pspy`
• Check `/etc/passwd`, `/etc/shadow`, `/etc/sudoers`
• Privesc through PATH abuse, wildcards, or kernel exploits
>>> Privilege escalation
• From low-shell to root/system
• Look for:
– Misconfigured permissions
– SUID/SGID binaries
– Weak services running as root
– Credential reuse in scripts
• Always check kernel version and installed software
>>> Cracking passwords and hashes
• Use `hashcat`, `john`, or `hydra`
• Common hash types: MD5, SHA1, bcrypt, NTLM
• Grab hashes from `/etc/shadow`, SAM file, or databases
• Use wordlists like `rockyou.txt`, custom combos, or brute force
Once you're inside, stay sharp. Getting in is only half the job. Escalate and control responsibly.
Part 11 next: Maintaining Access
#nevent1q…sm3k
#hacking #nostr #infosec #ctf #vibecoding

2025-06-25 05:58:57 GMT

- reply

Part 9 of my Ethical Hacking Notebook
Web Application Attacks
>>> OWASP Top 10
• A1: Broken Access Control
• A2: Cryptographic Failures
• A3: Injection (SQLi, NoSQLi)
• A4: Insecure Design
• A5: Security Misconfiguration
• A6: Vulnerable Components
• A7: ID/Session Issues
• A8: SSRF
• A9: Monitoring Failures
• A10: Server-Side Validation Bypass
>>> Burp Suite workflows
• Use Burp Proxy to intercept traffic
• Spider the target to discover endpoints
• Use Repeater to manipulate requests
• Intruder for brute force and fuzzing
• Extender to add modules like ActiveScan++
• Decoder, Comparer, and Logger are also useful
>>> Authentication bypass
• Try SQLi in login forms (`' OR 1=1--`)
• Test for weak credentials or logic flaws
• Look for exposed endpoints like `/admin`, `/login/reset`
• Modify cookies, headers, or tokens
• Bypass client-side checks (JavaScript, HTML controls)
Web apps are often the weakest link. Learn how they work and break them with care.
Part 10 next: System Hacking
#nevent1q…ra5u
#hacking #nostr #infosec #ctf #vibecoding

2025-06-25 05:56:54 GMT

- reply

Part 8 of my Ethical Hacking Notebook
Exploitation Basics
>>> Exploit types
• RCE (Remote Code Execution) — run commands on target
• SQLi (SQL Injection) — inject queries into databases
• XSS (Cross-Site Scripting) — inject scripts into websites
• LFI/RFI — load local or remote files
• CSRF — trick users into submitting unwanted requests
• Deserialization, XXE, logic flaws — all fair game if misused
>>> Using Metasploit
• Start with `msfconsole`
• Search: `search exploit/windows/smb`
• Set up: `use`, `set payload`, `set RHOST`, `set LHOST`
• Launch: `exploit`
• Try `exploit/multi/handler` for catching shells
• Use `post` modules for privilege escalation or info gathering
>>> Manual exploitation
• Understand the vuln and why it exists
• Craft payloads with tools like `sqlmap`, `xsser`, `curl`, `burp`
• Python and bash scripts help with automation
• Manual = more control, better learning
• Always confirm your exploit did what it was supposed to
You don’t need zero-days to get in. Most real-world breaches use old exploits done well.
Part 9 next: Web Application Attacks
#nevent1q…0eza
#hacking #nostr #infosec #ctf #vibecoding

2025-06-25 05:50:26 GMT

- reply

Part 7 of my Ethical Hacking Notebook
Enumeration Techniques
>>> SMB (Server Message Block)
• Look for open shares, usernames, OS info
• Tools:
– `smbclient -L //target`
– `enum4linux`
– `smbmap`
• Try null sessions if no creds needed
>>> FTP (File Transfer Protocol)
• Check for anonymous login
• Look for sensitive files or config backups
• Use:
– `ftp target`
– `nmap --script ftp*`
– `hydra` for brute force
>>> LDAP (Lightweight Directory Access Protocol)
• Used in Active Directory environments
• Enumerate users, groups, computers
• Tools:
– `ldapsearch`
– `nmap --script ldap*`
– `BloodHound` for deeper AD mapping
>>> Web directories and subdomains
• Find hidden paths and endpoints
• Use:
– `gobuster`, `dirb`, `ffuf` for brute forcing paths
– `sublist3r`, `assetfinder`, `amass` for subdomains
• Look for staging panels, admin areas, APIs
>>> SNMP (Simple Network Management Protocol)
• Often misconfigured with `public` string
• Get system info, user names, interfaces
• Use: `snmpwalk`, `onesixtyone`, `snmp-check`
>>> SMTP (Simple Mail Transfer Protocol)
• Enumerate users via VRFY or EXPN
• Use: `nmap --script smtp*`, `smtp-user-enum`
>>> RPC (Remote Procedure Call)
• Used in Windows systems
• Look for shares, services, usernames
• Use: `rpcclient`, `nmap --script rpcinfo`
Enumeration is the art of asking detailed questions and collecting answers that matter. Small clues stack into full access.
Part 8 next: Exploitation Basics
#nevent1q…gnls
#hacking #nostr #infosec #ctf #vibecoding

2025-06-25 05:46:25 GMT

- reply

Part 6 of my Ethical Hacking Notebook
Network Scanning
>>> Subnetting, ports, protocols
• Understand IP ranges: `/24` = 256 hosts
• Know port types:
– 0–1023 → well-known
– 1024–49151 → registered
– 49152–65535 → dynamic
• Common protocols:
– TCP (reliable), UDP (faster, no handshake)
– ICMP (ping), ARP (local discovery)
>>> Detecting firewalls and IDS/IPS
• Firewalls block ports or IPs
• IDS/IPS monitor for suspicious patterns
• Techniques:
– Scan with timing tweaks: `-T2`, `-T1`
– Fragment packets: `nmap -f`
– Use decoys: `nmap -D RND:10`
– Spoof source IP: `--spoof-mac` or `-S` (careful)
>>> Scan types in context
• SYN scan: quick and stealthy
• ACK scan: test firewall rules
• Null, FIN, Xmas: bypass basic filters
• ICMP sweep: find live hosts
Good scanning maps the battlefield without setting off alarms. Be efficient, not loud.
Part 7 next: Enumeration Techniques
#nevent1q…wrel
#hacking #nostr #infosec #ctf #vibecoding

2025-06-25 05:25:02 GMT

- reply

🫡

2025-06-25 05:20:24 GMT

- reply

🤣🤣

2025-06-25 05:18:25 GMT

- reply

This would be a great solution

2025-06-25 05:16:14 GMT

- reply

Oh what the hell

2025-06-25 05:07:16 GMT

- reply

Gm!

2025-06-25 04:46:08 GMT

- reply

Part 5 of my Ethical Hacking Notebook
Active Recon
>>> Nmap
• Scan for open ports, services, OS info
• Common commands:
`nmap -sS target` — stealth SYN scan
`nmap -sV target` — version detection
`nmap -A target` — aggressive scan
• Use scripts: `--script vuln`, `--script smb*`, etc
>>> Netcat
• Directly interact with ports and services
• Grab banners: `nc target 80`
• Bind/reverse shells: used in post-exploit too
• Simple and powerful for testing services
>>> Masscan
• Like Nmap but way faster
• Great for scanning huge IP ranges
• Example: `masscan -p80,443 10.0.0.0/8 --rate 10000`
• Use with caution — very noisy
>>> Banner grabbing
• Manually connect to services to learn versions
• Helps identify vulnerable software
• Try: `telnet`, `curl`, `nc`, custom scripts
>>> Service and version detection
• Identify running software on open ports
• Tools: Nmap, WhatWeb, Wappalyzer
• Use results to look up known vulnerabilities
Active recon wakes the target up. Be smart, stay stealthy if needed.
Part 6 next: Network Scanning
#nevent1q…zkql
#hacking #nostr #infosec #ctf #vibecoding

2025-06-25 04:43:20 GMT

- reply

Part 4 of my Ethical Hacking Notebook
Passive Recon
>>> OSINT (Open Source Intelligence)
• Collect info without touching the target’s systems
• Use Google, LinkedIn, Twitter, Nostr for data gathering
• Look for emails, usernames, infrastructure details
>>> Whois, DNS, Shodan
• Whois — find domain registration details
• DNS enumeration — find subdomains, MX records, TXT records
• Shodan — search internet-connected devices and services
• Use tools: `whois`, `dig`, `nslookup`, `shodan-cli`
>>> Nostr-style footprinting
• Track public keys and relays
• Analyze user posts for info leaks
• Map social connections and activity patterns
• Use Nostr clients and bots for data collection
Passive recon is about quietly gathering clues before you make a move.
Part 5 next: Active Recon
#nevent1q…ng6j
#hacking #nostr #infosec #ctf #vibecoding