How I keep learning while stepping away from a lesson for a second

 So, I have stated that when I am stuck, I take a step back for a few minutes, but I wanted to explain that I don't just go and do nothing. 

True there are times when I go play with my son or cook my family lunch, or whatever. But for me my learning right now is to a point that I feel like I need it for my sanity. But on the same hand when I get stuck on something that, maybe I think I shouldn't it drives me nuts, LOL. I have high expectations of myself, so I can get hard on myself when I don't immediately get something. But back to the topic.

Let's take this morning for example, I was working through what should have been an easy task on PentesterLab, but one of my computers is down so I am working on the one I never installed VIM on, which this exercise called for. I thought no problem how hard can it be to install VIM on Windows. And I was correct it wasn't that hard. I started going through the task and it wasn't working, and I couldn't tell why. So, I googled and worked through and still nothing. So, I decided to step back for a second. Now this is 430 in the morning, and everyone is sleeping so this is where I have developed what I feel is a good method.

As I said I feel like I am behind in learning this. I mean, most people I meet are in there early 20's learning this, aside from myself and a few oddballs. Most people my age have been doing this a long time. So instead of doing nothing I have a few other programs I am working through, so I just switch gears and still learn something relevant to cybersecurity and Red Team specific material. 

This morning I decided to work through TCM Security's Practical Ethical Hacking course. Yesterday I started on InfoSec's Ethical Hacking Learning Path. This gives me a break from the specific problem I am having while still ensuring that I am working towards my goal.

Heck there are even times when I need to step away from a sticking point to the point where I step out of the red team mindset and decide to get back to networking fundamentals or whatever.

The point is we all only have so much time in each day. Just because you need a break doesn't mean you have to completely stop learning for the day.

I understand the mental health side and limits on time when it comes to concentration. I am sure the longer this blog goes on the more those things will come up as I have my struggles at times with concentration. So, you have to do what's best for you but sometimes just the smallest shift in material can change it just enough to reset your concentration clock.

One of my favorite things about the learning side of Cyber is nothing is the same from minute to minute and its one of the things that first drew me to the red team side, so the concentration thing doesn't seem to be too big of a problem. That is really the biggest draw when I was talking to a friend, and he was equating it to a puzzle and how every day is slightly different because, what is an exploit today might get patched tomorrow. There is always something changing and making you think outside of the box. 

Oh, and this blog has just helped me step away to the point I see what is wrong instead of the file being saved as test.php or was saved as test.php.un. which I am not sure why or if that is what is messing with the exercise, but it is something different than what is happening in the lesson, so I am going to have to look into that. So that goes to show we can still be working towards our goal (which I am assuming for everyone is to break into cyber), and not be directly working on a problem and figure stuff out.

Immerse yourself in this material and there will not be a shortage of shifts you can make when you need to step away from something.



Location: Kansas, USA

Comments

Post a Comment

Popular posts from this blog

LLMNR

Image
Here we learn a little about LLMNR. So here is a description of the attack. I think the key here is that it provides the hash. These days anytime you can get a hash it's a win. Even if its long and complex, hash cracking tools are a 3 second google search.  I like graphics like this cause to be honest, even if I know how to attack it I am not always sure how to mitigate what I am doing. Its why I like learning what is behind the scenes. In the next few posts, I am going to show some mitigation techniques the course brought up and the reason for that is it really helped me start to think about how to mitigate. Again, I will not be sharing everything and if you want to learn more, please go check out  TCM Security . This has really been a great course to get my brain thinking in ways to help businesses.  And here are their recommendations for mitigation. And this is just to get your brain in the mode of mitigation. Remember we are doing this to help businesses not just to d...
Read more

More mitigations

Image
 So like I said we are going over mitigations and I grabbed a couple slides and while this is not everything, I grabbed ones that helped to spark a thought process and understand how mitigation can be performed. Now we started with SMB Relay because we were told its one of the most exploited vulnerabilities. Really until this slide I was thinking "if it's such a known vulnerability why is it still being used?" And seeing this slide with the pros and cons made me realize certain things need to be used and our job as security professionals can't be just to shut down everything that can be exploited but rather make things as safe as possible so that our companies can still be as productive as possible while being as safe as possible. Now I always thought I knew strong passwords but in taking this course I found out just how easy password cracking is. So, 14 or more characters and make it complex.  Capital, Lowercase, Numbers, Special Characters, stay away from common wor...
Read more

Overwrite and BadChars

Image
 I wrote a script for Bad chars and show how I overwrite the program. This is all leading up to finding the right module and then gaining shellcode. Exploit Development is defiantly something I want to take some more time to get to know. I plan on going through these videos at least one more time.  So a couple things to remember is take out "\x00" and make sure you wrap it in "()" Here is the first code I wrote And here is the correct code. Anyone catch the mistake? Thats right line 9 I forgot to change.  Now remember like with all the lessons before we are running both vulnserver and immunity debugger as admin. Attaching vulnserver  to Immunity Debugger and pressing play. The goal is to overflow the buffer space and through the EBP (Extended Base Pointer) and into the EIP (Extended Base Pointer Instructional Pointer). Which is where we will be placing the malicious code.  And as you can see it is now paused meaning we gained overflow and crashed the machine....
Read more