puck tools — test your egress policy against real C2 traffic →
Offensive ContextOffensive ContextContact
#linux

You don't need permission to start

Loose pen-and-ink sketch of a tall gate chained and padlocked shut, standing on its own with no fence attached to either side. Four people wait patiently in line in front of it while a fifth simply walks around the open side.

Nobody is going to walk up and tell you that you are allowed to get started with that thing you want to learn. There is no email. There is no course or certification that will make you magically ready. Most importantly no job title needed to get started, and the person you are hoping will one day say “you’re ready” is themselves waiting on somebody else to say it to them.

So start. That is the whole of it. The first tenet of an offensive mindset is to act on that curiosity. Most people who never get going are not blocked by ability, they are standing at a gate that was never locked, waiting to be waved through.

There is exactly one permission in this field that is real. I want to be precise about where it sits, because conflating the two is what can get begginers in trouble. You don’t need Permission to learn. You do need Authorisation to touch someone else’s systems. That said I encourage you to repeeatedly break the systems you own, fixing them is a valuable skill in itself.

The first box you are allowed to attack

It is the one you are typing on.

You own it. You do not need a lab budget, a Hack The Box subscription, or a permission slip to look at it, and it is already running more software than you can account for. It doesn’t need to be “security” for it to be useful. Start with what is listening:

For instance on linux we can use ss (8) to look for listening services. Side note, on linux use ss -h to get the help info and man ss to get the man page (aka the manual)

$ ss -tlnp
State  Recv-Q Send-Q  Local Address:Port  Peer Address:Port Process
LISTEN 0      4096          0.0.0.0:22         0.0.0.0:*
LISTEN 0      511         127.0.0.1:4321       0.0.0.0:*    users:(("MainThread",pid=100616,fd=24))
LISTEN 0      4096    127.0.0.53%lo:53         0.0.0.0:*
LISTEN 0      5             0.0.0.0:8000       0.0.0.0:*    users:(("python3",pid=123924,fd=3))
LISTEN 0      4096             [::]:22            [::]:*

Here we see there are 5 listening services. The first one and last, are port 22, which is SSH. The listener on port 53 is DNS. The listener on 4321 and 8000 are the most interesting.

Of those two, which is the most interesting?. One is bound to 127.0.0.1(loopback), this local machine only. The other is bound to 0.0.0.0(any), which means everyone on the network. Two wildly different exposures. Let’s pull on it:

$ ps -o args= -p 123924
python3 -m http.server

$ ls -l /proc/123924/cwd
... -> /home/evan/www

Hrm looks like someone started a web server. http.server is from the python stdlib, has no access control and serves the directory it was started in. (see pydoc http.server for more info). We can look in /proc (man procfs) for that pid to find the working directory.

$ ls -l /proc/123924/cwd
... -> /home/evan/www

So what it is actually publishing to the local network? Let’s check it out with curl

$ curl -s http://127.0.0.1:8000/ | grep -oE '>[^<]+/</a>'
>.git/</a>
>.secrets/</a>
>archive/</a>
>.venv/</a>
>node_modules/</a>
>src/</a>

.git/ is the full history of this repository. .secrets is propbably something on this machine that could be interestting. I could probably look for those while exploring other web apps in the future.

What have we figured out so far… netstat,bind addresses, how to start a simple http server. That cost nothing but the willingness to explore what is on my own machine and ask why. No permission was involved at any point, because there was no one to ask.

The honesty of the unknown

It is perfectly okay to start on something you don’t know how to do. You don’t need to learn something you already know how to do. Noody will judge you for not knowing something, unless you claim to be an expert in something you obviously are not.

No need to rush into being an expert, that comes with time. Laern to enjoy the journey from noob to master. The journey is where you gain the experience needed to build intuition. It is good to remember that nobody is born knowing how any of this work.

Fix the problems you have

The reason “just start” usually fails as advice is that nobody can’t tell you exactly where to start. People default to a random class and then forget evertyhing they learned when they go to apply the lessons.

Take the last thing that made you go huh and follow it until you solve the problem. A service you did not know was running. An error that mentioned a protocol you have never read about. A binary that wanted an argument you could not guess. Fix your problem, then stop. You are not trying to reach the bottom, you are trying to build the habit of going down the rabbit hole.

That habit is the actual skill. Deep knowledge is the result of thousands of repetitions; from inside it is mostly a long series of small refusals to leave something unexplained. Every one of those was self-authorised.

Two things can make learning much faster now than it was when I started: the tooling and most of the documentation is open (no more dumpster diving to find docs and manuals), and you have a tireless expert on hand that will explain the layer beneath the one you are on. There is a right and a wrong way to use that expert, and it is the difference between finishing the task and being able to finish the next one. But that is its own post.

Right now the only thing standing between you and learning is one command in a terminal on a computer you already own. Go see what is listening.

← All posts