Live Recon | @IppSec Talks About Hacking, His Favorite Tools, HackTheBox and More!

### Overview In this live stream episode of Live Recon, host Ben (NahamSec) is joined by co-hosts Jason Haddix and STÖK to interview prominent cybersecurity content creator and Hack The Box contributor IppSec. The conversation spans IppSec's early background in gaming, hardware, and systems administration, his transition into offensive security, and the core philosophies guiding his approach to reconnaissance, CTFs, and career development. The discussion also touches on the practical differences between bug bounties and CTFs, favorite testing tools, and managing mental health, routines, and boundaries in the tech industry.

### Key Topics - **Background & Entry into Tech**: IppSec details his start in hardware technician work in 2006, transitioning into Linux, Solaris, and Windows systems administration, as well as early experiences with AOL/AIM hacking, StarCraft casting, and game hacking. - **Networking vs. Certifications**: The speakers discuss the value of college, training, and certifications. IppSec emphasizes that while he attends training like SANS and NetWars for networking and learning, he generally skips certification exams. He notes that showing continuous improvement and demonstrating soft skills are far more critical for bypassing the "HR firewall." - **CTFs vs. Bug Bounties**: The panel compares CTFs to bug bounties. IppSec explains why he prefers CTFs and deep technical problem-solving over bug bounties, citing the risk of burnout, repetitive payload spraying, and toxic competitive dynamics tied to financial incentives. In contrast, STÖK and Jason present perspectives favoring real-world external attack surface discovery and deep target analysis. - **Reconnaissance Philosophy**: IppSec describes reconnaissance as an art rather than an automated science. Rather than flooding targets with automated scanners, he focuses on spotting subtle anomalies, reading documentation, and analyzing what tools do *not* report. - **Tools and Automation**: The participants discuss preferred tools for directory busting, web fuzzing, and proxying, evaluating options like Burp Suite, Wfuzz, ffuf, Gobuster, and Feroxbuster. - **Mental Health, Burnout, and Setting Boundaries**: The stream concludes with an open dialogue on imposter syndrome, daily routines, social anxiety, depression, and the vital career skill of learning to say "no" to overwork.

### Technical Details - **Pattern Recognition & Recon**: Drawing from real-time strategy (StarCraft) mechanics, IppSec compares recon to identifying missing elements and subtle discrepancies. For instance, finding an Nginx or Apache server setting a `JSESSIONID` cookie can hint at an underlying Tomcat instance with URL misconfigurations that scanners miss. - **Host & Artifact Forensics**: Leveraging blue team and incident response experience, IppSec points out how timestamp precision (sub-second or millisecond cutoffs versus 32-bit representations) and file creation clusters around specific targets (e.g., `user.txt`) can expose backdoor files and challenge author actions. - **Specific Vulnerability Case Studies**: - *WordPress MFA Bypass*: In a Hack The Box machine named "Press," IppSec bypassed MFA via legacy XML-RPC functions allowing post editing, leveraging the PHP Anywhere plugin to achieve code execution. - *PHP/Laravel Type Juggling*: Exploiting loose equality checks (`==`) in Laravel APIs that accept JSON payloads in the request body even during `GET` requests, allowing authentication/flag validation bypass via `{"flag": true}`. - *MFA Token Brute-Forcing*: Bypassing rate-limiting IP blacklists in Laravel APIs by rotating `X-Forwarded-For` headers alongside sequential numeric fuzzing. - *IPv6 Link-Local Pivoting*: On the "Sneaky" box, calculating `fe80::` link-local addresses derived from ARP table MAC entries to pivot across local broadcast domains. - *ProcFS Inspection*: Bypassing blind web issues using Local File Inclusion (LFI) by reading `/proc/sched_debug` or `/proc/<PID>/cmdline` to discover running services (such as knockd) or intercepting active reverse shells. - **Tool Preferences**: - *Burp Suite*: Primarily used for Repeater without extensions or Collaborator. - *Fuzzers*: Preference for Wfuzz over ffuf or Burp Intruder when multi-parameter fuzzing and header injection are needed without custom wordlists; choosing Gobuster for targeted non-recursive scans and Feroxbuster for recursive exploration.

### Takeaways - Reconnaissance is most effective when driven by curiosity and reading between the lines rather than relying on noisy, automated scanning pipelines that produce alert fatigue. - Deep struggles during CTFs build lasting technical retention and problem-solving intuition ("spidey sense") far better than superficial successes. - Soft skills, networking, and demonstrating a trajectory of self-improvement open more doors than stacking advanced certifications alone. - Establishing firm boundaries—especially saying "no" to excessive workload—is critical for preventing burnout and sustaining long-term passion in cybersecurity.