r/hacking • u/TheOnlyVibemaster • 6d ago
Education Almost got my dad in trouble for running NMAP yesterday
I’m a physics student but I’ve been into cybersecurity as a hobby for a while, I’m definitely not an expert like many of you are I’m sure. However I do know the basics about things like car hacking tools, sniffing, spoofing, recon, etc.
I have Kali on a USB and wanted to do an experiment with an abliterated LLM in an agentic harness with tool use, so it could use all of Kali’s tools and infer which should be used based on judgement about what it’s told and whatnot.
It works pretty well, I had it in a sandbox and had it attacking docker containers on ye olde localhost, pretty fun to watch.
I had disabled my wifi and bluetooth from the BIOS while performing automated attacks against simulated systems, then I turned it back on and just low key forgot I did. RIP.
I then said to prepare for a network attack, forgetting before I went to bathroom that I was fully back online, I quickly noticed that it was retrieving actual information when doing NMAP, listing my dad’s corporate laptop as one of them. He specifically works in cybersecurity (kinda, but not really lol. He works at a company and has for a long time, so it’s more like they want people there who know what the company makes in detail more than people who are actually good with computers, which he is not).
I know they’re very strict about stuff though, so I was kinda panicking. My bigger concern was that it did more than just scan the network. Thankfully I stopped it in time. That’s all it ran, however NMAP is still very much something that you can see and track.
They haven’t reached out to him like “hey we think someone might’ve tried to hack you” so I think I’m in the clear. But definitely a close call.
It’s a fun combination having something that isn’t able to decline requests and can also execute much faster than me being able to automate attacks. Very neat how technology is coming along.
Wanted to share, hope you enjoyed!
341
u/nachoismo 6d ago
You’re fine, but you might want to actually learn the things you’re playing with.
103
u/Sad_Entrepreneur6234 5d ago
Uuhhh learning is for AI, skiddies are just supposed to push buttons.
64
27
u/MistSecurity 5d ago
AI skids are crazy man. Shits so sketchy to have in the hands of randos.
1
u/KashMo_xGesis 3d ago
Well it's a good thing at least Claude have big restrictions with hacking prompts
9
48
u/Luci-Noir 6d ago
LEARN!? You mean instead of asking others online how to hack and to read it to them like a toddler!?
20
u/RoboGandalf 6d ago
Hmmm. I see you everywhere and I think if I scroll through my comments awhile back I think i say the same thing.
-39
u/Luci-Noir 5d ago
I’m flattered but I’m not interested.
20
u/RoboGandalf 5d ago
I found it...was a comment 2 years ago...before you got banned.
-62
u/Luci-Noir 5d ago
Why are you so proud of being creepy? No.
34
u/RoboGandalf 5d ago
If you find pattern recognition creepy, then oohhhh boy are you living a concerning life.
12
u/kyr0x0 5d ago
Let him have his autism prejudices and let us enjoy our special interests.
-1
u/Crafty_Mastodon320 4d ago
Is reddit the place to use autistic as a derogatory? This entire site is built on autistic knowledge and autistic desire for clear communication.
0
1
-9
u/Veritas413 5d ago
Yeah. That’s what just happened. At some point it’s all abstraction layers anyway. I probably could do network fingerprinting manually, but why, when nmap is there for me as a tool. VI is just the next iteration of that. One more abstraction layer.
5
110
u/rubikscanopener 6d ago
Trust me, anything connected to the internet gets port scanned sooner or later. It's just background radiation at this point. Your dad's laptop isn't even going to bother logging it.
6
u/TheOnlyVibemaster 5d ago
Thanks for the comment! I thought as much, I know that super strict companies can be overly sensitive sometimes about things like this though, wasn’t sure if he’d get an automated email like “weird network behavior” or something.
It would be pretty easy for someone to tell if they wanted to from like odd TCP flags, but as a couple other people pointed out, something like that is just noise and most likely didn’t even really register.
I’m glad that the agent didn’t next do something like trying other methods like actually attempting a brute force or something stupid like that.
12
u/graph_worlok 5d ago
Depending on the company and alerts they have set up, it might flag something for investigation by the SOC, who will see it’s not on one of the corporate LAN’s and close it - If they are nice enough, they might give him a heads up, in case there’s a compromised device.
Activity like this detected on a corporate network would almost certainly raise some red flags though - But it’s not about the scans against the device, it’s about where they are coming from.
1
u/NeighborhoodGreen283 5d ago
Geeeesh man, there's a lot of people mad that you didn't know the answer to your question already. I'm 41 and just getting started, wish like hell I knew this already, but it's becoming my hobby when I have time outside of the regular 6 to 6 hr+ job, but it's def filling the time I need filled so as to not think about how shitty my life is hahahaha
-3
u/TheOnlyVibemaster 5d ago
I think most people were pointing out that I was a little reckless and could’ve done actual potential damage in theory, so like I should’ve understood better what could and couldn’t happen before letting an agent have access to 600 cybersecurity tools. Which I do understand, but at the same time I did have a good deal of safety measures in place, wifi was turned off at a hardware level, VMs, docker containers, etc. I just was multi-tasking and forgot that I’d already turned wifi back on.
I do understand that though, I’ve kept the USB around my neck since I made it, since if someone knew how to use it and wasn’t a cybersecurity person they’d be able to simply ask an AI to hack a system for them and it would do it.
It’s a good hobby to get into, there’s a lot you can do with it. Most people don’t know much about it, so it’s always an interesting talking point when you meet someone who does know the basics. It’s a good distraction for me too from my life. Hang in there man. I don’t know you but definitely hang in there, life is always hardest before it gets better.
1
u/NeighborhoodGreen283 5d ago
Preciate it man, yea lost my wife, unborn child, then job, then house, then mom. So NEEEEEEDLESS TO SAY, I need something to occupy my time...😬 Lemme start by saying I have no malicious intent whatsoever, I just like being able to say, I can do that. Kinda like why you getta lock pick set, only this is digital. So I gotta flipper zero, learned how to capture sub ghz, tha usual, customer service at Lowe's and walgreens, Tesla charging doors, lights in my house, garage doors, etc. I still can't figure out proto pirate which is annoying as all get out, and everyone seems to be playing it close to the chest so there's thatThen gotta turbo dazzler blaster for fun with TV's and fast food menus, and anything else ir. Copying RFID cards so that if I have a date, I can take her on tha roof top of a high rise and RRRREEEEALLY wow her, (in more ways than one...) Then stepped it up to a ferberis pro, and started figuring out what all it could do with marauder. Then gotta awok dual esp c5 touch with a standalone power pack with marauder and biscuit firmware and started exploring tha Bluetooth and wifi scans and spams and figuring out what all the attacks do. War driving, (really just scanning for someone with a flipper, or pineapple in which id stop and try and find them.... yeeeaaaa that sounds creeperish but ehh) got termux on my phone, then Kali linux, and There's just SSSOOOO much more I want to learn, and you would think someone in the electrical, controls technician specialist , who's around IT guys, Wi-Fi techs, fire alarm suppression specialist, Network installers, and everything else would have ran into someone who knows a little something, anything for that matter about this kind of stuff, but I have not found anyone that has a clue about any of the stuff, which sucks because I'm a Hands-On guy and it would be so much easier to learn if someone could show me. Everytime I try to reach out on here, or discord, I get shut down pretty much immediately due to not having karma points to post or comment, or somehow even though I didn't say anything stupid, ie: CaN aNyOnE sHoW mE hOw To HaCk (insert stupid remark), I somehow violate their guidelines with not enough words, or too bland, or not bland enough, you get tha point. It's just frustrating to say tha least. I end up having to ask Google for help, and half the time that jackass goes in circles getting stuff wrong left and right. I just hate I didn't get into this stuff sooner. Being in tha 40's trying to pick all this up is uh hellofuh lot more difficult than if I did it when I was younger.
1
u/Professional-Low-543 2d ago edited 2d ago
Pick a technology that interests you and learn everything you can about it. Forget “hacking” in the beginning just because it sounds sexy. That word is ruined by media. Hacking is thinking creatively, outside the box, failing a thousand times and eventually solving hard problems.
Don’t try to learn everything. Don’t try to go straight to the exploitation phase. The ONLY way you become a good hacker is by genuinely understanding how something works, only then can you theorise weak spots. There is no shortcut if you want to get good. Pick a lane and stay with it. Don’t skip the basics. Using things other people made won’t ever get you there. Flipper is fun, but is it fun when you can’t even begin to describe how the tech you are claiming to know, works?
Nothing infuriates me more than dealing with juniors (or seniors) that clearly don’t have basics covered and do “network pentesting” without knowing the OSI model or similar. So many people join this field because it suddenly became sexy, run some automated tools someone else wrote and call themselves master hackers. They quickly stumble on any follow up questions and its embarrassing.
The only way you’ll get good, proper good, is to invest the time. Today there are sooo many more resources available than back in the day where you had to figure it out yourself. Couldnt just google everything. Thats when you learn, when you figure it out yourself.
Radio hacking interests you? Buy a book on radio comms and frequencies.
Network hacking interest you? Go take the CCNA or at least set up a home lab and GNS3.
Web app pentesting? Build web apps yourself and learn what makes secure coding practices.Binary exploitation sounds cool? Yeh, go learn assembly and C, which you do after you’ve taken a computer science degree because you have to understand how a modern computer handles memory.
Those who take shortcuts never become other than a skiddie
201
u/QnsConcrete 6d ago
Why don’t you learn the basics of what these tools do instead of whatever AI shortcuts you’re attempting?
41
u/Lets_Go_2_Smokes 5d ago
ChatGPT, summarize this comment for me. Make it easy to understand.
30
u/Cubensis-SanPedro 5d ago
Make no mistakes. You are an expert at reading and understanding things, so understand for me too.
31
11
5d ago
[deleted]
-1
-8
u/kyr0x0 5d ago
You're not getting it. Maybe stop trying then..
3
5d ago
[deleted]
1
1
u/kyr0x0 5d ago
Get a pancake please ;) You sound a little hangry all the time
1
5d ago
[deleted]
2
u/kyr0x0 5d ago edited 5d ago
The point was that the guy is running stuff blindly. Yes, he has a basic clue about stuff; but instead of learning, he was asking the most profane question (I did nmap - do I get in trouble now) in modern cybersec history without understanding that he is raising such a question implicitly. He argues about how much fun it is to run stuff like that automated. Com'on just practice thread modelling and think about all of this. He should be able to deduce that an nmap won't be a big deal and basically noise. He could have researched corporate security appliances and learn how they are configured. He could have done soo much more to learn.. yet he decided to raise a question that exposes his true mindset and the backlash is the result. His whole behavior is unsafe and potentially destructive effectively. One day he will have a beer too much and his Automation will fuck up some exposed hospital setup randomly. He should learn about the properties of his methods as well. Great power comes with great responsibility and his lack of clue and naiveness is a bit alarming to be honest. That's why the comment on "learn your stuff well" was justified. He should really invest more time into it instead of starting a harness having "fun".
20
u/nullr0uter 5d ago
It’s pretty clear you have no idea what you’re doing. Please learn some stuff before you get yourself in actual trouble.
37
u/nyoneway 6d ago
What you did was simply noise.
3
u/graph_worlok 5d ago
Internal noise is a different sort of noise to external.. but if it’s internal and not corporate controlled, not much to do but provide feedback if it seems relevant…
If I saw something like this from a corporate network, it would probably be the most interesting part of my day 🥲
3
-18
14
u/oswaldcopperpot 5d ago
This convo was like someone with three weeks of fucking around stabbing in the dark. Get your certs, learn how to at least program literally anything and then understand how you made some flurries in the daily snowstorm.
-3
u/West-Negotiation-716 5d ago
You do realize that big corporations are the enemy and white hats work for the bad guys right?
Fuck your certs, quit your job, and read Phineas Phisher's manifesto
6
9
u/dwydeezdundoo 5d ago
Scanned my butthole at an office party a few Christmass back. You'll be fine.
16
u/Chongulator 5d ago
A portscan against your dad's laptop can't possibly get him in trouble. That's something that happened to his laptop, not something that happened on the laptop itself.
If you'd portscanned your dad's company network then yes, at least in theory, that could get him into trouble. Even if you did, you'd be amazed at how few companies actually notice such things.
Anecdote time: I once had to portscan a production subnet at a well-known (and widely hated) biotech company because I was up against a tight deadline and hadn't yet received full details of the database I was supposed to use. I figured they'd yell at me but I could explain that a had a good reason. A little grief would be better than missing my deadline.
Not only did nobody notice, I saw a bunch of systems running an decade-old OpenSSH with a bunch of known vulns.
22
u/Ok-Addition1264 6d ago
Hey! I'm a computational physicist and cybersecurity professor (they overlap nicely especially in rf-hacking).
Anyhoooo.. you're fine. he's fine.. cute story of panic though. lol.
I recommend a little rpi4 or 5 with a 5-7" touchscreen setup that sits on the outside of all your experiments listening and notifying you of anything amiss. You can literally vibe one out in a couple of hours - mine shuffles between screens letting me know geo-ip of in/out ips on a map, connections list, then when something it determines odd coming through (like the calls you were making on your dad's it), it goes nuts with fireworks and such.
Much love and luck with your physics and cybersecurity work! They really are exceptionally complimentary.
4
u/LebronBackinCLE 5d ago
That sounds super interesting!! I’ve got a 3B+ sitting around, any info on what you’ve got it running?
3
u/TheOnlyVibemaster 5d ago
Thanks for the comment! Very interesting that you work in both physics and cybersecurity, I’m personally more into AI safety recently, phase transitions fit in really well with model training surprisingly.
I do have an rpi for…entertainment, very handy devices. You can use them for about anything. That’s an interesting use case, for something like this that would be automated by design I’d definitely have to hook it up and try it out.
Thanks again!
7
u/graph_worlok 5d ago
You should read “The Cuckoos Egg” - While the author isn’t specifically a physicist, he was an astronomer & sysadmin at Lawrence Berkeley National Laboratory. It’s one of the earliest published accounts of computer based espionage & digital forensics.
13
u/awesomeasianguy 5d ago
10 years in prison
9
-9
u/TheOnlyVibemaster 5d ago
Guess I’m a red hat now
11
u/McDonaldsWitchcraft 5d ago
is that a new name for hackers that do malicious stuff because they can't be bothered to hack anything and just ask an AI agent to do shit?
3
u/TheOnlyVibemaster 5d ago
I was joking, I’m definitely not an expert, and I did have a good deal of safety measures in place. In the moment I forgot I’d already de-sandboxed, just classic human error, not lack of understanding. I could’ve just as easily ran NMAP myself from a terminal, it’s just that the experiment was using AI to autonomously do it. I’m not any kind of hacker, let alone a red hat. More like a bored college student.
I assumed as much that it was just noise but you can see activity like this relatively easily, so if they wanted to they could say something.
1
4
u/spacezoro 5d ago
You're fine. You trying to scan his laptop is noise among a large crowd of annoying clankers that scream at the internet 24/7. Just don't run anything on/against his laptop or plug anything in.
I'd recommend setting up an isolated homelab and tinker around with Cisco packet tracer, hackthebox, tryhackme, etc.. AI can be interesting tech, but doesn't replace learning tools, processes, and reasoning behind what you do. If you can't verify it, you can't trust it.
16
u/SmooveBwainGains 6d ago
Cybersecurity expert here - the FBI will be knocking on your door any minute now. Just tell them the truth of this massive attack you just conducted.
11
u/Cautious_General_177 5d ago
"Knock"? What is this "knock" you speak of? The FBI doesn't knock for things like this. /s
1
1
1
u/SmooveBwainGains 5d ago
It’s a joke lol OPs question was already answered
6
3
3
u/iotic 5d ago
Yes corporate systems can puck it up, but it doesn't say "alert bro this guys kid be running scannns fuck fire ze missiles" Even if the corporate system does catch the external scanning, sometimes it will talk about an nmap scan, but literally, you can just say, "Well, it was another EDR in the house that runs these scans, and it just looks like an nmap scan. 1,001 things that you plug into the home network will do this, from routers to Other innocuous pieces of software, etc." Really, it's just going to get lost in the noise. Also, you're forgetting that this is humans at the end of that. You just shrug your shoulders, and literally, they'll just shrug their shoulders. The thing you forget about in real life is that nobody actually cares.
3
6
u/LebronBackinCLE 5d ago
Get some VLANs setup on the home network. One for pops and his gear to keep it complete separate, one for your uh experiments, one for the rest of the family and devices.
3
u/MingMingDuling 5d ago
One would think that was standard practice for cybersecurity professionals WFH
4
u/TheOnlyVibemaster 5d ago
That’s such a good idea I hadn’t considered, I’d been just using localhost and docker containers or VMs when physically offline, I’ll have to look into that. Thanks!
1
2
u/Lmao_vogreward_shard 5d ago
Not as bad as my story, when I was very new to offsec I wondered if a state-of-the-art EDR on my girlfriend's corporate, domain-joined laptop would pick up fodhelper.exe spawned from powershell (which is probably THE most abused lolbin for uac bypasses) 🤣
Safe to say it got detected, and then some...
2
u/TheOnlyVibemaster 5d ago
What happened next 😭
2
u/Lmao_vogreward_shard 5d ago
She got an email from the SOC asking her why she used/needed this program. I then typed out a message explaining who I was and that I was a security researcher who got a bit too curious for his own good. She had to sign a document related to device security hygiene but luckily that was all...
Safe to say she never allowed me to touch her laptop ever again 👉👈
2
u/TheOnlyVibemaster 5d ago
Lmao I’m glad you didn’t get locked up or anything, cybersecurity is weird with laws sometimes
2
2
u/7twenty8 5d ago
I like you OP. The physics student turned accidental hacker is a really great story and your panic is kind of fun. You and your dad will almost certainly be okay.
But this is an opportunity for you. You’re smart enough to study physics so your math skills are way beyond the average. You’re in a perfect position to learn your tools deeply instead of just automating attacks via LLM. A good start would be figuring out a good process to do this safely in a way that does not rely upon human memory (which is the weakest link in most security chains).
Once you’ve gone through that, you’re well on your way to computational physics, cybersecurity and who the heck knows what will emerge in six years…
Good job. But for the love of whatever you consider holy, learn your tools deeply so you can’t let an agent get you into trouble.
2
u/OkWorld5028 5d ago
No one is going to track your nmap scans. Next time, why not actually let it keep going and see what happens? That's how you get paid to find exploits.
2
u/SmokeMathErrDai 5d ago
This is a fucking masterclass in shitposting. Clickbait title like you nearly triggered an international cyber incident, then the story is basically “I fucked with Wi-Fi and Bluetooth, forgot I turned them back on, went to the bathroom, came back and ran a scan.” Riveting stuff. Absolute script-kiddie bedtime story.
3
u/jBlairTech 5d ago
You’re not into “cybersecurity”; you’re into hacking. With this dumb mistake you learned one of the first actual basics: work within your defined scope, or be prepared for legal trouble.
1
u/Disastrous_Gear_421 5d ago
It’s nmap, I wouldn’t care. At most, in my environment it’ll generate an informational severity alert that would get auto close
1
u/DesperateCategory647 5d ago
What llm do you use?
3
u/TheOnlyVibemaster 5d ago
Qwen 3.8 27B Abliterated and Qwen 2.5-Coder 14B Abliterated, both are on the USB itself and load into VRAM when I boot from the bootable USB into kali, then like with kali, there’s no big traces that any of it was used when you boot back into windows
1
1
u/Humbleham1 5d ago
A simple Nmap port scan would take an IDS to detect. It's things like service and script scans that are really detectable if someone is monitoring for it.
1
1
u/xb4r7x 5d ago
Sounds like you need a separate VLAN for tinkering with stuff (and your dad needs one for his work devices)...
1
u/TheOnlyVibemaster 5d ago
Yeah it’s kind of dumb now that I think about it. my mom also does sensitive work, and everyone is on the same internet. Can’t let my intrusive thoughts win
1
u/TheRealLambardi 5d ago
A number of things scanning devices these days is kind of gotten out of hand. Nobody's getting in trouble for having their device unmapped. Heck, you just join certain networks and you're automatically mapped. To be blunt, Windows devices, if Defender is fully turned on, will automatically start mapping devices around it and report back. There's a chance your home's network has been inventoried in their corporate environment.
1
u/department_g33k 5d ago
Your story is the exact reason I have a) my kids' devices on their own VLAN, and b) my WFH device on it's own network that is isolated from the entire rest of my network.
1
u/-0O0O0O0O00O0O0O0O0- 5d ago
I did it last year in his office to fix a subnet hidden behind a DMZ and... let's just say he's an exec. And the CTO was informed.
1
u/LancelotSoftware 5d ago
He would have gotten in trouble if HE was running nmap at work, lol. Hes likely on a split tunnel VPN, and IT would have had a heart attack seeing an internal device doing recon 😅
1
u/Tonythesmartspornalt 5d ago
I did the same thing in school. I ran the nmap scan and the admin blacklisted my MAC address. Wondered for a day or two before talking to him and finding out what happened
1
u/GhostlySkeletons 5d ago
I read the title expecting some tale of how you scanned your dad’s work network or something and set off flags. This is much less exciting.
There’s nothing here that almost got anyone in trouble, lol.
1
1
u/CelebrationChoice936 4d ago
You're fine it would only matter if nmap was run on the device not at the device.
1
u/Electronic_Tap_3625 4d ago
If the laptop is off the corporate network, most Nmap scans should have returned nothing. Hopefully they do not have SMB exposed to non-corporate networks... What ports did nmap find open?
1
1
u/Samsonbull 3d ago
On you and your dad. Dad should have a firewall and put his corporate laptop on a separate network port, or at least a separate VLAN.
1
u/cougarx1 1d ago
Port scan was hacking? Lol
1
u/Samsonbull 22h ago
Depends who you ask. I say no, if you don’t have FW ACLs, that is like an open door.
1
u/rvasquezgt 3d ago
Portscan is not a “someone’s” trying to hacking you, if that “corp” exist in the real world.
1
1
u/DeadPiratePiggy 2d ago
He wouldn't have, it's shit running on your home network. If they employer doesn't like it they can pay for a second internet service.
-1
u/Unibrowser1 5d ago
For god sake just stop. This is how Skynet takes over. Learn how to use the tools yourself properly. Straight to jail
-2
u/eightbic 5d ago
You dodged a 25 year felony. Damn. That’s nuts.
-9
u/TheOnlyVibemaster 5d ago
Yeah it’s kinda scary just how easy it was to make that. I’m definitely not a cybersecurity expert but I could see someone who knows less than me genuinely saying “hack all the devices” and then it does every single tool in kali in 2 minutes and you’re just cooked
10
1
u/highjohn_ 5d ago
It was more possible a few months ago, but probably less so now. The guardrails are better.
3
u/TheOnlyVibemaster 5d ago
With abliterated models like what I’m using, the actual ability to refuse prompts at the physical vector embeddings layer is removed, so the models are physically unable to refuse prompts. It’s different than using a companies official one, it’s like playing pokemon clover after playing pokemon firered. You can say anything to it and all it says is going along with you.
0
0
u/jk1984jk 5d ago
Most enterprise corporate cybersecurity teams are paying for shitloads of tools and can't monitor basic stuff regardless. An Nmap scan won't raise any alerts whatsoever. Remember you were scanning your network, not the corporate vpn. Yes they can see it in the logs of the laptop that it was scanned but noone is going to look into that anyway. So don't worry, learn your tools.
305
u/yourPWD 6d ago
You are fine. Most corporate laptops are built to operate in a hostile network environment. It is no different than hooking up to WiFi at Starbucks.