and of course I get the VPN to work literally 10 minutes after ending stream. Welp ... can't be helped :) I unfortunately am also unable to archive the stream as Twitch did not store my desire to have streams be archived.
Therefore for those who weren't there a summary:
- TryHackMe has practically all of their form fields (login form, sign up form etc) improperly labeled by just a placeholder (e.g. rather than "password", the label is " Please make me strong.."), requiring the user to guess at what the field is meant to contain. Generally not a blocker, but annoying and sloppy.
- After onboarding, we picked the " JR Penetration tester" learning path.
- We worked through the first room. Simple web page-based offensive security simulation using gobuster and a hidden webpage.
- We figured out that Guacamole is used for remote access to the lab VM, a tool I have previously made sure is able to transfer audio.
- #ScreenReaders generally only have access to the host system, no remote machines, necessitating a screen reader to be running on the remote end to make that machine screenreader-accessible. This is easy enough to do, but THM's VMs are improperly configured causing audio to not work, therefore no screen reader can actually output speech. This is a rather easy to fix issue, they just ...haven't.
- We had no end of trouble getting VPN to work and I only got it to work after multiple regenerations of the ovpn file so that should be smoother next stream.
- We eventually completed the room by using the screen reader's OCR function liberally to interact with the secret web page which was tedious, but eventually got us the flag.
FOr now, schedule is tuesdays for ic_null content, wednesdays and saturdays for zersiax (gaming) content. If you want to see #accessible gaming, follow that account as well :) Going to try to squeeze in a second ic_null stream weekly as well, watch this space.