#cybersecurity | Python | Page 7

lean skiff Oct 5, 2018, 5:46 PM

#

think_left

orchid notch Oct 5, 2018, 5:47 PM

#

(word sucks i changed to latex )

lean skiff Oct 5, 2018, 5:47 PM

#

i see

orchid notch Oct 5, 2018, 5:47 PM

#

alright

#

back to the table wars

lean skiff Oct 5, 2018, 5:48 PM

#

reposting challenge

#

📎 maleficent.txt

inland oyster Oct 5, 2018, 6:02 PM

#

thank you @lean skiff i really appreciate it

lean skiff Oct 5, 2018, 6:25 PM

#

@inland oyster np

thorn obsidian Oct 5, 2018, 9:50 PM

#

https://marc.info/?l=git&m=153875888916397&w=2
These releases fix a security flaw (CVE-2018-17456), which allowed an attacker to execute arbitrary code by crafting a malicious .gitmodules file in a project cloned with --recurse-submodules.

orchid notch Oct 5, 2018, 9:53 PM

#

that one is already a bit older

#

and ive never seen anyone clone a git repo like that

#

so the impact is rather minimal on the average git user

safe bear Oct 5, 2018, 10:33 PM

#

Oh yeah I remember reading about that a few weeks ago

upbeat palm Oct 6, 2018, 12:50 AM

#

https://www.lightbluetouchpaper.org/2018/10/05/making-sense-of-the-supermicro-motherboard-attack/

Light Blue Touchpaper

Theo Markettos

Making sense of the Supermicro motherboard attack

#

CBC mode with random IV is the best block cipher mode imo.

orchid notch Oct 6, 2018, 1:08 AM

#

and why is that @upbeat palm

upbeat palm Oct 6, 2018, 1:40 AM

#

According to Cryptography Engineering and my research on them, the encryption process is just one by one i.e. one thread at a time and adding random IV,key and XORing the first block, then concatenating previous messages messages with other blocks and vice versa and better than others.What about you? @orchid notch

orchid notch Oct 6, 2018, 1:41 AM

#

why should it be better than for example OFB

upbeat palm Oct 6, 2018, 1:45 AM

#

Single IV is used for encryption of all blocks.

#

CBC mode changes IV after certain number of encryption.

valid furnace Oct 6, 2018, 7:38 AM

#

@safe bear Keep posting these videos

#

orders all the keys

safe bear Oct 6, 2018, 7:39 AM

#

Oh no

#

Please don't

valid furnace Oct 6, 2018, 8:00 AM

#

@safe bear why not?

safe bear Oct 6, 2018, 8:01 AM

#

Because of the many reasons they said at many points in the video

valid furnace Oct 6, 2018, 8:06 AM

#

@safe bear hahahahahhahahahahahah.
I do what I want

safe bear Oct 6, 2018, 8:07 AM

#

Now I regret sharing it

#

And I'll leave it at that

valid furnace Oct 6, 2018, 8:09 AM

#

@safe bear
No in all seriousness, literally everything is ridiuculously broken, people believe in make believe worlds.
I always figured elevators were that easy to break into, but christ is that bad.

#

There's really nothing to it, unscrew a panel, alligator clip the service key. Done.

safe bear Oct 6, 2018, 8:13 AM

#

Yes, I know and have known for years.

#

Just because it's broken, however, does not make it fair game for shenanigans

valid furnace Oct 6, 2018, 8:15 AM

#

@safe bear yes it does.

#

needs a general SDR transceiver.

safe bear Oct 6, 2018, 8:17 AM

#

Why?

#

It's easy to ask why not, but harder to ask why if you don't have any maturity

#

Just sayin'

valid furnace Oct 6, 2018, 8:21 AM

#

Knowledge is power, it does demand greater responsibility.
Now, a mature one would recognize that there are ethics and safeties involved.
One should not carelessly or recklessly abuse knowledge or power, absolutely.

But to say I should follow rules, how normal people act, because they can't understand me, because they feel threatened, because they don't have the power, is a false claim of authority.

#

Your grandmother says that computers are a waste of time. Do you listen?
A manager demands you play IT to him and his team, because he refuses to learn "computers", Do you listen?
Your car breaks down on the road. Do you just call AAA, or do you open your hood and plug your battery back in?

#

@safe bear Now, the thing about an elevator, is that generally there's no reason to mess with it. It's a method of travel. I can readily take stairs or whatever. So, the knowledge that grants me power over an elevator, also grants me the understanding of when to use it, typically never in this case.

safe bear Oct 6, 2018, 8:27 AM

#

No, actually never

#

Unless you're an authorized penetration testing team

valid furnace Oct 6, 2018, 8:28 AM

#

but say I visit a large building, and late night, I like to goto the roof to chill out and enjoy the scenery? Why does it matter?

safe bear Oct 6, 2018, 8:28 AM

#

You obviously didn't watch the video fully

#

You walk into a given elevator, think you know the tricks to get it to do what you want, maybe it works out, maybe you cause it to go out of service, maybe you cause a bug and something else happens.

valid furnace Oct 6, 2018, 8:31 AM

#

Yes, because using an alligator clamp to toggle a key switch can cause anything but designed usage.

#

I might as well stick my hand in a wall outlet. You don't just attach the alligator clip to things you don't know and fry yourself.

safe bear Oct 6, 2018, 8:32 AM

#

I'm speaking generally

valid furnace Oct 6, 2018, 8:32 AM

#

You're basically saying "don't stick my head into a car's running engine when the hood is up"

#

Well, you don't have to be an elevator/car expert, to undrstand that flipping a switch, turns the car on.

#

@safe bear I get what you're saying though. 😉 I'm just playing devils advocate.

#

I'm not going to break random elevators and screw random people over.

#

my real concern is just that I don't get stuck in an elevator.

#

hate being trapped.

safe bear Oct 6, 2018, 8:38 AM

#

Can you stop mentioning me, thanks

valid furnace Oct 6, 2018, 8:38 AM

#

shrugs

safe bear Oct 6, 2018, 8:39 AM

#

I'm obviously checking the channel

#

Basically, I don't like it when jokes don't feel like jokes

valid furnace Oct 6, 2018, 8:43 AM

#

I don't like the idea of a safe and contained world where I'm only allowed to go where told.

#

What's wrong with going to the top of a building and peering over the edge to see what it looks like?
Or to experience the scenery as it snows.

#

One of my greatest pleasures was taking my ex or my brothers to watch a movie in the theater at 3 AM.
Or we'd game on the big screen.
Going onto the roof and hanging out.

safe bear Oct 6, 2018, 8:47 AM

#

I'm not disagreeing with that

#

But keep in mind we're in a public channel

valid furnace Oct 6, 2018, 8:48 AM

#

in that case all that is perfectly legal. 😃

safe bear Oct 6, 2018, 8:48 AM

#

I've also gotten more conservative as my experience and knowledge in this space has grown

valid furnace Oct 6, 2018, 8:49 AM

#

I'd like to hear about that! Conservative in what ways and why? 😃

#

I think that's productive, to learn about how and why you believe the way you do.

safe bear Oct 6, 2018, 8:51 AM

#

Maybe when it's not 3AM

valid furnace Oct 6, 2018, 9:02 AM

#

is looking up the laws surrounding these concepts.

lean skiff Oct 6, 2018, 1:52 PM

#

heres an easy CTF challenge

#

if maleficent.txt was too difficult

#

https://lappysheep.github.io/

orchid notch Oct 6, 2018, 2:15 PM

#

@lean skiff solved

#

shall i post the flag or wait or something else?

lean skiff Oct 6, 2018, 2:16 PM

#

dms

fervent patio Oct 6, 2018, 2:19 PM

#

that's a pretty big flag

orchid notch Oct 6, 2018, 2:20 PM

#

its not the flag

fervent patio Oct 6, 2018, 2:20 PM

#

hm

pearl ore Oct 6, 2018, 2:20 PM

#

@upbeat palm

upbeat palm Oct 6, 2018, 2:22 PM

#

@pearl ore Start with Python,cause you need a scripting skill and python got a huge support of libraries for penetration testing to Cryptography,this for now.
Reverse engineering- Check Malware Analysis book,web application penetration testing- check out Lynda damn good course.
First of all,develop some skills in Python and do a lot of CTF,read write up,use picoCTF etc.

#

I guess this is enough for now, don't stress too much.

pearl ore Oct 6, 2018, 2:22 PM

#

I know python well (except OOPs)

upbeat palm Oct 6, 2018, 2:22 PM

#

Check the pinned message.

#

Okay,thats good
Get familiar with pwn,hashlib, pycrypto and other libraries and check out cryptopals

#

BTW any specific topic in infosec?
Like Malware Analysis, Forensics,Web application etc?

pearl ore Oct 6, 2018, 2:24 PM

#

What is CTF?

#

I am interested in Forensics, Pentesting

upbeat palm Oct 6, 2018, 2:26 PM

#

Do you know competitive programming?

pearl ore Oct 6, 2018, 2:26 PM

#

Like hackathons?

upbeat palm Oct 6, 2018, 2:26 PM

#

More or less,yeah.

pearl ore Oct 6, 2018, 2:26 PM

#

Yes

upbeat palm Oct 6, 2018, 2:27 PM

#

CTFs are just like competitive programming but just for cyber security guys.

pearl ore Oct 6, 2018, 2:27 PM

#

Oh

upbeat palm Oct 6, 2018, 2:29 PM

#

But before trying them, I'd recommend you to take some courses on cybrary.it

#

@pearl ore Forensics...You need to learn reverse engineering then.

pearl ore Oct 6, 2018, 2:32 PM

#

Where can I read about different sub-fields inside cybersecurity..?

upbeat palm Oct 6, 2018, 2:34 PM

#

Well, actually I also don't know everything about sub-fields but they are kinda interrelated.

#

@pearl ore
https://www.quora.com/What-are-the-subfields-of-Cyber-Security

What are the subfields of Cyber Security? - Quora

A group of experts spent time to come up with a mapping of the entire field. The intent was to better describe different career paths and areas of study. There are a variety of specialties ranging from secure hardware design to setting overall pol...

pearl ore Oct 6, 2018, 2:37 PM

#

Okay so I will start with cybrary.it

upbeat palm Oct 6, 2018, 2:38 PM

#

Yup,and tbh get ready to read a lot and lots of stuff.

pearl ore Oct 6, 2018, 2:38 PM

#

I like to read 😅

#

I pretty much self taught programming

#

The two things I am interested in IT are: Security and Programming

#

Thanks @upbeat palm

upbeat palm Oct 6, 2018, 2:40 PM

#

So do I, learned python on my phone.😅

pearl ore Oct 6, 2018, 2:40 PM

#

I will contact you in this channel if I need any other related information..

#

Very few people know about this topic

upbeat palm Oct 6, 2018, 2:41 PM

#

@pearl ore Don't thank me,and when you feel that you're ready to compete do consider making a team for a CTF with me.
KnownError is most experienced guy here.
For Cryptography you can consider Nix, he's damn intelligent.

pearl ore Oct 6, 2018, 2:42 PM

#

Sure

#

Have a nice day..✌

upbeat palm Oct 6, 2018, 2:44 PM

#

I'm having a nice night with a freaking PDF file.
You too have a nice day.

lean skiff Oct 6, 2018, 3:56 PM

#

@pearl ore I also recommend using a linux vm or something that has a terminal

#

terminals mostly come with already inbuilt cybersec related software

#

like thc-hydra

pearl ore Oct 6, 2018, 3:57 PM

#

I have kali on VM

#

And also that vulnerable linux

#

I forgot its name

lean skiff Oct 6, 2018, 3:58 PM

#

DVL?

valid furnace Oct 6, 2018, 4:00 PM

#

@upbeat palm @lean skiff You setting up for something?

lean skiff Oct 6, 2018, 4:02 PM

#

wym setting up

valid furnace Oct 6, 2018, 4:02 PM

#

oh, CTF

lean skiff Oct 6, 2018, 4:02 PM

#

i host my own challenges

#

most of them are CTF, some of them are cybersec related

valid furnace Oct 6, 2018, 4:06 PM

#

So I think I'm decent at designing safe procedures, policy.
I definitely toy with tools for cryptography, cryptocurrency, permissions and security for servers a lot.

but I'm not familiar with the exploit world.

pearl ore Oct 6, 2018, 4:11 PM

#

Its Metasploitable

valid furnace Oct 6, 2018, 4:12 PM

#

what do you mean?

pearl ore Oct 6, 2018, 4:12 PM

#

@lean skiff asked which distro I was talking about..

#

Now I remembered the name😅

lean skiff Oct 6, 2018, 4:12 PM

#

lmao

upbeat palm Oct 6, 2018, 4:33 PM

#

@valid furnace Was playing CTF, but one of the challenge is freaking hard.

#

@lean skiff Any update?

lean skiff Oct 6, 2018, 4:34 PM

#

Nope

#

Someone requested and paid for a hint

#

so I'm guessing it's still progressing

upbeat palm Oct 6, 2018, 4:34 PM

#

Paid for a hint,wow.

lean skiff Oct 6, 2018, 4:34 PM

#

using a bot to have a virtual currency

#

not actual payment

#

smh

upbeat palm Oct 6, 2018, 4:35 PM

#

Oh.

#

👌

#

Lemme know when anyone find something in it.

lean skiff Oct 6, 2018, 4:36 PM

#

kk

upbeat palm Oct 6, 2018, 4:37 PM

#

Any previous CTFs?

lean skiff Oct 6, 2018, 4:38 PM

#

Here's a moderate difficulty one

#

We think we've found some more data of relevancy. Unfortunately, if there is a method of encryption behind this madness, it may either be something we've never seen before or perhaps something simple that has been made complicated.

#

📎 launcher.b64

#

Tip - One of the words may not be correct...

upbeat palm Oct 6, 2018, 4:40 PM

#

What is the flag format?
Or it's just a special word?

lean skiff Oct 6, 2018, 4:42 PM

#

iirc there's an 8 character flag

#

should be Flag: {}

valid furnace Oct 6, 2018, 4:49 PM

#

So, how does CTF typically work anyway?

#

looks like some cipher/code.

upbeat palm Oct 6, 2018, 4:57 PM

#

CTFs are like completion where you have to complete given tasks.

#

Tasks include:-
Reverse engineering
Forensics
Web application penetration testing
Cryptography etc.

valid furnace Oct 6, 2018, 4:59 PM

#

sounds really hard. I tend to do niche things

#

for example, I help people recover bitcoin/electrum wallets

#

usually it's useless, but if they have an idea of what their password/seed was, we've occassionally recovered it

#

I'm at around $80,000 recovered

upbeat palm Oct 6, 2018, 5:00 PM

#

Idk,but your work sounds difficult.

valid furnace Oct 6, 2018, 5:00 PM

#

$20,000 I personally handled

upbeat palm Oct 6, 2018, 5:00 PM

#

That's so cool.

valid furnace Oct 6, 2018, 5:01 PM

#

@upbeat palm long story short, I'm an opinionated asshole about rights and what not, but I take my reputation and security very seriously and I genuinely want to help people improve the world.

safe bear Oct 6, 2018, 5:02 PM

#

02peek

valid furnace Oct 6, 2018, 5:02 PM

#

Python isn't great for parallel computation though.

#

and its not very fast.

upbeat palm Oct 6, 2018, 5:02 PM

#

Wow,that's so cool.
I tried to help people but after sometimethey again do the same shit and came to know this happened,that happened.

valid furnace Oct 6, 2018, 5:03 PM

#

I have about 12 bitcoin projects that need to be cracked with notes on them.

upbeat palm Oct 6, 2018, 5:03 PM

#

How you crack the bitcoin wallets?

valid furnace Oct 6, 2018, 5:05 PM

#

Here's what I do.

Take detailed notes about the person, contact info, what software they used.
Guide the person through memory exercises to detail as much as possible about what their password was, and what their seed may have been. Detailed notes.
write software, or configure already made software to fit those parameters and run it for awhile.
if it doesn't work out, I freeze it and store it.
eventually I'll try to break their wallets again.

upbeat palm Oct 6, 2018, 5:05 PM

#

Sounds very difficult.

valid furnace Oct 6, 2018, 5:05 PM

#

yeah and honestly I don't know what the hell I'm doing.

safe bear Oct 6, 2018, 5:06 PM

#

Security in a nutshell

#

If you don't know what you're doing then you're doing it right, when it comes to a lot of things.

#

Well, that's not the best wording

valid furnace Oct 6, 2018, 5:08 PM

#

but hey, I've helped people with hundreds of thousands, escrowed about a hundred thousand more
not bad for being clueless.

safe bear Oct 6, 2018, 5:08 PM

#

finger_gun

valid furnace Oct 6, 2018, 5:08 PM

#

let me look at my notes, maybe I can throw one at you

upbeat palm Oct 6, 2018, 5:09 PM

#

In a nutshell, you're awesome.

valid furnace Oct 6, 2018, 5:10 PM

#

Eh, I'm not sure how legitimate I am.

#

I just got really involved in the bitcoin community, and the cryptocurrency "rush" has wound up with a ton of newbs screwing up access to digital money.

#

backups people come on

#

imposter syndrome is real

#

so that launcher.base64 file, I have no idea where to start with that

safe bear Oct 6, 2018, 5:18 PM

#

Personally I really don't like CryptoCurrency. I like a lot of the ideas behind it, but not the huge resource wastage and malicious attacks trying to get wallets.

valid furnace Oct 6, 2018, 5:20 PM

#

case02 - 5 BTC - unknown string passphrase?
case03 - 0.178 BTC - 3-8 char password?
case05 - 0.37645647 BTC - brainwallet from italian poetry?
case06 - unknown?
case08 - 50 BTC (probably a bogus claim)
case09 - unknown? <= 13 char password?

#

I don't think resource wastage is a problem at all, if anything it's probably more efficient than current systems.

#

sorry pings

safe bear Oct 6, 2018, 5:22 PM

#

More power than the country of Ireland

#

Thanks 👌

upbeat palm Oct 6, 2018, 5:23 PM

#

13 character password.

valid furnace Oct 6, 2018, 5:23 PM

#

Eh, it's not really a problem, and honestly, the security and cryptographic basis that bitcoin provides is well worth the energy the miners consume, over the legacy financial system and abuses and corruption.

#

Also, there several other (legitimate) cryptocurrencies that are not high energy usage. 😃

upbeat palm Oct 6, 2018, 5:24 PM

#

How did you recovered 13 character password?

valid furnace Oct 6, 2018, 5:24 PM

#

but I absolutely agree with you. Most cryptocurrencies are just speculative BS with a bunch of idiots and asswipes trying to defraud others.

#

that really sucks, as always.

#

@upbeat palm to be clear, those are currently open cases.

#

If you're interested in trying to crack one, DM me

#

I come from IRC, so I have a strong habit of tagging everyone.

safe bear Oct 6, 2018, 5:33 PM

#

Ahhh

#

Yeah, I never did IRC. Poked around on Freenode a few months ago, but that's about it.

valid furnace Oct 6, 2018, 5:40 PM

#

with the low sum amounts, I can allow you guys to try to crack those if you want, probably keep a portion without issue.
the larger amount I'll have to ask the owner permission, as that's more risky as its worth more, etc.

chilly elk Oct 6, 2018, 10:05 PM

#

anybody in here willing to give their opinion?

#

Im going to be setting up an IP monitoring daemon or asyncronous script to check in RT for unknown/untrusted inbound and outbound connections and notify me of them. Should I go about making devices trusted based on MAC addr or should I add static IPs to my home networks and only worry about those that arent pre-recorded

safe bear Oct 6, 2018, 10:09 PM

#

Personally, I use static for the first 100 or so, then DHCP for the rest
I'm too lazy to whitelist, especially since it's a pain when friends/family are over
DHCP doesn't provide any security, since someone can just sniff ARP traffic then give themselves an IP in the subnet range and spoof an existing MAC(edited)
Really you want to make sure they're not able to authenticate period
And enable isolated clients if possible, though that breaks a lot of stuff like Echos and Sonos
I think I have isolation enabled on two guest networks but not the other two personal networks

#

Firewalling would help as well

chilly elk Oct 6, 2018, 10:11 PM

#

the only people who are on my personal network are me and my mum. I could set static IPs for her devices just because im too lazy to care about her security

safe bear Oct 6, 2018, 10:11 PM

#

Depends on how much work you're willing to put into it tbh

chilly elk Oct 6, 2018, 10:11 PM

#

I mean based on what i want to do this is a big ass project

#

i still need to get asyncio down to a t

safe bear Oct 6, 2018, 10:11 PM

#

Client Isolation solves most of the issues

chilly elk Oct 6, 2018, 10:11 PM

#

can you write daemons in py

#

prob not right

safe bear Oct 6, 2018, 10:11 PM

#

Since it's much more difficult for a infected device to spread

#

yes you can

chilly elk Oct 6, 2018, 10:11 PM

#

oh really?

#

hmm

safe bear Oct 6, 2018, 10:11 PM

#

https://pypi.org/project/python-daemon/

PyPI

python-daemon

Library to implement a well-behaved Unix daemon process.

chilly elk Oct 6, 2018, 10:12 PM

#

im thinking a daemon would be best

#

AH

#

thank you

#

look at you with the links so fast

#

ur a god

safe bear Oct 6, 2018, 10:12 PM

#

Bookmarks :^)

chilly elk Oct 6, 2018, 10:12 PM

#

WeSmart

safe bear Oct 6, 2018, 10:12 PM

#

11,000 bookmarks

chilly elk Oct 6, 2018, 10:12 PM

#

WeSmart

#

uhhh

#

ok maybe thats a bit too much

safe bear Oct 6, 2018, 10:12 PM

#

GWfroggyWeSmart

chilly elk Oct 6, 2018, 10:12 PM

#

Hmmm

#

im gonna need help on this for sure

safe bear Oct 6, 2018, 10:12 PM

#

Hehhehheh

chilly elk Oct 6, 2018, 10:12 PM

#

is there anywhere in this server i can like recruit?

#

I know

#

twitter

safe bear Oct 6, 2018, 10:31 PM

#

Recruit?

#

If it's public and open-source and uses Python, you're welcome to share it in #303934982764625920

chilly elk Oct 6, 2018, 10:42 PM

#

@safe bear i meant like anywhere i can ask if somebody wanted to work on it with me

#

so Twitter doesnt enforce HSTS so just be careful on there

#

and soundcloud does not have HTTPS Redirect

#

so be careful there

safe bear Oct 6, 2018, 10:46 PM

#

I'm not that paranoid

#

Props for paying attention 👍

chilly elk Oct 6, 2018, 10:49 PM

#

gotchu 😃

#

I meant soundcloud does NOT have https redirect

safe bear Oct 6, 2018, 10:50 PM

#

Oh, I thought you meant they had both and redirected instead of just HTTPS

#

Which is vulnerable to a downgrade attack

#

But tbh is just fine because there are a whole lotta people that can't access HTTPS for one reason or another

chilly elk Oct 6, 2018, 11:04 PM

#

Im just surprised soundcloud doesnt redirect HTTPS

chilly elk Oct 7, 2018, 12:06 AM

#

@valid furnace we have been talking about this here

valid furnace Oct 7, 2018, 12:06 AM

#

@chilly elk
VLANs won't really be noticable at all, no throttling is introduced unless you make it.

#

I have a full on enterprise network setup in my apartment

chilly elk Oct 7, 2018, 12:07 AM

#

ok well see

#

im a broke boi

#

with a shit router

#

no ethernet

#

and little networking skills unless it has to do with recon

valid furnace Oct 7, 2018, 12:08 AM

#

Basically, I have a VM server that is trunked onto all the VLANS.
I can spin up specific VMs on specific VLANs to provide services for various networks.

Currencly I have: infrastructure, internal, guest, security, public, iot subnets/VLANs

chilly elk Oct 7, 2018, 12:08 AM

#

ok so basically ur running an office

#

in ur home

#

lmao

valid furnace Oct 7, 2018, 12:11 AM

#

infrastructure has no routes
internal routes to everything else.
guest can access public only
security has no routes
public, bunch of websites, bitcoin nodes, torrent servers
iot, no routes. These are devices I want to control, but I don't want to call out to chinese assholes.

chilly elk Oct 7, 2018, 12:11 AM

#

r u a filecoin/siacoin user?

valid furnace Oct 7, 2018, 12:12 AM

#

firewall rules to match. I don't have it quite yet, but I'm going for whitelist only.
Problem is it's a pain in the ass to setup access lists for everything you want to lalow, they don't seem to publicize them that much.

#

No, I'm not familiar with those. I've only been involved with several coins religiously.

chilly elk Oct 7, 2018, 12:12 AM

#

yeah my biggest fear was setting firewall rules lmao

#

ah i se

#

yeah i was an early investor in BTC and then a big adopter of the pump and dump shitcoin phases people went through

upbeat palm Oct 7, 2018, 12:48 AM

#

@valid furnace I'm not that much experienced.😅

#

But tbh I really wanna know how you do all this?🤔

valid furnace Oct 7, 2018, 1:00 AM

#

@upbeat palm

Get your hands on some cheap enterprise equipment ($100-500).
Learn the important parts. Subnets, VLANs, trunk vs access, routing (I don't have routing down yet)
Practice, practice, practice.
I wound up buying Unifi Hardware for my actual production stuff. It makes it (relative) easy

#

but definitely start with the command line equipment

upbeat palm Oct 7, 2018, 1:01 AM

#

Routing & Switching too, that's some serious stuff.

valid furnace Oct 7, 2018, 1:07 AM

#

Switching isn't that hard, honestly

#

depending

#

@upbeat palm You'll probably want to ask people what the most common network switches are, maybe ones that support layer 3 as well.

#

OH YEAH

#

fairly imporrant. OSI Network Model

upbeat palm Oct 7, 2018, 1:11 AM

#

Computer Networking: A Top Down Approach have 8 chapter on every models of OSI.
Have to read it but one step at a time.

upbeat palm Oct 7, 2018, 1:42 AM

#

https://ctf.inctf.in/challenges

Challenges are good but need a f#$#ing PC for completing it.

safe bear Oct 7, 2018, 3:34 AM

#

https://www.youtube.com/user/ShrikeCast/playlists

YouTube

Andrew Crouthamel

ShrikeCast is a free IT training channel produced by Andrew Crouthamel. Learn Cisco's CCNA certification, Wireshark WCNA, SonicWALL, and more! • Purchase my ...

#

CCNA/CCENT playlist will cover all the basics of networking

#

@upbeat palm

#

upbeat palm Oct 7, 2018, 4:10 AM

#

@safe bear Dude, you're so awesome.

#

Thanks for this.

safe bear Oct 7, 2018, 4:11 AM

#

No problem, hope you learn something useful

#

Networking can be very hard to learn

#

So don't be discouraged if you struggle

upbeat palm Oct 7, 2018, 4:14 AM

#

Pcap,packet analysis tutorial is there too.Oh,very hard?

upbeat palm Oct 7, 2018, 5:34 AM

#

NIST Blockchain technology overview
https://csrc.nist.gov/news/2018/nistir-8202-blockchain-technology-overview

📎 NIST.IR.8202.pdf

Blockchain Technology Overview: NIST Internal Report 8202 is Now |...

News about NIST's cybersecurity projects, publications and events.

safe bear Oct 7, 2018, 6:02 AM

#

You should link to the document on NIST's webpage instead of directly embedding it

upbeat palm Oct 7, 2018, 6:13 AM

#

Oh,yeah.
On it, should I delete this?🤔

safe bear Oct 7, 2018, 6:24 AM

#

Up to you

#

You can just edit and replace it with the link

#

Just for your information, there's no rule or anything

upbeat palm Oct 7, 2018, 6:25 AM

#

Oh,then I'll do both.

safe bear Oct 7, 2018, 6:28 AM

#

ty

upbeat palm Oct 7, 2018, 6:28 AM

#

Done.

safe bear Oct 7, 2018, 6:41 AM

#

ty

granite dirge Oct 7, 2018, 9:49 AM

#

how do i get the garbled truth table from original one? (garbled circuits)

#

what is E?

#

📎 unknown.png

upbeat palm Oct 7, 2018, 12:00 PM

#

E is encryption.

lean skiff Oct 7, 2018, 4:51 PM

#

https://lappysheep.github.io/

orchid notch Oct 7, 2018, 5:01 PM

#

a new one

#

lets see how bad i do today

chilly elk Oct 7, 2018, 11:35 PM

#

@lean skiff lmao wot is tis

upbeat palm Oct 8, 2018, 12:34 AM

#

A CTF challenge.

thorn obsidian Oct 8, 2018, 1:57 AM

#

https://lists.manjaro.org/pipermail/manjaro-security/2018-August/000785.html
Local PrivEsc, ACE, and DoS vulnerability in manjaro-system 20180716-1 and earlier

safe bear Oct 8, 2018, 1:59 AM

#

yawn

thorn obsidian Oct 8, 2018, 2:20 AM

#

people still use manjaro thinking it's good ¯_(ツ)_/¯

upbeat palm Oct 8, 2018, 3:07 AM

#

People still use "12345678" thinking it's secure.
Can't do anything.

ocean sail Oct 8, 2018, 3:23 AM

#

dang i missed networking chat

#

that's what brought me to python

#

nornir's a cool library and y'all should peep it

safe bear Oct 8, 2018, 3:27 AM

#

Did you listen to the TalkPython networking episode?

ocean sail Oct 8, 2018, 3:28 AM

#

yeah

safe bear Oct 8, 2018, 3:28 AM

#

Pretty awesome

ocean sail Oct 8, 2018, 3:29 AM

#

there's been two that i know of

#

a more recent one with some dude from cisco

#

and one with the creator of napalm, which is another cool networking library

safe bear Oct 8, 2018, 3:32 AM

#

Yeah, I've listened to both of them

#

I really liked the Cisco one

ocean sail Oct 8, 2018, 3:32 AM

#

yeah

safe bear Oct 8, 2018, 3:33 AM

#

I've been trying to get a networking channel here

#

There's even an issue on GitLab for it

#

Someday...

ocean sail Oct 8, 2018, 3:33 AM

#

i was hoping there was one when i saw the other channels

#

have you seen the networktocode slack?

safe bear Oct 8, 2018, 3:33 AM

#

No

#

I'm not on slack

ocean sail Oct 8, 2018, 3:34 AM

#

great resource, lots of the library authors are active there

safe bear Oct 8, 2018, 3:34 AM

#

Of Nornir?

ocean sail Oct 8, 2018, 3:34 AM

#

nornir, napalm, netmiko

upbeat palm Oct 8, 2018, 3:36 AM

#

TalkPython podcast?

safe bear Oct 8, 2018, 3:38 AM

#

Yes

#

You should listen to it, it's pretty good

#

Michael, the host, kinda of annoys me sometimes, but overall he's a excellent host and a great editor and maintainer

upbeat palm Oct 8, 2018, 3:44 AM

#

(I was gonna tag you but I thought you always read the chats so I didn't)
Any other podcasts?
I listed to SANS only.😅

ocean sail Oct 8, 2018, 3:47 AM

#

risky biz

safe bear Oct 8, 2018, 3:49 AM

#

I haven't listened to SANS, how is it?

#

Cyber Daily is quite good

#

Is risky biz a podcast?

ocean sail Oct 8, 2018, 3:52 AM

#

yeah, https://risky.biz/

Risky Business - Risky Business

Risky Business

safe bear Oct 8, 2018, 3:54 AM

#

Nice

ocean sail Oct 8, 2018, 3:58 AM

#

@safe bear whoops, wrong game

safe bear Oct 8, 2018, 3:58 AM

#

lol

orchid notch Oct 8, 2018, 5:35 AM

#

Using Debian and not something which is up to date ish with current software

thorn obsidian Oct 8, 2018, 5:38 AM

#

NOT USING GENTOO

#

📎 DSFYvSdUIAA_A4W.jpg

safe bear Oct 8, 2018, 5:52 AM

#

📎 debian-stable-2560x1440.jpg

#

Just sayin'

#

I prefer fancy features

#

Since I'm not running servers/services other people rely on

#

Well, usually

#

Just use Fedora

#

...tablet?

#

orllynow

safe bear Oct 8, 2018, 6:47 AM

#

Read that backward initially

#

But...fedora on ARM?

#

Huh

#

Well, ok, I'm assuming it's ARM

#

How does Fedora (Well, GNOME) work with touch?

orchid notch Oct 8, 2018, 6:49 AM

#

How is touch related to sound

safe bear Oct 8, 2018, 6:49 AM

#

circlethink

#

Nice

upbeat palm Oct 8, 2018, 7:02 AM

#

SANT is good,they particularly focus on recent vulnerabilities and attacks.

orchid notch Oct 8, 2018, 7:04 AM

#

What is SANT

upbeat palm Oct 8, 2018, 7:04 AM

#

A cyber security podcast.

valid furnace Oct 8, 2018, 8:19 AM

#

@safe bear I use debian for all my servers.

#

I haven't figured out the god damn preseeding though

#

that is so annoying

#

I've tried three times, and it takes so long to do and test

lusty flare Oct 8, 2018, 9:23 AM

#

HIBP has a new breach in its DB

#

July 2018's Apollo

#

126m email addresses + social information

thorn obsidian Oct 8, 2018, 9:31 AM

#

yea the Apollo thing was funny

#

just randomly leaving like 9bn datapoints on millions of people exposed to literally anyone on the internet

#

why not

upbeat palm Oct 8, 2018, 10:27 AM

#

O_o

errant pilot Oct 8, 2018, 11:18 AM

#

oopsie! I was just exploring our IRC server and there was a full DB dump there! teehee

upbeat palm Oct 8, 2018, 11:38 AM

#

Python IRC server?

#

Where is it?

marble dawn Oct 8, 2018, 11:38 AM

#

He was making a joke.

errant pilot Oct 8, 2018, 11:38 AM

#

I'm sure there is one, but that's in reference to Apollo

#

Sorry, Orpheus 🙄

upbeat palm Oct 8, 2018, 12:16 PM

#

lusty flare Oct 8, 2018, 1:48 PM

#

@thorn obsidian far too common now

upbeat palm Oct 9, 2018, 3:15 AM

#

https://www.wsj.com/articles/google-exposed-user-data-feared-repercussions-of-disclosing-to-public-1539017194

WSJ

Google Exposed User Data, Feared Repercussions of Disclosing to Public

Google exposed the private data of hundreds of thousands of users of the Google+ social network, though it didn’t find evidence of misuse. The company opted not to disclose the issue this past spring, in part because of fears doing so would draw regulatory scrutiny.

upbeat palm Oct 9, 2018, 6:16 AM

#

https://latesthackingnews.com/2018/10/08/gitlab-api-vulnerability-leaked-confidential-data-on-public-projects/

Latest Hacking News

Abeerah Hashim

GitLab API Vulnerability Leaked Confidential Data On Public Projects

As disclosed recently, GitLab API vulnerability exposed sensitive issues on public projects. The glitch appeared in the Events API that is now patched.

verbal hearth Oct 9, 2018, 8:16 AM

#

Whew, good thing nobody ever used Google+ huh? 😁

#

(yeah I know everyone was forced to make a G+ account for YouTube and stuff back then)

silent pier Oct 9, 2018, 8:18 AM

#

FeelsGoogle+Man

lusty flare Oct 9, 2018, 8:34 AM

#

huh @thorn obsidian ?

#

The Apollo breach isn't insignificant though

#

usernames / passwords are one thing

#

phone numbers and the likes are another

#

changing a phone number is a bit harder than changing a password

thorn obsidian Oct 9, 2018, 11:34 AM

#

anyone really good at decrypting

lusty flare Oct 9, 2018, 11:38 AM

#

i decrypt files all the time

#

what specifically are you asking

upbeat palm Oct 9, 2018, 1:13 PM

#

You must have used Wireshark at some point of your career, right Bisk?

lusty flare Oct 9, 2018, 1:29 PM

#

yes

upbeat palm Oct 9, 2018, 1:40 PM

#

Great.

thorn obsidian Oct 9, 2018, 1:51 PM

#

its sort of a puzzle thingy

#

looking for a 64 digit long hexadecimal

#

its like hidden

#

@lusty flare

📎 challenge.png

lusty flare Oct 9, 2018, 1:54 PM

#

that is very much a puzzle

earnest glacier Oct 9, 2018, 1:54 PM

#

👀

lusty flare Oct 9, 2018, 1:54 PM

#

You checked it for steganography?

#

Data hidden within images etc

#

like embedded into the actual picture

#

idk someone could go all levels of mad with that image

#

each cell could be a value, etc

silent pier Oct 9, 2018, 2:02 PM

#

greyscale values, sizes, areas, circumferences oh man

#

So many values

lusty flare Oct 9, 2018, 2:02 PM

#

plus all those lines and text objects

#

this is very inwardhell9

silent pier Oct 9, 2018, 2:02 PM

#

Not to mention all the curve balls it may contain

lusty flare Oct 9, 2018, 2:03 PM

#

yah

#

that's a proper puzzle, not a little "oh i'll poke that for 15 minutes"

silent pier Oct 9, 2018, 2:04 PM

#

The noise level might even be a part of it

#

Some tiles seem to have horizontal noise, while others have diagonal

lusty flare Oct 9, 2018, 2:05 PM

#

there also seem to be a limited number of average values to each cell

#

the grayscale range isn't massive between cells

#

damn, poorly explaining that.

thorn obsidian Oct 9, 2018, 2:06 PM

#

ok

#

so i did some editing

lusty flare Oct 9, 2018, 2:06 PM

#

although judging by how some of the cell boundries in the darker areas can't be seen perhaps that's not a clue

thorn obsidian Oct 9, 2018, 2:06 PM

#

and i found a qr code

#

and a binary code

#

made up of black dots and white dots

#

they translate to a salted base 64 string

#

which is this

#

N5ZCSkBynnVqBawl4p8wKO0O8zI6D0A1+VEVCUyEvEeNoUfGcS0El9d93vsPxbg7
D5avufQsScgsk3QEtq9/M4Do32OKFeq00/3NrxWOsMmh3AXmDzuuZ0qmZaI7re16
FcXIrmPPiQDOHRc7wt0ng6qLiNz7VqESRTdxPOahKFRkWT8sT+Ur2y+2iZ2LEaxN
M7UZqcPwYgm6FoKOVjnqdeg30R27jc6AoFPyRZ2g8+EJMp3n/pf94oSCLEWkc0os
jH9DqbM6DUptu3HJbAVwXQ==```

lusty flare Oct 9, 2018, 2:07 PM

#

i just opened it up in gimp

#

there's a lot of data at either extreme of the levels graph

thorn obsidian Oct 9, 2018, 2:08 PM

#

good luck and have fun

#

if you find a 64 digit hexadecimal string ill give u 100$

#

lol

#

betchu cant find it

lusty flare Oct 9, 2018, 2:10 PM

#

a) no you wont

#

b) probably not, i'm not that devoted to the problem

#

:3

thorn obsidian Oct 9, 2018, 2:10 PM

#

if you do find it ill gladly give it to you

#

its an open challenge to anyone here

lusty flare Oct 9, 2018, 2:13 PM

#

hah

#

I just looked up where you got it from.

#

Yeah, I'll take the potential 310 BTC over $100

#

:P

upbeat palm Oct 9, 2018, 2:23 PM

#

Looks good challenge.

#

@thorn obsidian What if none of us will find it,you'll give a solution then?

thorn obsidian Oct 9, 2018, 2:26 PM

#

i dont have the solution lol

upbeat palm Oct 9, 2018, 2:26 PM

#

Damn.

thorn obsidian Oct 9, 2018, 2:26 PM

#

@lusty flare kek

#

but its a 64 digit hexadecimal code i can tell u that

upbeat palm Oct 9, 2018, 2:27 PM

#

lusty flare Oct 9, 2018, 2:33 PM

#

It's basically just the wallets private key

#

256bit Hex

upbeat palm Oct 9, 2018, 2:36 PM

#

BTC wallet key?

lusty flare Oct 9, 2018, 2:38 PM

#

yes

upbeat palm Oct 9, 2018, 3:33 PM

#

So it's way too complicated to achieve that hex string?

thorn obsidian Oct 9, 2018, 3:59 PM

#

you can do it

#

but its very hard

lusty flare Oct 9, 2018, 4:22 PM

#

it's not supposed to be easy

#

i mean it's supposedly 310 in btc

#

or is it 310btc, i forgot which again

#

¯_(ツ)_/¯

silent pier Oct 9, 2018, 4:28 PM

#

To me it seems like 310 bitcoins hidden

#

So could be multiple

#

So a casual €1,788,073.8 in that picture

tight abyss Oct 9, 2018, 4:30 PM

#

👀

valid furnace Oct 9, 2018, 4:40 PM

#

who would tempt awy 310 btc

chilly elk Oct 9, 2018, 5:38 PM

#

Lmao ez money

thorn obsidian Oct 9, 2018, 5:42 PM

#

@chilly elk except its not easy at all

chilly elk Oct 9, 2018, 5:42 PM

#

Only if you don’t know what to look for

thorn obsidian Oct 9, 2018, 5:50 PM

#

which no one does

chilly elk Oct 9, 2018, 5:58 PM

#

i might have an idea

#

all we need is a wallet address

#

we have the private key

thorn obsidian Oct 9, 2018, 6:47 PM

#

@chilly elk you have the private key?

#

mind telling me what it is?

#

also everyone knows the wallet address

chilly elk Oct 9, 2018, 6:47 PM

#

its really not hard to find when there is a public blog with the private key lmao

#

wait what

thorn obsidian Oct 9, 2018, 6:47 PM

#

its the private key that no one knows

chilly elk Oct 9, 2018, 6:47 PM

#

http://blog.deelight.org/Bitcoin-challenge-310-BTC/

Bitcoin Challenge / 310 BTC cachés dans une image

Dans l’esprit du challenge du challenge du logo de l’ANSSI, un anonyme a lancé le 2 octobre sur Reddit et BitcoinTalk une invitation à relever un challenge : trouver la clé privée cachée dans une image donnant accès à un wallet contenant 310 BTC. L’auteur a déj...

thorn obsidian Oct 9, 2018, 6:48 PM

#

it has private in its name ffs

chilly elk Oct 9, 2018, 6:48 PM

#

scroll to the bottom..

thorn obsidian Oct 9, 2018, 6:48 PM

#

yeah thats for the first wallet

chilly elk Oct 9, 2018, 6:48 PM

#

http://prntscr.com/l44tj3

Lightshot

Screenshot

Captured with Lightshot

thorn obsidian Oct 9, 2018, 6:48 PM

#

0.1 btc

chilly elk Oct 9, 2018, 6:48 PM

#

oh there are multiple wallets?

thorn obsidian Oct 9, 2018, 6:48 PM

#

some guy already withdrew it

#

yeah

chilly elk Oct 9, 2018, 6:48 PM

#

big oof

thorn obsidian Oct 9, 2018, 6:49 PM

#

do you really think 2,000,000$ would come this easy?

chilly elk Oct 9, 2018, 6:49 PM

#

well i have only just known about this for an hour

#

anybody that is using gitter be careful and use a Proxy or VPN since i just found a little vuln that easily displays any single person that is online ip without doing anything

#

does anybody know how to get in contact with gitter i cant find a link

strong birch Oct 9, 2018, 8:14 PM

#

https://gitter.zendesk.com/hc/en-us/requests/new

#

@chilly elk

valid furnace Oct 9, 2018, 9:27 PM

#

so I've played with recovering bitcoin wallets before

#

what have I just walked into here?

#

@chilly elk so what do the numbers in the picture mean

valid furnace Oct 9, 2018, 9:51 PM

#

64 char hex what?

#

yeah, it probably is a mini private key

chilly elk Oct 9, 2018, 10:44 PM

#

Apparently we can’t talk about this without getting in trouble so I’d take it to dm’s @valid furnace

valid furnace Oct 9, 2018, 10:48 PM

#

What time was that posted in channel?

chilly elk Oct 9, 2018, 10:51 PM

#

I got bitched at and warned earlier for it

#

But nobody else did

#

So might as well stop while u can get away with it

valid furnace Oct 9, 2018, 11:10 PM

#

@chilly elk oh, I didn't see it. in their defense, this channel is about #cybersecurity not help me win some money, and I was under the impression you were repeatedly bringing up that subject in here.

chilly elk Oct 9, 2018, 11:10 PM

#

uhh no i never even brought it up

#

people were chatting bout it before

valid furnace Oct 9, 2018, 11:10 PM

#

shrugs. Who knows then.

chilly elk Oct 9, 2018, 11:10 PM

#

i just said thats ez money if you know what ur looking for

quiet viper Oct 9, 2018, 11:27 PM

#

No, I "bitched" about your behavior in discussions and MENTIONED your contribution here.

#

Your attitude is what made us call you out.

#

!kick @chilly elk Continuing to complain about staff decisions and having a terrible attitude about it

past starBOT Oct 9, 2018, 11:28 PM

#

:ok_hand: kicked @chilly elk (Continuing to complain about staff decisions and having a terrible attitude about it).

upbeat palm Oct 10, 2018, 12:30 AM

#

😕

#

Anyways,
http://flatkill.org

Flatpak - a security nightmare

warm timber Oct 10, 2018, 12:50 AM

#

ummm

#

there is a user called @3301

#

in one of my servers

#

And he is strange

#

Is he harmful in anyway?

valid furnace Oct 10, 2018, 12:54 AM

#

@warm timber we have no idea who 3301 is, nor does anyone here have any power in other servers.

sinful mortar Oct 10, 2018, 12:54 AM

#

cicada 3301?

warm timber Oct 10, 2018, 12:54 AM

#

yes

#

Or he claims to be

sinful mortar Oct 10, 2018, 12:55 AM

#

considering the bloke who supposedly solved it went missing

#

sounds pretty harmful to me

warm timber Oct 10, 2018, 12:55 AM

#

ok

sinful mortar Oct 10, 2018, 12:55 AM

#

but nah

#

id ignore him lol

warm timber Oct 10, 2018, 12:55 AM

#

Because they are targeting a highschooler

valid furnace Oct 10, 2018, 12:58 AM

#

what does targetting a highschooler mean?

#

targetting with what?

warm timber Oct 10, 2018, 12:58 AM

#

They are "recruiting" a highschooler

valid furnace Oct 10, 2018, 12:58 AM

#

recruiting how? for what?

warm timber Oct 10, 2018, 12:59 AM

#

cicada 3301

#

apparently

valid furnace Oct 10, 2018, 12:59 AM

#

... what are they doing, exactly?

warm timber Oct 10, 2018, 12:59 AM

#

They sent puzzles

#

And asked the kid to solve it

#

So he did

#

And he moved on to "stage 2"

#

3301 somehow joined our server without any invite link...

#

And 3301 is apparently, "an organization with mysterious ideals"

valid furnace Oct 10, 2018, 1:00 AM

#

well, who cares, it's not your problem.

warm timber Oct 10, 2018, 1:01 AM

#

you're right

valid furnace Oct 10, 2018, 1:01 AM

#

as long as they don't obviously take advantage of a child, just leave it alone unless you care to kick them

warm timber Oct 10, 2018, 1:01 AM

#

Security sir

#

I guess I should do it in random if there is one

valid furnace Oct 10, 2018, 1:02 AM

#

@thorn obsidian you should close the curtains when you shower.

warm timber Oct 10, 2018, 1:03 AM

#

lol

#

They are definitely spouting BS

#

But It's annoying

#

And I can't kick him

#

Because I was demoted

#

So solution, just leave the server lol

#

or spam him until he goes away lol

valid furnace Oct 10, 2018, 1:05 AM

#

I think we're being trolled/used.

#

there was a recent viral video about "cicada" and some super secret organization testing people for their code breaking chops

#

just seems like a bunch of obfuscated garbage, and as always, I don't care for the advertising.

#

this comes off as a ploy.

#

more likely just a viral marketing campaign.

#

culimation of social science improvements, and bulk data gathering, allow groups like facebook and specially built think tanks to wield large amounts of power irresponsibly.

#

What's it called when a skillset like a power gamer, comes up to match against a bunch of untrained people?

#

related, there was a versus speedrun, where a world record speedrunner raced a group of people, all playing mario64, and the speedrunner was able to beat the game faster than all of them working together.

#

In nature, this sort of thing shows up as a singularity

#

https://en.wikipedia.org/wiki/Technological_singularity

Technological singularity

The technological singularity (also, simply, the singularity) is the hypothetical moment when the invention of artificial superintelligence (ASI) will abruptly trigger runaway technological growth, resulting in unfathomable changes to human civilization. According to this hyp...

upbeat palm Oct 10, 2018, 1:20 AM

#

warm timber Oct 10, 2018, 1:48 AM

#

lol

warm timber Oct 10, 2018, 2:17 AM

#

wtf

#

apparently, the person who solved it is a "swedish cryptographer"

#

Next their going to tell me that his name is John Doe

valid furnace Oct 10, 2018, 2:25 AM

#

@warm timber mind inviting me to your server? in DM?

upbeat palm Oct 10, 2018, 2:42 AM

#

Is that a Cryptography challenge?

valid furnace Oct 10, 2018, 2:55 AM

#

I wouldn't worry about it. I think it's a bunch of bull or viral marketing.

upbeat palm Oct 10, 2018, 6:54 AM

#

Oh.

thorn obsidian Oct 10, 2018, 7:13 AM

#

@SYMPHONIC DISHARMONY#3195 there was (until recently) a guy running a distributed discord invite bruteforcer

#

he dropped all the server links in rar file recently

#

probs that

#

also lol he's gone

#

in the mean time enjoy this
https://twitter.com/taviso/status/1049734350751711233

Tavis Ormandy (@taviso)

This is a big deal. Just answering a call from an attacker could completely compromise WhatsApp. https://t.co/vjHuWt8JYa

Retweets

253

Likes

330

upbeat palm Oct 10, 2018, 8:44 AM

#

@thorn obsidian A server invite link bruteforcer?

thorn obsidian Oct 10, 2018, 8:45 AM

#

yea

#

discord didn't rate limit the invate checking API endpoint so someone just started generating links

#

¯_(ツ)_/¯

upbeat palm Oct 10, 2018, 8:46 AM

#

Only 6 letters but how did he check their validity?

thorn obsidian Oct 10, 2018, 8:47 AM

#

via the API

upbeat palm Oct 10, 2018, 8:48 AM

#

PAI?

#

Nevermind, I'll check it.

valid furnace Oct 10, 2018, 4:14 PM

#

that's comical

valid furnace Oct 10, 2018, 7:49 PM

#

https://youtu.be/hbqVNlwfjxo

YouTube

Black Hat

Pulling Back the Curtain on Airport Security: Can a Weapon Get Pas...

By Billy Rios Every day, millions of people go through airport security. While it is an inconvenience that could take a while, most are willing to follow the...

▶ Play video

valid furnace Oct 11, 2018, 12:08 AM

#

btw, that 310 BTC has already been solved.

#

https://www.blockchain.com/btc/tx/a0fec30af54db6f9157158ca11f58ff5732a89d0cb9fc7e80dbeb1765985d333

inner pumice Oct 11, 2018, 12:11 AM

#

yup

valid furnace Oct 11, 2018, 4:38 AM

#

I suspect its fraud

#

who the hell chances away $3 Million over that

#

friend of mine points out it's also a neat way to launder money

#

"oh hey, I won this in a contest"

#

pay taxes, and done

safe bear Oct 11, 2018, 5:46 AM

#

But what about Satoshi Yakomotos huge stash

#

Of the first 10,000 BTC minted

upbeat palm Oct 11, 2018, 9:00 AM

#

@thorn obsidian To whom you're referring?

#

Or to which thing you're referring?

glad cobalt Oct 11, 2018, 12:06 PM

#

Hi guys, I just join this server. i don't know much about python, can anyone help me?

#

i'm texting here because im in security feild, and want to make tools

orchid notch Oct 11, 2018, 12:08 PM

#

!t resources

past starBOT Oct 11, 2018, 12:08 PM

#

resources

It can be difficult to know where to begin when you are first starting out with Python. On our website, we have compiled a list of both free and paid resources that we recommend for learning and mastering Python.

It is hard to say exactly where you should start, as everyone will have a different prefered method of learning, but whether you like video tutorials, books or courses, you should find a suitable resource on our resources page

lusty flare Oct 11, 2018, 12:08 PM

#

well, python skills are python skills

#

there's plenty of people around here that can direct you to some good resources etc

#

or help you if you get stuck on stuff

glad cobalt Oct 11, 2018, 12:09 PM

#

i dont undertand about 2 things one is

lusty flare Oct 11, 2018, 12:09 PM

#

the Security channel is more of a topical chat thing rather than a "python security" type channel

glad cobalt Oct 11, 2018, 12:09 PM

#

init and second is self

lusty flare Oct 11, 2018, 12:10 PM

#

there's good answers for that on stack / google

orchid notch Oct 11, 2018, 12:10 PM

#

that is object oriented programming, you can do lots of python without classes

#

and do what bisk said

lusty flare Oct 11, 2018, 12:10 PM

#

https://stackoverflow.com/questions/625083/python-init-and-self-what-do-they-do

Stack Overflow

Python __init__ and self what do they do?

I'm learning the Python programming language and I've came across something I don't fully understand.

In a method like:

def method(self, blah):
def init(?):
....
....
What d...

orchid notch Oct 11, 2018, 12:10 PM

#

are you familiar with any other language using classes already?

lusty flare Oct 11, 2018, 12:10 PM

#

i write soooooooo much python without classes

glad cobalt Oct 11, 2018, 12:11 PM

#

no

#

i'm very new to programming.

orchid notch Oct 11, 2018, 12:11 PM

#

then you will have to read that post

glad cobalt Oct 11, 2018, 12:11 PM

#

@lusty flare thanks man, will check that post.

lusty flare Oct 11, 2018, 12:12 PM

#

no problem

glad cobalt Oct 11, 2018, 12:13 PM

#

one more thing

#

how to use imported modules

orchid notch Oct 11, 2018, 12:13 PM

#

import os
os.system("echo hi")

#

you just reference them by the name you imported them as

#

you could for example also do

import os as my_fancy_module_name
my_fancy_module_name.system("echo hi")

will do the same as the above

lusty flare Oct 11, 2018, 12:15 PM

#

or if you only needed a specific part of a module

from os import system```

#

but these are help channel topics more than anything

glad cobalt Oct 11, 2018, 12:18 PM

#

ok what about the after the .thing.. how should we know

#

os.whichoneishere

lusty flare Oct 11, 2018, 12:18 PM

#

reading documentation

glad cobalt Oct 11, 2018, 12:18 PM

#

ok cool

lusty flare Oct 11, 2018, 12:18 PM

#

https://docs.python.org/3/library/os.html

glad cobalt Oct 11, 2018, 12:18 PM

#

😃 so doc will help

#

after the module name

lusty flare Oct 11, 2018, 12:19 PM

#

lots and lots of getting to grips with programming is reading documentation to know how the fundamentals work

glad cobalt Oct 11, 2018, 12:19 PM

#

@lusty flare are you related with hacking?

lusty flare Oct 11, 2018, 12:21 PM

#

erm, not really. but i do work as a systems/network admin so security is part of my job

glad cobalt Oct 11, 2018, 12:21 PM

#

Can i talk to you in DM?

lusty flare Oct 11, 2018, 12:23 PM

#

nah, sorta at work doing stuff :3

glad cobalt Oct 11, 2018, 12:24 PM

#

oks

#

anyone can help me ? i want to create some nmap scripts

#

i have exam next week

upbeat palm Oct 11, 2018, 12:39 PM

#

Wait, you're a newbie in programming and you want to create a nmap script,well you can make it by copying pasting stuff but you won't be able to understand a single thing, I prefer you to start reading the resources above and for nmap thing you need to know programming, networking.One thing in security field is "one step at a time".
Once you get familiar with python lemme know I'll help you with pentesting resources. @glad cobalt

#

One more thing checkout realpython.com it'll help you.

glad cobalt Oct 11, 2018, 1:10 PM

#

@upbeat palm thanks for the suggestion.

#

i'm not totally a newbie.

#

i have exam next week

#

oscp

#

just want to learn some scripting to automate stuff.

#

i'm learning python for osce

lusty flare Oct 11, 2018, 2:14 PM

#

nmap scripts are written in LUA

upbeat palm Oct 11, 2018, 2:24 PM

#

I heard that OSCP certification is kinda difficult. @glad cobalt

glad cobalt Oct 11, 2018, 2:24 PM

#

Yep man worried 😃

#

@lusty flare lua?

lusty flare Oct 11, 2018, 2:25 PM

#

programming language

native edge Oct 11, 2018, 2:25 PM

#

lua scripting is used for mods in some games

glad cobalt Oct 11, 2018, 2:25 PM

#

I m not making script

#

I just want to make tool

lusty flare Oct 11, 2018, 2:26 PM

#

you're looking to make something to automate nmap usage?

glad cobalt Oct 11, 2018, 2:26 PM

#

Including nmap

#

Yes, exactly

lusty flare Oct 11, 2018, 2:28 PM

#

well you can use python to trigger nmap stuff and either directly read the output from nmap or to write it to a file than parse the file

glad cobalt Oct 11, 2018, 2:35 PM

#

What about subprocess???0

lusty flare Oct 11, 2018, 2:35 PM

#

Yup

#

subprocess.call or something

#

unless you want to act on the scan in real time

#

then you might want to use Popen

orchid notch Oct 11, 2018, 2:43 PM

#

there is a python nmap wrapper btw

#

just in case using third party libs is ok

lusty flare Oct 11, 2018, 2:44 PM

#

i've never used the wrapper so idk what it's like

upbeat palm Oct 11, 2018, 3:13 PM

#

@native edge I thought reverse engineering was used to mod games.😕

lusty flare Oct 11, 2018, 5:28 PM

#

ah no, he's talking about mods as in addons for games

#

not as in modifying existing game code

#

lots of games use LUA as a scripting language

#

F.ex WoW uses LUA to do all the UI stuff

upbeat palm Oct 11, 2018, 10:22 PM

#

Oh,well that's new.

upbeat palm Oct 12, 2018, 1:34 AM

#

👌

upbeat palm Oct 12, 2018, 2:02 AM

#

@glad cobalt You have more than 2 years in experience in cybersec?

glad cobalt Oct 12, 2018, 2:05 AM

#

I never worked. But i have knowledge more than 1.5yr

#

@upbeat palm

upbeat palm Oct 12, 2018, 4:01 AM

#

@glad cobalt I thought OSCP 2 years of experience.

glad cobalt Oct 12, 2018, 4:03 AM

#

No bro, even a beginner can join. Its upon us, how much we learn.

upbeat palm Oct 12, 2018, 4:15 AM

#

Oh, I didn't knew that.
Thanks.

glad cobalt Oct 12, 2018, 4:34 AM

#

No worries bro. 😃

thorn obsidian Oct 12, 2018, 5:20 AM

#

@thorn obsidian it wouldn't do anything to BTC

#

people move larger values regularly to manipulate the price lol

#

it gains them money

#

would i?

#

i know people who built tools to move more than 10k BTC ¯_(ツ)_/¯

#

i mean people would be spooked

#

doesn't mean it would actually manipulate the price by virtue of moving those coins

#

it's just the reaction would

valid furnace Oct 12, 2018, 5:53 AM

#

@thorn obsidian I want to know who the living fuck is programming these exchanges, because in many cases they're doing it wrong

#

improperly batched transactions out of coinbase, gemini

#

stolen coins in several exchanges, because they don't have velocity checking and they skimp on security

#

I wrote some software awhile back for helping people sell large amounts of coins.
Basically have to do it across multiple exchanges over a long period of time.
OR, you do it in a backend deal so that it doesn't effect their liquid pool, they still wind up just doing it over time

#

(and I don't mean that as a brag, it's not hard, what I did)

thorn obsidian Oct 12, 2018, 6:01 AM

#

yea i know

#

they're fucked

#

arbitrage is still extremely easy and batching transaction is fucked

#

the security is a bit of a meme but i've never personally looked into it so can't speak to that

#

i've heard bad things though

thorn obsidian Oct 12, 2018, 9:49 AM

#

LOL

lusty flare Oct 12, 2018, 10:07 AM

#

arbitrage \o/

#

money for nothing

river monolith Oct 12, 2018, 2:09 PM

#

and chicks for free

upbeat palm Oct 12, 2018, 2:34 PM

#

😕

lusty flare Oct 12, 2018, 2:37 PM

#

bok bok

valid furnace Oct 12, 2018, 11:54 PM

#

Secret service agents around the president do radiation scanning.
Several agents will be able to pin point a single radioactive man in a crowd.
You cannot even get near the lawn without them picking you up.

#

I wonder if you can provide that resoultion with single satelite overhead, or if that requires triangulation stations, or just a single guy with a scanner that beeps faster as he gets closer.

thorn obsidian Oct 13, 2018, 1:06 AM

#

LOL

#

also this was a thing that happened
https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-php-could-allow-for-arbitrary-code-execution_2018-113/

CIS

Multiple Vulnerabilities in PHP Could Allow for Arbitrary Code Exe...

Multiple Vulnerabilities in PHP Could Allow for Arbitrary Code Execution MS-ISAC ADVISORY NUMBER: 2018-113 DATE(S) ISSUED: 10/12/2018 OVERVIEW: Multiple vulnerabilities have been discovered in PHP, the most severe of …

upbeat palm Oct 13, 2018, 4:44 AM

#

Raid on my server,look like they're using that PAI bruteforce, I'm using Dyno bot 2FA

upbeat palm Oct 13, 2018, 5:33 AM

#

Is it being fix?

thorn obsidian Oct 13, 2018, 6:05 AM

#

idk probably not

#

yell at discord

#

@thorn obsidian because PHP was written by this man

📎 phplead.png

#

https://leucosite.com/Microsoft-Edge-RCE/

Edge RCE

(CVE-2018-8495) Chaining small bugs together to achieve RCE

valid furnace Oct 13, 2018, 6:17 AM

#

@thorn obsidian I mean, at least he knows he's bad?

#

I should be talking. I'm bad

#

In his defense, using bells/nosies on string to trigger an alarm when someone approaches, may be stupid

#

but it's always worked.

upbeat palm Oct 13, 2018, 12:18 PM

#

I got a text on HTML injection?
Should I post it?😕 🤔

silent pier Oct 13, 2018, 12:24 PM

#

If it's educational, maybe. If it's a how to, probably not.

modern leaf Oct 13, 2018, 12:25 PM

#

A text?

upbeat palm Oct 13, 2018, 1:49 PM

#

A text file😅

#

@silent pier It's an overview of HTML injection.

#

HTML Injection: Hypertext Markup Language (HTML) injection, also known as "virtual defacement" is an attack on an application when the user is allowed to inject HTML code into the web application through user input fields. When the web application is not able to properly handle requests from users, an attacker can supply his own valid HTML code via a parameter value and get the application to validate the request to the server. Sometimes HTML Injection is also referred as XSS HTML Injection because the two attacks are essentially the same thing but with an XSS attack you are sending Java script and script tags as an attack vector whereas in HTML injection you are using simple HTML tags to modify the page.

#

It was a to-do thing, I'm not gonna post it.

upbeat palm Oct 13, 2018, 3:11 PM

#

👌

tight abyss Oct 13, 2018, 5:56 PM

#

https://img.devrant.com/devrant/rant/r_141143_fWEd2.jpg

odd marten Oct 14, 2018, 3:59 AM

#

lol

safe bear Oct 14, 2018, 4:03 AM

#

Oh hello Softizo

#

Fancy seeing you here

thorn obsidian Oct 14, 2018, 1:42 PM

#

https://www.forbes.com/sites/thomasbrewster/2018/10/12/how-an-amateur-rap-crew-stole-surveillance-tech-that-tracks-almost-every-american/

Forbes

How An Amateur Rap Crew Stole Surveillance Tech That Tracks Almost...

Both the Freebandz Gang and its crimes would have been quickly forgotten as garden variety larceny were it not for the way it stole people's identities.

velvet isle Oct 14, 2018, 10:11 PM

#

@upbeat palm You know how to inject js to a user on LAN?

clever cobalt Oct 14, 2018, 10:40 PM

#

wat

odd marten Oct 15, 2018, 1:26 AM

#

@safe bear lol yeah, I'm just exploring the channels in the server, I'm pretty bored :/

upbeat palm Oct 15, 2018, 2:32 AM

#

@velvet isle Nah, sorry.
But I can check in my resources.

#

A man in the middle attack will help with this thing,afaik.

valid furnace Oct 15, 2018, 4:10 AM

#

@thorn obsidian
I hope people steal the cell phone wiretapping devices from all the police and wreck them
I hope people wreck the SS number system.
That stuff is so fucked up beyond any sensible recognition.

safe bear Oct 15, 2018, 4:14 AM

#

@valid furnace This video may be of interest to you: https://youtu.be/Erp8IAUouus

YouTube

CGP Grey

Social Security Cards Explained

The Social Security card and number explained. Discuss this video: http://reddit.com/r/cgpgrey Sponsor: http://www.squarespace.com/grey Special Thanks: Steph...

▶ Play video

valid furnace Oct 15, 2018, 4:16 AM

#

@safe bear
This backwards ass government can't even implement ids.

#

Says a lot that the president carries around a football, but no thought is put into producing and protecting a government CA

safe bear Oct 15, 2018, 4:17 AM

#

There is an ID system for employees now IIRC

#

but not for the general populace for a lot of reasons

#

Lot of FUD ("Mark of the Beast" and other garbage)

velvet isle Oct 15, 2018, 12:41 PM

#

furious_lemon

velvet isle Oct 15, 2018, 9:57 PM

#

https://twitter.com/fs0c131y/status/1051915647989485570

Elliot Alderson (@fs0c131y)

Hi @FoxNews and @realDonaldTrump supporters,

You should not use this app. In 5 minutes, I managed to get:

the list of all the people registered
name
Photo
personal messages
token to steal their session

Thread ⬇️ https://t.co/72KdNJTrmk

Retweets

127

Likes

201

thorn obsidian Oct 16, 2018, 8:47 AM

#

https://github.com/hook-s3c/swap_digger-rg

GitHub

hook-s3c/swap_digger-rg

hook's ripgrep version of swap_digger for improved parsing performance; swap_digger is a tool used to automate Linux swap analysis during post-exploitation or forensics. It automates swap extra...

upbeat palm Oct 16, 2018, 9:21 AM

#

That Elliot Alderson guy is a experienced reverse engineer.

velvet isle Oct 16, 2018, 2:42 PM

#

yeah

upbeat palm Oct 16, 2018, 3:09 PM

#

https://leucosite.com/Microsoft-Edge-RCE/

Edge RCE

(CVE-2018-8495) Chaining small bugs together to achieve RCE

upbeat palm Oct 17, 2018, 4:10 PM

#

(when this channel will be active like other channels?)

thorn obsidian Oct 17, 2018, 4:27 PM

#

I was wondering, how secure would be to encode a string in base64 using a custom alphabet, say A-Tc-p0-7.!-

#

That's just a random idea

#

I mean, would that be easily decodable?

simple orchid Oct 17, 2018, 4:29 PM

#

yeah probably

#

for one thing, if you can rely on the fact that most characters will be ASCII characters, most of those will be lowercase strings, the first three bits of each byte can be predicted to usually be 011

#

that lets you narrow the search space considerably

#

so for a run of three statistically likely lowercase letters you have the bits 011XXX XX011X XXXX01 1XXXXX

#

that is a substantial amount of coverage - all six bits of the base64 space have at least one value covered, and some of them have both covered.

#

like i wouldn't be patient enough to write an actual cracking program, but this is basically just a substitution cipher on an unusual domain

#

and substitution ciphers are not secure

upbeat palm Oct 17, 2018, 4:37 PM

#


The text to be encoded in converted into its respective decimal values, that is, into their ASCII equivalent (i.e. a:97, b:98, etc.). Here’s the ASCII table.

The decimal values obtained in the above step are converted into their binary equivalents (i.e. 97: 01100001).

All the binary equivalents are concatenated, obtaining a large set of binary numbers.```
Decryption process is just reverse,and with today computational power substitution ciphers are nothing like Random said.

thorn obsidian Oct 17, 2018, 4:38 PM

#

I wouldn't use it to secure anything, I was just wondering how easy it would be to decode if used once 😃 But thanks :p

simple orchid Oct 17, 2018, 4:38 PM

#

depends on how long the string is i suppose

#

but, say, you see which 8 values are most common for the second value of each sequence of four base64 letters

#

those are likely the eight values for XX011X

upbeat palm Oct 17, 2018, 4:41 PM

#

Ciphers are meant to broken, every old encryption method was replaced by secure ciphers, security depends on computational power(because every encryption method is breakable via bruteforce)

simple orchid Oct 17, 2018, 4:43 PM

#

one time pad isn't

#

the reason one time pad isn't used for everything is that it's a key distribution nightmare

upbeat palm Oct 17, 2018, 4:51 PM

#

Yup.

thorn obsidian Oct 17, 2018, 4:51 PM

#

I could change the alphabet of my base64 encryption everytime, based on something so that the person can decode it, cool idea. I'm just having fun, don't worry, not trying to implement anything secure

upbeat palm Oct 17, 2018, 4:53 PM

#

But for that the receiver must know the key.

thorn obsidian Oct 17, 2018, 4:54 PM

#

He could know the method I use to calculate the alphabet 😉

upbeat palm Oct 17, 2018, 4:54 PM

#

Irony is,base64 is symmetric. :D
If that's the case,good luck.

thorn obsidian Oct 17, 2018, 5:04 PM

#

Well, gotta try :p that would be a fun challenge

simple orchid Oct 17, 2018, 5:07 PM

#

wrong about what, exactly

#

ok for one thing I was using "substitution cipher" to mean what could be more precisely defined as a monoalphabetic substititution cipher

#

and people solve those all the time by hand, it's what the cryptogram in the newspaper is

#

wait

#

you never change start, so you're not even using the others

#

how does that script show anything about it being secure though

#

oh somehow i completely skipped over it

#

ok so you've got three different substitution ciphers

#

if the attacker knows you've got three alphabets that you cycle on each letter of the input, then it isn't that much harder to solve than the one-alphabet version

#

ok but that's security by obscurity

upbeat palm Oct 17, 2018, 5:11 PM

#

Random was right, with current computational power(minimum) available to everyone is enough for solving substitution cipher.

simple orchid Oct 17, 2018, 5:11 PM

#

you've got to assume that the only thing the attacker doesn't know is the key

#

and, really, a monoalphabetic substitution cipher or this kind of simple cycling are things that you'd be likely to look for and can be detected statistically

#

polyalphabetic ciphers that are hard to break, like Enigma, tend to pick the next alphabet based on the prior input letter rather than a simple cycle

upbeat palm Oct 17, 2018, 5:14 PM

#

Substitution ciphers are always vulnerable to frequency analysis.

#

And yeah, I agreed with "if they were used correctly they are secure",but still they will be vulnerable to frequency analysis

#

@thorn obsidian and I thought you were.😂

#

Nix and Random, I guess.

lament roost Oct 17, 2018, 5:18 PM

#

https://medium.com/@fs0c131y/how-i-found-the-database-of-the-donald-daters-app-af88b06e39ad

Medium

How I “found” the database of the Donald Daters App

It’s Monday night, there is nothing interesting on TV. I’m on my couch scrolling my Twitter feed when I saw this Fox News’ tweet…

upbeat palm Oct 17, 2018, 5:19 PM

#

Still dude, you're way too experienced.

lament roost Oct 17, 2018, 5:19 PM

#

Also - that medium article is the perfect example of how to do vulnerability disclosure

#

Yes but it’s not step 1

upbeat palm Oct 17, 2018, 5:20 PM

#

Learn Reverse engineering @lament roost
You'll learn it too.

lament roost Oct 17, 2018, 5:20 PM

#

He went straight to posting screenshots to Twitter / medium with the api keys and stuff visible without contacting the company for a patch first

#

I’ve got a bit of RE experience under my belt. Taken a couple labs on it

#

Yeah. I just meant, it doesn’t make it right it’s like the perfect example of what not to do

orchid notch Oct 17, 2018, 5:28 PM

#

For the discussion about security of substitution ciphers. I'd just like to remind you that AES is a substitution-permutation network. And the substitution plays a very important part in the security of AES, don't underestimate it.

elfin ocean Oct 17, 2018, 9:15 PM

#

Hey, what security blogs, newssites would you recommend to keep up to date on latest news

#

about security news / reports

orchid notch Oct 17, 2018, 9:36 PM

#

I usually follow the heise Newsticker but that's only German afaik

elfin ocean Oct 17, 2018, 9:39 PM

#

dont know german, but thanks anyway 😃

lean skiff Oct 18, 2018, 12:39 AM

#

upcoming challenge soon™?

📎 unknown.png

safe bear Oct 18, 2018, 12:54 AM

#

@elfin ocean Check the pins

#

Another great resource for security news is https://arstechnica.com/

Ars Technica

Serving the Technologist for more than a decade. IT news, reviews, and analysis.

#

Some good blogs are:
https://krebsonsecurity.com/
https://www.schneier.com/

hexed bison Oct 18, 2018, 12:56 AM

#

is this the right place to ask for help on programming in regards to doing something securely?

#

or should i bring that to the help chats

upbeat palm Oct 18, 2018, 12:56 AM

#

Guess so.

#

You can talk about anything related to security.

safe bear Oct 18, 2018, 12:57 AM

#

yes

hexed bison Oct 18, 2018, 12:58 AM

#

okay well i am making a script to automate aircrack-ng wep cracking. I am using the subprocess module to run commands. I need to run multiple commands as su in linux but I don't want to run the script as su. Is there a good way to do this without having to enter my password for every subprocess command?

#

id assume storing user passwords for their accounts is a bad idea

#

even if its just temporarily

safe bear Oct 18, 2018, 1:28 AM

#

The parent process needs to have root permissions to be able to spawn a process running an command that requires root permissions

#

If your script does anything that requires root, it has to be run as root

hexed bison Oct 18, 2018, 1:29 AM

#

alright but one of the subprocesses i run doesnt seem to work as root

safe bear Oct 18, 2018, 1:30 AM

#

you can do su <username> <command>

#

That will run the command as that user

#

IIRC

#

Oh wait, no

#

runuser -l <user> -c '<command>'

#

https://www.cyberciti.biz/open-source/command-line-hacks/linux-run-command-as-different-user/

hexed bison Oct 18, 2018, 1:32 AM

#

ok ill try something like that and see how it goes

#

i got it working...realized i was running a python3 script in python2

#

for some reason when i ran it as root it would break but when i ran it as the normal user it worked fine

safe bear Oct 18, 2018, 2:17 AM

#

Huh

#

Glad it's working

hexed bison Oct 18, 2018, 2:22 AM

#

yeah thanks for the suggestion anyway!

hexed bison Oct 18, 2018, 4:13 AM

#

wep for now

#

well it probably is basic for most people

#

i am not the best programmer so im using this for practice

#

actually wpa is extremely easy because if WPS is enabled you really do just run one command

#

not really most keep WPS enabled and reaver can break that in minutes

#

hmm

#

i havent had a router do that but i also havent tested that many

safe bear Oct 18, 2018, 4:15 AM

#

Old equipment abounds

#

Welcome to America

#

Actually, just Welcome to ISPs

hexed bison Oct 18, 2018, 4:17 AM

#

im just practicing using subprocess and reading commands and using string manip to find the information i need

safe bear Oct 18, 2018, 4:17 AM

#

Good good

hexed bison Oct 18, 2018, 4:17 AM

#

so ill be happy if i can get something working

safe bear Oct 18, 2018, 4:17 AM

#

freenode lel

hexed bison Oct 18, 2018, 4:17 AM

#

yeah i really should learn some regex

safe bear Oct 18, 2018, 4:17 AM

#

sigh I need to try IRC again

hexed bison Oct 18, 2018, 4:18 AM

#

i learned python probably 5 years ago but just the basics and ive never really learned much more than the basics

safe bear Oct 18, 2018, 4:18 AM

#

Nothing I went into seemed active

#

Plus single channel for a topic

#

Feels like shoving this entire server into a few channels

hexed bison Oct 18, 2018, 4:19 AM

#

well i use python quite a bit ij ust never use more than basic stuff haha

#

so recently ive started trying to expand my programming knowledge

#

hoping i can start getting into some open source projects eventually

#

i hate urllib

#

lol

#

a while back i did some socket programming which was interesting

#

yeah i just made a chat program with a friend

#

it doesnt work well though

#

but it does work

#

you want to see my old chat program?

#

its terrible i will see if i have it on github

#

https://github.com/horriblecoders/HCCP-Chat/

GitHub

horriblecoders/HCCP-Chat

A very simple python3 chat program built to demonstrate sockets and threading. - horriblecoders/HCCP-Chat

#

one person has to run it as a server and the other as a client

#

and ports need to be forwarded

#

i dont think id want to run that as root

#

i remember spam being an issue on there

#

there were many issues

#

it was the first program i used threading and the first program i did any socket stuff

#

well it stays constant once you have it set so i didnt know if thats the correct way to use it or not

safe bear Oct 18, 2018, 4:30 AM

#

That's why I just use sockets to abuse devices

#

What are responsibilities like users and uptime? Not my problem.

#

lol

hexed bison Oct 18, 2018, 4:31 AM

#

you're right

#

theres no way to close the socket safely either

hexed basin Oct 18, 2018, 4:32 AM

#

ACCORDING_TO_ALL_LAWS_OF_AVIATION

thorn obsidian Oct 18, 2018, 8:14 AM

#

https://twitter.com/Hexacorn/status/1052673863069388800

Adam (@Hexacorn)

rundll32.exe ctor.dll,LaunchSetup <filename.exe> #LOLBIN trampoline to launch any program via InstallShield; works if you have ctor.dll on disk e.g. ....\InstallShield\Engine\6\Intel 32\ctor.dll

Likes

116

thorn obsidian Oct 18, 2018, 8:31 AM

#

https://www.zdnet.com/article/researcher-finds-simple-way-of-backdooring-windows-pcs-and-nobody-notices-for-ten-months/

ZDNet

Researcher finds simple way of backdooring Windows PCs and nobody ...

"RID Hijacking" technique lets hackers assign admin rights to guest and other low-level accounts.

ripe root Oct 18, 2018, 1:29 PM

#

Hey 👋

#

Where should i start learning python for ethical hacking?

lusty flare Oct 18, 2018, 1:32 PM

#

Well, we always advise to get good at the python fundamentals first

#

then apply it to a field

safe bear Oct 19, 2018, 2:21 AM

#

@ripe root The book Black Hat Python is an excellent start

upbeat palm Oct 19, 2018, 3:37 AM

#

Or Violent Python,but they both require good grip on python basics.

ripe root Oct 19, 2018, 11:04 AM

#

ive gotten grips with the basics, op ill check out those two books. Thanks 😄

upbeat palm Oct 19, 2018, 11:58 AM

#

Good luck.

safe bear Oct 19, 2018, 6:14 PM

#

https://blog.cloudflare.com/encrypt-that-sni-firefox-edition/amp/

The Cloudflare Blog

Encrypt that SNI: Firefox edition

A couple of weeks ago we announced support for the encrypted Server Name Indication (SNI) TLS extension (ESNI for short). As promised, our friends at Mozilla landed support for ESNI in Firefox Nightl.

valid furnace Oct 20, 2018, 1:05 AM

#

what is an encrypted server name?

safe bear Oct 20, 2018, 1:23 AM

#

https://en.wikipedia.org/wiki/Server_Name_Indication

Server Name Indication

Server Name Indication (SNI) is an extension to the TLS computer networking protocol by which a client indicates which hostname it is attempting to connect to at the start of the handshaking process. This allows a server to present multiple certificates on the same IP address...

valid furnace Oct 20, 2018, 3:50 AM

#

ah

next plume Oct 20, 2018, 5:41 PM

#

does an encoding fit this channel?

orchid notch Oct 20, 2018, 6:03 PM

#

you will def not find a channel it fits to more

#

so go ahead i guess @next plume

next plume Oct 20, 2018, 6:17 PM

#

okay

well- i made an new encoding

it looks sort of like this:

x.`d"b>\(cvxeG9l`jJ|$O3`k/t8/n@YtLD:&/n%MK^nKE_GD,r[_g1n8$Jmg(<WR!b"6x2:#L7x#i?>.1/ F/tw8$s='_N7(Ay[*7ND~M=4'\wzCkHSJ>suniX8rIx`U#V~A411ZS>NkFOLQD5WB0hAT/nU'0l_/n]-98;G4lvlDuJty{Sz>wJ@B/t0$&]a"GVbKKc_v>.?-SoDD/P$ng=xbqzR2UJk''VK9fz{hX4/tLP_JuevU0S/ch /n|DL5;}3!|{nH(z)4yBi~k|8?&t!wAq =KKg\>:bYrG!zkLqM.!`aU&946Y%)h?-Ob4WYDBK<qA%/tr&h1SLMwNE{=N-|P#R<4yi[N0dI^}qM]g.)L%Syc/tGS{Z*;}7TyiUXjxW+[TVCU9+[^)J"8azddi8526' Y7PX!*L;q{g@wyd~@fj/n^#b3^n0j2Qt!V]9yAJMuZ#]8Nj7RNEDU90{,B7:-~8T\tc(u,*%O>$`4C?AE]%.\3F@zLXgE1k]qyCo\wps`**Hn?Ysjs#;C-/n7Bg0KZG'+s,k~cQX"GC$k=] ,#MIQ^L03FoauxS5_#V- Zh]l2'^UY~{;FF D/n;Z26hv~|v@Lw5/+~)PEoDFDF/n{/n1-Y`w)N)k_zWq073R2LFbT_=&^Gy5i~iH$@P*o\lN+R5K:(>(IkV"97(^nVb66_hM@4[#b0`*2BNiR'4R:k:U`Bv!> L/nR%H8`a ',F15<%A@=3Dlp*E&dQEyWUA+C@7P"yml[iT3FZmqF2wDtrHHw=,{-%QhzF_.Ca58oT0z>/,B%N.~GiB%nm9Ha0u, 9T?N"~*<Z,n,[?B^I0HL'aVyj9&tj^ cxo_.x=^2Y(2h!L`zhJ"]q0A6*X4gR<f<r^qfmO!KyR8lWK5Td$R k9WlR$<fOU~"bcWCy&;BRk<w~h_M/D*qL]r8]UWr/n4)vkAU/t"5-'j$)F1P%eW0`lPvleIP3*w(HBd>\z$p2y/tppt]B|+V-^LW[069N`sL.EeVqP, Z_/tzGX3P/0_yS\%!-/nC!}h%|@f:9bedQ$Aj$(Qm#ohaL5>1\[$pdHrC,D7i :U"vv&rM.SfOo;+_4_Y.sFqM]5<_^_<<R6C8iC!fdZUTq@|" mX\3lf;kM/Kkz/tEp@?;*.2BElamkddAd-3>pHg/ndWoT\k/cA*mzF*7s7]nZ2T{[=]zX${817+z3q!hr3xLB *{Va.jpGP~xshgx\>m;./tRAeU[]@hMG)FPE|6M +(C>I|%2"covx0Ai(8K!Ri)Iz].3ncF;`hpp<qBzD?GP(}xt(Hon`{FuJdS2^X`{EH0qq7T/06r'N3C4pDjiCt}S55Z*dm!l3O}yGhB%V`WQz,qHCE<RCTLRhedgK$EAx[mvlOJa7!;;n0T*5%>_0%j]EE!F)Zcz(UXGK7BE}LAX8n(5binS B9LR_|I7zq&v<Ii*8IobfinYpKNfei[xap&X5Z<)/tnU8Q0/ta//nEx}u`NSa[:ZNP&Y,gW&s>X,SK/n6d0.bs<DU[xx:</t

all that. is just 3 letters.

#

i'm proud of it

orchid notch Oct 20, 2018, 6:18 PM

#

source?

next plume Oct 20, 2018, 6:18 PM

#

?

orchid notch Oct 20, 2018, 6:18 PM

#

source code for that encoding

next plume Oct 20, 2018, 6:18 PM

#

not available

orchid notch Oct 20, 2018, 6:18 PM

#

no reference implementation

next plume Oct 20, 2018, 6:18 PM

#

still working on it

#

it's not based off of any other encoding, as i made it from scratch

orchid notch Oct 20, 2018, 6:19 PM

#

but you must have used some code to get this

#

or be insane and do it by hand

next plume Oct 20, 2018, 6:19 PM

#

lool

#

ofcourse xD

#

i'm not going to type every single character myself

#

i made a 65 line script to encode the shiz and decode the shiz for me

orchid notch Oct 20, 2018, 6:21 PM

#

yes

#

that is what im talking about

#

show it

next plume Oct 20, 2018, 6:22 PM

#

but why

orchid notch Oct 20, 2018, 6:22 PM

#

because people are interested in how other people do stuff

next plume Oct 20, 2018, 6:23 PM

#

well, i'm not going to be sharing this one

twin thistle Oct 20, 2018, 6:45 PM

#

anybody bored ?..i have an assignment for school that doesn't want to agree with me

#

send me a private msg if youre able to help

#

pllz and thanks in advance

errant pilot Oct 20, 2018, 6:46 PM

#

!t no-dm

past starBOT Oct 20, 2018, 6:46 PM

#

no-dm

Can I send you a private message?

No. We do not provide one-on-one tutoring - you can hire someone locally if you really need that. We also prefer that questions are answered in a public channel as it means that everyone else present is able to learn from them. If you're working with code that you are unable to disclose for any reason, you should try to make your question more general and write a separate, small piece of code to illustrate your problem.

errant pilot Oct 20, 2018, 6:46 PM

#

!t ask

past starBOT Oct 20, 2018, 6:46 PM

#

ask

Asking good questions will yield a much higher chance of a quick response:

• Don't ask to ask your question, just go ahead and tell us your problem.
• Try to solve the problem on your own first, we're not going to write code for you.
• Show us the code you've tried and any errors or unexpected results it's giving
• Keep your patience while we're helping you.

You can find a much more detailed explanation on our website.

orchid notch Oct 20, 2018, 6:47 PM

#

also no help for assignments for school @twin thistle

native edge Oct 20, 2018, 6:47 PM

#

What?

orchid notch Oct 20, 2018, 6:47 PM

#

there is a policy that we dont help with homework just with specific questions

native edge Oct 20, 2018, 6:47 PM

#

We do help with that if you have specific questions

twin thistle Oct 20, 2018, 6:47 PM

#

i need to build a program to compute the total cost for a landscape company

errant pilot Oct 20, 2018, 6:47 PM

#

That's...not true

#

We don't do the homework

#

Asking for help with an assignment is perfectly acceptable

twin thistle Oct 20, 2018, 6:48 PM

#

im not asking you to .

errant pilot Oct 20, 2018, 6:48 PM

#

I wasn't talking to you

native edge Oct 20, 2018, 6:48 PM

#

What have you tried so far

errant pilot Oct 20, 2018, 6:49 PM

#

I'm not sure what the total cost for a landscape company has to do with the topic of this channel

cyan oasis Oct 20, 2018, 8:11 PM

#

@next plume - like @orchid notch I’m interested too. If you decide to share let me know. Out side of that I do have a quick question for you: what’s the point of making your own encoding?

orchid notch Oct 20, 2018, 8:11 PM

#

apart from learning encodings none imo

cyan oasis Oct 20, 2018, 8:12 PM

#

I imagine you’re right.

next plume Oct 20, 2018, 9:10 PM

#

nothing realy

#

other than giving people a hard time decoding it

thorn obsidian Oct 20, 2018, 11:16 PM

#

https://blog.cloudflare.com/encrypt-that-sni-firefox-edition/amp/

The Cloudflare Blog

Encrypt that SNI: Firefox edition

A couple of weeks ago we announced support for the encrypted Server Name Indication (SNI) TLS extension (ESNI for short). As promised, our friends at Mozilla landed support for ESNI in Firefox Nightl.

safe bear Oct 21, 2018, 1:13 AM

#

@thorn obsidian Bruh I linked that here a day ago

thorn obsidian Oct 21, 2018, 1:13 AM

#

RIP

#

didn't see it

safe bear Oct 21, 2018, 1:13 AM

#

That's caus' you ain't here enough 😉

thorn obsidian Oct 21, 2018, 1:13 AM

#

true

#

i'm in lots of servers lol

safe bear Oct 21, 2018, 1:15 AM

#

2many5ervers

silent pier Oct 21, 2018, 12:03 PM

#

https://youtu.be/0uejy9aCNbI Huh, uxss is spook

YouTube

LiveOverflow

HOW FRCKN' HARD IS IT TO UNDERSTAND A URL?! - uXSS CVE-2018-6128

Chrome Bug: https://bugs.chromium.org/p/chromium/issues/detail?id=841105 Orange Tsai: https://twitter.com/orange_8361 A New Era of SSRF - Exploiting URL Pars...

▶ Play video

orchid notch Oct 21, 2018, 12:07 PM

#

@silent pier i watched that video before and am now writing down the URI grammar to determine the correct IP from the python example at the end

silent pier Oct 21, 2018, 12:07 PM

#

Still watching it

#

Ah i see

#

Curious to hear what you come up with

orchid notch Oct 21, 2018, 12:09 PM

#

its huge

#

if i wrote down the additional grammar for IPv4 v6 and "vFuture" my paper would already be full

#

📎 unknown.png

silent pier Oct 21, 2018, 12:19 PM

#

Yeah i had a glance at the grammar

#

and frankly i think it's a mess :P

orchid notch Oct 21, 2018, 12:22 PM

#

I'd say https://cdn.discordapp.com/attachments/470884583684964352/503531496099807242/unknown.png the first one is the IP

#

it goes

URI = scheme ":" hier-part [ "?" query ] [ "#" fragment ]

scheme = http
and hier part can be translated to
"//" authority path-abempty

and as authority evaluates to
[ userinfo "@" ] host [ ":" port ]

the 1.1.1.1 should be accessed imo

silent pier Oct 21, 2018, 12:27 PM

#

I cant say i have any arguments for or against that. Curious what other may say though ¯_(ツ)_/¯

safe bear Oct 21, 2018, 5:09 PM

#

That's a cool video

velvet isle Oct 21, 2018, 9:09 PM

#

@thorn obsidian how do you rate it ?

#

Looks like Firefox is getting more security features than the rest of us

#

FeelsBadMan

#

😂

orchid notch Oct 21, 2018, 9:26 PM

#

just my interpretation of the grammar

native edge Oct 21, 2018, 9:27 PM

#

i'm surprised that's valid syntax at all

upbeat palm Oct 22, 2018, 12:54 AM

#

https://thehackernews.com/2018/10/libssh-ssh-protocol-library.html?m=1

The Hacker News

LibSSH Flaw Allows Hackers to Take Over Servers Without Password

LibSSH Authentication Bypass Flaw (CVE-2018-10933) Allows Remote Attackers to Access Vulnerable Servers Without Requiring Password

safe bear Oct 22, 2018, 1:12 AM

#

The flaw isn't in OpenSSH though

#

Which is the most commonly used implementation

valid furnace Oct 22, 2018, 2:23 AM

#

shrugs

#

Minimize attack surface area. SSH and other private use ports should not be connectable by the public.

upbeat palm Oct 22, 2018, 2:47 AM

#

GitHub use LibSSH.

safe bear Oct 22, 2018, 3:20 AM

#

Github already posted that they weren't vulnerable

#

But updated anyway

#

Also ssh is useful for remote access, you can't really block it unless you don't want remote access

#

You can put it on a non standard port to fool dumb bots (hi Mirai) or behind a port knocker

ember shore Oct 22, 2018, 4:40 AM

#

@thorn obsidian did you mean to tag me? I don't know anything about security and never discussed anything about it in this channel haha

thorn obsidian Oct 22, 2018, 8:37 AM

#

for the IP thing, 2.2.2.2 is actually correct

#

the first part is a username used for HTTP basic Auth and the # at the end denotes some other HTTP URL specific stuff