Twitter
#cybersecurity
velvet isle
Twitter
young fog
That's fucked
thorn obsidian
has anyone read any books that give a pretty good introduction to cryptology and different concepts within?
orchid notch
i heard cryptography engineering is good although i never read it fully because too little time
thorn obsidian
I’ll check it out
upbeat palm
@thorn obsidian If you want to learn it for software development checkout Crypto101 on GitHub
thorn obsidian
Just in general but will do
upbeat palm
@velvet isle Nice, it's good.
But different people different perspectives.
upbeat palm
Innovate, it doesn't tell much more about implementation.
chilly elk
message one of my friends clients got from his hacker
worth the read.. scary shit
velvet isle
safe bear
@chilly elk That's a scam
It's phishing, plain and simple
Can't recall when the pattern was first seen but it's becoming more common
chilly elk
yeah ik
errant pilot
It would probably be more effective without the dumb porn thing in the middle of it
errant pilot
How about "hey, I see your banking information"
safe bear
The porn thing is what's going to get a lot of average joes to cough up tho
errant pilot
It starts out strong and then just falls apart
tall haven
It's obvious - it's written in a generic, non-personalised manner
chilly elk
you should be fired
the kid who sent this is contracted by companies to blue team for them
and this is one of his clients
safe bear
The grammar is also off, which is a common phishing tell and what reminded me oh yeah this is that scam
chilly elk
so what he probably just phished or bruteforced his email?
safe bear
Oh, "Dear client of <client_name>" lmao
safe bear
C'mon if he's a blue team he can do better than that
errant pilot
Don't people get paid loads of money to do this? You'd think they'd put more effort into it
safe bear
Though if he's phishing that's not blue, that's red mate
chilly elk
and he shared it w me on telegram to have a laugh
safe bear
Not a template
safe bear
Yes
Now imagine if that with proper grammar and a professional feel to it
And had information about you specifically mixed in
Would you be more scared?
chilly elk
yeah obviously i wouldnjt take it as just a mass scam bot
safe bear
Automated phishing campaigns
safe bear
Feed OSINT results into a smattering of templates that you then snipe out to prime targets
Actual red teams know how to do that sort of thing
Which goes to show just how fucking degenerate phishers and spammers are
chilly elk
@safe bear im working on an application/tool for iOS and Windows/Linux. Idk if you'd be interested in working on with me but I want to make an app that allows you to share any file seamlessly to your computer by pressing the share button. If you dont know swift or ObjC dont worry about it I will be doing that but if you wanna help with the python backend let me know 😃
sorry if thats OT
chilly elk
lmao
safe bear
WHAT DO THEY MEAN?!!?!
upbeat palm
@chilly elk Woah, nice dude.
First penetration testing framework, now a file sharing app.
safe bear
What're you doing awake lol
upbeat palm
@chilly elk Not a sarcasm, I really appreciate your skills.
thorn obsidian
@chilly elk lmao this amazing phisher wrote translation instead of transaction
velvet isle
@chilly elk what will be unique about the app?
errant pilot
@velvet isle Sorry, that was a false positive
velvet isle
Alright
chilly elk
@upbeat palm oh wow thanks Man lo
@thorn obsidian yeah I thought it was hilarious
@velvet isle idk you only have options to do it through the cloud. No direct sending to your computer.
chilly elk
Yep
velvet isle
😄
errant pilot
@velvet isle should be safe now
chilly elk
@velvet isle since we will be running an https server to communicate locally with your phone couldnt we just use the chacha20-poly1305@openssh cipher for TLS?
leaden blaze
This was the link @velvet isle wanted to post but was incorrectly removed by one of our filters: https://twitter.com/zackwhittaker/status/1083447650555478017
chilly elk
lmao
thorn obsidian
would this be safe enough to prevent code execution? python async def v3(self, ctx, email): import os from shlex import quote try: v = validate_email(email) # validate and get info email = v["email"] # replace with normalized form except Exception as e: # email is not valid, exception message is human-readable await self.bot.say("Invalid email.") print(e) return if ctx.message.author.id not in beta: await self.bot.say("Not allowed.") return runme = "grep {} db/premium_users.txt".format(quote(email)) 🤔
chilly elk
@velvet isle tlslite-ng has some nice integration of ChaCha20-poly1305 for layering it on socket streams :)))
@thorn obsidian very easily navigated
thorn obsidian
wdym
chilly elk
i could just open the file and change the if
instant access
if i were you
id set up a db
and force a login
thorn obsidian
no1 can edit the file
chilly elk
its python
thorn obsidian
its a discord bot command to search a file
thorn obsidian
lmap
chilly elk
yeah that should work
thorn obsidian
just wondered if there could be character combinations that the OS would take as whitespaces
chilly elk
damn i need to read more
thorn obsidian
but I trust the email filter enough ¯_(ツ)_/¯
chilly elk
im guessing they have to send a command w their email?
chilly elk
yeah that should work
chilly elk
send validate_email() func real quick @thorn obsidian
thorn obsidian
yea I mean I tried bypassing it & failed
velvet isle
@chilly elk As you suggested I agree
upbeat palm
Guess so.
thorn obsidian
Dope
safe bear
Ah
north rover
@thorn obsidian shlex quote might work out but spawning a subprocess just for searching something in a file is a bit overkill isnt it
python can do that just fine
thorn obsidian
@north rover I can't do it without blocking
for some reason aiofiles takes 10-20 times slower than a normal python search
also eats up the ram really badly
north rover
aiofiles uses a threadpool
thorn obsidian
either way it's far 2 slow and there's no good libs for non-blocking search
north rover
how do you spawn the subprocess?
thorn obsidian
with aiofiles?
async with aiofiles.open('filename') as f:
async for line in f:
if "str" in line:
print("Match: " + line)```no, i meant your current grep approach
north rover
so how's that non-blocking?
thorn obsidian
because either way it takes around 0.1 seconds to work
north rover
just using regular "blocking" code within python would be the most optimal approach
thorn obsidian
regular search was slower than grep
it took around 1-2 seconds
- im planning on adding bigger files so that doesn't help l0l
orchid notch
About 3k people yes
orchid notch
I mean about a fourth is online the community is actually much bigger than 3k
fervent root
do you know how can I verify if I'm root on python?
and functions in windows too, with system privileges
i'm creating a reverse shell
orchid notch
Well I know for Linux, there it would be when the uid is 0 so os.getuid() == 0
For Windows I don't know
pulsar crystal
yeah no
any script where the word "victim" plays a part in the docstring is probably too rich for this server
please read our rules, especially rule 5.
!rules
past starBOT
thorn obsidian
Soz
thorn obsidian
😅
violet dune
wait "hacking"
violet dune
also im making a simple text encryption software
thorn obsidian
Umm p;ease dont hate me
violet dune
can i ask a quick question here bout code
violet dune
i wasnt talking to you.
fervent root
ok
pulsar crystal
it's a help channel. ask away, that's what it's for.
fervent root
so, use @thorn obsidian
violet dune
basically
it converts a letter to a number
adds blank number to it specificed by user
the reconverts it to text when the otherside of the software is run
makes sense right?
violet dune
no because it will always change because of how the code is written
A with value 3 will becomes D
anyway i need it to change it to a number and thats where im having trouble
violet dune
it is encryption
pulsar crystal
he already said it was encryption
violet dune
^
fervent root
yeah, i dont saw it
pulsar crystal
turning A into a number is a simple matter of doing ord("A")
violet dune
ord?
pulsar crystal
gives you an integer that represents the unicode point for the character.
violet dune
can u show me what you mean
pulsar crystal
no probs
fervent root
ok
pulsar crystal
lol
fervent root
hebruerhbue
thorn obsidian
char = line or int.strip()
Or something idk
violet dune
its not made for actual security
thorn obsidian
I learned so much on bruteforce
violet dune
i havent done python in awhile and needed a refresher project
violet dune
yeah why
oh @pulsar crystal one more thing
how do i make input take input as an int
pulsar crystal
you can't. just convert it afterwards.
fervent root
a = int(input())
thorn obsidian
Nicely done
violet dune
good idea cobra that shoukd work
fervent root
input, default returns a string
pulsar crystal
and keep in mind that cobras example will crash if you provide anything that isn't an int
so you might wanna sanitize it
fervent root
@pulsar crystal herbuerhbeurbeubhre exactly
violet dune
how
an if else statement
that would reject it if it wasnt an int?
also how would i go from the ord thing u told me back to letter?
thorn obsidian
else: print str()
pulsar crystal
# Ask the user until they provide a valid input
while True:
try:
user_input = int(input("Please input a number")
break
except ValueError:
print("Invalid input. Please try again")
continue
this kind of pattern is pretty common.
and if you wanna go from ord back to number, you can use chr
it does the opposite
fervent root
orchid notch
What does this herbuer..... Mean you repeatedly say? @fervent root
pulsar crystal
back to letter I mean
violet dune
lemon can i use that exact code
fervent root
It's a brazilian kkkkkk
pulsar crystal
just type it out yourself, but yeah use that pattern if you want :))
better for learning if you type
helps retention
fervent root
@pulsar crystal , how can I write code here?
pulsar crystal
!codeblock
past starBOT
pulsar crystal
like this
orchid notch
Probably because you didn't type it correctly?
fervent root
@violet dune You're using python3?
violet dune
yeah
pulsar crystal
my bad, there's an end paren missing after that int(input
that's why you're getting syntax error
but I did tell you not to copypaste it :P
violet dune
accidentaly hovers over lemons pfp and fliches cause they werent expecting it to move
orchid notch
Somebody should invent some mechanism in the cpython interpreter to make the user aware of the missing ) or ,] or w/e instead of syntax erroring on the next line
thorn obsidian
Have i been helpful to anyone so far?
fervent root
@pulsar crystal How can I beak line here?
pulsar crystal
@fervent root @thorn obsidian I know you two are trying to help but it might be better if you worked on your own python ability first and then helped our users when you've got more experience.
no offense.
fervent root
yeah
pulsar crystal
appreciate the effort, though :)
fervent root
I response him because It's a simple question
pulsar crystal
take it however you want :P
fervent root
@pulsar crystal OK ehrburehbure
@pulsar crystal Answer me please
how can I break lines here?
violet dune
oh lemon i have question
pulsar crystal
kinda clogging up this channel
violet dune
how do i break the code if its also greater than 25 or less than 1
pulsar crystal
the input?
violet dune
the num input yeah
orchid notch
if integer >= 25 or integer < 1:break
pulsar crystal
well, in the pattern I showed above, you could just manually raise the error if that were true.
because I'm assuming you actually mean how can you ask the user to retry
fervent root
'''python
a = input
while not(a.isdigit()):
a = input()
pulsar crystal
@fervent root what did I just tell you
fervent root
'''python
a = input
while not(a.isdigit()):
a = input()'''
pulsar crystal
this isn't a god damn sandbox for you to practice code blocks in
orchid notch
That code is also wrong btw
fervent root
ehrbuehrbeubhr
orchid notch
It would assign the function input to a yielding some weird errors in the while stuff
fervent root
i'll do it @pulsar crystal , I'm new on discord, and in english too
violet dune
i couldnt do an if in the while true tho could i
pulsar crystal
sure you can
violet dune
i can do
pulsar crystal
you can nest almost anything inside of almost anything else.
give it a try and we'll give you some pointers if you get stuck.
pulsar crystal
yes. but keep in mind that break in this case indicates that you're happy with the input.
is that what you want? stuff that's larger than 25?
probably not, right?
pulsar crystal
so what we're doing in the except block is continue
which just rolls another iteration for the while loop
pulsar crystal
I wonder if this works yet
violet dune
so i dont clog this channel with basic code questions
thorn obsidian
Lol
thorn obsidian
?
glad cobalt
Hi guys
Can anyone tell me with which lib
I can change wallpaper and change windows settings
Like changing wallpaper
Setting lid setting and removing shortcuts etc
thorn obsidian
Soz bro have no clue what you mean
fervent lodge
Anyone here pretty knowledgeable with networking?
upbeat palm
Not good enough, but ask it.
thorn obsidian
Hey ! Anyone have experience with mitmproxy api ?
wary inlet
@plain kelp You can use something like https://www.cloudflare.com/ddos/
thorn obsidian
@plain kelp best thing would be a reverse proxy an another IP, and some iptables rules, also CloudFlare, and remember not to host your website on an obvious port like 80 but set it to something totally random like 45532 & only use the reverse proxy to display the page
upbeat palm
thorn obsidian
@thorn obsidian it's to prevent sites being o censys. The first thing I do whenever trying to find a backend is go on censys without even bothering checking the real IP, since people don't think that using CloudFlare doesn't protect their websites being crawled
Using 80 or 443 is just terrible practice if you don't have much network capacity.
orchid notch
Setting it to 80 or 443 is a standard which should definitely be followed
thorn obsidian
if you plan on getting your site hit off sure
that's what the reverse proxy is for smh
standard != secure
orchid notch
Putting a reverse proxy which listens on port 80 or 443 and forwards to another server which also listens at 80 or 443 isn't insecure afaik and still follows the standard
If the proxy and the server are different machines or containers or whatever that is ofc
thorn obsidian
a reverse proxy would be an external server, in that way if it goes offline a new one can easily be fired up w/o the backend web server going off
orchid notch
Yes and why shouldn't any of the two listen on the standard ports if they are seperate machines and the cricital one isn't able to be reached without going through the proxy before
thorn obsidian
the reverse proxy can listen on standard ports that's normal
orchid notch
And why should the server not do that if it's inside an internal network
thorn obsidian
well it can but I haven't seen a single person host a website on an internal network yet, everyone just buys a VPS and hosts it
almost everyone I've met has always just bought a contabo or hetzner or OVH or Digital Ocean or Linode VPS
then added a domain & CF to it
orchid notch
Well first of all that's how companies might do it and second what stops you from having both inside a docker container and just let the proxy contain expose ports
Also that you didn't see it happen does not mean it's bad or not usual in places where you didn't look
thorn obsidian
im not saying its bad practice, it seems pretty good tbh, im just saying everyone I've always seen does bad practice
and if your network is internal then sure that's a good idea, however again most people or companies would rather not having a website hosted on their network, because if someone tries to hit the reverse proxy offline then there might be a chance of more network issues for the company
orchid notch
Then again use docker containers or some cloud solution (I am sure there are some) which at least imitate internal networks
thorn obsidian
a cloud solution is good but a local docker is still risky
thorn obsidian
in what way
firewalls are quite useless against DDoS attacks
reverse proxy
no
im saying 443 can be used by the reverse proxy
so that you don't expose your backend with a normal 443
as soon as you put a website on port 443 its exposed
as in that in a week your backend is public and available to be searched
no
if you put a website on port 443
it goes on https://censys.io/ within a week
which, is why you have reverse proxies
the fact anyone can find someone and hit the site off very easily
It's very easily vulnerable to DDoS attacks
anyone looking at your backend server isn't handy
it scans servers
oh my god
yeah
it crawls HTML of all IPs
saves it and makes it publicly searchable
your web server would be the backend server
how?
webserver is a specific type of backend server used for “internet” traffic.
HTTP servers tend to have the files on them...
if it goes down there's not much use in anything anywhere
I've never seen them used for anything else except a reverse proxy
which always just loaded the files from another http server
blacklisting everyone else seems like an overkill
you'll have to whitelist everyone else in the future
maybe you want to make some automated functions from other software that CloudFlare doesn't support
or that would block
maybe you need some sort of file uploading and CloudFlare will block it
(they do have a limit)
other software would connect to the http server
maybe you have another server that retrieves information or a custom admin tool
or a bot 🤷
blacklisting everyone seems a bit additional
😂
you too 🤷 👋
daring lark
safe bear
"Interesting" is one word for it
Here's one of many reasons why putting the service on a different port buys you very little: https://github.com/robertdavidgraham/masscan
masscan 0.0.0.0/0 -p0-65535 in 6 minutes with the right network and hardware configuration
If your shit isn't secure, then it being on another port won't matter
If it is, again, it won't matter, and you'll end up just causing yourself a lot of pain since things expect services to be on specific ports (and sometimes don't even let you specify a different port!)
plain kelp
How can I find security holes from my website?
thorn obsidian
the point is that IoT search engines don't index your site
This was to protect against DDoS attacks not to secure the websites
also port scanning the internet has no use in finding the site as long as you don't have some weird shit in the banner
orchid notch
What
Of course it has you can clearly identify the open ports and then just send some http GET request to each of them and see where you get a http response
And if your site is registered at a domain and somebody is actually interested in damaging you he usually already knows your domain and doesn't have to search for it
And if your site is registered at a domain and somebody is actually interested in damaging you he usually already knows your domain and doesn't have to search for it
orchid notch
why should he identify open portsof the internet
as i already explained if somebody wants to damage your server via a ddos attack he probably already knows very well what IP / domain he is searching for
orchid notch
yes but if your website is like
behind a domain there is always an IP leading to it
thorn obsidian
which is why you use reverse proxies and DDoS protection providers
orchid notch
the people always know which endpoint to attack and if they ddos the shit out of your reverse proxy and make it go down you will also have problems
thorn obsidian
and the reverse proxies can port to a server with a totally random prot
orchid notch
even if a new one jumps in
thorn obsidian
well that's why you buy new servers when you need more capacity
orchid notch
what
thorn obsidian
there's nothing to do against major DDoS attacks except upgrade the network capacity
the more servers the less load
orchid notch
yes so if there is nothing to do against it why bother hiding the port
thorn obsidian
because it's preventing them, it's always better for the real IP to be masked.
orchid notch
if people have a domain they have an IP and if they have an IP its just a matter of minutes till they find out which port is your http port
thorn obsidian
they can hit the reverse proxies and there's a chance the real site is actually up
orchid notch
and then you are fucked no matter where your stupid port is
thorn obsidian
how are they gonna find the IP if it's masked behind reverse proxies and DDoS protection providers
orchid notch
if the reverse proxy is down your site isnt accessible anymore from the outside either which leads to the site appearing to be down
thorn obsidian
which is why you buy more servers to use as reverse proxies when you have to
and you hope the datacentre will try to mitigate the attack
orchid notch
this still does not defend your opinion on changing defautl ports at all but okay
thorn obsidian
you just don't get this lol
if you have a site on port 80/443/8000/8888/8080 there's a very high chance your site is already exposed no matter what protection you use
the reverse proxies use these ports to protect the actual site hidden from another IP
if a reverse proxy goes down the main site doesn't go down, which is why you can get a new reverse proxy as the site still functions
orchid notch
if all your proxies go down there is no route to your site -> site appears down
it comes to the same result
thorn obsidian
but its still better thn using a normal port
note if your site goes down -> site appears down
the point is that it's harder to take down
orchid notch
ill join scot at this point
thorn obsidian
you can add more network capacity and decrease the network load of reverse proxies instead of having your main web server fired at
😂 okay cya 👋
- Using port 80/443/8080/8888 = Site ends up on IoT search engines such as Censys, Shodan, Fofa etc.
- Anyone can go on them and get your web server backend and take it off within seconds
- Using an alternate port (that's high) will prevent having a site indexed, of course the port can be discovered but there's no useful header for the attacker, unless he decides to send a get request to the whole internet which doesn't help
- The reverse proxies will run on 80 & 443 as normal - however, they will connect to the actual web server without exposing it, so if they get attacked new ones can be temporarely bought to increase the network capacity, and this way the network load will be balanced, so that the DDoS attack impact can be reduced, some proxies might go down or get overloaded but it's more likely for the web server to stay up than if it was directly attacked.
- Using a DDoS protection provider will also help to mask the reverse proxies, which in return ensures that the actual web server IP is masked more
maybe that explains it more 🤷
(note that I'm not saying this makes the site secure, it just prevents against DDoS attacks by making discovering the real IP way harder and way more time-consuming)
orchid notch
this is the concept of a reverse proxy
if there is a reverse proxy your web server does not have
an external IP
ther eis nothing to discover
that is the POINT of a reverse proxy
thorn obsidian
you can point them to another server...
orchid notch
what
of course i can redirect all my http requsts to another web server
ever heard of load balancing?
they do exactly that but with hundreds of other servers
in fact a reverse proxy can be a load balancer
thorn obsidian
yeah, and in that way they can filter the traffic before sending it and reducing the work done by the web server while hiding the IP
orchid notch
again there is no ip to hide
proxy runs on port 443 receives request checks it maybe its in his cache or something -> forward to internal ip at port 443 internal -> internal server responds to proxy -> proxy responds to client
the internal server has no external IP to hide
thorn obsidian
yeah the proxy responds not the actual web server
it'd be like proxy -> filter traffic -> forward to IP on random port -> internal server responds -> proxy responds to client w/o exposing web server IP
in that way the web server doesn't get blasted with the traffic to filter if it does receive a DDoS attack
and at the same time doesn't get indexed
tropic heath
I hate asking for help, I'm a bit lost. I'm looking for a list of different flavors of Python. I've heard of PyCharm. I'm in the Network Security Field. Can someone help?
how is an IDE a flavor of python
tropic heath
Excuse my ignorance. I'm just getting my feet wet with Python. Last time I messed with any coding was VB in '09
tropic heath
I'm looking for an interface a bit more than using python through linux terminal.
orchid notch
well then you could of course use pycharm however its an IDE so it might be a bit overwhelming for a beginner. Maybe stick to a code editor like vscode or sublime text first
tropic heath
VScode or Sublime. Thank you. I have Ultra Edit at work and it's feature rich; just a bit much to take in.
orchid notch
if you got more questions #tools-and-devops is usually used for these questions
tropic heath
Will do thanks @orchid notch
orchid notch
np
buoyant maple
how secure is flask + sqlalchmy by default? I have heard django is good by default but thats "batteries included"
waxen ice
@buoyant maple django's ORM is possibly the best on earth. i dont use django, but man, everyone loves their ORM.
SQLAlchemy is absolutely secure. and very comprehensive and stable
the bigger issue is that it's not the most user-friendly from the outset
security isnt as big of an issue these days
sql injection isnt a norm anymore or anything
more often ORM drawbacks are things like performance
sometimes theres a middle ground. i personally find peewee the nicest to use, and it does take a performance hit in some areas compared to well-written sqlalchemy code, but often times it isn't enough to matter
by 'nicest' i mean peewee is less verbose, very straightforward and easy to use, and is what i usually default to when starting a new project
personally i'm mostly interested in async implementations going forward.
Orator is hands-down the nicest ORM to use in terms of user-friendliness and elegance, but it isn't as kept up to date by the creator
regarding Flask, just don't leave your web app in debug mode while it's in production 😉 that will eliminate the most hilarious security risk [that still took down a large startup a couple years ago]
buoyant maple
I have tried the django ORM and did prefer it, good to know nonetheless 😃
peak gate
orchid notch
Yes it's evil that's been known for a long time
north rover
jesus
novel river
having a lil giggle at the reverse proxy convo up there 
boreal dove
Okay basically
def decode(data):
for pos in range(14, len(data)):
data[pos] = ((data[pos] + int(42 * -0.5)) - ((pos - 2) % 6)) & 0xFF
if someone can tell me what this means
Its used to decode a certain file, but as far as my knowledge goes this hasnt worked for unknown reasons other then it saying invalid character
\I know it used utf 8 into bytes into hex or something, or a byte shift i think
I can hook you up with the whole file, i just want to know how to replicate it
safe bear
What version of Python are you using @boreal dove
I'm not terribly experienced with Binary RE, but it might be doing something with the positions (can't remember what its called)
boreal dove
I actually figured it out now
the file was like not nested right in things just had to change a couple things to get it to work
or lol you can just use DGData for Node.js as the encoding you see
safe bear
Cool
ancient nacelle
I know little about security, but would you like to improve? code quality or function?
@glad cobalt
one thing, are you copying the current users Signature or any user?
tall haven
@glossy stratus Post it in #303934982764625920
upbeat palm
upbeat palm
Google Fu is awesome
velvet isle
hehe
I agree
Messanger doesn't encrypt messages also
Just sent over secured connection
btw @chilly elk How the coding projects coming ?
chilly elk
Working on something bigger and better than babysploit
You’ll see soon 😃
If u follow me on Twitter I think I shared some video
orchid notch
you dont have your twitter linked to your account though
chilly elk
@orchid notch no but it’s all over my GitHub and that’s how papa Jason knows me
Ok now it’s displayed lol
cedar pelican
@thorn obsidian If I'm not mistaken 7-zip can do both
So can winrar
I might be wrong
thorn obsidian
Winrar can open zips and rars, yes
So can 7-zip
But zipfile module can only open .zips
cedar pelican
Can they be accessed from the command line?
Because you could use the os module.
Maybe
thorn obsidian
I am asking if there is a module that is basically like zipfile but also works for .rars
Why would I need the os module?
I can unzip, extractall etc just fine
upbeat palm
@thorn obsidian Try rarfile module
thorn obsidian
@upbeat palm does it support zips aswell
thorn obsidian
@thorn obsidian Thanks for that. But from what I understand it cant unzip/unrar files that are pass protected?
Also a side topic question: I cant decide licences for my projects. MIT or GNU GLP v3? I dont mind people seeing and modifying my code as long as they credit me etc. Which license would suit me better?
Basically I am all about sharing and having open source. But as long as I am credited etc and not held liable or accountable/warranty for the things people do
thorn obsidian
Nope it seems like it can't
thorn obsidian
@thorn obsidian as a matter of fact staff kinds warned me if it was for my pentesting projects I should post it here and ask it a bit more “Discord-friendly”
orchid notch
if its so discord firendly its not related to security anymore (like this case) scott is still right though
thorn obsidian
Eh I mean it was for my ZIP Cracker
so I wasnt sure
but yea, I'll give credit where its due
This fuckin argparse
Uhm as this thing is related to my project:
And that has nothing whatsoever to do with optparse. As I said at the very beginning, your current problem is the Python 3 bytes/strings distinction that doesn't exist in Python 2. The code you are working with is reading what Python 3 would regard as bytes, but is attempting to convert them as if they were strings encoded as Windows 1252. Find out what you have to do to deal with the unicode/bytes distinction in Python 3.
Not sure how do I do that, unicode/bytes distinction in P3
an error i've been getting is this:
(venv) C:\Users\USER\Documents\Jetbrains\PyCharm\Project>Projectv1.py -f "Generic ZIP Name.zip" -d "list.txt"
Traceback (most recent call last):
File "C:\Users\USER\Documents\Jetbrains\PyCharm\Project\Projectv1.py", line 38, in <module>
main()
File "C:\Users\USER\Documents\Jetbrains\PyCharm\Project\Projectv1.py", line 31, in main
for line in passFile.readlines():
File "C:\Users\USER\AppData\Local\Programs\Python\Python37\lib\encodings\cp1252.py", line 23, in decode
return codecs.charmap_decode(input,self.errors,decoding_table)[0]
UnicodeDecodeError: 'charmap' codec can't decode byte 0x8f in position 193: character maps to <undefined>
I dont get what is the issue there, it cant read the unicode because its bytes?
if yes: how do I fix it?
gentle heron
if its binary data you shouldnt use 'readlines' but just read since readlines will assume that the ascii character for line breaks is intended to be used as a delimiter.
if passfile is just a plain text file then you prob need to open it with the correct encoding. any non ascii characters will throw an error if your default encoding doesnt support them
and as a password file it might be utf-8 etc
thorn obsidian
Yea its a plaintext doc
pass_file = open(document)
for line in pass_file.readlines():```Thats the duo that the error is related to
Would ! be considered ASCII?
Numbers and letters are ASCII
what about symbols?
,, ., #, etc
if they arent; is there a way to tackle this? As some files have symbols and some dont (and are standard text docs)
gentle heron
yeah those are usually ascii but there are multiple code points that can look like those. plus if your default encoding is multibyte but does not cover every codepoint it can cause issues. like there are a TON of codepoints in utf8 but not all of them resolve to a symbol
i think you need to figure out what encoding they are supposed to be and just load them all with that or convert them. utf-8 is a good starting guess
looking at your error message and what that other guy said, it looks like right now you are using 1252 as your encoding. idk anything about that one but I am going to guess it can do multibyte characters
so if its encoded utf-8 and you read it in some other encoding its going to get decoding errors on any unusual character or its going to just generate garbage when you display it
looking at https://en.wikipedia.org/wiki/Windows-1252 its a one byte encoding BUT 0x8f (which is the byte listed) is NOT a valid codepoint
so the file must not be encoded in 1252
so basically most encodings support most of ASCII, which is itself an older encoding. but above 0x7F or so most encodings do whatever they want
import io
f = io.open("test", mode="r", encoding="utf-8")
is a good start
thorn obsidian
As I am not that familiar with io mind elaborating?
I get that my encoding is incorrect thus its raising an issue. But isnt the default UTF-8?
so Instead of open(dictionary) I should do io.open(dictionary, mode="r", encoding="utf-8)?
@gentle heron
gentle heron
no the default isnt utf-8, it depends on your operating system
thorn obsidian
Well its Windows rn
gentle heron
and yeah thats what you should do instead of a regular open. you just have to import io first
gentle heron
yeah i dont think windows uses utf-8 by default
thorn obsidian
pass_file = io.open(dictionary, mode="r", encoding="utf-8")
Traceback (most recent call last):
File "C:\Users\USER\Documents\Jetbrains\PyCharm\Project\PROJECT.py", line 38, in <module>
main(args.zip, args.dictionary)
AttributeError: 'Namespace' object has no attribute 'dictionary'
so it wont take the specified file?
PROJECT.py -z "Generic ZIP Name.zip" -f "file.txt"
Thats how i start my script
so file.txt is suppose to be opened
gentle heron
i think thats an error in the PROJECT.py file.
have you edited PROJECT.py or was that automatically generated?
thorn obsidian
Uhm what do you mean
like did I write PROJECT.py?
Yea, i am 'modernizing' an 'obsolete' code that was written in Python 2.7
was using optparse, instead I am using argparse
gentle heron
ah ok, so the error is with your code that reads in the arguments it looks like
thorn obsidian
oh wait its having issues with my args
yea
I see that main(args.zip, args.dictionary)
also the fuck happened to Offtopic/General names lmao
gentle heron
haha they change regularly. you can submit a new name on the discords github repo
thorn obsidian
ah, they changed quite fast instantly thats why
anyways
uhm mind If I dm you the code?
Per channel's rules I cant share it here as I wish to share it but I am not sure what is wrong with my argparse
gentle heron
we could move to a help channel if you want, this is more of a general python question at this point
gentle heron
oh do you mean the project isnt allowed :U
thorn obsidian
kinda
yea
yea
Pentesting tool/'cracking' tool so thats why
I could edit the shit i wrote and make it TOS friendly
but yea
Sure gimme a sec
when did this get here
i'll ping you two in a sec in another channel
aight, apologies
Mmh better if I just DM as many stuff are a bit problematic to edit
mossy junco
Let's just not do zip cracking here at all maybe
mossy junco
Don't worry about it
velvet isle
Let's just not do zip cracking here at all maybe
^
There are subreddits for these things
Lets keep here clean
safe bear
lol
gentle heron
hmm this seems like a good way to get in legal trouble if they are targetting minors lol
oh it asks for parental permission so that prob reduces that even though i wouldnt be surprised if it was trivial to lie
safe bear
So free VPN in exchange for reading all your data? Eww.
velvet isle
I honestly can't believe I'm witnessing this with FB
safe bear
I can
velvet isle
lol
Well this sounds good
You heard they wanna integrate FB with WhatsApp and Messenger and IG ?
😂
safe bear
While I tend to be pretty moderate, Facebook is an exception. They're horrible.
velvet isle
latent kelp
any thoughts on https://spyware.neocities.org/articles/discord.html ?
latent kelp
there's nothing new on there but it's not exactly reassuring
gentle heron
User's e-mail address
All text messages
All images
All VOIP data (voice chat)```aka shit you send over discord
or directly to them when you sign up
seems pretty standard. the Logs of all of the other programs that are open on your computer going back isnt even weird since it shows what game you are playing
and for that it needs to know whats open
but they could prob reduce that. otoh its common to send that for anticheat in games
safe bear
Yeah, how else is rich presence gonna work?
gentle heron
overall this is very sensationalist
i dont know why anyone would take it seriously
i like RMS but its super sad he apparently linked to this
safe bear
Basically this is: "Discord is a typical for-profit chat client BURN THE HERITICS"
gentle heron
not because its technically wrong, but because its written so horribly
spyware level: EXTREMLY NORMAL
not that its ideal, but its non unusual at all
safe bear
You could condense this to a bulleted list, prepended with "Privacy things to be aware of before using Discord"
gentle heron
yea
also he claims nitro cant sustain discord, but reddit's data shows that it CAN
because reddit says they get more than enough from reddit gold
and its a very similar subscription
safe bear
The store is their next monetization method post-nitro
gentle heron
yea
also his only source for 'discord is fully funded by spying' is that they have investors paying them
safe bear
And (somewhat off topic) has a chance at succeeding since people are getting tired of Steam's stagnation IMO
gentle heron
which is super common
yea epic is trying too and they have a good shot at it as long as they dont give themselves horrible pr...
safe bear
They're already doing better than Twitter lol
gentle heron
because they have fortnight
safe bear
Twitter is basically funded by VC money
gentle heron
Discord has confirmed in an email correspondence[6] that it does receive government requests for information. So, we know that the government potentially has access to all of the information that Discord collects about you.
like literally every US based company
since not providing it when you get a warrant is illegal
gentle heron
they could do e2e encry for dms but since this is mostly a chat room service thats not really that useful
safe bear
Especially since I suspect even DMs are implemented as rooms
gentle heron
it would make sense
simple orchid
end to end encryption wouldn't necessarily be impossible for rooms
simple orchid
have a key encoded in the invite
safe bear
One issue though is Discord is community-based
simple orchid
it'd be very clunky though
safe bear
So maybe with groups
But not with servers
since they need to be able to see messages for trust and safety issues
simple orchid
the kind of thing that would really only make sense for a dedicated chat network specifically built around the feature
safe bear
Also the content filtering (checks for NSFW images as well as malware I think)
simple orchid
there are ways to validate reports while maintaining secrecy for any non-reported message
whatsapp does it aiui
gentle heron
also servers are generally pretty public so anyone coudl just log everything
safe bear
@past star is watching
velvet isle
I don't think discord tries to collects so much data from other programs
I once inspected the traffic
Was just messages and pfp's flowing
marble dawn
there is some telemetry in there
thorn obsidian
Just innocently collects every device and app you've ever opened and makes sure to know the times that you do it
marble dawn
That's pretty standard
thorn obsidian
Pretty sure other apps don't exactly care about your activity
Except when you use them
marble dawn
Pretty much all social apps care a lot about your activity lol
thorn obsidian
Yeah when you use them, they don't tend to monitor your phone
marble dawn
if you think discord is bad, you should see what the facebook app does
thorn obsidian
I never rly used fb oof
marble dawn
that thing is constantly scanning on bluetooth in the background
I have a huawei device and the system manager thing notified me about it
thorn obsidian
Oof
I thought Huawei was banned in so many countries 🤔
Must only be the routers
marble dawn
It's banned in the US
if that's what you mean
that's not really "so many countries" :P
native edge
The next Bluetooth will greatly increase accuracy for locating devices
velvet isle
Doesn't have to be related to python
Hacking, data sanitization, encryption, and protecting yourself and your devices.
That's the channel description
marble dawn
It should be at least tangentially related to Python
this is a Python server after all
but that one is kind of relevant to the server itself
thorn obsidian
well, its not really hacking or data sanitization or encryption or protecting anyone or any device its just news
which just talks about the FBI being annoying looking into discord users
tropic bay
slate robin
i'm making a password generator/ storage program
i want to encrypt and decrypt the textfile where i store the credentials
but how can i do that in such a way that someone with access to the machine couldn't just do it?
i guess by public key crypto but is there a guide for doing it in python3?
i can store the public key in the code itself but the user would have to enter the private key
is there a way to make the private key some kind of string the user could remember?
slate robin
this is purely as an interesting project to do by myself as a learning excercise, i'm not going to be using it for actual sensitive credentials
velvet isle
@slate robin Check out https://github.com/gabfl/vault
These will give you ideas of how to go around doing such thing
Keep in mind. There are many encryption algorithms that are used today
I'd choose one based on situation
glad cobalt
How to check if the user is root or not ?
In bash i can check like this: if [[! $(id -u) == 0]]
glad cobalt
Will it work on windows
safe bear
No
glad cobalt
Its not workinu
safe bear
This works for me: https://stackoverflow.com/a/1026626/2214380
glad cobalt
Ok cool only unix
safe bear
import ctypes, os
try:
is_admin = os.getuid() == 0
except AttributeError:
is_admin = ctypes.windll.shell32.IsUserAnAdmin() != 0
Oh :P
orchid notch
https://csrc.nist.gov/news/2019/pqc-standardization-process-2nd-round-candidates 2nd round has begone guys
thorn obsidian
So quick question regarding .zips
Does 7zip and winrar have different compressing/creating methods for .zip files?
I had a program unzip 2 .zips: 1 made via 7zip and one made with winrar. 7zip was unzipped successfully but winrar failed. Do note they were pass protected
but this raises a question whether winrar is 'buggy' or 7zip
Because I cant figure out why it could unzip the 7zip packed .zip but not the winrar zipped .zip
tight abyss
the zip format supports a number of compression algorithms, of which the most common is "deflate" according to Wiki
tight abyss
It could well be imaginable that some types are not implemented by some tools
thorn obsidian
thats 7zip
Winrar has normal
while 7zip is deflate
not sure what normal is
It could be what you said but its odd...
i mean it doesnt say deflate anywhere here
so I presume normal is deflate aswell?
Thats 7zips
so yea
tight abyss
when in doubt, I would personally trust 7zip over winrar
tight abyss
Can you find out what zip format version each tool produces?
tight abyss
not sure
the required version is encoded in the 5th and 6th byte of the file, but no idea how you can extract that with your tools
glad cobalt
Any better way to write this
Because its not checking other cmds after checking the first one
tight abyss
You should really post your code as plain formatted text here and not as screen photo, if anyhow possible. Text from photos can not be searched, copied, is harder to read, takes more bandwidth, ...
orchid notch
inb4 Somebody implementes an @past star feature utilizing tesseract to extract source code from images
thorn obsidian
@glad cobalt you could just sys.exit("message")
thorn obsidian
@glad cobalt: elif and not
glad cobalt
@thorn obsidian can you give me one example?
thorn obsidian
Is there a way to do whois with python and extract all the info using json or some other way to a txt?
And yes, I asked an admin earlier today before asking this question. Since whois data is public I can ask this question freely
velvet isle
@thorn obsidian Why not use os.system ?
mortal perch
os.system is deprecated
velvet isle
oh
mortal perch
mm my bad, must've got confused with something else :/
but yeah, subprocess is safer, and gives you a lot more control of the spawned process
safe bear
os.system is for lazy ignorant fools 🔥
subprocess.check_output does the same thing, has more flexibility, and is generally not a shit interface.
It also makes it clear where external applications are being called
green prairie
@safe bear How would I got about accessing an environment variable using subprocess?
So the equivalent of os.environ.get("DESKTOP_SESSION")
safe bear
@green prairie Why would you use subprocess to do that? Just use os.
upbeat palm
safe bear
VIRUS
PASSWORD
MINORITY REPORT
DARK HOODIE
NO SHAVE NOVEMBER
FORTRAN
THE MATRIX
What do those all have in common?
Also, only two (possibly three) have anything to do with credential stuffing
velvet isle
🤔
cinder badge
i guess hacking
safe bear
Do you see the embed picture?
Oh, for credential stuffing
Because it happens to be November and they are using it as an excuse for their atrocious hygiene of course
upbeat palm
🤔
reef onyx
Hi guys
Really excited about security and infosec !
New to python.
New to this field
gilded pebble
You have a PC?
reef onyx
Yes
gilded pebble
Oh
reef onyx
I mean laptop
reef onyx
Installing cent os on it
😀
Hoping to learn a lot from u guys
So this channel is about pentesting/ security ?
If I'm not wrong
upbeat palm
Yup, it is.
urban moon
does anyone happen to have some optimal settings for scrypt, i.e cost, keylength, threads etc? if you have a answer please tag me, thanks 😄
urban moon
@thorn obsidian what do ya mean by that
c# nuget package, if that’s any use to you, lol.
I believe it’s called CryptSharp
I’m on my phone sorry for the slow typing
midnight delta
hello all
i just receive as msg in messenger from one friend an image that says someone else add a photo with me.. i inspect this link an i saw this
after that i opened with python the link and the result was data from image
i can give the link tho if someone want to explore or anything
btw
my question is : if is a picture is that possible to contain a virus? how is that possible because i think- its impossible to run a code from image
marble dawn
It's possible for other data to be hidden in an image file, but you'd still have to actually run that data as an application somehow
Unless there's an exploit in your image viewer
midnight delta
image viewer?
marble dawn
In the case of a browser, though
The browser cares more about the mime type sent by the server
midnight delta
and from there can run the code?
marble dawn
In the http headers
So I guess if you got what appears to be an image but actually contains html as well, serving it as text/html might cause it to render as a Web page
I've gotta run, but you should check the headers
jagged dawn
Nice friend eh?
midnight delta
my friend but he didn't know until i showed him this
@jagged dawn easy bro
@thorn obsidian it wasnt only just an image
it was a link
i dont know if i can post the link here
headers from this link :
{'Content-Type': 'image/jpeg', 'X-Haystack-NeedleChecksum': '37123595', 'timing-allow-origin': '*', 'Access-Control-Allow-Origin': '*', 'Cache-Control': 'max-age=1209600, no-transform', 'Date': 'Mon, 04 Feb 2019 11:54:30 GMT', 'Access-Control-Expose-Headers': 'X-FB-CEC-Video-Limit', 'Connection': 'keep-alive', 'Content-Length': '75045'}
the link starts with https://scontent.xx.fbcdn.net...
midnight delta
so ? what is that mean?
thorn obsidian
@midnight delta you sure you didn't post an image on Facebook and someone's just linking it
That just seems like a valid Facebook image, the warnings are normal it's just Facebook telling you not to paste random lines into your console
Discord does it too
midnight delta
@thorn obsidian i am sure ! i didn't post anything .. isn't it virus or something ? i dont trust this link at all. My question is if an image can have malicious code because images cannot run code..
@errant pilot @quiet viper sorry for the mention! can i post the link here? maybe someone want to explore for more information
quiet viper
Do not link it
If you suspect it's malicious, do not post it here
And yes, it's possible for any file to hide malicious code
midnight delta
to hide yes, to run ?
willow coral
you don't have to manually execute it
a file could be crafted to exploit a parser or any utility that processes it allowing for code execution
thorn obsidian
Feel free to link me it in dms.
If you ever sent a picture to anyone even in a group chat on fb messanger etc it's likely likely why it's on fbcdn.
velvet isle
@midnight delta at first, it looks like an rce
Beware of those links/files people share with you
Hope you have a modern antivirus installed :)
worthy locust
hello guys, i want to get into ethical hacking/pentesting with python. the book i would use uses 2.6/2.7, is that alright or should i look for a newer one with 3.x?
dusky horizon
it should be alright if youre using 2.x or 3.x
3 has some newer features though but is largely similar to 2
or so ive heard
worthy locust
alright, thank you
dusky horizon
np
worthy locust
i remember 2.7 has a difference in the print function
dusky horizon
not sure if this is what you mean but you can use format strings in v3
which are a huge qoli
dusky horizon
yep
thorn obsidian
@worthy locust the print function difference is very minimal
Most incompatibility problems ive seen was just 2.7 programs needing print("...") instead of print "..."
cough I liked the old print more
magic sentinel
would f"hello {user}" would be equivalent to "hello {}".format(user) ?
thorn obsidian
Yeah
magic sentinel
oml. Is f"" the standard way of doing it or is "".format() preferred? or is it just personal preference?
thorn obsidian
I think it's personal preference but f strings are faster
gentle heron
f strings are intended to be the new proper way
if they take off i assume the other ways will be considered deprecated/obsolete eventually
of course they are only in somewhat recent versions of python so youll have to keep that in mind
safe bear
You can use print("text") in Python 2, but you cannot use print "text" in Python 3 (However, it does not behave in the same way unless you use from future import print_function)
The print different and the few other syntactic changes (like .items() instead of .iteritems() for dict) can be easily fixed using 2to3.py (included with Python) or by using six to be compatible with both.