programming

[tawny sparrow]

is that a good solution?

it worked xd

[onyx merlin]

the google search here would be python if item in list

[tawny sparrow]

i searched this, "how to check every item in a list python"

i founded the if ... in ....

thanks ninja ❤️

[fading lark]

just wrote some art

    i = 0
    cos = math.cos(math.radians(angle))
    sin = math.sin(math.radians(angle))
    while (not max_dist or i < max_dist) and max_dist < max(game_map.shape):
        ny, nx = int(coords[0] + cos * (i+dist_offset)), int(coords[1] + sin * (i+dist_offset))
        if -1 in (ny, nx) or ny >= game_map.shape[0] or nx >= game_map.shape[1]:
            return 2, (int(coords[0] + cos * (i-1)), int(coords[1] + sin * (i-1)))  # Out of bounds
        elif game_map[ny, nx] == 0:
            return 3, (int(coords[0] + cos * i), int(coords[1] + sin * i))  # Wall
        i += 1
    return 4, (int(coords[0] + cos * i), int(coords[1] + sin * i))  # Free to go

it's the collision check for my rip off wii tanks game I'm coding to implement some ML into

for no reason at all

hardest part is yet to be implemented: the ricochet effect when a bullet hits a wall

[lilac holly]

That takes me back to my childhood.

[lapis slate]

hello, this is my first message in here. Does anyone in here ever had STATUS_INFO_LENGTH_MISMATCH while using NtSetInformationToken to set the token integrity? Im pretty sure i've had everything right but i always get that NTSTATUS 🥲. im using TOKEN_MANDATORY_LABEL as the data input, is that correct?

im using C# btw. and for the TokenInformationLength, i use Marshal.SizeOf to get the size of the TML

[lapis slate]

hmmm should use normal sizeof instead 😂

[rapid meadow]

Use countof

[lapis slate]

never heard of that before

now i got a new error

InvalidSid

i use ConvertStringSidToSid

it doesnt return an error

nvm fixed it

[brazen eagle]

Just use 180 - angle, or invert the angle across the normal vector to the plane

[fading lark]

yeah

But I need to calculate the angle of the wall it bounces off as it can be upside, downside, left side, right side etc. with all different angles

so I'm probably gonna need to do some atan2 magic in addition to some point detection magic

[brazen eagle]

should be able to use the velocity vector w/r to the normal

[brazen eagle]

arg how can people enjoy coding with JavaScript?

I have two react components that refuse to talk to each other because one want require and the other wants imports.

and node is derping out

[solar hull]

Based on discussions on this server earlier: because javascript is compact and does not require strict typing :p

[brazen eagle]

yeah but I just want to get this presentation working with proper code syntax highlighting

[fading lark]

I personally dislike JS

Some of the method / function names don't click etc

like function parseInt() and method .toString()

very persistent™️

[cursive orchid]

i have a text file which looks like

user: jake
x
x
x
x
x
hash: fsdsdfdf
y
y
user: john
x
x
x
x
x
hash: gfdgfggg

i want to get this into the format: user:hash with bash but not having a good day

this gets me each "section" of a users details

grep "hash" file.log -B 6

and i thought i could use awk or xargs somehow in conjunction with that but no

[tropic minnow]

awk 'length > 4' <file> should give output without those one-two word lines

[cursive orchid]

one-two word lines?

[tropic minnow]

x
x
x

these ones

[cursive orchid]

ohhh those are actually other properties which i just emitted for this example

[tropic minnow]

oh those are required?

then tr -d "\n"

should make it compact and delete new lines

[plucky helm]

Is that something like a crude parser for LDIF output? 😄

Grabbing uid and userPassword fields

You could use multiline regex to extract the capture groups as needed

[tulip sail]

If you want pure bash:

grep "\(user\|hash\)" hashes | cut -d " " -f 2 | sed 'N;s/\n/:/'

Provided that format is consistent throughout the file, that will grab it

On the off chance that there are other instances of "user" and "hash", use:

grep "\(user\|hash\): " hashes | cut -d " " -f 2 | sed 'N;s/\n/:/'

[cursive orchid]

i did it in a fucky way in python but would have probably been useful if i just said this was lsadump::dcsync output

and wanting to associate SAM Username with Hash NTLM

[tulip sail]

I think @thorn finch has a nice webapp for Mimikatz parsing?

[cursive orchid]

is it one that i can download locally? 👀

fawaz ain't nabbing my client data 😅

[thorn finch]

Its JavaScript

So it runs on the browser

Mimikatz.xyz

[cursive orchid]

oooh cool that's nice

[cold cloak]

and stores it on fawaz server 👀

[shrewd vault]

Hey, I'm reading up on a C# networking library and one of it's methods is: "Provides the underlying stream of data for network access" does this mean anything for someone? It's a library that's used for socket creation

[stiff dove]

Hi

[shrewd vault]

It's the System.Net.Sockets library and I'm talking about the GetStream Method

[stiff dove]

trying to get an entry-level IT job and the hacking games seem like thwey would propel me forward fast.

[shrewd vault]

shut yo ass up

how is that even relevant to this channel it's not even a question

[lilac holly]

@icy bobcat

[plucky helm]

What do you need to discuss about it?
Connect to a network, get its NetworkStream and read data from it; isn't that it?

[shrewd vault]

What does "underlying stream of data" even mean

How does that relate to actual networking terminology?

[icy bobcat]

Oi

[shrewd vault]

your honor he was on that bull'

[icy bobcat]

Don't be mean. First and last warning

[shrewd vault]

while you're here 👀

would you happen to know anything about what I asked?

[plucky helm]

When you make a connection, you gotta send or receive or do both
So there is NetworkStream, you wrap it with the writer or reader classes to do what you want with the underlying data within that stream

[shrewd vault]

underlying data being the data that's being sent or received?

[plucky helm]

Yeah

[onyx merlin]

Be polite.

[magic falcon]

Fluff bonked them already, James

[stiff dove]

I got a 34 inch widescreen monitor and trying to use it as a peripheral monitor on the right kinda is challenging

[thick ridge]

hello

i am doing intro to django

and

i dont understand this oart

Articles and articles

i am getting errors after errors

[cursive sun]

Hi

[bold spire]

hello

[bold spire]

maybe it's the extra ' , ' you have at line 21

[sick scarab]

In c, i have an array that holds any amount of integers, so for example, the user inputs "5 3 8 6" and then the program sorts the numbers in the correct order making it "3 5 6 8". My next step is to add the values in between each element. So the program would do 3+4+5+6+7+8 and put the total into a variable. My question is, would I need to do an inner for loop like

      for int j =0;... ``` or what would be an efficient way of getting the sum? Hopefully my explanation makes sense. I was thinking creating two variables, one for the first element and another for the second then i would increment once i get the sum for those values.

[fading lark]

for (int i = arr[0]; i < arr[-1]; i++) {
    sum += i;
}

^assuming arr[-1] returns the last element

[plucky helm]

What kind of values are being inserted in the second step?
Summing up and sorting doesn't make sense, as you could sum the values in any order

If you are filling the initial array of values with every integer in between after sorting, and then finding the sum of those values
Then you could just find it as -

=> Σ(max) - Σ(min - 1)
=> (max - min + 1) / 2 * (2 * min + (max - min))

[tight island]

I've made a telegram bot which reads the data of an image and keeps it in a variable until someone requests it. I've noticed that the bot after like 1-2 hours forgets the data of the image and the variable becomes null or empty(not sure). Is there like a time limit for how long it's gonna keep the memory?

It errors out when I run the command to request that image. Last line of the error reads:
telegram.error.BadRequest: File must be non-empty

[sick scarab]

lmao i was over thinking this completely, that makes sense ty. And i have a variable which holds the value of the last element

I was thinking like do the first and second element, then increment each position

[fading lark]

Ahhh okay

[heady hill]

I think we need more info. Can you show your code?

[sullen venture]

did you try only rel="icon" and not rel="shortcut icon"? is it in the <head> of the html? is the portrait.png a regular <img>-tag?

[sand nymph]

in C what happens to the functions that are not called in the main ? Are they executed or not?

[stoic badger]

If I wrote something like

#include <stdio.h>
int foo(){
  printf("This is the foo function!\n");
  return 0;
}

int main(){
  printf("This is the main function!\n");
  return 0;
}

Only the main function would execute. However, the foo function and everything it does still exists in the memory space of the process, it's just not being called at all (someone please correct me if I'm wrong).

So simple answer: No they don't get executed

but given certain circumstances, unchecked user input could get it to execute

[sand nymph]

big thanks !

[wispy kestrel]

Gave +1 Rep to @stoic badger

[onyx merlin]

Exception being things like libraries that have their own functions that get called when loaded, I can't remember the Windows or Linux function names though

[sand nymph]

ok !

[stoic badger]

this is true

[hollow tangle]

For linux you can mark a function with __attribute__((constructor)) and it will get executed whenever the library is loaded like

__attribute__((constructor))
void foo() {
  printf("Hello World!\n");
}

Windows has DllMain

#include <Windows.h>
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved) {
  switch (fdwReason) {
  case DLL_PROCESS_ATTACH:
    printf("Hello World!\n");
    break;
  case DLL_THREAD_ATTACH:
    break;
  case DLL_THREAD_DETACH:
    break;
  case DLL_PROCESS_DETACH:
    break;
  }
  return TRUE;
}

It's a pretty handy feature when developing libraries

[remote echo]

Mistakes which a programmer should be aware of and work on them

https://twitter.com/_swanandx/status/1493436535416696837

Swanand Mulay (@_swanandx)

"Experience is the name everyone gives to their mistakes." -Oscar Wilde

You will get better from working on the mistakes, so here is a thread about are few mistakes a beginner programmer should know about! 🧵👇...

Twitter · Feb 15, 2022, 4:06 AM

[viscid crane]

how to do this operation in x86 Assembly
rax = rdi modulo 256
I tried this but I dont know what am i doing wrong
0x400000: mov eax, edi

[plucky helm]

Why don't you use and eax, 0xff?

value % 256 => value & 0xff

[viscid crane]

actually i am new to x86 i really dont understand the meaning of modulo 256

[plucky helm]

The modulo is % (get the remainder)
314 % 10 => 4

[viscid crane]

i get what modulo does mathematically

but when is was searching for what does this operation mean in x86 it was said it is equivalent to moving last 8 bits of the number

[plucky helm]

Yeah, value % 256 gets the remainder when dividing with 256 (2⁸)
Which is equivalent to keeping the last 8 bits (256 => 2⁸)

[viscid crane]

f yes why i didnt think that way

[plucky helm]

value := 312
0000000100111000 (16 bits)

% 256 => keep last 8 bits
& with 0000000011111111 (255 or 0xff)
  0000000100111000
& 0000000011111111
= 0000000000111000

[viscid crane]

why is and used?

i get the operation you did in example

it is redundant

i think

[plucky helm]

Yeah, just updated it😅

You get that part of keepingthe last 8 bits?

[viscid crane]

yes

[plucky helm]

With value & 0xff you are keeping the 8 bits using 0xff (255) as the mask

It is 11111111

[viscid crane]

0000000000001001 & 0000000011111111 = 0000000000001001 https://www.rapidtables.com/calc/math/binary-calculator.html

i tried it here

[plucky helm]

Oops, I forgot to update the latter value🤦‍♂️

[viscid crane]

oh

[neat vale]

Hey, while debugging same binary on my Kali vm and on my Ubuntu vm, I got same address values withis the registers...

Why is that we are debugging in 2 different machines => diff. Workspace => value should be different right??

Then why am I getting the same address??

Provided, ASLR is disabled!

Any form of help would be very much appreciated....👌

[pine vault]

In Java, how to store object of no-arg constructor in ArrayList if I am using Collections.synchronizedList(new ArrayList<Integer>)?

[solar hull]

I’m not sure I understood what you’re trying to do.

Create an empty synchronized list?

[pine vault]

1st of all, keep in mind that I am a n00b in programming.
Here, I am creating one ArrayList object capable of storing objects of 2 classes.

I haven't done any dedicate course of java so just googling things up

I found that synchronizedList() is the way to do so

[solar hull]

Collections.synchronizedList wraps an existing list and makes the list synchronized. It has nothing to do with the types the backing list accepts.

The backing list is the actual container for the values. And in your line, the list is typed to contain Integer objects.

[pine vault]

backing list?

see I want one ArrayList object to store objects of 2 classes

[solar hull]

Yes. The one that actually stores the data.

Are the two classes related, and have a common super class?

[pine vault]

yes an abstract class

[solar hull]

Then you should likely create the backing list typed with that abstract class

Now the ArrayList creation refers to Integer.

[pine vault]

should I give you a bit more context, asking just in case you aren't already engaged somewhere else rn

[solar hull]

You can provide context here.

[past summit]

any DEVS here?Need a quick help

[magic falcon]

Just ask your question

[past summit]

Error.
An error occurred while processing your request.
Request ID: |a49c44ff-4708fb6047f3bfd4.

Development Mode
Swapping to the Development environment displays detailed information about the error that occurred.

The Development environment shouldn't be enabled for deployed applications. It can result in displaying sensitive information from exceptions to end users. For local debugging, enable the Development environment by setting the ASPNETCORE_ENVIRONMENT environment variable to Development and restarting the app.

i was getting this after deploying my website

[magic falcon]

deployed to production or to dev environment?>

you should never enable debugging on a public facing anything

[past summit]

i can access the other pages but can't access only one page

production

but in my local host i can access every pages well

[magic falcon]

What are the config differences between prod and dev?

[past summit]

prod means deploying to the customers and dev evn is the enviroment development by the dev

[magic falcon]

What I'm telling you is to investigate those differences.

[past summit]

i have not much idea about this

[magic falcon]

Because if it works locally, there is some config or permission that differs from production.

Can you even talk about this publicly? I would imagine your NDA may not allow it.

[past summit]

i was just building it for my project for my end term

[past summit]

well i'll say yes as it's just a simple project website for beginners like me

[magic falcon]

If this is going to be graded or assessed as part of a course, your first person to ask should be your instructor

[past summit]

ya you are right...But our teacher didn't even teach about ASP.NET well and he was teaching us on 2015 version of visual studio.so we got confused when we use 2019 or 2022rc

besides due to the lockdown,it was all in vain..

i just learnt some few from youtube mainly from freecodecamp

And then they are doing business for the project as an advantage..it was like they collects some money around 70 USD from the students who cannot do their projects and then they built it for those students..it's really bad here

[meager bone]

I'm currently trying to decrypt a string using bruteforcing a key. How can I implement whether the returned string is succesful or not? I assume only method is to check whether its human readable (ascii), but how can this be done?

[onyx merlin]

Unless you know what the file or string is, you really can't. That's part of the trouble.

Ascii readable chars fit a certain range so that's doable though

Well, readable printable

[meager bone]

i know the decrypted string only contains lowercase/ uppercase characters and digits

No special characters

[onyx merlin]

Then you can write a function to check the contents of a string and return true or false, right?

[meager bone]

Yeah indeed, think thats the best option :)

thanks!

[steady igloo]

Hello, I've got a question what's the difference between

diff $(echo $var1) $(echo $var2) 

Or doing

diff <(echo $var1) <(echo $var2)
```?

[shell parrot]

https://www.gnu.org/savannah-checkouts/gnu/bash/manual/bash.html#Command-Substitution

[honest sequoia]

Hi guys, anybody used SpaceVim as IDE? And, if is possible to supports multiples programming languages.

[remote echo]

Haven't used it but i think it should definitely support support multiple programming languages

It's vim afterall

[plucky helm]

I maybe wrong, but there is neovim which is being developed
And Lunarvim to configure it which I think is better than Spacevim
https://lunarvim.org

[keen grail]

in my python code why it is showing 'code is unreachable pylace'>?😕

[somber trail]

@silver kindle what are you needing help with?

[silver kindle]

if I had pic perms I would've showed you 😭

Enter the number of integers:5
1
Enter an integer:5
Enter an integer:12
Enter an integer:14
Enter an integer:20
Enter an integer:25
YES: input is sorted

Enter the number of integers:2
Enter an integer:10
Enter an integer:2
NO: input is not sorted

I gotta make the program like this

I just need guidance in that because I'm a little confused on how I can make the "Yes: input is sorted" at the end

or No: input is noot sorted

[clear lodge]

!docs verify

[narrow terrace]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[clear lodge]

Then you can send pics

[somber trail]

yeah imma need some pics cuz im not understanding

[past summit]

@clear lodge do u mind if we move to medium study room once?

[clear lodge]

Sry papa its 1 AM for me hehe

[silver kindle]

hol'up

one sec

[past summit]

do u mind if i can DM u?

[clear lodge]

You may but I will look at it after sleep :)

[silver kindle]

@somber trail sorry for the ping

does it show?

now?

[somber trail]

what is part a?

i dont understand what your sorting by

[silver kindle]

Part a I did it I'll show you

[somber trail]

i hate to tell you but thi sis a little above my head :c im sorry

[clear lodge]

So sorted means low to higher integers?

[somber trail]

"nondecreasing order"

so yes if its increasing? idk it confuses me

[clear lodge]

Yes you got that correct

[silver kindle]

thanks lots

[wispy kestrel]

Gave +1 Rep to @clear lodge

[clear lodge]

I dont think I really helped whaha

But do you know what to do now?

[silver kindle]

I'm asking sum peeps out with some help, I just need someone to just tell me how I can write that they're sorted and how they're not sorted 😭

[brazen eagle]

Just for the record, we don't generally help with homework assignments here :)

[silver kindle]

oH

@brazen eagle No worries man 😌

[brazen eagle]

(Mostly because that would technically be cheating)

Also you don't technically need to actually sort the input

[lilac holly]

I need a learned pentester to tell me which place to go to learn python

Complete noob here*

Are you wanting to learn python strictly for pentesting?

[magic falcon]

That's not a good reason to learn python. Python is such a small piece of pentesting.

If you want to learn python, the no starch press books are all pretty good.

[lilac holly]

Yes, and also for automation and building programs etc

Whatever i can do with python i want to do it lol

Juun gave you a good source of learning it.

[jagged nacelle]

@magic falcon I just had a programming test and found myself just starting to write code and trying to make it work. taking a step back and programming FOR the objectives made it infinitely easier. simple thing but very effective. It can be so easy to just fall into a rabbit hole of trying something until it works when it's not even what you need.

[brazen eagle]

Having some objective is usually a good idea

[lilac holly]

Hey I just got a question, which language and framework would you recommend for coding a website backend?

[paper lily]

https://www.geeksforgeeks.org/top-7-programming-languages-for-backend-web-development/

[tulip sail]

I use Python Flask by preference, personally 🤷‍♂️

[magic falcon]

100% depends on the intended use of the webservice and projected lifespan and needed controls.

If it's a thing that I need to maintain for years, I would pick a framework that has a lot of security controls met out of the box without a lot of fiddling. If it's just so i can show something off in a short lifespan, I would probably pick something that doesn't require as much time investment to get 'right'

[sick scarab]

Not sure if this goes under programming but in bash, is there a way I can use the "find" command to show the full path of the file im searching for, rather than starting from where I use in the command? Like:
find ~+ ../Folder1 -name "*.txt" 2>/dev/null gives me the full path and ../Folder1/file,txt. Hopefully this makes sense.

[lilac holly]

with the last line of lst how do I take specific input from lst and replace specific characters from display

#Step 2
import random
word_list = ["aardvark", "baboon", "camel"]
chosen_word = random.choice(word_list)

#Testing code
print(f'Pssst, the solution is {chosen_word}.')

#TODO-1: - Create an empty List called display.
#For each letter in the chosen_word, add a "_" to 'display'.
#So if the chosen_word was "apple", display should be ["_", "_", "_", "_", "_"] with 5 "_" representing each letter to guess.

guess = input('Guess a letter:').lower()

display = ['_' for i in chosen_word]

string = ''.join(display)





#TODO-2: - Loop through each position in the chosen_word;
#If the letter at that position matches 'guess' then reveal that letter in the display at that position.
#e.g. If the user guessed "p" and the chosen word was "apple", then display should be ["_", "p", "p", "_", "_"].
lst =[ i  for i in chosen_word if i == guess]

[onyx merlin]

I think you should read up about lists and indexes

[lilac holly]

alright

[brazen eagle]

Totally depends on what you need, and what you know.

[lilac holly]

I would like to make a portfolio website

[brazen eagle]

Then you probably just need a static site

[lilac holly]

But I would like that they can make an account on the website and do some stuff on it, It will be a little bit more than just showing myself and work

also a appointment system

and so on

[cold fractal]

anyone suggest me where to start programing for penetration tester

[magic falcon]

black hat python or black hat go are great books to start with.

But, if you are learning programming specifically for pentest, that's such a small part of the job you would be better served by having a much broader set of topics

[brazen eagle]

True, then a WordPress type thing is enough

[lilac holly]

but idk wordpress has too many "security breaches"

[magic falcon]

most wordpress breaches are caused by bad plugin configs.

[brazen eagle]

This, the core product isn't that bad

Muiri uses wp

[tulip sail]

Although I probably wouldn't if I was starting again now 🤷‍♂️
I set my blog up when I was just getting into security -- my dev and sysadministration knowledge was... limited

[cold cloak]

I think taking a look at the CVE (cvedetails) page for Wordpress should tell you enough.

[whole yacht]

You got a pretty good idea on how not to do it from these rooms

[inland badger]

so structs in C are like classes in python?

or are they different?

[faint sparrow]

@inland badger no not really

structs in c are meant just to store data

whereas python's classes both store data and have functions attached to them

[tulip sail]

Structs are effectively combined data types -- a way of pulling multiple pieces of data together.

[faint sparrow]

C lacks OOP

[inland badger]

ah, thanks!

[tulip sail]

Classes are a different concept all together

[inland badger]

okay!!

c++ has OOP right?

[tulip sail]

Mhm

[inland badger]

right!

[tulip sail]

A C++ class is like a python class, although they are still different to use. Same idea though.

[inland badger]

okay!

thanks!

[faint sparrow]

you can kinda do oop in C, but that just is making functions attached to a certain struct
kinda like you separated the data storing portion of a class and put the functions from it next to it but not necessarily attached to it

[inland badger]

are there any disadvantages to it?

[tulip sail]

It's hacky as hell 😆

[inland badger]

ah

kay

[faint sparrow]

^
don't think there are disadvantages per se, but depending on the project it may or may not result in messier code

[inland badger]

okay thanks!!

[tulip sail]

It's not how structs are meant to be used, but it works.
It's just messy. Basically involves stuffing pointers to functions into the struct and calling them that way.

[inland badger]

so the c++ implementation is "better", right?

[tulip sail]

C++ is designed to use OOP concepts, so, yes, infinitely so

[inland badger]

okay!

[brazen eagle]

I mean you're storing function pointers in both cases anyways, just one is more hidden

[past summit]

Is it ok not to learn c++ after knowing C# when it comes to ASP.NET web development framework?

[brazen eagle]

you can learn whatever you want in whatever order you want 🙂

[magic falcon]

You can do OOP in C - it gets pretty funky though, as your 'data' in the structs is void pointers to function names. Encapsulation is done through a trickery by having different header files for the public, protected and private interfaces.

Python also doesn't really do OOP, as the private and protected interfaces are only recognized by convention and not by the language itself.

[glass skiff]

hi, i wanted to ask if i should get familiar with and rely on it or just write my own stuff i think the second is the best but im still contradicted. Should i just do both?

familiar with metaspliot* sorry

[true pumice]

Honestly, Metasploit doesn't take that much to get familiar with it.
Completing Blue, Ice & the Metasploit room on TryHackMe are more than enough to understand the fundamentals.

I'd recommend not relying on it but knowing how to use it has a great benefit.

[glass skiff]

i see thank you yes i understood that

[wraith latch]

For a bit of a challenge and fun I decided to make a script that will nuke my reports, scripts etc. Automatically and then self destructs the script

Since it will be my last day at my current job soon

[tropic minnow]

is this powershell or something else?

[wraith latch]

This is Batch

[tropic minnow]

I assume, as in windows batch file?

[wraith latch]

Yes that's right

[tropic minnow]

nice, don't see a lot of those normally

[wraith latch]

Thank you, Windows is my daily driver and I'm more proficient at Batch than powershell to be honest. I tend to use powershell for creating Windows VPN profile import scripts

[wispy kestrel]

Gave +1 Rep to @tropic minnow

[brazen eagle]

I think we can all agree that encapsulation is a joke and is never done properly?

[dusky stratus]

I have a small question for this channel 🙂
In my course, we always put the following in each mini-script (Python)

if __name__ == "__main__":
        main()

I guess I understand what it does but would just like to understand a bit better if that makes sense? Thanks in advance

[faint sparrow]

It's to make sure that the main function doesn't run when you import the file in another file

[dusky stratus]

Thanks Szy

[wispy kestrel]

Gave +1 Rep to @faint sparrow

[ornate fulcrum]

how much you get paid at your current job?

[wraith latch]

Not enough

[ornate fulcrum]

i'm looking to pursue computer science but i'm extremely weak at math literally can't understand maths, should i or can i do it? bro

[wraith latch]

I am horrible at maths, also did not go to university. My opinion on university would be biased, I felt it was a waste of time for me as I wanted to start getting work experience right out of college

You need to ask yourself why you would consider computer science and what kind of job you'd like to have, if you require that university degree then go for it by all means

[ornate fulcrum]

Appreciate bro.

[ornate fulcrum]

I want to be an front end developer and gonna have a decent job.. could you guide me? What steps should i take and how should i start my journey

[wraith latch]

University might be a good step for you. I have a friend who is doing his masters right now who wants to be a developer. I wouldn't be the right person to guide you unfortunately, I am not a developer nor interested in becoming one. I would suggest following some people on LinkedIn, finding a good mentor would be amazing for you as they could help guide you

[lilac holly]

this is cool

[ornate fulcrum]

Appreciate your time, and it was nice to talk to you sir. Thank you 😊

[wispy kestrel]

Gave +1 Rep to @wraith latch

[wraith latch]

Hey not a problem, good luck out there

[ornate fulcrum]

🤟

[magic falcon]

It's possible, but I've only seen it since in a sane way once

[brazen eagle]

properties are the way

[magic falcon]

not fields?

[brazen eagle]

field-backed properties?

well tbh accessors and mutators are stupid if you want to go OO zealot

[magic falcon]

i could see that.

[brazen eagle]

a class should be exposing behaviours, not state

[cursive orchid]

any python modules that will create derivations of strings? e.g., report2019 would produce report2018, report2019, report2020 ...

burp's content discovery does it

[solar hull]

TBH that's a rather simple algorithmic exercise.

[cursive orchid]

for that example yeah

[compact atlas]

Is anyone participating in google hashcode this year?

[boreal sand]

Kickstart

https://cdn.discordapp.com/emojis/658067905870561282.png?v=1&size=64

[brazen eagle]

Yup

[compact atlas]

Have you tried one pizza yet

[brazen eagle]

the practice problem? not yet

[compact atlas]

I think it is true that no one cares about practice problem after all

*sigh

[brazen eagle]

have some ideas, probably not very optimal though

[compact atlas]

what's your idea?

mine is just bruteforcing for 41 seconds

[brazen eagle]

brute forcing but intelligently

But probably just avoid the most hated ingredients

[upper shoal]

This might be a dumb question but is becoming a software developer the best way to become good at programming?

[onyx merlin]

IMO that's putting the cart before the horse, you need to be a good programmer before getting a dev job.

[upper shoal]

I'm not particularly interested in dev jobs, just getting comfortable writing programs/scripts necessary for security

[onyx merlin]

So don't become a software developer if you don't want to be a software developer?

[upper shoal]

Sorry I think this must be one of those don't ask to ask situations

[magic falcon]

the interviewer process for a dev role usually has technical and practical tests to judge your programming knowledge and ability. Best way to learn the basics is to write a bunch of code, and ramp up the complexity of your projects to push the boundaries of your knowledge and ability.

[brazen eagle]

don't need to be a dev for that, maybe know some of the basic principles though

[halcyon sphinx]

I am currently in commerce stream. Is there any possibility that i could learn and join Ethical hacking or cyber security

[brazen eagle]

Aaaaaaaaah hashcode is hard this year

[boreal sand]

Hashcode is just a big event to build pressures among the mind of coders

Not worth it if u arent very skilled such that google calls u for interview

[magic falcon]

Big disagree. Having hard problems to work on helps programmers to develop the problem solving idioms we rely on to produce quality solutions.

[brazen eagle]

Yeah it was a tricky problem this year

Scoreboard froze us at 1017th

But it's usually fun challenges

[compact atlas]

My god I had no idea what to do

Is the solution getting as much level ups as possible?

I am mentally damaged after hashcode

[brazen eagle]

Haha

We manage to get about 1.8 million points

That was with a pretty dumb algorithm

[brazen eagle]

I don't think there's one good solution here, its an optimization problem, and a complex one at that

They usually open up a practice mode afterwards

[compact atlas]

We couldn’t finish it in time

And were stuck on writing a dum algorithm

Lol

[brazen eagle]

We found the dumbest solution possible, threw it on all the files and submitted those to get some points, then worked on optimizing

Got us maybe 40% of the way there in about 40 minutes

Well 80% of our final score anyways

[compact atlas]

Did you use any objects

[brazen eagle]

Sure

Had a collaborator object, a project object, a skill object

[compact atlas]

We spent an hr and half writing inputs

[brazen eagle]

Reading the inputs is a basic parsing job, took us half an hour to get all that set up

And outputs as well

[compact atlas]

We had contributor object that holds every contributor details

[brazen eagle]

Contributor had a name and a list of skills

Project had the project details and a list of roles (also the skill object)

[compact atlas]

And I ended up writing a super long if statement

[brazen eagle]

Ha

[compact atlas]

That i dont even know what I was writing

[brazen eagle]

That happens

We took a bit of time to diagram everything out

[compact atlas]

We tried using intelligent bruteforce to this

But didnt know what to bruteforce lol

Mentorship made this problem so hard

[brazen eagle]

We mostly ignored the mentorship angle

That was a 10% issue

IMO those that got 33 on the example are the ones who got level ups working properly

In my opinion, there were 3 major stages: prioritise the projects to do first, work out the level ups, then try to figure out the mentoring

We got a good chunk of points when we prioritized high scoring projects that could be done quickly

We got another couple hundred k when we deprioritized collaborators recently put on projects

Those were quick wins though, we spend the remainder failing to get a decent algorithm afterwards

Though I think I solved my level up issue

20 seconds after close

[compact atlas]

I think im still going to try figuring it out

Do you think its okay to prioritize mentoring first and level ups?

Since only one person can mentor several people at a time

[crimson juniper]

Does anyone know a thing or two about Mac OS through virtual box?

[onyx merlin]

It's against their terms of service and licensing, effectively software piracy unless it's on Apple hardware. Please don't discuss it here.

[winged magnet]

SELECT (select sum(Total_Amount) from sale where Party_name='Restaurant') - (select sum(Amount_Recevied) from cash_book where Party_Name='Restaurant') as money_left ; there is a mysql command to get a money_left of a single party name BUT WHAT will be the command if i want money_left with party_name from all party exist in the table.

[faint sparrow]

Not sure I follow what you're looking for. Example gets a sum of sales of party x, and subtracts the sum of received money from party x right?
And you are looking for sum of all money received minus sum of sales of party x or smth else?

[brazen eagle]

I just debugged the code that wasn't working last night and scored 3 289 254 points in practice mode

[compact atlas]

Thats truly impressive

Ive been trying to figure it out around 2 more hrs after close and ended up getting stuck in an infinite loop 💀

[brazen eagle]

yeah I had some of those

can probably scratch out a few more points by getting the mentoring bits implemented

[compact atlas]

My program keeps running into the situation where no contributors can work on remaining projects due to their level requirements

Did you guys have to prioritize some certain contributors to level up?

[brazen eagle]

not really, could be a good idea though to try to match exactly as close as possible then fan out

a lot of points can be gained just by tracking the contributors properly

our first guess didn't worry about levelups or anything, just put as many people on the projects as possible

[winged magnet]

I would like to show the problem through screen share so that it will be more clear plz tell me when u r free

[remote echo]

Best explanation ever

[normal saffron]

IM ACTUALLY BUILDING A PROJECT OF SOMETHING WHICH USES A COMBOBOX AND I NEED TO EXTRACT DATA FROM MYSQL AND PRESENT IT IN COMBO BOX AND I NEED TO PLAY A VIDEO WHEN A COMMAND BUTTON CLICK HAPPENS , THESE ARE THE TWO THINGS I NEED HELP WITH IS ANYONE HAS SOME SPARETIME?

[brazen eagle]

Sorry are the all caps really necessary?

[winged magnet]

are u working in netbeans n mysql project

[eager gulch]

Can anyone here help me with some python home work?

[brazen eagle]

We don't generally help with homework

[eager gulch]

What if I frame the questions to exclude references to homework?

[hushed mica]

@eager gulch .. Thaw your chickens out a day early.

thats what my friends always did

[dusky stratus]

Is asking about something related to the python in my MSc okay if it's just more of a 'why isn't this working and can I learn?'

I can also send it to the tutor but I think it might be minor.

[dusky stratus]

Nevermind, wasn't reading very well 😄

[brazen eagle]

homework questions still have a certain style to them. I.E. We'll know

[tropic minnow]

In a room with ssti, I wondered why the "location" of popen class object changed after a reset, shouldn't it be the same every time considering, python loads it's objects from a library or something?

[undone wasp]

Is bash scripting good for hacking? Just curious.

[whole yacht]

you can automate some manual tasks with it

[true pumice]

If you can understand bash really well, it would probably benefit you a lot on the terminal

Especially when you don’t have access to other languages that you’re more familiar with

[true pumice]

Couldn’t say from experience but I don’t know how many exploits are actually built from C++, I believe metasploit is mainly Ruby and Python iirc

[solar echo]

And C

[true pumice]

Although metasploit isn’t primarily a privesc tool^

[solar echo]

True

[haughty prism]

Hi,

How are you today?

I am subscribed to tryhackme.com my username is osama.faheem.

I am currently enrolled in a Bachelor of Information Technology (Honours) programme and must complete a research paper. Machine learning for cloud security is the subject of my presentation.

The issue is that I have a presentation in front of a panel of professors in less than a week.
The objective is to develop a neural network-based application to analyse Cloud-based Fraudulent Resource Consumption (FRC) attacks.

I need to replicate the FRC attack by running a script that launches an attack against a cloud-based asset with a specified budget and can output some numbers indicating the attack's intensity. As a result, the attack's effect is that resource consumption becomes a jumble of numbers. For instance, the script can perform Fraudulent Resource Consumption (FRC) and inform us how many resources were affected by the FRC attack.

Then, another script captures and infers that data indicates an actual attack, implying the detection phase. This requires the use of a neural network-based script such as Support Vector.

That is now the assistance I require.

• Is it possible can I use tryhackme virtual machines to perform the attack and show it, my professors, how FRC works?

• Is there anywhere on the internet to obtain these three scripts that combine to perform Fraudulent Resource Consumption (FRC) attacks in the Cloud, detect and block the attack, and then inform us of the number of resources consumed? We are required to utilise Support Vector machines.

I would be highly appreciative if you could assist me with this practical presentation.

Many thanks and regards,

Osama Faheem

[onyx merlin]

So you need it complete in less than a week and you have not got a plan for demoing?

[haughty prism]

No I have a week left

[onyx merlin]

And you don't have a plan?

[faint sparrow]

how long have you known you have this presentation to do

[onyx merlin]

Have you developed your neural network based application to analyse FRC attacks?

[haughty prism]

I got this information last Thursday

[lilac holly]

Hello friend
Hope you all are doing great

[brazen eagle]

Uhh that timing seems suspect to me

[magic falcon]

Very sus

[brazen eagle]

What's the actual error? One the debug tools and the network tab

[wraith latch]

Perhaps a silly question, but why do you want the download link to open another tab?

I can't see why this wouldn't work though

It must be a permissions issue

[wraith latch]

I'm pretty sure people and organizations still use it. I think you need to start checking the permissions the user has got that's running apache, it could be that this user is not able to access the file. Alternatively you may have a misconfiguration in apache preventing this from being accessed.

I hope you may find this resource usefull for troubleshooting steps https://www.cyberciti.biz/faq/apache-403-forbidden-error-and-solution/

[onyx merlin]

Apache is used all the time. It ain't old at all.

It's actively used and maintained. Alongside Nginx and IIS, you've probably got the three most populat webservers

[wispy kestrel]

Gave +1 Rep to @onyx merlin

[onyx merlin]

Exclude all the CDN ones and you've got apache, nginx, and IIS

[wraith latch]

Good luck!

[brazen eagle]

Dunno if it's been mentioned here, but there's a ton of coding books on humblebundle for cheap https://www.humblebundle.com/books/joy-coding-no-starch-press-books

[heavy rampart]

https://twitter.com/saviomartin7/status/1498612113446944768

Savio Martin ⚡️ (@saviomartin7)

Building is the best way to learn coding!

Here are 10 Websites that will help you improve your frontend skills by building real-world projects.

A Thread 🧵👇

Likes

3153

Retweets

952

Twitter · Mar 1, 2022, 10:52 AM

[lilac holly]

I am trying to make a python script that simply runs a bash command which I am trying to stop after certain number of lines is reached any ideas of how to approach that?

for example I want the bash script to output

1
2
3

to a file
then stop the bash script

[true pumice]

well, you would need a loop

But, why python? Why not just do it in Bash

[lilac holly]

I am just more familiar with python is all, the script is just a subdomain enumeration script so I want it to only print out the first 100 subdomains to prevent infinite loops, but that would require multithreading I guess?

[tropic minnow]

If you really want to use bash from python, you can look into the os Module but it'd be inefficient imo

[lilac holly]

any better ways of doing it? I don't mind doing it fully in bash

[tropic minnow]

Well, you need some module to interact with bash and run commands, and os module is the most common/documented iirc

[wraith latch]

do you get an error message?

what's the exact message?

[plucky helm]

+FollowSymLinks?👀

As pointed out here, all Options must start with + or -, ...

[dusty moon]

hey guys

just a small help

like for the past 2 days ive been getting issue using python setup.py install method

its says setuptools and easy install are deprecated

can someone explain me about the use of setuptool,wheel and egg on python

and it turned out to be i should be installing using pip install from the git folder

[wraith latch]

what does it say now?

[wraith latch]

Did you check whether the user running httpd had got permissions to that file?

Just remember that everything you do on apache, is ran as that user

[cloud edge]

Something similar like this one for ethical hacking?

[onyx merlin]

They regularly do release security focussed bundles. There aren't any on at the moment.

[brazen eagle]

Same publisher

[brazen eagle]

They were referring to the programming bundle I linked earlier

[onyx merlin]

I'm aware - it looked like they were asking for ethical hacking bundles?

[brazen eagle]

Asking if it was similar to the ethical hacking bundle I thought

But maybe upon second reading

[wraith latch]

Don't think it's wise to run that as sudo

[onyx merlin]

Are you not running it as a service as apache typically does?

That's not running as root, that's running as a service. Usually as apache or whatever

[brazen eagle]

Oh dear

Yeah that's just running the service, which as James mentioned, is not necessarily, and should not be, running as root

[brazen eagle]

Do you have a .htaccess file blocking the file or something?

401 generally means you need some form of authentication

And/or authorization

https://httpd.apache.org/docs/2.4/howto/htaccess.html

[lilac holly]

Has anyone every had an "SSL: CERTIFICATE_VERIFY_FAILED] certificate verify has failed: certificate expired.

And been able to fix it? (This isn't my problem, it's a college peer)

[onyx merlin]

Is their certificate actually expired?

[lilac holly]

No, everything is up to date.

[onyx merlin]

Did they check the certificate though? The valid from and valid to?

[lilac holly]

He'd get that in his settings of his browser?

[onyx merlin]

(overleaf is just what I have open rn, doesn't really matter. Steps are for chrome.

[lilac holly]

Got ya

[onyx merlin]

It's most likely that the valid to date has passed so whatever it is needs to generate a new cert

[lilac holly]

🙂 thanks.

[clear lodge]

Hey all, bit new to unit testing. Working with jest and I'm trying to exclude a directory with testPathIgnorePatterns. However, when I look at the coverage report I see the directory is still in the report. I'm kind of assuming that means it isn't being ignored, is that a correct assumption?

[magic falcon]

unfamiliar with that particular tool - i'll take a look at jest this evening

is that a JS thing?

[clear lodge]

haha yes it is

[magic falcon]

🤮 I'll take a look anyway, because it's you asking

[clear lodge]

you're too kind. If I figure it out before that time I will report back so you don't have to 😉 hahaha

[magic falcon]

so i had two minutes to look up that testPathIgnorePatterns thing - it's likely that either your regex isn't tuned correctly enough. can you throw up an example project to verify behavior?

[clear lodge]

I think I got it, looked into the jest configuration where I noticed that testPathIgnore and coveragePathIgnore were 2 different things. It should be all good now

thank you for the effort!

https://youtu.be/Uo3cL4nrGOk

have you seen this?

'such a messy language. I love it'

[magic falcon]

I feel like it's going to erode what is left of my soul..... the Destroy All Software JS talk is the best

https://www.destroyallsoftware.com/talks/wat

[clear lodge]

hahah, nice video

audience losing their shit in there, haha

[magic falcon]

just remember, addition operators in JS aren't commutative 🙂

so nothing JS does with an operator is math!

[sharp bolt]

https://tenor.com/view/batman-gif-10091619

I feel like watman needs to be a THM emoji

[wraith latch]

So I'm not programmer by any stretch of the imagination right, but I'm trying to comprehend two things in Python:

1. How do I correctly define a function?
2. How can I incorporate argparser within said function?

I'm trying to build a URL unshortener (I know there are some API's for this, I'm going at it manually because these services do not always give a HTTP 301 response with location header, a lot of them do it in JS apparently)

The idea is to do a HEAD request on a argparse argument (URL that the user gives the script) to see whether there's a redirect response and to search for a location header. At this point I disallow redirects and want it to be set to allowed in case there are multiple redirects.

I think it'd be neater and more efficient to have this inside of a function, but I'm not sure what else I need to add because as soon as I add: def Functionname() the whole thing breaks, so I suspect I need to add something within the ().

My code so far is this:

import requests
import argparse

parser = argparse.ArgumentParser(prog="Unshorten",description="Did you get a shortened URL that you don't trust? This tool will unshorten it for you so that you can see where it actually leads to.")
parser.add_argument("-U",
help="Enter a shortened URL to examine. (E.G: shorturl.at/lAFRY should lead back to my Github repo)",
required=True)
parser.add_argument("-V",
help="Verbose output")

args = parser.parse_args()
Short_url = args.U
verbose = args.V


try:
   r = requests.head(Short_url, allow_redirects=False)
   print (r.status_code)
   if r.status_code//100 == 3:
       print (f"Status code:{r.status_code} \nRedirected to:{r.headers['Location']}")
       allow_redirects=True

       if r.status_code//100 == 2:
           print (f"Final destination: {r.url}")

except:
   print (f"Nothing was redirected")```

I'm pretty sure my nested if statements are wrong as well

If a user gives the argument -u I just want it to display the final destination. If you add -v I want it to show every URL it gets redirected to

[winged magnet]

plz check my question here https://stackoverflow.com/questions/71340760/how-to-get-mysql-data-using-jdatechooser-upon-choosing-date-to-jtextfield-in-net

[wraith latch]

What's the runtime error you're getting, is it "unexpected token void" by any chance?

I think you have a slight syntax error, GetOs() should be getOS() I think, other than that no clue as this is not really my thing

[brazen eagle]

you need a colon after the def iirc

[wraith latch]

Try putting your code into a syntax checker such as https://jshint.com/

[brazen eagle]

def fn():

[wraith latch]

Yes you're right, apologies I wrote the pseudo code a bit too fast. Even then it's still broken, I think I need to add something inside of the ()

[brazen eagle]

if it's in a class you need the self keyword

[wraith latch]

I've not created a class within the code

do I need a class for a function?

[brazen eagle]

not that I know of

() alone should work

[wraith latch]

that's what I had thought too 😦

[winged magnet]

i have already declared it no error related to that

[brazen eagle]

though anything created in the scope of that function will be lost unless returned

[wraith latch]

functions and classes are all magic to me

[wraith latch]

I did try to mess around with returns, but I kept the nested if statements which are probably not helping either

[brazen eagle]

oof

[wraith latch]

I think I need a for loop

then some if statements

[brazen eagle]

here's a simple port scanner I wrote with classes in py: https://github.com/Hydragyrum/py-port-scanner/blob/master/port_scan_v2.py

[wraith latch]

and return the stuff I need

thank you @brazen eagle I'll take a look at that to see if that makes sense, perhaps that contains the answer I need

[wispy kestrel]

Gave +1 Rep to @brazen eagle

[brazen eagle]

I stole a few bits from Muiri

[wraith latch]

Ah so you've included more than just Self within the () inside of the function

but that's all in its own class

that's object oriented right? (trying to get my terms right)

[brazen eagle]

ish

I included the function arguments in the function, as those go 😛

[wraith latch]

What's the error you're getting?

So I think that's what I need to end up doing somewhat

because I am using argparse for my argument because I want it to be ran from the CLI

like how some other tools are run such as nmap, nikto, etc

Just trying to automate some manual reconnaissance

[brazen eagle]

seems fair, you'll need to store your args somewhere though

[wraith latch]

So parser.add_argument("-U", help="Enter a shortened URL to examine. (E.G: shorturl.at/lAFRY should lead back to my Github repo)", required=True) parser.add_argument("-V", help="Verbose output") might not be enough?

The script does "see" it if you will and it takes the argument

[brazen eagle]

that's a start

if the argument is required, then the -U isn't required, use a positional argument

[wraith latch]

When I run it, it looks like this

[brazen eagle]

that looks alright though

[wraith latch]

It so far only works for sites that actually give a redirect response and have got a location header

I need to look at some examples where they use JS to redirect

[brazen eagle]

The JS will be harder to process

[wraith latch]

yeah

I was thinking of going at it the lazy way

[brazen eagle]

regex and hand grenades?

[wraith latch]

to just set redirect to false first, then set it to true actually

but that's probably not the safest option

[brazen eagle]

You won't process the js in python

It'll just be plaintext

[wraith latch]

I'm also considering including proxychains within the script, because the main reason I started to make this is because a lot of phishing emails I get will redirect countless times to other pages

[brazen eagle]

Might want to sandbox that as well

[wraith latch]

That's another problem to sort haha

no idea how to tackle that, can't even get this stupid thing to work with my pea brain

been at it for 3 days straight and it works 50%

I really like your port scanner tool

[brazen eagle]

It's bad though :p

[wraith latch]

it works though

mine doesnt

XD

[winged magnet]

the error is this:
Exception in thread "AWT-EventQueue-0" java.lang.NullPointerException
at java.base/java.util.Calendar.setTime(Calendar.java:1800)
at java.base/java.text.SimpleDateFormat.format(SimpleDateFormat.java:974)
at java.base/java.text.SimpleDateFormat.format(SimpleDateFormat.java:967)
at java.base/java.text.DateFormat.format(DateFormat.java:374)
at NewJFrame16.GetOs(NewJFrame16.java:184)
at NewJFrame16.<init>(NewJFrame16.java:21)

as i told u the date is not selected

[brazen eagle]

might want to break out the debugger to see why

[wraith latch]

Yeah it does seem to fail on that library

it tells you on which lines it fails too

it's probably some kind of syntax error, but unsure since you didn't give the full code I think

[brazen eagle]

standard lib though, probably not a bug there, but rather you're passing a null to it

[winged magnet]

ya

but i have to put it is a event

[brazen eagle]

figure out where the null is coming from, probably a misconfig

[winged magnet]

on running time as date is not selected the error is coming

if it get implemented with an even like on selected date then the code may run

[wraith latch]

Oh man I think I really broke it now

    # def __init__(self):
    #     self.
    def parse_arg(self):
        parser = argparse.ArgumentParser(prog="Unshorten",
        description="Did you get a shortened URL that you don't trust? This tool will unshorten it for you so that you can see where it actually leads to.")
        parser.add_argument("-U",
        help="Enter a shortened URL to examine. (E.G: https://cutt.ly/dAd4ipy should lead back to my Github repo)",
        required=True)
        parser.add_argument("-V",
        help="Verbose output")

        args = parser.parse_args()
        self.args = args
        Short_url = args.U
        verbose = args.V

    def Unshorten(self, url, args):

        try:
            r = requests.head(Short_url, allow_redirects=False)
            print (r.status_code)
            if r.status_code//100 == 3:
                print (f"Status code:{r.status_code} \nRedirected to:{r.headers['Location']}")
                allow_redirects=True

                if r.status_code//100 == 2:
                    print (f"Final destination: {r.url}")

if __name__ == "__main__":
    URL_Unshortener = URL_Unshortener()
    URL_Unshortener = parse_args()
    URL_Unshortener = Unshorten()```

  File "Projects/Python/Unshorten.py", line 41
    if __name__ == "__main__":
    ^
IndentationError: unexpected unindent

[onyx merlin]

You can't have try without except

[wraith latch]

Thank you

[wispy kestrel]

Gave +1 Rep to @onyx merlin

[wraith latch]

Now I have another error to explore, but at least it tries to run now

still got lots to learn with python...

great it's working again!

Sort of anyway

I've got the class and def function working now, I am at the stage now where I need to define what to put within the () I think

    # def __init__(self):
    #     self.
    def parse_arg(self):
        parser = argparse.ArgumentParser(prog="Unshorten",
        description="Did you get a shortened URL that you don't trust? This tool will unshorten it for you so that you can see where it actually leads to.")
        parser.add_argument("-U",
        help="Enter a shortened URL to examine. (E.G: https://cutt.ly/dAd4ipy should lead back to my Github repo)",
        required=True)
        parser.add_argument("-V",
        help="Verbose output")

        args = parser.parse_args()
        self.args = args
        Short_url = args.U
        verbose = args.V

    def Unshorten(self):

        try:
            r = requests.head(Short_url, allow_redirects=False)
            print (r.status_code)
            if r.status_code//100 == 3:
                print (f"Status code:{r.status_code} \nRedirected to:{r.headers['Location']}")
                allow_redirects=True

                if r.status_code//100 == 2:
                    print (f"Final destination: {r.url}")
        except:
            print ("something went wrong")

if __name__ == "__main__":
    URL_Unshortener = URL_Unshortener()
    URL_Unshortener.parse_arg()
    URL_Unshortener.Unshorten()```

So if I run the script without any args it gives me the helpfile (expected behaviour)
I give the -U argument and it goes straight to the except (not expected behaviour)

I think in the Unshorten function I need to add something more other than self, but not sure how to approach this, this is what I feel I have been stuck on for a few days

[brazen eagle]

you missed the exception catch earlier yeah

you also need self.short_url = args.U

otherwise it stays in function scope

try to keep your naming scheme consistent though, and for python, follow the pep8 standard

I prefer lowercase args where possible, though URL should be positional

eg: unshorten.py -v url_to_unshorten

rather than unshorten.py -v -u url_to_unshorten

also, pro tip: you can use ````python` in discord to set the language for syntax (python in this case)

[wraith latch]

Sorry I figured out a slightly different way to fix it

I did this in the end within the Unshorten function ```python def Unshorten(self):
# print (self.args.U)

    try:
        r = requests.head(self.args.U, allow_redirects=False)
        print (r.status_code)
        if r.status_code//100 == 3:
            print (f"Status code:{r.status_code} \nRedirected to:{r.headers['Location']}")
            allow_redirects=True

            if r.status_code//100 == 2:
                print (f"Final destination: {r.url}")
    except:
        print ("something went wrong")```

[wraith latch]

Don't think that quite worked for me oh well

Within my r parameter I defined it in there because it felt a little neater to me, got to the same conclusion as you luckily through a lot of trial and error

[wraith latch]

Oh, how do I go about that?

[brazen eagle]

see the hosts param in my example

basically don't set a -name

wait

eg:

parser.add_argument("hosts", help="The target(s) IPs. May use CIDR notation to scan multiple hosts in parallel.")

[brazen eagle]

that works as well

but it's ```python on the same line 😉

[wraith latch]

python test

[brazen eagle]

missed again I think

[wraith latch]

pythontest

the f

I feel so dumb today

[brazen eagle]

```python
code here
```

like that

[wraith latch]

test

there we go

gotcha

[brazen eagle]

you can use a bunch of other languages as well

[wraith latch]

That's good to know

[wraith latch]

Right so thats how that works. As long as I make that the first argument, it knows that's the first one and then I can use -v for verbose output (once I decide how I want that to look)

[brazen eagle]

doesn't need to be the first in the def

but if there's more than one then it'll take them in the order defined

[wraith latch]

Still, that suggestion makes even more sense because I always want to supply a url so no need for -u

[brazen eagle]

yeah

[cobalt kelp]

Hi guys, I could use some help with numpy module

I am given an numpy.array, for example:

print(a)
array([[1, 2],
       [3, 4],
       [5, 6],
       [7, 8]])

Now I need to get an array which has average value of every row. So result here would be:

array([1.5],
      [3.5],
      [5.5],
      [7.5])

I can't find the right solution (other than looping through with for loop)

there has to be some better way

[wraith latch]

Do I smell a homework question? 👃

[cobalt kelp]

you smell correctly.

[wraith latch]

I wish I could help

but I suck

and I don't think people generally help with homework on here tbh

[cobalt kelp]

thanks anyway lol, at least you cheered me up a little

[magic falcon]

Your first point of contact for homework questions should always be your instructor.

[wraith latch]

It works!!!

[brazen eagle]

looks a bit odd that it loops 3 times to what looks like a 200 response

[wraith latch]

Yeah that's github for ya

They respond a lot

[brazen eagle]

well it's going to the same place

[wraith latch]

Not sure how to manage that

will still tinker with it though

see if I can get some output on how long it took to process the URL etc.

[crystal light]

You could check if the url is the same as before just using if and have the print function after the check.

[wraith latch]

That could work

[crystal light]

What do you use to find the link? Is it a redirect header?

[wraith latch]

Yeah, I look for the status_code//100 == 3 to catch any of the 3xx response codes, within that a try to gets the header location via a HEAD request because its faster than GET. Then I do a separate GET request in a for loop

[graceful agate]

https://twitter.com/owasp/status/1499761713671028739

owasp (@owasp)

OWASP @SecureCodeDojo is an open-source platform for delivering software security knowledge. In this episode, we'll deploy the Dojo and discuss organizing events. We'll also demo some fun challenges with @CloudSecPaul & @Owasp_DevSlop
Join us! RSVP 🔗: https://t.co/yw9STff7SO https://t.co/dAlSBbs1wR

Twitter · Mar 4, 2022, 3:00 PM

[crystal light]

Thats actually awesome, but I think you could skip the 3xx check entirely and just check the header cause some url shorteners give you a code 200 and than have like a php / js thing that redirects a few second later, guess there no solution to that though.

[wraith latch]

Yes thats true, I'm trying to think of a way around those script

[crystal light]

You could check the source for those types of scripts using some regex, not sure if it’s possible with php though

[wraith latch]

If the source isn't obfuscated yes

Hate these scammers man

With their million redirects

[crystal light]

There has to be a way to “remain” on the page for a few seconds to see if code runs.

[plucky helm]

You could check operations available under numpy like reduce, average (read the docs)

[crystal light]

It’s scummy but you get website visits haha

[wraith latch]

Yeah, theres a allow redirects

[magic falcon]

Web is stateless, 'remaining on the page' just means letting their JS sit on your browser engine for whatever the time frame you specify is

[crystal light]

Yeah and IIRC js can redirect you.

[onyx merlin]

You'd need a headless browser, or to inspect javascript

[crystal light]

Oh good to know, thanks.

[wispy kestrel]

Gave +1 Rep to @onyx merlin

[crystal light]

Is the chromium python module a headless browser?

[cobalt kelp]

It worked perfectly with np.mean() thanks anyway

[wispy kestrel]

Gave +1 Rep to @plucky helm

[wraith latch]

It looks like it yes, you can set so using something like ```python
opts = Options()
opts.set_headless()

I'll look into this further to see if I can use this the way I want

[haughty prism]

Hi,

I hope everyone is okay.

I am doing a research project for my Bachelor of IT (honours) on Machine Learning for Cloud Security.
This research paper discusses the Fraudulent Resource Consumption (FRC) Attack and uses Support Vector Machines (SVM) to detect cloud-based FRC attacks. Fraudulent Resource Consumption (FRC) attacks are created by slowly using cloud services' metered resources. The attacker's goal is to abuse the utility pricing model by stealing cloud resources. This skilful resource overuse results in a significant cost burden for the client. These assaults employ low-intensity HTTP requests per hour, like legitimate users. Due to this, FRC attacks are difficult to detect. FRC is an Economic Denial of Service (EDoS) attack that targets cloud adopters' financial resources by increasing their costs. Unlike DDoS assaults, which can temporarily block legitimate users from accessing services, EDoS attacks can significantly increase cloud users' costs. Support-vector machines (SVMs, also known as support-vector networks) are supervised learning models that examine data for classification and regression analysis.

Now I want guidance for a script that Can capture this generated FRC traffic, run SVM on it for training and then run SVM on it for testing. Training can be one script, and testing can be another script.
Secondly, is it possible to use AWS or Microsoft Azure to perform these testings

I shall be highly grateful if you could kindly guide me in this.
Thanks & regards,
Osama Faheem

[onyx merlin]

https://owasp.org/www-community/attacks/Cash_Overflow#:~:text=A Cash Overflow attack is,provider to disable the application.

[haughty prism]

Thanks @onyx merlin

[wispy kestrel]

Gave +1 Rep to @onyx merlin

[lilac holly]

hello , I am stuck at the blackjack problem of kaggle , the problem is that I am unable to understand the problem

In this problem we'll be working with a simplified version of blackjack (aka twenty-one). In this version there is one player (who you'll control) and a dealer. Play proceeds as follows:

The player is dealt two face-up cards. The dealer is dealt one face-up card.
The player may ask to be dealt another card ('hit') as many times as they wish. If the sum of their cards exceeds 21, they lose the round immediately.
The dealer then deals additional cards to himself until either:
the sum of the dealer's cards exceeds 21, in which case the player wins the round
the sum of the dealer's cards is greater than or equal to 17. If the player's total is greater than the dealer's, the player wins. Otherwise, the dealer wins (even in case of a tie).
When calculating the sum of cards, Jack, Queen, and King count for 10. Aces can count as 1 or 11 (when referring to a player's "total" above, we mean the largest total that can be made without exceeding 21. So e.g. A+8 = 19, A+8+8 = 17)

For this problem, you'll write a function representing the player's decision-making strategy in this game. ```

as far as i understand is that whenever the player count is less than 21 the player should hit

[true pumice]

It’s strange that you would be programming the player’s inputs but it’s just the same as the dealer’s when the player chooses to stand or exceeds 21

[lilac holly]

but the next move of dealer is implement through their program

[true pumice]

Not sure what you mean

It would be something like

function player_decision(cards):
if total(cards) >= 16:
return stand

else:
    return hit

If I’m understanding correctly

And then you would throw in a catch if there’s an ace card on the hand

if total(cards) >= 16 AND ace == false:
return stand

[halcyon sphinx]

Actually i have issue with my CMOS battery and it actually changes my time to random. Can anyone help me to create a automatic script to change the time?

[plucky helm]

What do you mean by random?
Issue with times on Windows and Linux (dual boot)?

You could use NTP (Network Time Protocol) to automatically update the system time, no scripts needed

[onyx merlin]

...replace the battery?
An issue with the battery won't set your time randomly, it'll set it to a zero value of sorts

[plucky helm]

That 1 Jan, 1970 or something?

[onyx merlin]

Depends on the system

Of the systems I've been messing with, some are 1st Jan 2015

[plucky helm]

That for Unix time, perhaps you used different systems. I ain't familiar with others a lot 😅

[onyx merlin]

Yeah. We're not talking operating systems though, this is lower level.

[plucky helm]

Oh ok, still out of my league 😄
Just worked onxv6 system in one of my courses

[waxen bay]

Is there someone who could help me with windows hooks in c++?

[slate cypress]

Hi there, quick question. With python and sockets...sometimes while fuzzing a buffer overflow vuln I need to add "\r\n" to the end of the payload string sometimes not. What is the indicator for that?

[tropic minnow]

"\r\n" are ascii characters basically, for the enter command (return and new line), I don't think, you usually need them in service-based interfaces(if you're using s.send in python)

If I've confused something again,

@tulip sail can explain it better

[brazen eagle]

you'll probably want to count what's been drawn and assess the probability of going over 21

[slate cypress]

Ah nice thank you

[wispy kestrel]

Gave +1 Rep to @tropic minnow

[tulip sail]

Depends on the implementation of the program you're sending it to.
\r\n are a carriage return and linefeed respectively -- combined they represent a newline in Windows. *nix systems just use \n. Old Macs used \r alone but now use \n like the rest of the sane world.

It's basically just telling the program that the line ends here, which, for some programs, is how they denote the end of the expected buffer

[lilac holly]

is there any good way to pass reference value of immutable object in python . I can't find one
or is that not allowed in py ?

[lilac holly]

hey guys yesterday i decided to make wordpress themes and i came across to an error

so it is supposed to look like this

[onyx merlin]

Open console, see if the CSS is being loaded or if it's erroring

[lilac holly]

the code on my terminal has been loaded

[onyx merlin]

Browser console. Devtools.

Learning how to use devtools is really really useful for frontend stuff

[onyx merlin]

Check what CSS files are being loaded and used

[brazen eagle]

Network tab can help

[brazen eagle]

Nothing out of the ordinary there to me

[wraith latch]

Have you tried clearing your browser cache?

[lilac holly]

No I havent, I will try

[lilac holly]

ok i did that but no results so far

also i did a debug session

it found no results

[wraith latch]

It was worth a try. Do you maybe need to go to webaddrews.mac like in the example screenshot?

[lilac holly]

no because i run bitnami

in order for me to run wordpress i need to go to 127.0.0.1

and i coded another sectin of it and i saw changes

man i didnt know that making themes is so hard

even the tutorial cant help me ( pls dont judge me )

here is the tutorial

[wraith latch]

Sorry man, I can only suggest your site has issues loading the CSS or it is loading it fine but the CSS is not doing what you expect it to do

[lilac holly]

it has to be a bug or something

[onyx merlin]

It won't be

[lilac holly]

elaborate

[onyx merlin]

There's a lot of troubleshooting you need to do first, especially if you want help

[wraith latch]

Troubleshooting such as looking for help on google. A quick search result for "why is my css not being applied" yields https://stackoverflow.com/questions/16513530/why-is-my-css-style-not-being-applied

[onyx merlin]

It's very normal to assume that because something isn't working, it must be a bug.
I'm here to tell you that 99.999% of the time, it's user error. It's something you've done wrong.
That's not a bad thing. It means you can fix it. Careful reading, intelligent troubleshooting.

[wraith latch]

Well said

[lilac holly]

alright i will do that

[tulip sail]

Wordpress does not like this

I would put money on this being a case of the CMS trying to use an absolute URI for a non-existent domain to load the CSS file

[lilac holly]

so what would fix this issue?

[tulip sail]

Checking the absolute path in settings and ensuring that it's resolvable

[lilac holly]

thank you for your answer i appreciate it

[wispy kestrel]

Gave +1 Rep to @tulip sail

[torn cairn]

Hello

[wraith latch]

@brazen eagle hope I'm not disturbing you but I've finished making the tool. I may make a 2.0 which will incorporate chromium in sandbox mode for those sites that use scripts to redirect you to another page. Take a look at the source code if you'd like to try it out for yourself https://github.com/JuanVG93/Python-Scripts/blob/82c7ff8577771bc3cdbb87f022be6392791ce674/URL Unshortener

[brazen eagle]

you should probably refactor the common bits in the two blocks in the unshorten function

[lilac holly]

hi

i am wondering what to do here

[solar hull]

What about redirect chains?

[wraith latch]

Works with those too

[wraith latch]

Hi, this is not the right channel however there are a few issues I see.

1. You need to start the machine
2. Either connect to the THM VPN so that you can use your own machine to interract with the ones on the network or you can use their attackbox
3. There's a directory of channels dedicated to room help, check if the name of the room is on the list or go to #room-help

[solar hull]

But doesn’t automatically follow them, right?

[wraith latch]

It does on a redirect, it's kind of the point of the tool.

[solar hull]

A single redirect? Not chained ones?

[brazen eagle]

Requests might follow redirects by default on a get

[solar hull]

Ah, right. Should every hop be logged?

[brazen eagle]

It won't log every hop though

[wraith latch]

It does on a get, that's what the for loop does

[wraith latch]

Yes it works with chained redirects when I was testing

[solar hull]

I missed that for loop, makes sense 🙂

[brazen eagle]

Oh dear gods I did not know requests kept a history

[wraith latch]

Neither did I

Was pleased to find out they did! Haha

[brazen eagle]

Ok sure why not

I'd've just shoved the for earlier calling head until I got the 200

Still won't grab js redirects

[wraith latch]

Sadly no, so I was thinking about making a 2.0 which will use chromium in sandbox headless mode which can grab the JS (I believe)

[brazen eagle]

Should be able to

Will it be able to give you the URLs though

[wraith latch]

I have no idea, but will find out

Fun project this and I think it could be useful for the community

[brazen eagle]

Wonder how it handles https://admin.hydrashead.net

[wraith latch]

Let's find out... Give me a few minutes

[wraith latch]

It doesn't pick up on the redirect as this is done by a script
Browsed to it myself and it made me lol

[brazen eagle]

:)

Should set up a dns entry to vouchers.tryhackme.hydrashead.net

[wraith latch]

I wonder if I had used sessions instead, it it would've picked up on it

[brazen eagle]

Doubt it, it's javascript

[young compass]

can someone help me with something regarding a java program that i'm trying to run that needs java -cp to run?

[tulip sail]

https://dontasktoask.com 🙂

[tropic minnow]

what's interesting is that, the article details almost exactly the same question the're asking!

[solar hull]

Sure

[lilac holly]

hello

[polar rock]

hey, anybody here knows any server focused towards web development? or front end in specific?

[brazen eagle]

There are tons

Might want to pick a language first though

also front end and server are a bit contradictory

[onyx merlin]

I imagine they mean discord server

[brazen eagle]

Oh maybe

I didn't think of that

[true pumice]

Picking a language is also good for finding a discord server, especially as some languages have main servers

But if you’re going into frameworks then you can use the Discord for that framework etc

Or look for just a YouTube channel that does web development, their discord usually will have help channels

[lilac holly]

hello

[untold iris]

yeah

[untold iris]

dms

[neat ocean]

Can someone please explain this to me:

`imelda = ("More Mayhem",
"Imelda May",
"2011",
((1, 'Pulling the Rug'),
(2, 'Psycho'),
(3, 'Mayhem'),
(4, 'Kentish Town Waltz')))

even = list(range(0, 10, 2))
odd = list(range(1, 10, 2))

with open("imelda.pickle", "wb") as pickle_file:
pickle.dump(imelda, pickle_file)
pickle.dump(even, pickle_file)
pickle.dump(odd, pickle_file)
pickle.dump(2998302, pickle_file)

with open("imelda.pickle", "rb") as imelda_pickled:
imelda2 = pickle.load(imelda_pickled)
even_list = pickle.load(imelda_pickled)
odd_list = pickle.load(imelda_pickled)
x = pickle.load(imelda_pickled)`

if I swap the even_list and odd_list variable names it swaps the contents as well

I don't know why because I thought it "loaded" the contents based on how it was imported? Essentially regardless of the variable name I should be getting the same results

[polar rock]

yes I meant the discord server

[polar rock]

yeaa, I am looking more towards a mentorship / tip & tricks based youtube channel as I have received a plenty of resources to look through 😅

so lemme knw if u got any

[true pumice]

Doesn't have a Discord, but if you haven't already, amazing YouTube channel for webdev https://www.youtube.com/c/TraversyMedia/videos

[polar rock]

Thanks for letting know

[onyx merlin]

Also learn CSS Flex

[solar hull]

WDYM by this? The file is read in order, so the data gets assigned to whatever variables you read it in

[fair flint]

Hi, I was wondering what this assembly code is, are these key scancodes? https://github.com/ricbit/brmsx/blob/master/DEBUGSR2.INC

[neat ocean]

Precisely, but if I swap the odd / even variable names it will swap the output when i print.

[oblique geyser]

Hello everyone, I’m thinking of joining Kenzie Academy to help me become a software engineer, any thoughts on the program? I’d appreciate any input.

Thanks

[rotund owl]

Hey guys anyone using Mac M1 for back-end dev?

[lilac holly]

hello there, I was just wondering which programming languages you are trying to learn

[thorny lintel]

Can i ask a JS question🙂

I'm a bit confused with these 2 if statements

const first = 30;
const second = 70;
const third = 120;

If(first && second && third > 100){}

So in this condition, so js will see it like this

is first > 100  ?? //false
second > 100  ??   //false
Third > 100   ??  //true

If all three are greater then only that condition will be true right sir? So

And if we'll use it like this

if ( (first && second && third) > 100){}

In this case first this code will execute (first && second && third)
So here that short circuiting concept will apply as all three are truthy values so it'll return the last one which is third
And then it'll check if its greater then 100 or not

Am i right sir??

[brazen eagle]

For the first if, no

It'll short circuit on first, because it's truthy

[thorny lintel]

Thank you sir..
I got this now

[crystal light]

I am trying to make a java object secure (Not be decompilable / access the vars within) and I can't seem to get it working without messing up the execution of the file, can anyone recommend good and free obfuscators / ways of making the code more secure myself?

[plucky helm]

Proguard?

[solar hull]

Whoever is going to run the code is going to need to be able to access the bytecode, somehow. There's only so far you can get with securing the code. Unless you mess with custom class loaders and encryption, the byte code will be available to the end user.

And even with encryption, the end user will decrypt the code. So they'll be running the unencrypted code. That being said, Proguard is pretty standard and freely available.

[crystal light]

Is it possible to make the object class read only? I feel like it isn’t but still

[solar hull]

the class file itself?

[crystal light]

yeah, so another class file can talk to it but it can't be read.

[solar hull]

The class loader reads in the file, so it needs to be readable.

[plucky helm]

Object visibility scopes?
public, private ?

[crystal light]

It's still in the file itself so it can be read

[plucky helm]

If plausible, use a server then to perform your secret-sauce procedure that you are not willing to share

😄

[crystal light]

actually, that's a good idea haha

[solar hull]

yep, SaaS would solve that problem, if your platform is secure 🙂

[crystal light]

but there is one big problem

[tropic minnow]

user can see you requesting the file?

[crystal light]

I want to make this for a CTF, and I want the user to be able to create a java class to interact with the object class

[solar hull]

Use some form of RPC?

[plucky helm]

Or IPC, with your secret-sauce stuff in a Golang binary, let them reverse engineer it😆

[crystal light]

would a capability be possible?

[crystal light]

I'll check out how to implement it, I feel like it might be a nightmare haha

[plucky helm]

Like setuid?👀

[solar hull]

nah, capabilities, not permissions

[crystal light]

not that far, setuid would make it possible for the user to run everything from a java class

[plucky helm]

Yeah, cap_setuid

SUID won't work for .class file

[solar hull]

ah, that one. I'm not sure what you'd gain from capabilities.

[crystal light]

Yeah but than the user could just run a shell

[crystal light]

Maybe give a specific capability on the java class that allows it to read the class file?

and the user would have write access to the class

[plucky helm]

Eh, not getting it.
There's an object (some byte-code stuff) that the player will be interacting with their own Java program

[crystal light]

wait, but than they could just read the contents and decompile it

[solar hull]

capabilities don't work on classes, they work on the binaries (and in this case it'd be the java vm)

[crystal light]

damn

[plucky helm]

They could do something like

// this binary can have capabilities
int main(void) {
    system("java ...");
    return 0;
}

[crystal light]

depends on the capabilities

I already spent all day making this PrivEsc, I can't give up now darn it!

I also need help with something else, I am trying to make a brute force type thing, and I am using a charset for the brute force, I want to be able to make the string generated from the charset an arbitrary length AND for it to iterate through every combination, is it possible to do this without a ton of loops?

and I have a conditions that needs to be tested for every iteration but the last.

[magic falcon]

Think about what you are asking, and then think about the combinatorial aspect of what you want to do. What's the asymptotic analysis of your algorithm?

[crystal light]

I don't understand, give me a sec to google some stuff

[plucky helm]

Could you give an example?
itertools in python could do it, I guess

[crystal light]

Okay I think I get it, I do agree that this is pretty much impossible, but I am using python and it has really weird stuff and things it can do so I thought it might be able to do it.

[crystal light]

    th = (h - ord(lst[q])) / 31
    if not th.is_integer():
        continue
    for i in range(len(lst)):
        th = (h - ord(lst[i])) / 31
        if not th.is_integer():
            continue
        for j in range(len(lst)):
            th = (h - ord(lst[i])) / 31
            if not th.is_integer():
                continue
            for o in range(len(lst)):
                res = (((((h - ord(lst[q])) / 31) - ord(lst[i])) / 31 - ord(lst[j])) / 31 - ord(lst[o]))

                if res == 0:
                    print(lst[o] + lst[j] + lst[i] + lst[q])
                    passwords.append(lst[o] + lst[j] + lst[i] + lst[q])```

Here's a snippet of the code

[magic falcon]

A lot of the python tools to reduce loops are just loops hidden from you by the API

[crystal light]

I pretty much want it to be able to take any input length and get an output.

[plucky helm]

It will be nice if you can give an actual example with some values, I will have to go through your code otherwise 😅

[crystal light]

I don't mind that, I mainly care about not having to write all the code, In my message I didn't mean I didn't want it to do the loops, I meant I want it to loop for any input length without me creating a hardcoded number of loops, ever if they exist elsewhere

[crystal light]

I don't really have a good example, but I'll see how much I can explain, lst is a list of all printable characters (taken from python string library) and h is an int value (that is a java hashCode, basically an int that is a hash which is what I'm trying to crack), the math operations are just me reversing the hash and the check in the first second and third loop are checking whether it is divisible by the number (if it isn't than the character is fully invalid for that position)

I can send you the full script with the values but I doubt it'll be helpful tbh

[magic falcon]

So explain what you're doing? Are you trying to reverse a hash to get the original input?

[crystal light]

I also have a way to find the length of the PlainText using the original "hash"

[crystal light]

It's not very much of a hash but yes, exactly.

It has false positives but its still good enough

[magic falcon]

do you know what hash algorithm was used?

[crystal light]

yeah, I implemented it in python.

for i in range(len(val)):
    h = 31 * h + ord(val[i])
print(h)```

[magic falcon]

So by definition, a hash is non-reversible

[crystal light]

Again, barely a hash

[crystal light]

yeah I'm not reversing it, just cracking it smartly

[magic falcon]

What's the utility? Are you trying to generalize this technique to apply it to a hash with a larger keyspace?

[crystal light]

It's just something I'm trying to make sure works for a CTF

and I want to optimize it as much as possible

It's a built it java function that is incredibly bad so I thought it would be cool for a CTF as a part of a challenge

[magic falcon]

Are you talking about the default .hashCode() method?

[crystal light]

Yeah

[magic falcon]

Are you trying to use this as a security thing?

[crystal light]

Not really, It’s a part of a CTF so I won’t spoilt too much, but the user needs to crack it, probably in parts.

[brazen eagle]

Hashcode is easy enough to collide

Can probably be overridden if you extend the object too...

[magic falcon]

hashcode was never intended to be a security feature though - it's about uniquely identifying objects in memory, not making a cryptographically secure hash

[crystal light]

Colliding happens constantly, I'm trying to make the cracking more reliable and more comfortable.

[brazen eagle]

Exactly

Also hashcode only takes 8 bytes into account iirc

[crystal light]

for every single 3 and 4 chars string I tried I got 9 matches for the "hash"

[crystal light]

I am wondering why it's always 9

[brazen eagle]

I have a sneaking suspicion that the software I work with uses hash code for passwords

[crystal light]

in very specific cases it isn't 9, I could only find 1.

[crystal light]

That would be terrible, like so incredibly bad.

[crystal light]

Do they atleast have decent password requirements?

[brazen eagle]

It is!

Naw it only takes the first 8 characters into account

Yay $VENDOR

[crystal light]

wait really? I need to check out the code again

[brazen eagle]

They may have fixed that in more recent versions of java

[crystal light]

    public int hashCode() {

        int h = hash;

        if (h == 0 && value.length > 0) {

            char val[] = value;


            for (int i = 0; i < value.length; i++) {

                h = 31 * h + val[i];

            }

            hash = h;

        }

        return h;

    }```

This is a snippet from jdk8 (2014)

Might be some weird java sorcery tbh

[brazen eagle]

Yeah it's weird, might've been java 6 that was borked, and they may have overridden it

[crystal light]

Point is, even with more bytes, it's terrible

I managed to get the PlainText length consistently using the "hash"

[brazen eagle]

Oh yeah

It's not meant to be secure or even good

Just good enough for casual use

[crystal light]

it's good for verifying a string for non secure uses where there also isn't any user input, any other case it's bad.

[brazen eagle]

Usually used for checking class equality quickly

[crystal light]

I managed to reduce cracking time for 4 chars with a 100 char charset to 0.017 from 0.047

I just keep finding weird little tricks haha

[brazen eagle]

If you know the length you can probably do some modulo tricks

[crystal light]

I am using a fixed length since I don't know how to get every combo of the full charset without having to writeup lots of lines and doing checks on all of them.

I think I have a way of avoiding collisions all together

oh wait that wouldn't work haha

[brazen eagle]

For that algorithm a collision is inevitable

[crystal light]

True, btw do you have any idea for #programming message ?

[brazen eagle]

That should be a O(n*m) operation

[crystal light]

Do you know how it can be written without slowing the cracking too much?

[brazen eagle]

If you're brute forcing you'll have to try every combo

[magic falcon]

n*m or n^m?

[brazen eagle]

You can try to work back from the math but it still won't be easy

[magic falcon]

Honestly, better off building a rainbow table and reusing it if you have multiple inputs

[brazen eagle]

Hang on a sec...yeah power

[magic falcon]

but as we've said, you're using hashcode for something it was never intended for

IIRC hashcode returns a 32b integer

[brazen eagle]

I think that's the point

It does

[magic falcon]

so it's only 4b keys

[brazen eagle]

So the result will be mod 2^32

You just need to generate those 4b keys

[magic falcon]

any number of inputs will cause collisions, because the keyspace is so small

[brazen eagle]

Generate a rainbow table with the 4b entries

Wonder if some entries are impossible or not

[untold iris]

Clean code holy

Nicest written core I have seen I think

[crystal light]

It’s copied straight from the java source code ;)

[solar hull]

And it's not even for unique identification, it's mainly for hashes in hash maps - to provide a value that would distribute the values within the map. Its not collision proof, but a.hashCode() == b.hashCode() does not mean a.equals(b). Equal objects should have the same hashCodes, though.

And it doesn't identify a specific object instance (unless the default implementation from Object is used).

[crystal light]

sooo many collisions, for each 4 char combo you have 9 collisions.