Morning

o/

mornin'

nope

wait

I mean morning o7

Afternoon

Peaceful day in the DMZ

Yeah ;p

I'm clearly hogging all the drama ;p

hehe

@ThomasPornin yeah Thomas. You should really up your game a bit.

hey @AviD ya know that link you sent me it's been pinned for a week -->

I don't know mods not reading the pinwall

pfft lol didnt realize

I tend to ignore your wall unless I have time for fun

but yeah I already feel stuypid... @M'vy already told me

heh I more get the impression you've been busy

which is always good

also true

well, and holidays here

so yeah...

and I am making good use of my new grill :P

why workstation caches domain pa asswordds

its just ridiculous

cause pentesters need to work too

well what if anyone from domain adds my domain account to there workstation, then gets my pass-word, infact they can get full control of domain then

it does not cache unless you log on that machine, does it?

What do you mean by "anyone from domain" ?

any user ?

so if a user never logged into my domain, they can't login to my machine when domain is not available

ok, seems like i understood it wrong, thanks for correcting me, thought it would cache is even if user doesn't logs in

I'm pretty sure workstation only cache password of user that successfully auth on it at least once

would facebook be able to cope with DDOS ?

Yes and no

Big enough DDoS wipes any service

So you budget for specific DDoS maximum

@RoryAlsop they are already receiving billions of requests though

it seems impossible

It isn't

You can DDoS anything. You just need to be able to provide greater load than they have budgeted for

Billions is not as big as you think

that makes sense

saying that, don't know why someone would go for FB

Why wouldn't you - big public target

attackers want to have an impact - taking out a large public service is very obvious

@RoryAlsop DDoSing a target for a short period of time is one thing, keeping up the effectiveness of the DDoS is another.

plus, you'd have to have one hell of a botnet to do that

There are a lot of active defences one can employ to mitigate a DDoS, especially when you are running on the scale of FB or Google.

Yup - I agree with both those points

You can still DDoS any site/application off the internet. You'd hope that the big boys would rapidly add further mitigation...

Saying "Big enough DDoS wipes any service" is true in theory but there really is practical limits. :P

Look at the numbers. The graph of peak bandwidth in these attacks is going far too sharply up. We have dramatically increased our protection...

It isn't far off the point of taking out some ISP's. And at that point I hope ISP's buy in to proper upstream DDoS mitigation

@TerryChia: conceptually, a scattering of 5 megaton nuclear warheads is a DDoS, and the Internet was (partially) designed to resist exactly that.

Currently the main thing in Facebook's favour is the multiple redundant points of presence (and Google as well) but a big enough Botnet has an impact even in this scenario

thinking out of box, what other choices people have other then DDos

@Developer for what purpose?

i didn't thought about that

Hey I was wondering what was the difference between a normal graphical card and one built-in on the cpu? Is it only that the one built-in can use be used for some cou tasks?

Some cpu tasks*

External GPU are usually more powerful than integrated one, cause more space and better cooling possibilities?

@BobEbert might be worth doing some research on the subject

Then why would one choose an integrated gpu? Cost?

I guess

depnds the job you want your GPU to do

90/10 I guess?

90% of people only need 10% of features

toptenreviews.com/computers/articles/mobile/… On this website, they say that gpu uses the cpu's memory to run, costs less overall and heat's less

Would this description sums it up?

You may choose the integrated GPU because nowadays you have it, whether you want it or not.

I use a laptop computer which has both an integrated GPU, and an extra, more powerful GPU.

I disabled the latter.

The reason is that what I do does not involve much 3D, so the internal GPU is fine for that, and using the external GPU severely reduces autonomy (like down to less than 1 hour instead of 3 hours) and makes part of the keyboard uncomfortably hot.

@ThomasPornin the external gpu would be for a user that play games such as battlefield or someone that would mine bitcoins whereas a normal user would be just fine with the integrated one? Thanks for your answer btw

Games tend to use a lot of GPU power, indeed. Some specific compute-heavy applications can also get a substantial boost when using a GPU, but this requires the computational problem to be amenable to GPU implementation.

GPU are, as a computing platform, heavily parallel in a semi-SIMD way.

For instance, GPU are very good at computing many SHA-1 on potential passwords. However, they are very bad at computing many bcrypt on potential passwords.

Because bcrypt relies on operations that do not map well at all on what the GPU hardware can do.

For my personal usage, on my laptop, the external GPU is not useful, which is why I deactivated it.

thanks for the help/tip!

@ThomasPorninis is it an actual external GPU (connected via something like Thunderbolt 3) or "only" a dedicated GPU?

@SEJPM It is external to the CPU but still soldered in the motherboard, inside the laptop case.

If it was really external as in "out of the case", I would not disable it, I would simply unplug it and leave it at my home.

hello

hi

What is up, boys?

It's been a minute.

I guess everyone died =(

lol

who is better then penetration testers to ask for assistance regarding vhds

@Developer VHD desginers

@schroeder they suck

as VHD don't have any User Interface

its somehow related to pen testing

I'm afraid that I do not understand the issue. I don't see a pen test angle.

I am learning offline attacks on machine

but I am stuck at step 0

ok - then not a pen test issue - just a simple tech issue

do you guys not copy disks to vhds for offline attacks ?

some people do sometimes

i have a online machine, I need to get cahced domain credentials but offline

safest option i think is to get vhd n ....

Performs pen test *click* *scribble* out of ink...

Heh