Root Access

12:06 AM

that was derpy

I was wondering why I had no sound coming out of my headphones. Which was plugged into the amp, which was not plugged into the soundcard.

Journeyman Geek

1:10 AM

deskthority.net/workshop-f7/…

holy crap this is cool

HackToHell

3:54 AM

dwave.wordpress.com

Luke

4:05 AM

Am I bad for feeding the trolls? superuser.com/questions/468524/…

Luke

4:22 AM

Anyone want an invite the the Freelancers private beta? We need more questions to make it public. Ping me!

Ariane

5:23 AM

(Shameless pinging) @Luke I'm looking for someone to go through my site a bit, so I have someone to test it before I hand it in. It would be greatly appreciated if you could do that for me.

HackToHell

@Ariane need halp ?

Journeyman Geek

lol

hm, SR3 is a lot more amusing with the russian accent

HackToHell

@JourneymanGeek SR3 ?

Journeyman Geek

saints row 3

HackToHell

@JourneymanGeek I was stupid enough to not buy that during thq bundle >.<

Journeyman Geek

5:29 AM

yes you were ;p

HackToHell

I played that game after the bundle ended and it was real awesome

barcelona is amazing google.co.in/maps/…

Journeyman Geek

I'm almost tempted to buy the sequel when it comes out

HackToHell

And I should try and finish all the games I got through the thq bundle :P

Journeyman Geek

with HIBs ALWAYS pay the average, they very often throw new stuff in later

Luke

5:51 AM

@Ariane Details?

HackToHell

7:11 AM

wtf quora.com/India/…

Journeyman Geek

@HackToHell: actually that explains a lot ;p

HackToHell

I am scared to go to university now @_@

I was actually expecting advanced stuff at college not bubble sort and other childish crap -_-

Journeyman Geek

lol

@HackToHell: unless you are SERIOUSLY lucky, focus on grades and don't get your hopes up on getting interesting stuff ;p

HackToHell

@JourneymanGeek duh, did you quit engineering cause of stuff like that

Journeyman Geek

@HackToHell: yeah

HackToHell

7:16 AM

School is like that but I expected college to be different >.<

Journeyman Geek

don't want to scare you or anything ;p

no difference ;p

HackToHell

My last computer teacher was suck a dick that she didn't allow me to install VS

had to use TurboC++ :/

Journeyman Geek

oh, one thing with my school I love

"We expect you to submit stuff in word .doc, use whatever tools you want"

but you're expected to document them

HackToHell

Luckily she was mu teacher for only the last two years of my school life :D

Journeyman Geek

also, if you're good at coding, buddy with someone semi-smart but has issues

not an idiot, then you'd do all the work ;p

HackToHell

7:19 AM

@JourneymanGeek I like breaking and fixing things better than coding ;p

Journeyman Geek

lol

so do I!

HackToHell

Anyone can code, not everyone knows software internals

Journeyman Geek

lol

yup

I don't do either ;p

I have a good memory, and a good nose for working out where stuff is broken >_>

HackToHell

oh gawd CSE syllabus is boring :|

Journeyman Geek

lol

school is boring

HackToHell

7:23 AM

I am going to be learning C and Java (J2SE and J2EE) for 4 fucking years

Journeyman Geek

lol

HackToHell

J2EE is really outdated

Journeyman Geek

eh, I primarily learnt how to write reports ;p

HackToHell

only google uses it

@JourneymanGeek LOL

Journeyman Geek

and skim through acedemic documents VERY fast, and convince people you know what you're talking about

ESPECIALLY when you do, but

HackToHell

7:25 AM

You mean academic book s?

Journeyman Geek

lol

books/documents/reports

protip. Read the abstract. If its useful, control f through for key words ;p

HackToHell

I usually finish all my books before the start of the year so that I can sleep/read story books in class

Journeyman Geek

lol

we do a lot of research papers in murdoch

especially on the management side

you can't read all the books

;p

HackToHell

@JourneymanGeek i have no idea how many books will be prescribed in colleges

Journeyman Geek

usually? one per course

you will often have additional supplimentary notes/books you are expected to read

I can tell you, quite frankly, I only used the texts for about a quarter my modules

I use google scholar (I linked it with my school library account so i could access more books) a lot

HackToHell

7:33 AM

hmmm I still have 2 more months before it starts

Journeyman Geek

what's your major?

HackToHell

I THINK i will be doing Computer Science

I might switch to Information Technology, depends on stuf

Journeyman Geek

can you find a syllabus/course plan?

HackToHell

yes, I found one and that's why I am moaning about it being boring ;p

There seems to be only minor difference between colleges

Bob

8:08 AM

urgh

my desktop has just... frozen

I wasn;t even using it

Oliver Salzburg

8:41 AM

@Bob :(

Bob

@OliverSalzburg just hard restarted it

not much else to do

Oliver Salzburg

9:08 AM

I had freezes like that coming out of nowhere as well. Very annoying. Usually my USB headphones are to blame :P

Or so I imagine

Bob

hmmm

mine are plugged in. I wonder.

Oliver Salzburg

In my case it's usually related to them being disconnected though. It's hard to do any real research because the situation usually causes a freeze ;D

Bob

o.O

Oliver Salzburg

But I think the actual audio device does not get removed when I unplug them in certain cases. And as soon as an application wants to play a sound, it freezes. And soon the whole system freezes

Bob

ouch

Oliver Salzburg

9:20 AM

The worst thing to do is unplug while the computer is asleep. That freezes it 100% on wakeup after unlocking

Windows wants to play the "Welcome You!" sound and that's it :D

2

Cat likes shiny things

Journeyman Geek

lol

as long as cat doesn't pounce it ;p

Oliver Salzburg

She just stares at it for hours :P

Bob

9:41 AM

@OliverSalzburg get a laser pointer :P

Oliver Salzburg

@Bob Sure, but it's not laser time right now. It gets them really hyped

HackToHell

The first time my cat saw a fire, it inhaled it :'(, stupid thing tried to smell it :D

Journeyman Geek

lol

Oliver Salzburg

We had some burned whiskers here as well. That's the only way they learn apparently

This is mostly protest time though, they're waiting for the 12 o'clock feeding

After that they finally calm down and sleep

HackToHell

@OliverSalzburg My cat used to bite everyone of it was hungry

Oliver Salzburg

9:54 AM

:D

Bob

ooh... annoy-a-tron

Oliver Salzburg

10:33 AM

Someone called me at 10:00 this "morning" while I wasn't at my desk yet. So I called them back 20 minutes later, they were like "I'm in the middle of something. I'll call you right back." Now it's 12:30 and still no call

I wonder what was so important

Bob

lol

damn it Intel

why does IRST run verification at what seems to be the highest priority?

I'm trying to use my computer ffs

how about letting some other programs have more than a tiny sliver of disk access time

no, clippy, go die in a fire

Oliver Salzburg

lol

Interesting: blogs.msdn.com/b/oldnewthing/archive/2013/05/28/10421616.aspx

Bob

10:52 AM

O.O

store.steampowered.com/app/222710

Why is that on Steam? :S

Journeyman Geek

I guess steam wants to be a full package manager? ;p

HackToHell

lol package manager :D

Journeyman Geek

thats pretty much what it is

Bob

@OliverSalzburg Cool, you can reset hotkeys like that? :D

Journeyman Geek

and actually if you think about it, its pretty good at that

HackToHell

10:53 AM

A budget program that costs 60$ :D store.steampowered.com/app/227320/?snr=1_software_4__201_5

Oliver Salzburg

@Bob They have a couple of applications on Steam now

Journeyman Geek

steam greenlight...

geeze seems SLIGHTLY dubious ;p

Oliver Salzburg

Stuff like Greenlight is really amazing. Like, you let your customers determine what to sell them. You can't go wrong with that

It's like on the radio where they give you 3 songs to pick from, and you can call an expensive number or send a text message to chose which one they should play

As if it mattered. The call/message is probably more expensive than the MP3!

And all the people who didn't pick the winning song will be like :((((

Now they have to wait 10 minutes before they play that one :((((((((((((((

Journeyman Geek

lol

Bob

@OliverSalzburg Heh. As @allquixotic would say, Pringles! :P

Journeyman Geek

11:02 AM

@OliverSalzburg: and don't forget, steam dosen't really lose any money if a game dosen't sell

Oliver Salzburg

But it probably will sell because the future customers picked it :D

Journeyman Geek

@OliverSalzburg: or they blacklist the company from greenlight ;p

Oliver Salzburg

heh

Bob

11:21 AM

O.O

@OliverSalzburg blogs.msdn.com/b/oldnewthing/archive/2013/05/28/…

that name...

Humm?

uhh

Oh what...

if you load that link, select the URL and hit enter again

(named anchors seem to be broken on that blog)

Oliver Salzburg

Yeah, I guess you wanted to point to kinos comment?

Bob

11:23 AM

yep

Oliver Salzburg

Gah what a trolly comment

Journeyman Geek

11:45 AM

he does have a point tho ;p

cause its soooooo hard to have Qwerty as an option and let people switch

everyone did it in france, which was awesome, cause I wish azerty would DIAF

oh god. I want to kill my dad.

he's trying to learn sql. he has sqlite.exe saved on his computer. instructions say sqlite foo.db. he starts sqlite, then types foo.db. then complains it dosen't work

HackToHell

12:03 PM

@JourneymanGeek better than my mom, who restarts IE everytime she wants to go to another website

Bob

@JourneymanGeek that's... not how you learn SQL

Journeyman Geek

@HackToHell: he knows enough to get into trouble... but not enough to understand how to get out of it

@Bob: XD, I actually told him, twice he has no idea what he's doing. I thought he was doing a MOOC course, but he's wandered off into some tangent

Bob

1. get a proper query browser

2. get a proper query browser

(or whatever the generic name for those things is)

it's really helpful to see what's going on

heck, even phpMyAdmin can work for that

Journeyman Geek

lol

the CLI is better for learning the commands.

I need to get him off the craptastic windows shell tho

Bob

@JourneymanGeek eh, visualising the results really helps

and the CLI makes no difference from a GUI when all you're doing is entering a text command

any textbox would work for that

and the command would be exactly the same

user88311

12:47 PM

I'm beginning to think my computer just just hates power supplies, anybody know of a problem that could cause a computer to chew out PSU's one after another, @Hennes @Bob @JourneymanGeek

Put my computer into sleep mode at 2AM. got up at 8:30 AM, found it doing same thing that happened last time the PSU was about to pop, power on, here everything start up, then the fan just keeps going at mid RPM and the power light just keeps flashing

I'll take the silence as a no

Hennes

Or as absence. I am not 24/7 behind my desktop

Broken power (socket side, with spikes), maybe some weird combination of a broken motherboard, bad luck... all three are possible (and neither quite likely)

user88311

1:17 PM

Bad luck, yeah I'll definitely go with that as part of the problrm

I had the thing running a whole 3 months and by looks of it, need a new psu

I'll go check to see if there is any issues with the socket then take a look at the PSU itself, right after I take a shower

allquixotic

@user88311 I have heard of computers nomming on power supplies like they're donuts, and usually it requires replacing all components to fix it

Journeyman Geek

@user88311: I'd probably blame the power input

it would be useful to work out what failed tho

allquixotic

1:47 PM

msdn.microsoft.com/en-us/library/office/… these docs are wrong

> The SourceData argument is required if SourceType isn't xlExternal. It can be a Range object (when SourceType is either xlConsolidation or xlDatabase) or an Excel Workbook Connection object (when SourceType is xlExternal).

It can be a String referencing a range

Journeyman Geek

@user88311: I'd ask an obvious question - are you using a cheap PSU, and are there any other devices that are failing?

Hennes

@OliverSalzburg /me peers at his cat. One set of burned whiskers, 3 weeks old.

Oliver Salzburg

:D

Hennes

3 weeks ago I needed candles as IR source for my Wii. @kitten_lindy tried to sniff the fire

Lindy

@kitten_Lindy

My name is Lindy Hop. I was born 29-4-2011. On 2-8-2011 I found a new home, thanks to the local animal shelter.

224 tweets, 10 followers, following 0 users

As you can see she is skilled in using computers. Especially in walking over keyboards.

Oliver Salzburg

@Hennes Your cat has its own Twitter?

Hennes

2:01 PM

Yup.

As do some people's horns and bicycles.

allquixotic

my computer has a twi - oh wait, that's a virus :D

Hennes

Example:

Charles C Serpent

@Charlie_Serpent

Military serpent in C. Official serpent of the London Gallery Quire, oft found slithering about with @artsyhonker in other settings. Non-venomous!

185 tweets, 70 followers, following 72 users

This musical instrument has 72 followers.

Journeyman Geek

lol

HackToHell

new twitter one boxing :D

allquixotic

there's probably a desk with more followers than me

Hennes

2:04 PM

Sometimes transported by bike:

Millicent Bobbin

@_Millicent_0, London

57 tweets, 22 followers, following 7 users

For the record, my own bike does not have a name.

It is just 'the bike' or 'the new bike'

Journeyman Geek

lol

@Hennes: If i was a hardcore biker I'd name it

kinda like how my computers have a name

Hennes

Ah. my old white laptop was "lily". The dark blue one "Iris"

Journeyman Geek

lol

Hennes

The Pentium (modern, no longer a 486!) with a 1100 guilder CDROM plextor SCSI burner was 'dragon'

Journeyman Geek

Athena, Artemis, Nyx are mine, shared computer is black beauty. Home servers were kitten and tamandua

allquixotic

2:12 PM

my computers have a fairly random name: vk#rms. I picked it at random by hitting keys one day and eventually learned why I wanted to keep it; "rms" is Richard Stallman's initials :D

started out with 4 and I use even numbers, so 4 6 8 10, etc... I'm up to 22

I give virtual machines an odd number

Hennes

What if you run a dozen VMs on a single server?

allquixotic

I haven't hit that scenario yet, but I'd probably keep incrementing the odd number counter

never had a need to have more than one VM per box

and my surface has 0

Ariane

@HackToHell @Luke Never saw the ping before going to bed. oo'

Well, it's a bit late now because the teacher is going to correct it today, but I wanted people to go around http://tsukimi.alwaysdata.net/projet_final and test around to see how well things worked. And ideally not mess things up too much because the teacher needs a proper page layout to correct and the crappy, patchy CSS is fragile.

allquixotic

2:31 PM

@Ariane learning CSS/HTML?

Ariane

@allquixotic Yes but certainly not in THIS project. I'd have minus one thousand over how messy and just globally awful the CSS and HTML are (using the teacher's template thinking it would be simpler - both wrong and time-consuming). This is a PHP project to make a homemade mini-CMS.

allquixotic

ah

i don't want to break it, besides i'd be very tempted to test its security and i'm doubtful your teacher is going to grade you on security best practices

Journeyman Geek

@allquixotic: I started the greek goddess series cause I keep running into athena/minerva references everywhere

Ariane

@allquixotic Nope, however someone did the exact same yesterday and got himself unable to login because he put a SQL injection in his login. He pestered me a lot so I actually did improve the security from the nothingness it was. So if you feel like testing security, even though it doesn't count, I don't mind. I'm actually curious of how much a novice at security like myself could improve security in a relatively short time.

Journeyman Geek

artemis was athena, when I got my new laptop, I wanted to move the name to it, there was an article with two tunnel boring machines, one called athena, one called athena ;p

nyx is called nyx cause I was originally planning on sneaking in parts ;p

Hennes

2:38 PM

If I ever have a decicated host as a wiki front-end it will be called Athena

Goddess of wisdom.

Ariane

@allquixotic If you're the challenge type, then I challenge you to obtain my MySQL database login information. It's possible, but contrary to yesterday, it shouldn't be easy. :p

Hennes

What was it yesterday? No password?

Journeyman Geek

@Hennes: patron goddess of the geeks ;p

Ariane

If I tell you that it's a big hint. Do you want the hint?

Hennes

Is the hint named 'Bobby' ?

I would not mind the frontend website.

And then I try something devious.

Ariane

2:39 PM

Eeeh? I.... don't know?

Hennes

Ariane: do you know redirects?

select foo from table where id is 1 or 1>2; --

Ariane

@Hennes JS redirects? Yeah, my website literally spams them.

Hennes

It took me half an hour before I realised it was not a standard out to standard error

HackToHell

@Ariane sorry, just saw this,I am going out !

Hennes

Instead 2>1 equals true

Journeyman Geek

2:40 PM

@HackToHell: mellon? ;p

Ariane

@HackToHell Have fun!

Journeyman Geek

gandalf, oops

HackToHell

@JourneymanGeek close, gandalf :P

@Ariane :)

@JourneymanGeek reverse search ?

Ariane

@Hennes Something you tried on my website? I'm sorta confused.

Hennes

Nope. But I recently read up on security flaws. Including sql injections

Journeyman Geek

2:41 PM

@HackToHell: hovered over the image ;p

allquixotic

@Hennes you use bourne based shells too much :D

Hennes

Apparently there are debug/warning tolls which warn for true and for 1=1 in SQL statements. But not yet for silly things like A>B. And 2>1 matches that.

(Source: 24 deadly sins)

allquixotic

wouldn't shell redirection have to be 2>&1 though? I always thought you needed the &

Hennes

amazon.co.uk/Deadly-Sins-Software-Security-Programming/dp/…

When the mind sees something it expects it will correct for minor errors.

allquixotic

@Ariane actually i think i could do some cool stuff if i had a valid login...

like, stuff past the login page

Hennes

2:46 PM

@allquixotic Is your name 'little bobby' ?

Ariane

@allquixotic Lol, the guy yesterday didn't see it either. It's the text fields' placeholders.

allquixotic

Fatal error: Call to a member function free() on a non-object in /home/tsukimi/www/projet_final/scripts/auth_check.php on line 16

Hennes

Her daughter is named Help I'm trapped in a driver's license factory.

Ariane

@allquixotic Did you try an SQL injection in your login?

Stack Exchange

0

Q: Comments to a question that should be answers

Problem: A trend of questions being answered purely in the comment field of the question. There is no formal migration of this into the answer format to the question. As a result, questions that appear to be unanswered actually do contain answers. The current voting system does not support any me...

allquixotic

2:49 PM

@Ariane No

I entered the field labels

Ariane

@allqui Weird... Can you restart your browser(s) and tell me if it still happens?

allquixotic

@Ariane no need to restart my browser, i can delete the PHPSESSID cookie

i can get to any page within the front-end, but when i click administration i get the same error every time without an authentication prompt, as long as i keep my session ID cookie

Hennes

http://tsukimi.alwaysdata.net/projet_final/
Projet is French for Project ?

allquixotic

GET tsukimi.alwaysdata.net/projet_final/… with PHPSESSID=k1ss69nmalrbumijmrm169803t7l09f6

Hennes

Oh cool. before I am logged in I get a coockie with a session ID

(checking with webscarab as proxy)

That is wrong

allquixotic

2:52 PM

you can try it yourself; use something like this to set the cookie

Ariane

gotta go out. Keep testing. Sorry.

Hennes

It is as if I walk into a hotel and management says "The pincode for the next room is 12345678". Do you want a room

allquixotic

@Hennes not necessarily; it's ok to get a cookie before you're authenticated, it can just keep track of session state, and say something on the backend like authenticated=false

Hennes

Maybe

But session IDs should be generated after a succesful login

And wipe from the DB after a logout

And protected by a proper timeout

In non-plaiin text.

allquixotic

@Hennes a secure app will give you a new session ID after you've successfully logged in; OR, the entire connection, from the time you get the cookie until after you're authenticated, takes place over HTTPS

Hennes

2:54 PM

Ok.

user88311

And I'm back, time to do dissemble my computer again

Hennes

But then you also want to remember to set a secure cookie.

So it does not get sent if you connect over HTTP.

Even if you redirect all http pages to https

Granted. I am not a security guy. I am just someone who did IT system management and who is trying to learn how to use webscarab to break webgoat

allquixotic

or you can disable your HTTP port entirely ;p

Hennes

Reference: code.google.com/p/webgoat and OWAS

Often not done for performance reasons.

/me downloads projet_final.zip

tsukimi.alwaysdata.net/projet_final/admin

admin / superadmin

allquixotic

think this can be CSRF'ed?

Hennes

3:06 PM

$query="
			select *
			from $table_admin
			where username='$user'
			and password='$pass'
		";

I wonder if I and use a username of true

allquixotic

sure, but that wouldn't help you any

Hennes

I am totally new to this

user88311

I've disconnected anything that would use power, hard drive, ethernet, dvd drive, all USB devices, still getting same result, fans turn on, and power light just keeps flashing, about 3X faster than it normally does in hybrid sleep mode, which is what it was in before I tried to power on, time to check the connectors

@Hennes Any ideas on specifics of what just to look for

Hennes

Sadly: no.

@ariane: Leaving the directory listable with a backup file in it might not be the best move. Especially if that backup contains passwords.

-- phpMyAdmin SQL Dump
-- version 3.4.8
-- phpmyadmin.net
--
-- Host: mysql2
-- Generation Time: May 29, 2013 at 10:19 AM
-- Server version: 5.1.49
-- PHP Version: 5.3.6-11

SET SQL_MODE="NO_AUTO_VALUE_ON_ZERO";
SET time_zone = "+00:00";

--
-- Database: `projet_final`
--
CREATE DATABASE `projet_final` DEFAULT CHARACTER SET utf8 COLLATE utf8_general_ci;
USE `projet_final`;

-- --------------------------------------------------------

--
-- Table structure for table `admin`
--

CREATE TABLE IF NOT EXISTS `admin` (

allquixotic

@Hennes nice find

Hennes

3:20 PM

I really should have stopped on line short of the actual password

Ok, now replaced with DELETED

Possible note:
`<input type="hidden" name="posted" value="1" />`
Hidden fields are not hidden. They are just not shown.

allquixotic

@Hennes can you do anything useful by reading or setting the value?

Hennes

In this case: not that I can see.

allquixotic

then it's probably fine

Hennes

This is a bit blantant though: <input name="adminPassword" type="password" placeholder="superadmin" required="required" />

I expect that to be a joke

user88311

That always lovely moment when you need to find vicegrips just to unplug the 20pin from the motherboard

Hennes

3:34 PM

20 pin? What is 20 pins?

34 was floppy. 40 was IDE. 80 was IDE. 50 was SCSI, 68 was SCSI (and 80 on SCA). 44 laptop IDE... but 20 ?

allquixotic

@Hennes the main motherboard connector is sorta like a molex but with 20 pins instead

....for 12V power

Hennes

Heh, I missed 25 for serial. 25 for paralel... and 25 for apple SCSI

allquixotic

it's either 20 or 20+4 ("24")

Hennes

Ah, the old 24 pins one.

user88311

20(+4)

Hennes

3:37 PM

I forgot about those

allquixotic

it'd be easier if we could use the USB connector for everything ;) mobo power, pci-e, sata, etc

Hennes

Meh

I kind of hate USB

Toooooo much overhead.

user88311

agreed

Hennes

I want eSATA and thunderbolt and displayport

But most of the world will not agree to that

USB might be slow, clumsy, half assed, but it is userfriendly.

Anyone here who like true humour

I mentioned this link before, but it is still great

popehat.com/tag/prenda-law

user88311

I see what looks to be either dust, the result of the connector being pushed in to far somehow, or very light scorch marks on the inside of one of the 24 pins, to be exact I think it's pin 18

The reason I say light scorch, is because it's not black, it's gray and more of a circle where the connector of the PSU would have come in contact with the plastic

If all else fails, I might try a cmos clear before I try a different psu, since I read if this happening sometimes with sleep mode, oh lovely windows

Ariane

3:57 PM

I'm back.
@Hennes I know about the hidden field. Its goal is just to pass a variable that isn't relevant to show the user.
The password being shown in the placeholder is just to give the teacher the password easily without him having to open the database.
As for the zip, congratulations on deleting it. I thought since the root folder had an index you couldn't list it, and since I put a link validation on the download.php page, I thought it was somewhat secure. How did you get it?

Hennes

I could list the root folder

Ariane

@Hennes Can you link it?

Hennes

Ah, we might be discussing different roots.

Try tsukimi.alwaysdata.nett

Without the /projet

Ariane

tsukimi.alwaysdata.net ? That gives me the "Test" index.html

Hennes

I get this: