OK so, apparently on some of the chat user icons, my profile picture is showing for about half of @HamZa's.
And when I right click and "copy image" for his icon and load it in a new tab, it shows his correct image, but here where it's embedded it's showing a copy of mine...
I mean, it's a vuln only in that it is a captcha bypass.
Guh, random bugs like this totally creep me out :/
Just yesterday, a Linux system with a high uptime for the second time decided fuck it, let's not support vDSO anymore! (breaking my seccomp policies because obviously I don't have gettimeofday() whitelisted...)
I bet half of these creepy bugs are exploitable :/
@HamZa Oh yeah it's not concerning me, I'm just pissed that the bug occurred on a Windows system for the first time in forever, where I don't know jack about debugging.
@Kepotx But then you'd think that the imgur link would actually be wrong
In my screenshot, if you actually type out the URL I'm hovering over, you'll see it's different. So unless imgur actually briefly served the wrong image, then it's gotta be the browser's fault, no?
@Kepotx Well that's clearly a server-side issue there. In this case, the only disconnect was between what resource the browser thought the URL provided, and the URL that was actually there.
Yeah that's not what happened here. This is 100% client-side.
Like I'd understand if the link for his profile image was accidentally replaced with my profile image, but in this case, it was his, but the browser cache thought it was mine.
My whole world has been turned upside down, black is east, up is white.
I'm too tired for this shit. I just want to go back to bed and pretend I actually know how to debug Winblows.
something along the lines of this: https://www.sjoerdlangkemper.nl/2017/03/01/bypass-ip-block-with-x-forwarded-for-header/
In a whitebox pentest, i once found a function "isAllowed" which does the following: if x-forwarded-for headers NOT present: DO IP blacklisting stuff if x-forwarde for headers present: then parse this header an attacker could set the x-forwarded-for header himself and bypass the restriction
"The royal celebrations were first held on 31 August 1885 in honour of the birth of Queen Wilhelmina, and the Queen’s Day (Koninginnedag) tradition was born. After Wilhelmina’s daughter (Juliana) succeeded to the throne in 1949, the day was changed to 30 April in accordance with the new Queen's birthday. "
@BenoitEsnard it depends who you ask, some people find it an important tradition and some say "screw tradition, screw royalty, viva la democratie 100%"
but in the end, it's a free day and everyone is outside celebrating imho it's a day where people drink a lot
it's also a day where you can sell your stuff outside on the streets without getting sued a lot of activities for adults and kids as well
counter question: if a LAN with several clients has a firewall but it doesn't filter anything (allow any/any) is an adversary able to analyze network traffic of that LAN?
