« first day (2688 days earlier)   

1:06 PM
Is the chat bugging out or are there two Mius?
@HamZa?
Oh wow it is bugging out.
OK so, apparently on some of the chat user icons, my profile picture is showing for about half of @HamZa's.
And when I right click and "copy image" for his icon and load it in a new tab, it shows his correct image, but here where it's embedded it's showing a copy of mine...
 
@forest half picture of Hamza? do you see a ham?
 
Hold on
Like what the fuck is up with that.
But when you go to the URL being highlighted, it's not Miu, it's that weird electric man thing.
 
Invasion of the Mius
 
:O
Run away!
 
@Kepotx hahaha bien joué
 
1:13 PM
I'll flood them with electricity!
 
@forest i did not try to hack SE
 
lol
My browser is going insane.
First time I get on a fucking Windows machine in like, 2 years and this happens?
 
@HamZa Encore une de ces expressions françaises reprises telles quelles en anglais j'imagine ? :P
Not sure if the problem is Windows
 
@BenoitEsnard #busted
 
Are you sure your browsers are updated?
 
1:15 PM
Yep
Firefox ESR
 
hard refresh?
 
Yeah I did that after I took the screenshot (it fixed it)
So clearly it's not a remote issue but rather my browser bugging the fuck out.
If I was on Linux I could have run gcore and found out why :/
I mean what could it even be? The reference to one image in the DOM being corrupted and pointing to another image?
 
While I was working for one of the most visited website website in France, we had sometimes people with random bugs like that one
My recommended solution was to clear the cache
Unrelated: I'm pentesting a website and found one error with Google ReCaptcha
"This reCAPTCHA is for testing purposes only. Please report to the site admin if you are seeing this."
Is this a vuln?
Looks like a captcha bypass, I'll test further
 
Yep it is.
I mean, it's a vuln only in that it is a captcha bypass.
Guh, random bugs like this totally creep me out :/
Just yesterday, a Linux system with a high uptime for the second time decided fuck it, let's not support vDSO anymore! (breaking my seccomp policies because obviously I don't have gettimeofday() whitelisted...)
 
@forest tbh, i encountered similar quirks in SE chat as well in the past
can't remember the specifics though
I usually just brush them off
 
1:26 PM
I bet half of these creepy bugs are exploitable :/
@HamZa Oh yeah it's not concerning me, I'm just pissed that the bug occurred on a Windows system for the first time in forever, where I don't know jack about debugging.
 
Was the chat open in your browser for a long time?
 
Nope, just turned on the computer thinking "I think I'll take another jab at learning a bit about Windows", decide to open SE, log in, open chat...
And I see Miu staring at me out of HamZa's profile picture.
 
@HamZa also seen a bug in SE chat, where a user was on sci-fiSE chat and had his historySE profile pic, despite having sci-fi as the main account
and it wasn't from the browser, everyone in the room had the same problem and see his historySE profile pic
 
@Kepotx But then you'd think that the imgur link would actually be wrong
In my screenshot, if you actually type out the URL I'm hovering over, you'll see it's different. So unless imgur actually briefly served the wrong image, then it's gotta be the browser's fault, no?
 
@forest Hamza's profile pic was successfully flooded with electricity
 
1:34 PM
Seems like it.
 
Miu captured the internet
and cut off the signal
 
And released stress on the processors?
Dammit Miu!
 
damn, how badass of a name is Don Coppersmith?
(kinda unrelated)
back to topic: browsers, huh? those darn things
 
Makes me think of Don Corleone.
And yeah, fucking browsers man.
 
@forest it wasn't only imgur pic, but whole profile with diferent name
 
1:39 PM
Eh?
The profile link was @HamZa's, the only thing that wasn't his was the image being displayed (even the imgur image URL was his).
 
in The Quill and Tankard, Apr 23 at 8:05, by NSNoob
@Edlothiad Idk there's something funny going on with my username here
"NSNoob" is his historySE profile, he should have "Aegon" profile instead.
 
@Kepotx Well that's clearly a server-side issue there. In this case, the only disconnect was between what resource the browser thought the URL provided, and the URL that was actually there.
 
and when i clicked at his name, i could see "Aegon" as main SE profile
 
Yeah that's not what happened here. This is 100% client-side.
Like I'd understand if the link for his profile image was accidentally replaced with my profile image, but in this case, it was his, but the browser cache thought it was mine.
My whole world has been turned upside down, black is east, up is white.
I'm too tired for this shit. I just want to go back to bed and pretend I actually know how to debug Winblows.
 
1:55 PM
What are you calling "this shit"?
How can a Miu invasion be a "shit"?
 
Trying to figure out how to create the equivalent of a coredump on Windows.
lol
 
The dev recaptcha I've found was on the staging environment
It looks like I can't login though, since there seems to be a IP verification
And captcha keys are different
Not sure if I can do anything with that
Well, the staging environment is IP-restricted on /, but not on all other paths
That looks like a misconfiguration
 
@BenoitEsnard try to mess with x-forwarded-for headers
 
2:16 PM
Well I'm not sure which IP are allowed
So that might be long to enumerate all IP adresses
I guess they only allowed /32 IPs
And I'm not going to make 4 billion HTTP requests to guess which IP is allowed, if that bypass works :D
I think I'll report the IP protection bypass on staging environment
 
something along the lines of this: https://www.sjoerdlangkemper.nl/2017/03/01/bypass-ip-block-with-x-forwarded-for-header/

In a whitebox pentest, i once found a function "isAllowed" which does the following:
if x-forwarded-for headers NOT present:
DO IP blacklisting stuff
if x-forwarde for headers present: then parse this header
an attacker could set the x-forwarded-for header himself and bypass the restriction
@BenoitEsnard haha i see
my bad
 
I tried 127.0.0.1, that didn't work :(
 
tomorrow is king'sday here, i'm kind of in need of a nice weekend
 
I guess I could stalk the admins, guess which IP ranges might be, and target those IPs to speed-up the bruteforce
What's King's Day ?
 
@BenoitEsnard it's dutch thingy: iamsterdam.com/en/see-and-do/whats-on/…
"The royal celebrations were first held on 31 August 1885 in honour of the birth of Queen Wilhelmina, and the Queen’s Day (Koninginnedag) tradition was born. After Wilhelmina’s daughter (Juliana) succeeded to the throne in 1949, the day was changed to 30 April in accordance with the new Queen's birthday. "
 
2:22 PM
Is it something important for your country?
A lot of such days are quite unimportant in our culture (France).
And people don't celebrate them.
 
@BenoitEsnard it depends who you ask, some people find it an important tradition and some say "screw tradition, screw royalty, viva la democratie 100%"
but in the end, it's a free day and everyone is outside celebrating
imho it's a day where people drink a lot
it's also a day where you can sell your stuff outside on the streets without getting sued
a lot of activities for adults and kids as well
 
"your stuff" like illicit things?
 
@BenoitEsnard i mean more like it's a mess, everyone putting their stuff outside on the streets, kind of like a free market
 
Or only stuff you don't care anymore so you basically sell them?
Oh okay.
 
can be cool for kids earning some moneyz
 
2:27 PM
I think the drinking part is similar to Saint-Patrick's Day, which is an Irish thing
French people celebrates that, even if that's not our culture :D
 
right, i guess so
 
@BenoitEsnard King's day is the best!
I've been to the netherlands like 10 years ago on King's day and had a blast
(no weed involved)
 
yeah, a LOOOOOT of tourists :P
that said, if you do plan to come on King's day, then please make sure you're coming on the right day

Last time tourists came on the wrong day (the old queen's day)
 
I live in a city that hosts a lot of tourists as well, so don't shame me :P
 
Would you consider accessing to a staging environment a vulnerability to report?
 
2:43 PM
@BenoitEsnard from where?
 
From anywhere
 
then definitely
 
Okay, thanks!
 
I think that's the important part. If it's only accesible internally, then I wouldn't necessarily include it, but in this case: deffo
 
Only accessible internally is quite normal imo
 
2:48 PM
but it would be restricted for admins and devs or whoever needs access
but unrestricted internal access is.. noteworthy I'd say, but probably not in a security report (that's what you are doing I presume?)
 
It's for a bug bounty program actually
 
counter question: if a LAN with several clients has a firewall but it doesn't filter anything (allow any/any) is an adversary able to analyze network traffic of that LAN?
 
I'm don't know the answer sorry :(
 

« first day (2688 days earlier)