The DMZ

D3C4FF

00:46

@TildalWave @RoryAlsop Speaking of subs....

Xander

@Adnan I've read a couple of hands-on reviews of that system recently...They've been very positive. It seems to be really impressive.

D3C4FF

There was that time, me and my mates found a sub moored off the cost, so we brought our inflatable dhingies out, paddled a few KM out to them and boarded em like the pirates we are... Single pin tumbler lock guards submarine. Lulz ensue.

Xander

@RoryAlsop Long range shooting is all maths...It's just a matter of how much you want to automate it. :-)

TildalWave

@D3C4FF what the... ? what type? and what happened next?

D3C4FF

@TildalWave I took sexy time photos of EVERYTHING

TildalWave

00:54

@D3C4FF do show! pr0n time :))

D3C4FF

@TildalWave Okay, gimme a mo' to find the passwords to that drive :P

TildalWave

@Xander 200 more, c'mon answer a few questions that don't seem off-topic, you'll be in the 3k territory in no time

Xander

@TildalWave LOL, soon, soon. I'm on-site with a customer this week, so a bit busier than usual, and out of my routine to boot.

TildalWave

@Xander Ah yes you mentioned something... Ohio yes?

Xander

@TildalWave Yup, Dayton, Ohio this week. Well, through tomorrow, anyway.

D3C4FF

01:01

@TildalWave @RoryAlsop

Sexytimes confirmed

TildalWave

01:16

@D3C4FF you are kidding me, sub was powered and tubes loaded? wtf? what class is that? looks like some Dolphin class to me (diesel engines, hunter/killer with 6 front tubes, about 16 crew)?

D3C4FF

01:28

@TildalWave No no.. I'm not quite up to infiltrating live fleets.

This had been sitting around a LONG time :P

Scott Pack

@JeffFerland That's strange sad to hear and somewhat encouraging somehow.

D3C4FF

And i certainly hope those tubes were not loaded :P

TildalWave

@D3C4FF Is this in any way related to that "front fell off" incident? :))

D3C4FF

@TildalWave Haha. Nope xD

TildalWave

@D3C4FF then why are they powered? or is that just a reflection from camera flash?

Scott Pack

01:30

@JeffFerland I'm most disappointed by who I lost to.

@Xander Where are you flying out of?

Xander

@ScottPack Dayton International. USAir has direct flights from DAY to CLT.

D3C4FF

@TildalWave Reflections from the flash, they have high-vis strips everywhere so if it floods then using the torches you can still find your way to oxygen points

Scott Pack

@Xander Ah, ok. Apparently I'm going to be in Columbus tomorrow. The wife's got an appointment at 10, then starting at noon we'll be looking at houses.

TildalWave

@D3C4FF well I get that but I can make out the tube numbers... I guess that was just reflection off the LEDs and they were simply marked with static displays

So which class was it? It could be Collins class, but those 6 tubes are slightly annoying me, and it also doesn't look as big, maybe some older version of it

D3C4FF

@TildalWave Lol. Pre LED days baby!

@TildalWave Its a pretty big space. The small shot doesn't do it justice, but a person standing upright reaches about midway up the middle tubes.

TildalWave

01:44

@D3C4FF yeah I get that, those tubes are pretty much same or really similar size in all of them and yes, you could fit a body in them with a bit of insistence LOL

Have you watched On The Beach? Not in any way related, besides there was a sub also, but just curious.

D3C4FF

@TildalWave Yeah, fuckin' love that movie. We watched it the day before we boarded

Its a classic :P

TildalWave

@D3C4FF well the classic is this one: imdb.com/title/tt0053137 but yeah it's a pretty believable scenario, not much dumbing down in there

D3C4FF

@TildalWave I'd like to check out a sub that's got VLS batteries

To get on board an Ohio class.

now THAT would be bad-ass

@TildalWave Oh shi-! I didn't realise it was a remake!

TildalWave

@D3C4FF well those are huge mothers you can probably play tennis in there

D3C4FF

@TildalWave Yeah, it'd be awesome :D

TildalWave

01:54

that's navy boys standing there in the "fifty" formation LOL

My fav ones are 688 (Los Angeles class) and Akula II

D3C4FF

@TildalWave Damn. They need to work on their kerning.

3

TildalWave

@D3C4FF hehe I'm sure they adjust for that in their bunks :)

Scott Pack

@TildalWave That's right. You plow through that water. Yeah.

TildalWave

@ScottPack You realize these mothers are so huge you can track them with satellites by the surface water displacement wake alone? I wouldn't want to think even what is their life expectancy in an all out war, probably minutes.

Scott Pack

@D3C4FF Funny story. I just showed that to my wife. Seeing as how she works in publishing she was rather amused that that was your first reaction.

Terry Chia

02:12

@TildalWave hehe yup. my 6th gold badge tomorrow.

D3C4FF

@ScottPack Yeah, a couple people in my family work in graphic design and what not, so it rubs off on me and i enjoy things like the kerning game:

type.method.ac/#

Scott Pack

Thanks for reminding me of that! I totally meant to send it to her.

TildalWave

@TerryChia in that case, you can afford 33 votes on answers too then, looking forward to it... just avoid voting on @Adnan's answers, he's in mortal danger as it is once the bear finds the time to wipe the floor with his ass LOL

Scott Pack

She's a sales rep for a yearbook company. That seems like something that may be fun to keep in her bag of tricks when training students.

D3C4FF

@ScottPack Yeah for sure! :)

Alright! If off to the law courts i go! :D

TildalWave

02:27

@D3C4FF I get a score of 86... no idea how good or bad that is?

D3C4FF

86 = Pretty good! I can do about 90-95% if i take the time

TildalWave

@D3C4FF challenges are always the same?

D3C4FF

@TildalWave Yeah, so you can 'learn'

I wish it was a bit more random

Anyway, i'll be back in a few hours or something

:D

Adnan

03:56

Spoof calls for everybody!!!

0

A: Is it possible to make a phone call appear to come from another phone?

The best solution is much simpler than what you're thinking about. I haven't tried many services, but I have accounts on two services and I'm 100% sure they have this feature (and I've used, it works!) Jumblo: Create an account and add some credit to it (10 Euros minimum excluding VAT), then in...

@D3C4FF Daaaamn!

Actually, call spoofing is a very important in pen. testing (at least I think it is), especially in the social engineering aspects. If you make the call appear as if it's from the boss' phone, will the IT guys reset and give you the new password?

Stack Exchange

04:13

[shouted, from the field] 'Aunt Beast hit a pop fly to second! Dive for it, Mrs Whatsit!'

TildalWave

@Adnan hmmm well that made me delete my PSTN call forwarding code comments... but how do you account for the calls to appear to be coming from the closer cell as OP describes? Can any of those pose as a VoIP to cell switch? I honestly have no idea, just asking.

Adnan

04:28

@TildalWave You see, the identity of the caller isn't exactly "detected" by the receiver (or the receiver’s provider), but rather disclosed by the caller and/or the caller's provider. I think you already know that. What these VoIP services do is just make the call for you on their own by disclosing a false identity to the receiver's provider, then connecting you to that call.

So you're not really calling that person. The spoofing service calls the person for you, then you call the spoofing company and they connect the two calls for you

TildalWave

@Adnan Well I know all that, that's pretty basic stuff but I was thinking of this:

> Or could he have some way of tampering with the phones so that he could be making calls while 50 miles from me, yet those calls show up as being made on the mobile he gave me, AND cell site analysis shows the calls went via the cell sites near my home or workplace?

Adnan

@TildalWave Well, this is just a possibility that the OP is suggesting. I don't know about that, but if I were an attacker, I wouldn't go with that much effort, I'd just use a spoofing service.

and I think that's what happened in his case.

Terry Chia

I demand this gets upvoted.

Step 1: Find a nice plump goat. Step 2: Sacrifice said goat to the anonymous gods. Step 3: ??? Step 4: Profit — Terry Chia 4 mins ago

TildalWave

@Adnan I don't think your VoIP provider can switch to any cell at will. I dig that they probably have switches with all major providers out there, probably leased and provided by carriers themselves... whatever the "deal" there is between cell and VoIP providers... but I'm not sure if cell providers install VoIP switches on most of their "masts" as OP said (BTW how do you call those? cell towers? repeaters?) and the VoIP provider can somehow select the nearest one?

Adnan

@TildalWave I don't see why the VoIP provider should care about all that. They just ask your provider to connect them to you, your provider does all the work of knowing your nearest cell tower.

@TildalWave and yeah, I think cell towers.

@TerryChia It could have been funnier, but it's alright.

Terry Chia

04:40

@Adnan Heh, the floor is all yours.

TildalWave

You can start HERE and contribute to the animal rights Stack Exchange community, then move onto HERE and contribute to the pets loving Stack Exchange community, and then we'll tell you about anonnews.org/forum, but only if you apease Gods of Stack Exchange first! — TildalWave 2 mins ago

made small corrections ;)

@TerryChia Poor goat! ☺

AviD

06:38

awww maaaaan, I just got un-serial-upvoted :-(

@RoryAlsop was it you?? damn sockpuppets...

actually did notice over the past few days somebody was upvoting all my questions...

Terry Chia

@AviD Hmm I think that might have been me. I was upvoting all the old questions for the electorate badge. Must have triggered the script.

AviD

@TerryChia hahaha, you badgewhore

TildalWave

@AviD ... just wanted to point fingers at @TerryChia ... too late, he self-confessed :))

AviD

and here I thought I had a sexy stalker... turns out it was just @TerryChia

TildalWave

@AviD how do you know he/she is not sexy? :O

oh btw... while we're being funny:

AviD

06:43

meh, he spends too much time asking stupid questions, instead of on his makeup. ;-)

TildalWave

I realize a lot of it must have been lost in translation, but where did basic reasoning disappear all of a sudden? You can't just throw a few of big words together and expect it to make any sense, no matter how much of vodka you had! When was the last time you threw a few LOGO pieces in the air, and they somehow magically assembled into a real castle? Please, for the love of God, sober up! You're not in the state to play Monopoly even, let alone ask coherent questions about securing a financial service! — TildalWave 4 mins ago

AviD

wait, are you suggesting that @TerryChia's gender is now in question...??? /cc @Iszi

@TildalWave lol, quite snarky there

*Lego, not LOGO.

LOGO was the little turtle "programming" language....

TildalWave

@AviD dunno, I've never personally established it beyond any doubt... tho whatever he/she turns up to be, I doubt he/she would like my methods

@AviD hehehe a freudian slip of a tongue there, oups

Terry Chia

@AviD Dammit guys! I thought @Adnan and @Lucas has established that I like boobies?

AviD

@TildalWave ftfy

TildalWave

06:46

@AviD I used to teach Logo back in the student years ;)

AviD

@TerryChia that doesnt necessarily restrict your gender...

Terry Chia

@FiascoLabs I don't need patetic mystery advices I just want to know bast practics from the bank security specialist, that's all. Anyway I always have a time to encrypt a database with external hsm. — Denis 7 mins ago

Hmmmmm

TildalWave

@AviD cheers!

Terry Chia

Alright, gotta step out for a bit. Stop doubting my gender dammit!

AviD

@TerryChia The lady doth protest too much, methinks. Now I'm really not sure.

@TerryChia commented and closed.

TildalWave

06:53

@AviD damnit that's what I wanted to say!

> sooper-sekyoor for teh win!

Lucas Kauffman

@TerryChia Did someone say boobies?

also wtf at the 'Hello how do I secure a complete transaction system' question

AviD

@LucasKauffman truth is at this point we could just close it as dupe. we've seen it before so many times...

hmm, we should close them ALL as dupes of each other, and make anybody who is interested spend 10 minutes chasing the chain. so A closed as dupe of B -> B closed as dupe of C -> .... -> Y closed as dupe of Z -> Z closed as dupe of A.

Lucas Kauffman

True

the guy was being cocky as well

cocky and incompetent

AviD

@TildalWave how is it that [animalrights.se] wasnt merged with [pets.se] into some animals.se?

Lucas Kauffman

@AviD animalrights.Se, I thought SE didn't do legal stuff?

AviD

07:04

I dunno, its an a51 proposal.

I dont think its the legals, I think its more about how to treat them. which shouts to me like its the other side of pets.se.

Though I cannot claim to give a damn either way.

M'vy

Heya

AviD

@LucasKauffman while I totally agree with you, I think telling the guy - who obviously thinks that he's god's gift to compilers - that he's not fit to program his turtle out of a box, is not really productive...

Lucas Kauffman

@AviD I'll edit the comment

TildalWave

@LucasKauffman we have Ask Patents which is mainly legal, no?

@AviD no idea really, they are kinda different, but I can't see many vastly different questions on animal rights than the three that are already there as example questions

AviD

07:21

@TildalWave thats a special case, its done together with the USPTO and its intent is not legal advice, but factual precedents.

@TildalWave it would be as different as parents.se and childhood.se. same topic, different viewpoint.

TildalWave

@AviD animals.se sounds pretty cool idea... not just pets, that's also relatively small set of questions we'd have to deal with in majority... but animals questions in general, that could be pretty interesting

AviD

@TildalWave right, does it really matter if you own the animal, or see it in the field?

well sure, different context, but still same family of questions.

TildalWave

@AviD Why would it? I'd say even "how does koala taste like" should be acceptable, unless it's better covered on some other SE website, like Seasoned Advice (which it isn't)

AviD

@TildalWave LOL

yeah, I think that actually might be the one sensible restriction, the animals being alive...

or at least being treated as a life-form, even if they are no longer alive, and not just raw materials that will soon be absorbed into my lifeform.

TildalWave

@AviD Ok, so no hunting, taxidermy, culinary questions,... yup, sounds reasonable... or maybe "animal welfare"?

AviD

07:29

@TildalWave oo perfect. you should comment that there on both of them.

24 mins ago, by AviD

Though I cannot claim to give a damn either way.

maybe "animal care"

TildalWave

@AviD I will, but laters... I'm off now, need to run ;) t/c

Lucas Kauffman

07:43

0

Q: How can user connect to Mysql DB with no access from remote host?

I have some website which are in the CPanel that i know remote database connection is disable by default and i tested it before. I know many people have some of my database passwords but they cannot connect to it.should i be worried about it? I know they should not know that but CPanel don't let...

mysql

OT?

Rory McCune

@LucasKauffman I see you just passed makerofthings for 11th spot!

Lucas Kauffman

@RoryMcCune I did?

cool ^^

must reach the top 10

Rory McCune

nooooo, I've been trying to avoid falling out of the top 10 for ages

my plan at the moment is to get past hendrik to give me a one place buffer

so I should be able to do that before you catch me :)

Lucas Kauffman

@RoryMcCune :P

I've got 2k rep to cover

so you should be fine

unless I hit a massive rep train

Antony Vennard

@LucasKauffman S'only 10 days! ;)

Less if you can get accepted answers and bounties.

AviD

07:58

@RoryMcCune yeah, well, I've been trying to avoid falling out of the top 2 rows for ages.

and before that, I was trying desperately to avoid falling out of the top row.

and before that, I wanted ... you know the rest.

hell, I still remember quite a few sweet months that I was #1.

Antony Vennard

@AviD To be an astronaut?

AviD

@AntonyVennard heh. not really, no. Fighter pilot, sure, but not really astronaut.

Antony Vennard

@AviD Ok okay. It was going to be one of the two, really.

AviD

lack of gravity would really mess with your burger.

Antony Vennard

Actually wait, knowing you, you could well have actually been a fighter pilot what with all the missile-dodging and all.

Rory McCune

08:02

@AviD well assuming I can get past hendrik, you're the next target :op (although that's a v.large gap so I'll need to be the train guy to bridge it!)

AviD

hehe

@AntonyVennard no, I used to wear glasses, which automatically disqualifies you for pilot school.

besides, need to commit to a bunch of extra years, and not to mention the ridiculous discipline...

Antony Vennard

@AviD Yeah, that sucks doesn't it? I wear glasses, so would likewise be disqualified. Was disgusted to find that out aged 5!

Adnan

08:25

Would you like it if a surgeon would ask another surgeon the "best practices" right before he would perform surgery on you? No. This is the same situation, if you have to ask it you aren't fit for the job. Does this mean you will never be able to do this? Of course not, but first you need to get the proper training and experience. Don't try to run if you can't walk :) — Lucas Kauffman 1 hour ago

Gold!

AviD

@Adnan @LucasKauffman oh much better now.

Adnan

@TildalWave How did I miss your vodka comment?!

AviD

Still dont think you'd be able to penetrate his veil of cognitive dissonance, but at least you dont come off as being completely dissmissive.

Adnan

Damn! When you guys go passive aggressive, go fu**ing passive aggressive!

Who the hell upvoted this?!

I think you're mostly looking at a performance penalty since you'll be parsing every HTML file instead of just shooting it out to each visitor. Size of penalty may be small. — BrianAdkins 10 hours ago

AviD

heh, just had a guy try to connect to me on LinkedIn. When asked, he claims to have met me at the OWASP meeting last week. Interestingly, I wasn't there, even though I arranged it...

Adnan

08:34

@AviD Come on.. with 500+ connections, everybody would think they get a job somewhere in your network.

AviD

@AJHenderson "then there is no more risk than having PHP files processed by PHP" - no more risk being the operative term here, that is you have just as much risk by having the PHP at all... not trivial at all, but obviously I get that it wasnt the point of the question... — AviD 19 secs ago

never miss a chance for PHP bashing.

@Adnan lol, it is possible, I do get all kinds of offers all the time - but thats not just about LinkedIn, I know personally every single one there (and worked with most).

that's why I dont just connect to anybody who's heard my name, or found me in a keyword search.

I just find it funny when somebody claims to have met me - I would know that I wasnt there!

Adnan

@AviD You know, I do understand having a certain baseless opinion about a programming language, I have some of my own. We joke about it all time here, it's alright. But in that comment you're implying that PHP, per se, is insecure.

Do you think that's ethical?

I believe you should at least add "IMO" or something similar.

AviD

@Adnan well no, I'm not implying it, I'm stating it outright.

but no, it's not baseless, nor opinion only.

Adnan

@AviD Alright, I'm not going that path again.

@AviD Why would they claim that? Just to expand their circles?

AviD

while it can be possible to build a relatively secure PHP application, fact is that (a) the near majority of them are *not, and (b) there are flaws galore in the php framework.

Adnan

08:42

@AviD Again, this is a completely ignorant statement (not by itself, but by shoving it in this context). But I'll do my best not to be dragged in this discussion again.

AviD

@Adnan heh. fair enough, at times it does seem like a religious argument, and only way to get out of that is to get in really deep.

@Adnan heh, too late ;-)

you're right, though, in this context it is completely uncalled for.

dammit, you convinced me to recant. just about that comment, not about my blatant heterosexuality.

Lucas Kauffman

@AviD was that sarcastic :p?

Rory McCune

@LucasKauffman the bit about his heterosexuality? I'd guess so :op

3

Lucas Kauffman

haha

AviD

@LucasKauffman no, really - I think the original comment was a bit too aggressively dismissive, even disrespectful - kind of like a "fackin' programmers" type comment. Now it's better.

Lucas Kauffman

08:50

@AviD wasn't meant that way more as a 'get some training'

AviD

right, and your last part made that clear now.

Lucas Kauffman

09:55

0

Q: Random pages getting created on classic asp site

In the file structure of my site, I see some randomly generated files like 'justinbieber.asp', 'justinbiebershoes.asp','guccishoes.asp' etc. I tried deleting them but they are generated again. Can anybody tell me the cause of this? Is my site hacked? How do I get rid of these files forever? Edit...

web-application

Lucas Kauffman

10:13

mmm Hendrik deleted my comment, while I didn't think it was offensive

@AviD is it worth to making a meta question for that or not really?

as I don't want to release the drama-llama

Antony Vennard

10:25

@LucasKauffman That depends on whether you really think the comment was wrongly deleted.

Personally, I wouldn't worry too much about comments. Actually, I think they're overused, but there you are.

For example, here's a comment on SO saying exactly what I said in my answer: stackoverflow.com/questions/4852548/…

Ladadadada

So, I just shut down an open resolver on one of those disused machines in another data centre every organisation seems to have.

It has three IP addresses regularly requesting "ANY isc.org".

Antony Vennard

@Ladadadada You've just done the internet a great service :)

Terry Chia

@LucasKauffman He deleted mine as well. :( I just pointed out that the OP was probably incompetent. Was that offensive?

Ladadadada

Hey, does anyone know how reliably unique PHP session cookies are?

Adnan

10:45

@Ladadadada seclists.org/fulldisclosure/2010/Mar/519

@Ladadadada I personally always override it and do something like session_id(somePRNG());

AviD

@TerryChia I find their incompetence offensive.

@LucasKauffman meh, as @AntonyVennard said, its just a comment. who cares?

@Adnan but cmon, its not really a falw in PHP, right...? ;-)

kidding, not getting into that all over again

Ladadadada

@Adnan Thanks, I knew that was out there somewhere. Good to know you've got the links at your fingertips. :-)

Adnan

@AviD In this case, yes.

AviD

2 mins ago, by AviD

kidding, not getting into that all over again

Ladadadada

The problem I'm investigating is what appears to be two different users accidentally getting the same PHP session ID.

What's more likely is that there's a bug in the code that determines these things and acts upon them.

Adnan

10:55

@Ladadadada Look down a bit, you'd find the C code to generate the values, then you'd know how likely it is.

AviD

any software, by any developer, can have a security flaw. the fact that one exists means nothing. It's how it's handled afterwards that matters, in addition to the density of flaws, and the WTFishness of them.

Terry Chia

@AviD If you want to be really pedantic, it's a flaw with the particular PHP interpreter being used, not PHP itself. I recall reading a really amusing argument either on SO or Progammers about how the language and the (interpreter/implementation) are totally different things. :P

Adnan

@Ladadadada But anyway, I'm checking my SVN store for you, I have the magic line somewhere.

AviD

@TerryChia sometimes its very true, sometimes its missing the point. "language" does not mean just the syntax.

Terry Chia

@AviD This one is definitely a case of "missing the point". :P

Ladadadada

10:57

The lack of real entropy could easily be made worse by the fact that the website in question is load-balanced across dozens of VMs, all using NTP locally. Values like gettimeofday() and the PID are far more likely to be identical.

Terry Chia

Although a little part of me dies whenever I look at or write PHP code. The language is just ugly.

Adnan

@Ladad Found it session_start(); session_id(bin2hex(openssl_random_pseudo_bytes(24)));

Ladadadada

@Adnan Thanks. I might throw that one at our devs. :-)

Adnan

@Ladadadada Now you got me thinking, is 24 bytes too much?

Ladadadada

@Adnan Probably. 16 bytes would render it pretty much unguessable.

But I don't see any particular harm in asking for 24.

Adnan

11:09

Guys, a little backing on this one please.

@BrianAdkins Incorrect! Anything outside <?php ?> (or its equivalent) isn't touched by PHP. The web server takes it from the disk and serves it to the browser. — Adnan 38 secs ago

the comment above it is wrong, and it has an upvote, I don't want people to be confused and think it's correct.

Terry Chia

@Adnan +1 for you. But this is the first time I ever hear anyone mentioning a performance penalty related to parsing php files....

Seriously, is this a concern to anyone?

Adnan

@TerryChia I don't think so.

Ladadadada

The performance penalty for parsing/compiling would be under a millisecond on the boxes I manage, even for a whole lot of PHP in a file (with no includes). I wouldn't have bothered mentioning it for HTML files with no or very little PHP in them.

Terry Chia

@Adnan I'm gonna start learning how to pick locks. Any recommendations for any particular types of locks to start with?

Adnan

Actually, I think that <?php ?> tags have nothing to do with PHP itself. They're just a way to tell the webserver that when it sees them it needs to send what is inside them to the parser instead of spitting them verbatim .

@TerryChia Always start with the pin tumbler. They're cheap, easy to learn, and can be made more challenging by using different kinds of pins.

Terry Chia

11:17

@Adnan I think that sounds right. The PHP parser won't be looking at the files themselves. Just whatever the web server tells them to parse.

@Adnan Roger.

Adnan

@TerryChia I recommend buying a practice pin tumbler lock so you can see what is going on.

AviD

@TerryChia well, if it was, they wouldnt be using PHP, now, would they? ;-)

Adnan

@TerryChia Something like this ebay.com/itm/151056970372

AviD

@Adnan @TerryChia no, it doesnt work that way. the webserver has a mapping of filetypes / filehandlers. if the php engine is configured for .html files, it will always be processing the entire file. the webserver would not be looking at the contents at all.

Ladadadada

@TerryChia I started by going to my local HackSpace's monthly lockpicking session. They brought a variety of locks and picks along and we got several hours to play with the lot.

Adnan

11:22

@AviD I see. But still, stuff outside <?php ?> aren't actually parsed by PHP, right?

AviD

basically, your comment there is wrong, and his is correct, but inaccurate. the penalty would be miniscule, if at all possible to be measured.

Terry Chia

@AviD Hmm I see. So if the php engine is configured for html, how does the parser parse the html data?

@Adnan Aye, will pick one up soon.

Adnan

@AviD I see. I'll remove it.

AviD

@Adnan well... to be accurate, the PHP engine would be parsing the entire file. it would (probably, did not actually review its internals) have to search contents for the <?php ?>, and if it doesnt find it it would shortcircuit the language interpretation and spit back out the html.

@TerryChia it doesnt really, it searches it for PHP code to interpret. BUT it does have to process the file.

Terry Chia

@AviD Ahh alright. Time to add that to my knowledge pile.

AviD

11:25

think of it this way: static files are handled directly by the webserver code. anything else, gets handed off to the PHP execution engine (I think that this is implemented differently depending on webserver), to be handled there.

so basically the webserver examines the filetype, and either throws it back on the user's connection, or makes a call to the PHP engine (either module, IPC, or whatever). the PHP engine then reads the file, and decides what to do with it - either interpret the code, and generate the response onto the connection, or just pass-through the contents onto the connection.

Lucas Kauffman

@AviD @TerryChia Time to break out our pitchforks and torches

AviD

Now, mind you, I did not actually study the execution internals of PHP, but this is my understanding. It is also how just about every other one would work.

Lucas Kauffman

I always find it funny when people call you sir on here

AviD

someone called me sir...??

Terry Chia

@AviD Sir.

Lucas Kauffman

11:29

@AviD they call you tiger

Xander

11:49

@ScottPack Good luck with the house hunt!

Adnan

@LucasKauffman It's all fun and games until they call you "friend" and they start asking you for sexy pics.

5

AviD

@LucasKauffman well, your mom does.

Terry Chia

@Adnan Hello friend.

AviD

Mellon.

Xander

@ScottPack Unfortunately, my calendar's ended up pretty full today. I'd hoped we'd be wrapped up by now, and I'd get to have a leisurely day today, but alas, it has not come to be.

Ladadadada

12:06

That's nice. OVH have a tool to determine whether your IP addresses are open resolvers or not: ovh.co.uk/cgi-bin/tools/dns_security.cgi

Adnan

@Ladadadada I've tried 3 IP address (totally different networks) and I'm getting the same error

> Problem detected: Given IP (x.x.x.x) is not in OVH ranges

Lucas Kauffman

12:27

They will not allow that beyond their own network for legal reasons probably

Ladadadada

Were the IP addresses you chose in an OVH range?

Lucas Kauffman

Oh god.

0

Q: Truecrypt Bruteforce, dictionary atack

i forgot my truecrypt password (yes i know its stupid), so i try to recover it doing a dictionary atack on my encrypted hdd, the thing is i know that my password is build out of six parts wich has about 3-30 differnet possibilities... have the same system for all passwords (easyer to remember) i ...

encryption brute-force tools truecrypt

Ladadadada

Their goal to help their own customers not be part of a DDoS.

Adnan

@LucasKauffman Aha. That's probably why.

Lucas Kauffman

I don't like OVH

Adnan

12:29

@Ladadadada Got it! I still think they should just scan their own range automatically and inform their customers.

Lucas Kauffman

they force you to install their kernel

Adnan

Don't you think so?

Lucas Kauffman

which is backdoored

and they also add their public key to your root account

Ladadadada

I don't like OVH either, but we have a couple of boxes with them because they're cheap.

Lucas Kauffman

and if you remove it your machine goes into 'unscheduled maintenance'

@Ladadadada have a look at Hetzner instead

Ladadadada

12:31

@LucasKauffman We're mostly in EC2. If we migrate those functions it will probably be into EC2.

This was rather interesting. codeascraft.com/2013/06/04/…

Will be something I keep in mind if we ever get big enough to have big data.

Adnan

@LucasKauffman What the hell are these prices?! Damn good! Do you use them?

Mind = blown

y i thought so already.. but i still need a tool, or inform about how to get the header file from the disk and creating my own rainbow table to find a collition ... — Michael Saiz 33 secs ago

Lucas Kauffman

12:48

@Adnan I actually use an old account I have with a friend at leaseweb

which is super cheap colo

but a lot of my friends use hetzner

a lot of them migrated from OVH to hetzner

Adnan

@Gilles I have an idea. I'll double rep-whore.

Adnan

13:06

@LucasKauffman I think I'll give them a spin.

Behold! Double rep-whoring!

0

Q: How can I spoof a phone call and make it appear to come from another phone?

[Hypothetical question. Created to preserve my answer on this qustion] I'm performing a penetration test against a company. Part of my social engineering procedure is to contact the IT department and try to convince them to that I'm an employee in the company and get them to reveal some sensitiv...

phone voip spoofing

@Gilles Why did you remove the first line? (I'm not asking in disapproval, I just want to know the reason from your mod point of view)

Scott Pack

14:06

@Gilles I have to say. I disagree completely on your assessment with the forensics bit. We would never bother going through all the trouble of tearing apart an iPad to grab a JTAG and inject a binary.

@Gilles We would use DFU mode, like what @RoryMcCune says, or use a piece of software to crack the passcode. It's a lot faster and less likely to damage the device.

@Xander Meh, it happens. I'm sitting in the OSU student union right now. It's pretty, but everything is freaking red and grey. Feels a little clashy.

@Xander I'm spending this time trying to do some data analysis before I meet with my advisor tomorrow.

Rory McCune

14:28

@ScottPack TBH for me the easiest way is usually grabbing a copy of the device backup. It gets backed up whenever connected to a device and iTunes loads, and the most you can do is require a password, you can't require a good password :)

Scott Pack

@RoryMcCune Oh exactly. Having a backup is at least as good as having the original device. There have also been times where we've had the device, but for whatever reason couldn't change the code or get it.

I haven't had a chance to sit down and use it yet, but I've been told Lantern, from Katana, is really nice.

Rory McCune

@ScottPack yeah then the DFU mode thing is the way to go, I keep hoping for a new DFU style exploit for more modern iOS devices...

Scott Pack

We were pretty bent with EnCase v7 and what they did with the mobile device stuff.

We bought their Neutrino seutp for v6, and while it was pretty awesome the software sucked. Then v7 came out, they rolled that into the main software package...but not really.

Rory McCune

@ScottPack ooh looks like that lantern thing has a free imager could be v.handy

Terry Chia

@RoryMcCune Talking about iOS exploits, have you seen the recent buzz about the charger one?

AviD

14:34

okay, explain something to me. Right now, e.g. NYC is not in EST, but in EDT, right?

so you change timezones twice a year?

I thought the whole timezone thing supports DST implicitly.

Rory McCune

@TerryChia yeah I'll be v.interested to see the detail on that one and whether it's a practical attack on a locked device...

Ahh that free imager only supports the devices that have the DFU mode problem so really it'll just be a wrapper round the free stuff. still could come in handy I guess

Terry Chia

@RoryMcCune From the talk description, I'm actually rather surprised that people consider it a big deal. I always thought people understood the risk USB chargers pose? Heck we even have a question about it here.

AviD

@RoryMcCune you guys are still UTC / GMT, even though its daylight saving? is that right?

Scott Pack

@AviD Right now, yes.

@AviD The official timezone is usually called EST5EDT

Rory McCune

@AviD GMT+1 at the moment

AKA BST

AviD

14:37

@ScottPack oh damn now thats just confusing.

Rory McCune

so yeah for the summer Greenwich isn't on Greenwich mean time

AviD

@RoryMcCune ohhh right okay.

Scott Pack

@AviD What's funny is we spend less time in standard time than we do savings.

AviD

so here's whats confusing me. Somebody is trying to set a schedule with me, and he writes lets say "1pm EDT / 6pm UTC".

I'm not crazy, right? He has a mistake there.

cuz EDT is UTC-4.

Scott Pack

Tardwrangler.

3

Rory McCune

14:40

@ScottPack the thing that really narks me about iOS forensics stuff is the way that companies try and hide the fact that they can't do locked / off acquisitions on anything more modern that an iPhone 4/iPad 1. It's usually there in the small print but very absent from marketing material

AviD

'course I made the same mistake, assuming I'm in UTC+2, but at least I was consistent - I referred to EST. so I was an hour off my own time that I intended, but the times I gave him made sense.

Scott Pack

@RoryMcCune No doubt.

Terry Chia

How did this discussion about iOS forensics originate again?

Scott Pack

@RoryMcCune I pretty much only get called in to do the linuxy and android stuff. I'll have to see what we use to crack the passcodes.

@TerryChia The comments on this question

security.stackexchange.com/questions/36748/…

Rory McCune

@ScottPack ahh I may have a question for you later this month. Have some work coming up looking at android security so may want to pick your brain :)

Scott Pack

14:42

@TerryChia The forensics examiners in the room disagree with the programmer on what constitutes professional behavior for forensics people. :)

@RoryMcCune You may pick whatever little there is!

Terry Chia

@ScottPack Ah, obviously the forensics guy is right. Damn programmers....

AviD

damn timezones. on top of the quirky definitions, any given client will handle them differently. sometimes its implicit, sometimes explicit, sometimes not at all.

actually its daylight saving time thats causing the issues. Damn Ben Franklin.

Scott Pack

GAA! I can't find in my own code where I'm doing specific calculations. NEED MOAR SUBS!

Terry Chia

@AviD See, all our timezone problems will be solved if we just communicate in Unix time.

Adnan

@AviD I despise DST!

@TerryChia Re-think that sentence.

AviD

14:45

@Adnan you ever go through a manual time shift for a large corp with a big server farm?

Scott Pack

3622

A: Why is subtracting these two times (in 1927) giving a strange result?

It's a time zone change on December 31st in Shanghai. See this page for details of 1927 in Shanghai. Basically at midnight at the end of 1927, the clocks went back 5 minutes and 52 seconds. So "1927-12-31 23:54:08" actually happened twice, and it looks like Java is parsing it as the later possib...

AviD

yknow, before all this automated stuff.

Adnan

@AviD Nope, and I hope I don't have to.

Scott Pack

I remember when they changed the time change dates a few years ago.

Every single goddamn Cisco device required a manual change

AH-HAH! No wonder I couldn't find that bit of code. It was in a different script!

What asshole build this?

Terry Chia

3 mins ago, by Scott Pack

GAA! I can't find in my own code where I'm doing specific calculations. NEED MOAR SUBS!

Adnan

14:47

@ScottPack You, mellon?

Scott Pack

Man. That @ScottPack is such a pigfarmer.

7

AviD

@Adnan not fun. nowadays it is (or should be) a hella more simple.

Terry Chia

Goddammit I hate writing reports.

Adnan

@TerryChia What are you writing reports about?

Terry Chia

@Adnan Some crappy school module. What a waste of time.

Adnan

14:48

It's nice to see that everybody here is complaining about something. This is like sitting with my girlfriend x3

Scott Pack

@Adnan Except none of us are complaining about your ahem performance.

Adnan

@ScottPack I think @Gilles mentioned that yesterday.

Simon

15:55

Ahoy

AviD

@Simon boat programming?

Transcript for