The DMZ - 2014-05-27 (page 3 of 8)

« first day (1258 days earlier) ← previous day next day → last day (3643 days later) »

11:00 AM

not sure if it's an apple issue or a carrier issue

@RоryMcCune oh, didnt know anything about that. I did get my Ebay password reset email, though. So that was exciting.

if its an (australian) carrier issue then I don't care :op

Interesting
http://chat.stackexchange.com/search?q=adnan&user=&room=151
http://chat.stackexchange.com/search?q=avid&user=&room=151
http://chat.stackexchange.com/search?q=kalina&user=&room=151
http://chat.stackexchange.com/search?q=kisunminttu&user=&room=151
http://chat.stackexchange.com/search?q=kisu&user=&room=151

@FEichinger i dont see any problems here officer :3

I was mentioned 14008 times in this room.

11:00 AM

@AviD I've not had mine yet and I tried setting it up and they were going to send me a mail like 3 days ago

super efficient!

@RоryMcCune actually, other than the timeliness, I was mildly impressed - it wasnt just a simple password reset, after logging in with my password they sent me another email, reset link, etc.

@Adnan in how long?

so they smartly did not rely on the password, which was ostensibly stolen.

@kalina All time

@RоryMcCune I think it's a problem with the pesticide, it's not very effective... 9gag.com/gag/av0wpyO

11:02 AM

still would like to know actual details though.

:D

@kalina You, 4104 times.

Well, you're not that old here

@Kisunminttu nice quality punnage for a non-native speaker!

I'm not either, but you're 5-6 months more recent

@Adnan Just waiting for my 63 to go up a notch

11:04 AM

and me?

@Adnan that's why I was asking how long

...

im not old either... last.. friday?

@RоryMcCune Hehe, couldn't resist

@Kisunminttu No idea what that means

@Kisunminttu never resist puns, they're awesome!

11:05 AM

@Adnan 65... getting close...

@Kisunminttu i see what youre doin here ;3

@Kisunminttu What? You were mentioned 405 times

Not 65

@Adnan I blame my glasses on that one.

Also, nice!

@Kisunminttu Just like with the kid you ran over the other day, you blamed him for playing in the no-cars-allowed street.

4

and i thought @kalina was murderous

11:08 AM

@Kisu aaaand now Supo are investigating you

@Adnan >:( now I have to nuke my computer! Thanks a lot!

just backup your stuff and bring the harddrives to mee

i'll put em to a good...cause

@Lighty Naah. Murder is just a side-effect.

Her primary goal is pain and suffering.

by hugging you to death?

i dont see why @Kisunminttu would be any more murderous then a kitten

No, by setting fire to you. Repeatedly.

11:11 AM

ok

a kitten with a flamethrower

I'm talking about kalina. What @Kisu does for murder, I do not know. Ask @Adnan. He probably has more experience with that.

oh, @Kisu would wreck the world on a day if she got the chance

2

@FEichinger You know what they say. A couple that slays together, stays together.

4

err, @kalina

im sucha derp

@Kisunminttu ... Right.

11:12 AM

@Kisunminttu that about sums me and my girlfreind up.... except its video games :S

So chatty this morning.

@DavidFreitag the @Adnan @Kisunminttu @kalina trifecta is in effect...

@Lighty except that she means two distinct people.

@AviD Teeheehee.

@RоryMcCune Now, now, you only need @Adnan and @Kisu for this to happen.

@RоryMcCune Sockpuppetception one might say.

11:14 AM

@RоryMcCune God damn it! Why include her? Now tonight is gonna feel weird.

@FEichinger yeah but @kalina is a force multiplier

im one of your sockpuppets too @Adnan, dont you think we sockpuppets think you're weird too? D:

@RоryMcCune Oh, definitely. She sure amplifies this all.

Which reminds me, anybody knows a reliable French proxy?

@Adnan before you go home tonight, we will remember to make you think of @kalina.

sorry @Kisunminttu.

11:15 AM

On a totally unrelated note, don't be alarmed if tomorrow there's a new French girl who is in love with me in the DMZ

@AviD I'm torn on whether I should approve of that ...

I think I don't approve of that. But it would be hilarious.

@Adnan Ummm...

ofcourse, if he makes sockpuppets love him, why not proxybots?

@Adnan Really? You want to spam the DMZ with another sock?

Don't you think three instances of you is enough?

@FEichinger 3? I count 7.

11:16 AM

@FEichinger 3 are not enough

you're just jealous >:

@AviD Shhhh! That's private mod info

heh.

@AviD Well, yeh, but that just gets out of hand anyway.

How cool would it be if actually Kisu, Kalina, and Lighty are all my sockpuppets

11:18 AM

@Adnan Hey, now, keep kalina out of this. I can very much confirm that she's not your sock. :P

@FEichinger I'll leave it at this without hurting you.

So, the Pope is in Israel with an Imam and a Rabbi. .. If they don't walk into a bar, it's all been for nothing.

Tweeted by Welshtabby on May 25, 2014 at 7:42 PM

@AviD I, too, sometimes steal Reddit comments and tweet them.

@Adnan that's not my tweet. I just thought it darn funny.

and not productive enough to retweet, so I just posted it here. in the non-productive zone.

@AviD Hey, man. We're very high functioning and productive member of the society.

Heh

11:24 AM

@Adnan reminds me of that line from sherlock.

> I'm not a psychopath, I'm a highly functioning sociopath. Do your research.

is using alternative names in a database more secure? like, calling a table P30PL3, instead of PEOPLE?

ve heard it makes it harder for people to do XSS, since there would be no known tablenames to damage

or is that just a silly illusion?

@Lighty first of all, if XSS can have any direct effect on your database, you have much bigger problems.

i have this small function to sanitize the input, in hope that would help a bit: pastebin.com/CKvTWy7B

second, it's barely even obfuscation, since it is possible to discover table names quite easily.

f.e. sysobjects, systables, INFORMATION_SCHEMA, etc...

@AviD To be fair, this assumes the attacker knows how to look that up. Which already rules out a lot of script kiddies that just try their luck with an injection.

11:37 AM

so if I have any form of read access on your db, e.g. SQLi, I would just find out the table names, and column names, and etc.

@FEichinger true. but the tradeoff there is pretty bad, since it does not come without a price.

@Lighty That said, just use prepared statements. Much simpler solution to that problem.

both on development, and on devops/dba.

ive read about that too, the prepare part

@FEichinger and stored procedures. and an ORM. and make sure to restrict access on the db objects.

@AviD Definitely. I wouldn't use it either, but it's not completely useless.

11:39 AM

@FEichinger just barely.

ok, so on the list, use prepared statements, DB names dont matter, and what about that thingie in the pastebin?

You don't need the pastebin anymore, if you use prepared statements properly.

and whats the difference in prepareing the statement, and sanitizing the input?

@Lighty it's PHP. you're screwed anyway.

(That said, you might wanna keep the html* functions in there, just for the resulting output.)

@AviD Hey, now, it's not that bad!

11:41 AM

also you need to differentiate between XSS and SQL injection.

im a sockpupet, im alwats screwed

@Lighty Why are you stripping slashes in an anti-XSS function?

$data = stripslashes($data);

@Lighty I'd strongly recommend you first read up on prepared statements before coming back on that.

@FEichinger sure, but there is a price... on developers, devops....

@AviD SHUSH!

11:42 AM

@Adnan because he's confused between XSS and SQLi.

i am

so, im gonna read up something first, then come back to pester you with easy questions

@Lighty Do you work with these things?

yes

Oh

@Lighty read up on SQLi. it has nothing to do with XSS.

11:44 AM

To be quite blunt, @Lighty and @Simon both are living examples of why PHP is so hard to take seriously. It takes a lot of effort and time getting the experience.

im a 17y old student with ym head up my arse and a rather poor teacher

ofcourse i dont have experience

:D

@Lighty Then you shouldn't have been hired to do production work

im not hired as "employee"

but as traineee

@Lighty Do you do production work?

in the netherlands, we have a a requierment to graduate, that you have to run 720 hours of trainee work at a company that does stuff youre studying for to even get allowed to take exams

11:46 AM

@Lighty Same in Finland

@Lighty Does your code go into production environment to handle company business/tasks?

yes, it does, but is not meant to be a thing with extreme inportance

but to fiddle around with and learn how it all works

@FEichinger And much of it has to do with w3schools.

its gonna be a dashboard where they can see what plugins they installed on webshops/websites, what components they have, google analytics, adwords etc.

all in one page

@Lighty I think you should bend over and prepare the vaseline. @Adnan's about to go all adnan on your ass.

so its a messs of API's and so

im a sockpupet, there is already a hand up my arse, technically

11:48 AM

hehe

ah, injections is what i was thinking, inputting weird shit to try to damage/fish the database

i thought that was ccalled cross side scripting

@Lighty There is no such thing as "cross side scripting".

XSS?

@Lighty site

typoes go a long way

11:52 AM

user image

"you might as well just kill yourself right now"

well, thats also an option

@Lighty whoa, okay. Take a break from coding, learn the OWASP Top 10 by heart. And understand them, of course.

Only then can you again touch the codebase.

yes daddy

I am a force multiplier?

interesting

@kalina You're a battlefield long-range marksman?

11:59 AM

if I was such inclined, I would be a sniper rather than your average run of the mill foot soldier

thats something i can agree wth o.o

« first day (1258 days earlier) ← previous day next day → last day (3643 days later) »

Transcript for

May '1427

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile