« first day (1867 days earlier)      last day (3027 days later) » 
00:00 - 15:0015:00 - 00:00

3:14 PM
@Simon
2
Q: How can I exploit a PHP endpoint that lets me instantiate an arbitrary class?

Mark AmeryPHP lets you instantiate classes from variables or array entries, like this: class Foo {} $className = 'Foo'; new $className(); $someArray = ['class_name' => 'Foo']; new $someArray['class_name'](); Distressingly, some of my coworkers - on multiple projects I've worked on at multiple companies ...

@Simon Wouldn't this attack depend on the rest of the code in question?
 
@MarkBuffalo it most definitely would
 
Do I look like the freaking PHP expert in this room? That's insulting.
 
Their applications are digging for a specific class if found... but you'd have to know which classes are there.
And those classes themselves would have to be vulnerable
 
you might be able to get an injection off on it
if there's some quirk of PHP that allows you to do that
and that case defaults to true if you're using PHP
 
Seems like it could be vulnerable to object injection
can't help but feel I'd need to see more of the code
 
3:21 PM
yeah, that's what I'm looking at
 
I didn't even know that you could do new $var();
That's horrible.
 
@Simon you're a new $var.
 
at first i was like "WHO WOULD DO THAT?!" then i remembered PHP developers exist
3
 
uuhhm I meant
@Simon you're horrible.
 
WTB new mod
 
3:28 PM
3
Q: Where can I travel on a suspended US passport, assuming I've already left my home country?

exiled00dI am a US citizen living in Europe with a valid long stay visa in an EU country. My US passport was marked suspended in the US Health and Human Services database for non-payment of support, but my passport (the physical document) says it is valid for another ten years. My question is: If I fly...

um
btw, when they say "suspended in the US Health and Human Services database for non-payment of support" they mean child support
 
Yeah, child support will own you.
@Ohnana Yeah, and I don't think you can instantiate built-in classes, can you?
 
@MarkBuffalo i don't know
maybe
 
They are used like eval(), str_replace(), preg_match(), etc., and are already instantiated.
 
those are classes? i thought those were functions
(ʘ_ʘ)
 
Ah, yeah... they are functions... lol
 
3:38 PM
okay
 
I wonder if you can throw eval() into the constructor
 
I wonder if you can throw @Simon into the destructor
you're a ridiculously pointless statement
 
What a ridiculously pointless statement.
 
@AviD i think that's illegal
 
Oh my god ovid saw in da future @@@
 
3:48 PM
What the heck
I SENSE HAX
 
lolol
 
mother of god
 
@Simon your face is predictable
 
Wait. Mods can either make you say things, or rearrange the chat timestamps?
 
hahahaha
YOU DONT KNOW THE POWAR OF THE MOD SIDE OF THE FORCE
 
3:50 PM
@MarkBuffalo no simon is just a broken record
 
beep boop
 
when i first got here i thought Simon was someone's AI project
 
hmm, which is better, "mod side of the force" or "dark side of the mods" ?
 
@AviD second one
 
@Ohnana I'm still not 100% convinced he's not
@Ohnana :-(
 
3:51 PM
@Ohnana That is true
 
@AviD the first is too ambiguous
 
@Ohnana your face is ambiguous
 
@AviD yes.
yes it is
 
there is the light side, there is the dark side, then far past that is the mod side.
 
the new star wars made me fall completely out of love with star wars.
It was next-level terrible. :|
 
3:53 PM
SHUDDUPSHUDDUP I DONT HEAR
 
You're a bad person Markus.
 
and yes I CAN make you say things you dont want to
 
@AviD The new Star Wars sucks
 
see?
consider that a warning ;-)
 
I thought the ponies were only for me.
I hate you now.
 
3:55 PM
and nah I wouldnt really abuse you like that, outside of a joke
 
@AviD star wars sucks in general
 
the needless abuse is #simon-only
@Simon hehehe
 
i watched all the movies and they were all uniquely awful
 
wow you are particularly wrong today
 
It doesn't surprise coming from Markus but I thought ohnuhnuh was better than that.
 
3:56 PM
yeah sure cling to your little desert space fantasy
 
wat
 
space incest
 
spincest
 
space desert
 
that's a bit of a stretch
 
3:56 PM
spesert
 
wow I almost want to stop mocking @Ohnana and go back to mocking @Simon now
 
@AviD Woooooooooooooooooooooooooooooow
 
its on a site called BIRTH MOVIES DEATH DOT COM
you want overrated? take a long, hard, look at LotR.
 
@Ohnana I liked all of them except The Force Awakens. Disney killed the EU, which was awesome because they didn't want to pay royalties to the writers.
 
4:03 PM
make it extra long. very very long.
 
as if lotr was good
 
I didn't like LOTR
 
4:16 PM
@MarkBuffalo Seriously you are a bad person man.
 
@Simon I'm with Mark on this on. I didn't enjoy LOTR
 
@Matthew How's your social life?
I'm doing a research that checks the correlation between not liking LotR and not having a social life.
 
Not bad. I meet with friends and we watch a couple of films on film nights. That wouldn't work with LOTR...
 
@Matthew Would your label your friends as being nurdz?
 
@Simon Other than the ones I work with?
 
4:22 PM
Sure.
 
@Simon well I dont have much of a social life, but not because I dont like LotR, but because I am too lazy AND have 5 kids
 
No then, not really. Some of them don't even have computers!
 
not to mention overly busy with being selfemployed...
 
@AviD Sorry, I cannot study you.
@Matthew Oh ok, which means that they are very weird people.
 
I think the inverse is true tho - like LotR too much leads to a stunted social life.
 
4:23 PM
Very good to know.
 
as explained in the previous video.
 
I'm not watching your god damn videos ovid.
 
@AviD Sounds like you need someone to share the load
 
@MarkBuffalo you looking for a job? ;-)
 
loooooooooooooooool ovid would be your boss
 
4:25 PM
@AviD I was suggesting that maybe you need to find someone :b
What do you do anyway?
 
@MarkBuffalo no thanks, I am happily married. But really, I appreciate the interest.
 
hugs the mossad
 
Weirdo
 
that's his official title
"hugger of the mossad"
 
@Ohnana pfft, pls. Shin Bet.
 
4:26 PM
Wait, if you're Mossad...
 
Actually I turned them down hard when they tried to recruit me.
 
Did a Pharaoh ever try to recruit you?
 
@AviD Peradventure one were to be interested in something thou offer, hao would one contactest thee?
 
wat
 
4:29 PM
Hypothetically barking
 
the normal ways
 
Allow me to try a less subtle approach.
 
pigeon, smoke signal, subtle vibrations thru the earth's core...
or, yknow, email / linkedin / telephone / in person
 
actually met a lot of people in person today, went to a big stupid conference
:27110416 ah sorry, my lastname @hotmail.com
 
4:30 PM
Um...
0
Q: How to view e-mails without internet connections?

LoukiosValentine79If I want to make a secure PC that has zero network connection, how can I view my e-mails on it? Are there any tricky solutions to still view my e-mails while I have no network connection? And all that in a secure way? Thinking of that I have another PC with network connection and a flashdrive?...

 
ovid@hotornot.com
 
Am I missing something here?
 
@Simon lol
 
Matthew lmfao
It's possible though
Requires a lot of tomfoolery
Avid link your unicode smuggling paper
 
@MarkBuffalo oof I dunno where that is now
why?
oh wait I think I have it here somewhere...
 
4:33 PM
I can find it. I will then find yoh
You
 
"You can view all the emails you send from one account on your linux computer to another without risking your secure PC in any way. I wouldn't advise using a flash drive or opening other emails without opening them elsewhere first, since you don't know what's in them."
 
@MarkBuffalo I dont get it
that wouldnt have my current address though...
 
That doesn't matter. It has your last name
 
@AviD Did you swap pyramids with a bud?
 
Which I don't know
 
4:34 PM
HOW DO YOU NOT KNOW HIS LAST NAME
 
@MarkBuffalo ah, but so does my profile here... its not secret...
okay sorry I was slow, didnt get what you were asking
 
Most of Markus' questions about a user can be answered by browsing his profile and he never damn realizes it.
 
pony
 
poneedoo
 
Nice. OWASP chairman
Alright well I'd like to connect with you a bit later. Not necessarily seeking jorbs. I am content here
 
4:36 PM
@Simon heh
@MarkBuffalo sure thing!
 
I thought you had higher standards than that, ovid.
 
I have to rebuild my linked in
 
@Matthew stallman would be proud
@AviD ur a baldy
 
LOL
 
@Ohnana AND PROUD
bald is the new hair
 
4:39 PM
@AviD i could spitshine your head
 
No one can be genuinely proud of that.
 
rub ya with a towel
 
@Ohnana is that the type of thing you enjoy
 
I already have a ton of grey hair. which means that I shouldn't go bald knocks on wood.
 
TIGGERS AREN'T SUPPOSED TO BE BALD
 
4:40 PM
@Ohnana are you offering or requesting?
 
@Ohnana careful, this is how bear maulings start
 
@Simon or, maybe, the other way around.
 
da bear isn't bald
@AviD NO
 
@Simon you're like 25
wth
 
@Simon do you know why I am voluntarily bald?
 
4:40 PM
@Ohnana -1 month
@AviD Are you?
 
because I did not want to be involuntarily bald.
 
o lawd
 
my terms, my conditions.
 
So you've got hair only on the sides?
 
with dignity. and pride.
 
4:41 PM
@Simon Obscure Bible reference. Because he's in Israel
 
@Simon no
 
OH MY GOD I'LL BE 25 NEXT MONTH
FUCK ME SIDEWAYS
 
@Simon lengthwise
hehehehe good old christian slater....
 
wot
 
breaking in
never mind
 
4:43 PM
Yeah I shouldn't ever mind with you.
 
@Simon yeah wouldnt want you to strain yourself.
 
Get ready to wrestle 'cause it's gonna happen soon.
 
something about pigs and mud...
 
You're a muddy pig.
 
@AviD That reminds me of the Simpson's movie. Spider pig, spider pig
 
4:49 PM
He's a funny pig.
 
5:44 PM
@Ohnana
Tactical pizza cutter with a tactical vest.
 
6:10 PM
why
 
.@owasp has 55 corp sponsors & 2458 members - keep participating everyone - $990k to be invested in chapters & programs #AppSecCali2016
I have to say, I'm quite surprised there are less than 2500 members.
Y'all aren't pulling your weight. (@AviD and @RоryMcCune excepted.)
 
 
1 hour later…
7:39 PM
Ok well since the chat is so dead, I decided that it's time to pull the plug.
Thank you to all of you for joining us in The DMZ but unfortunately, it has to go no.
#ripdadmz2k16
 
7:54 PM
who died and gave you power of attorney
 
@Xander I'm surprised that there are more than 100 members.
@Simon It's dead because whenever people try to talk, you tell them to shut up :(
 
@MarkBuffalo People = Markus?
 
I AM THE PEOPLE'S MARKUS
 
If anything, you're the people's mong.
 
And I deserve respect for that. twitches
Just got email spam from yet another recruiter that doesn't know basic English.
 
7:59 PM
i have a question about close votes
 
@Ohnana I don't know anything about them but I'll do my best to bullshit in a graceful way.
 
if 1/5 think it's unclear, and 4/5 think it's too broad, does the vote continue until 5 people agree on something? or once there are 5 votes, the question closes based on the most popular reason?
 
It keeps going until I decide that it's over.
We could ask the only mod that does something here though /cc: @RoryAlsop.
 
wow way to diss all the mods
r00d
 
@Ohnana This is correct
It keeps going until 5 people agree, I think...
I've seen 1/5, 4/5, 2/5...
 
8:05 PM
oh so i've been vote-splitting all this time
whooopsie
 
2 questions are asked, Markus answers "This is correct".
 
yep, you suck
 
fuck me i guess
 
Right in the ...
Ah, I won't go there.
 
@MarkBuffalo That's why the chat keeps dying, son.
 
8:06 PM
People are busy today
I've had a lot of work to do
 
8:32 PM
@Ohnana It just needs 5 close votes. It doesn't matter whether the reason is agreed upon or not.
 
@Xander oh good
@Ohnana Correct, but I don't need any user verification. — YPOC 2 mins ago
i feel like this has a dupe
 
8:49 PM
@Xander Okay, so I was totally wrong... but I distinctly remember a 1/4, 4/5 and something else, and the post wasn't closed. I may have been hallucinating in my sleep or something.
 
@MarkBuffalo Nope.
@MarkBuffalo Discussed peripherally in this question and answer by Laura from SE.
-4
A: Distinguish close votes by reason

LauraTossing in my opinion as an individual, not necessary "on behalf of SE staff". I actually don't agree with the premise of this request. While established users might benefit from seeing all of the reasons people voted to close, it's actually rather overwhelming to new users (who are probably mo...

 
Thank you for the correction.
 
9:07 PM
@MarkBuffalo Related ancedote: I remember a few years ago one of the mods (AviD, I think) either griping or laughing at us because we'd closed a question with votes for 5 different close reasons. I don't remember the question, but I do remember that it was a mess.
 
lmao
 
@Xander Maybe we need a close reason "this question is a mess".
 
@ThomasPornin That would be awesome. I suppose we could write that in for the custom "off-topic" reason, but a top level reason would be fantastic. I still miss the "Not a real question" reason.
 
closed because everyone thinks your question is stupid. go cry on meta
 
Mmh... a software update on OS X, and it changes the background photo on my left screen.
 
9:14 PM
"macs have great user experience"
 
@ThomasPornin Do not question the judgement of The Jobs.
He clearly felt your selection wasn't up to the standards of his operating system.
 
@Xander I don't question -- I assert that the Jobs is dead.
 
-1
Q: update metasploit framework without licence

SidahmedI registered in metasploit website, but they didn't send me the licence key. What are the problems that can occur from using metasploit without a licence, and how can i update my metasploit framework in this situation ?

 
@ThomasPornin That doesn't mean that he doesn't still have better taste in background images than you.
 
@MarkBuffalo you will get pwned by methasploit
seriously
it deliberately drops evasion techniques i think
 
9:18 PM
@ThomasPornin Seriously though, that's a weird bug.
 
@Xander Jobs having good taste ?
 
@ThomasPornin I love those things.
Could never afford them as a kid... now they're so cheap.. dude, I'm going to buy one off eBay.
ebay blocked at work kek
 
I really like the PowerPC architecture.
But the iMac case... I'd be ashamed to offer it as home for a goldfish.
 
Not me, dude. I LOVE it.
I wouldn't give my kids any apple products though, as that's child abuse. I'd give them a proper android.
 
@ThomasPornin Ha ha. Touché.
 
9:47 PM
questions with the answer in a comment piss me off
 
10:02 PM
wtf
"A 17-year-old girl who was physically and sexually attacked in Sønderborg will herself face charges for using pepper spray to fend off her assailant."
Not sure if satire site, or if it's that insane in Denmark
 
@MarkBuffalo I've seen similar stories from the U.K. Homeowners who fend off home invaders being charges with assault.
 
That's insane.
 
@MarkBuffalo Yeah, I don't understand it.
 
@Xander I didn't renew my membership
 
@RoryAlsop Don't see any value in the organization?
Or just not bothering?
 
10:07 PM
@Xander they have ... lost direction ... I feel
 
@RoryAlsop Fair enough. I can't disagree.
 
pepper spray is illegal in denmark
the same would happen in the USA if you used hollow-point bullets in the united states to kill an attacker
you're not prosecuted for manslaughter, but for illegal possession, which is much much less serious and is usually dropped based on circumstances
 
@Ohnana There's no such thing as an "unlicensed firearm" except for in the Communist states.
2
 
@Xander yeah... i know
feex. those are illegal on the federal level i believe
> It is not known, however, if the assailant in this latest incident was an asylum seeker or refugee.
 
I'd kill someone with an unfired hollow point if they came near my family like that.
 
10:11 PM
why are you mentioning it then you mental midget of a reporter
 
Meaning I'd literally mash the bullet against their face until they disappear
@Ohnana Haha, I know
 
@Ohnana Not sure what feex are, (typo?) but you are correct that there are firearms that are illegal at the federal level. And additional at the state level, for the Communist states.
 
@Ohnana Well, most people visiting the site will want to know that
 
@Xander say "fix" with a long e
 
@Xander "Assault" rifles? You mean the ones that look "tactical," but which are the same as a normal hunting rifle in every way? lol
 
10:13 PM
@Xander there are communist states in USA?
 
also i can feel a vein in my temple bulging
 
@RoryAlsop Yes. The ones that have stupid gun registration laws. :-)
 
those states amuse me. you have to register and inspect your car, but not your guns...
despite the fact that they're both dangerous pieces of machinery
 
@Xander lol. I actually thought you meant they had voted in a communist leader for the state. Surprised me, but then some people seem likely to vote for Trump and that's much worse
 
@RoryAlsop there is a communist party
 
10:16 PM
@RoryAlsop It does seem that way, unfortunately. I withhold judgement on who is worse though. They're all a bunch of useless clowns. And none of them actually intend to do anything they say.
Except, perhaps, for the ones that have no chance at all, and are already out of the running.
 
@RoryAlsop Well, we did for the country. Lol Barack Obama anti-christ ant-christ anti-gun anti-freedom anti-liberty waterboarding 9/11 patriot act kenya birth certificate gay marriage abortions runs out of breath and faints
(note: I am mocking people who take Obama-bashing to the next level)
 
Yo what's up with the fucking guns discussion again?
bye
 
@Simon Huh. Apparently we've tugged an emotional heartstring. Noted.
 
10:52 PM
@Xander Yeah, that's his trigger... so to speak. haha
 
 
1 hour later…
11:53 PM
@AviD poke
 
00:00 - 15:0015:00 - 00:00

« first day (1867 days earlier)      last day (3027 days later) »