The DMZ

3:54 AM

Heh, @RoryAlsop it seems a comment on Crypto.SE was taken out of context by a certain madman and plastered as evidence to support conspiracies :P

reallyreallyrandom.com/about/dont_believe

Right under quotes from Vladimir Lenin and Joseph Goebbels.

Tom K.

6:43 AM

wow

isnt that something

how did you stublme upon this @forest?

forest

7:00 AM

@TomK. Posted by the madman himself.

Paul Uszak

4.7k 1 11 29

For reference:

Exactly what @forest said - my "almost" does not refer to any conspiratorial theories Paul, or anyone else across SE for that matter, has come up with. For purposes of SE please strike out the word "almost" in that sentence. — Rory Alsop Mar 29 at 10:48

So instead he decided to put it on his site, and make it bold instead of removing it. :D

tl;dr crazy guy who thinks that WEP is an NSA conspiracy and that we should use the Pearson hash (a literal checksum) for everything, that Crypto.SE was taken over by the NSA, that reverse-biased zenner diodes are a foolproof way to construct a TRNG, and that the only way to be safe is to use OTPs (not one-time passwords, one-time pads!).

Also that pi can't be used as a nothing-up-my-sleeve number.

Even $\pi$ is completely suitable as a value for NUMS for algorithms that require constants with a special structure. The Oakley DH groups for example use a prime $p$ created with the simple equation $p = 2^n - 2^{n - 64} - 1 + 2^{64} (\lfloor 2^{n - 130} \pi \rfloor + c)$, where $n$ is the desired size of the modulus and $c$ is the smallest non-negative integer which makes the result a safe prime congruent to $7 \mod 8$. — forest Mar 23 at 3:07

-6

A: Nothing Up My Sleeve Lim-Lee Primes

An excellent question and good example of a NUMS that shouldn't be used. For full disclosure I don't really know much about DH key exchange, and nothing about Lim Lee Primes. Sounds like a 7/11 shopping mall. I mention this though specifically for that reason. There are people who know about ...

Anyway yeah, was just amused that I found his website where he quoted @RoryAlsop out of context. tl;dr generic crazy crypto guy with no threat model.

Tom K.

7:21 AM

i love how every 2nd sentence of his speaks about his limited knowledge of crypto

forest

Ikr. It's weird because he seems to know some terms and a little bit of the math behind it, but doesn't seem to understand even the fundamentals in a way that he can apply.

> For full disclosure I don't really know much about DH key exchange, and nothing about Lim Lee Primes. Sounds like a 7/11 shopping mall.

Someone who says that should probably not be giving advice on NUMS!

Tom K.

48

A: How can hashes be unique if they are limited in number?

how can for example SHA-256 be unique if there is only a limited number of them?! Where your issue occurs is that they're not unique. It's just very improbable that they'll reoccur. Unique in this context is not a mathematical definition, it's a humanist one. In terms of human numbe...

look at that, another old friend

forest

Took me a second to realize :P

Oh interesting, looks like on the network accounts page, even for questions that have been anonymized, it still shows the number of questions asked (despite the individual site saying nothing was asked).

Tom K.

7:51 AM

@HamZa yo: ctftime.org/event/568 :)

@BenoitEsnard

@Xavier59

uuh

"This will explain you how AEOI CTF was renamed into ASIS CTF is sponsorized by the Atomic Energy Organization of Iran and Sharif University, how this CTF is a honeypot for Iran’s cyber army and a training for Iranian young hackers."

"In summary, we have examined Iran’s cyber capabilities, including the TTP’s and significant targets of major hacker groups. We have tied members of several major Iranian hacker groups to one another, as well as to major regime-sponsored universities. [...] We have explored these groups’ involvement in CTF competitions sponsored by Sharif University and by the Atomic Energy Organization of Iran, Iran’s entity that oversees all nuclear research. These points support the theory that the regime trains young hackers. Additionally, we have found that the actions of Iranian hacker groups are in s…

Tom K.

8:37 AM

@schroeder feel free to delete all comments then

Benoit Esnard

9:40 AM

@Arminius I once had access to private betas which I wasn't invited for, I contacted SE and they told me that was "by design"

Xavier59

11:07 AM

@TomK. sadly given the amount of work I have to do I won't be able to play any ctf before july ! :(

Tom K.

11:26 AM

@Xavier59 wow, that's a long time :/ i will stop pinging you then (only until july! ;)

Benoit Esnard

11:46 AM

Does anyone know why SE bug bounty program is still private?

Tom K.

maybe @JourneymanGeek

Journeyman Geek

ah erm

not yet? ;p

I don't actually work here yanno ;p

Tom K.

that's why I said "maybe" and not "surely" :P

Journeyman Geek

;p

entirely unrelatedly

Tom K.

what?!?

Journeyman Geek

11:59 AM

wrong room ;p

anyway

Tom K.

haha

Journeyman Geek

I wouldn't be quite surprised if it got put off cause of the hunt for the new director of security + well, recent events

Arminius

@BenoitEsnard "by design", eh? :-)

Tom K.

that doesn't make too much sense to me tbh

"hey, we need a new CISO, we have extra juicy XSS vulns in our site! we left 'em all for you! come join us"

Arminius

I'm also hoping they open up their HackerOne program soon

Journeyman Geek

12:04 PM

Sometimes its worth asking what happened on meta

@TomK. Well, that's something the new CISO should administer

and it seems to make sense to actually get him in on the details

Arminius

But it appears the position is still open?

Journeyman Geek

Possibly!

I've not heard anything on the grapevine

I mean, I couldn't tell you if I did, but I didn't

Arminius

At least on the job page it still lets you "Apply"

Tom K.

didn't someone say that it's pretty much already all planned out...? very shortly after the job opened iirc

Journeyman Geek

ah

I've not heard anything... ;p

Tom K.

12:07 PM

I might be off though.. it's been a while

Arminius

Still bold to start the bounty program before hiring security people :-)

Journeyman Geek

Quite literally the place to hear these things is the right twitters.

Tom K.

@JourneymanGeek well, a new CISO would probably say: "yo, tech guys, fix that crap. give me a timeframe, do it in order, document it. why haven't you done that already?"

Journeyman Geek

lol

I think slightly more complicated than that

cough

Tom K.

@Arminius it's just outsourcing :P

well, it's the gist of it

my argument is, not much would change regarding the mending of an XSS vuln if a CISO is in the company or not

Journeyman Geek

12:11 PM

@TomK. but you'd just email them

rather than get bounty

and I'm under the impression SO corp's processes for things like that are still pretty informal

Tom K.

me too and that's another reason why I dont get that they are waiting with the fix, unless it is a veeery complicated issue

idk, maybe it's just a company culture thing europe/USA thing

Arminius

It wouldn't be that bad if they communicated more clearly

For example, after re-inquiring in February they said "you should have a status update soon" which doesn't really give me anything

Except it was the first time I actually got a ticket number to refer to

Journeyman Geek

12:37 PM

tbh? I think its partially that its slightly messy in general, and partially there's a bit of passing around of tickets and stuff gets lost :(

Rory Alsop

12:56 PM

Wow @forest - I'm in there with Lenin and Goebbels. Should I feel proud, d'ya think?

Position still is open at present. From various folks who went for it, I think it has been a learning curve for SE. A good one, I think, but steep

Arminius

1:30 PM

Does security.stackexchange.com give anyone else an IIS Window Server error right now?

Splash screen rather than error

Benoit Esnard

No error here

Arminius

Twitter disagrees

Benoit Esnard

No problem on SO neither

Arminius

Benoit Esnard

Wow.

Arminius

1:37 PM

That's what it looked to me for a minute

Now it's working again

Benoit Esnard

11

Q: Most of the SE sites are down

Most of the SE sites are down for few mins, but MSE is working fine.

bug stackexchange

"We're aware of the issue and yanking the affected web servers right now"

I guess I was load-balanced to the correct servers

Tom K.

1:52 PM

weird behaviour though

showing IIS splash screen

Benoit Esnard

2:19 PM

> We are in the process of upgrading our web servers. During the rebuild of a server it went back into rotation before we were ready for it go back. This resulted in the "Default Web Site" that comes with an IIS install to appear. HAProxy regarded the page as a valid response and put it back in rotation.

Tom K.

that makes sense

has anyone here tried out/tested/read something about 1.1.1.1 ?

what I read so far sounds kinda good, but a bit too good to be true

Benoit Esnard

Not tried yet, but seems to be good

AndrolGenhald

It's nice that it can do DNS-over-TLS and DNS-over-HTTPS, but I have a feeling a lot of people are going to just set it as their default and think it's more private when it doesn't actually change much if you don't make sure its encrypted

Arminius

2:48 PM

We're routinely linking to this question for questions about determining what type of encoding may have been used (I do, too) But isn't that thread pretty specifically about base64?

IOW, is that a useful generic duplicate target as we currently use it?

AndrolGenhald

@Arminius I've wondered about that too, but the accepted answer has that bit about reverse engineering which should be useful regardless of the encoding, so it's not completely useless as a duplicate

probably not the best though

Tom K.

^this

don't we do that pretty often? mark questions as duplicates, not because the question is the same, but because the answer of the dupe target also answers the dupe question?

Arminius

3:28 PM

@TomK. Sure, and I considered the answers, but I don't think the answers go into depth about different techniques to identify unknown strings

genaray

3:44 PM

Guys ? Is there a way to discover the SMB-Username of a certain device in my lan network ?

Arminius

At least I feel they don't outline a general approach including things such as entropy analysis like in Totally unknown file analysis approaches on RE.SE

genaray

@Arminius This isnt reffering to me right ?

Arminius

@genaray No, sorry, I was just continuing my thought from eariler :-)

Benoit Esnard

@Arminius Different techniques?

There's only a single good technique actually

Known as FWE

It can recover any format with 100% reliability

Even when the string was corrupted, on a damaged hardware

genaray

When i run an NMAP scan it tells me that the computer name is "Dell-PC" for example... can i use the computer name to determine the SMBUser name somehow ?

Benoit Esnard

3:56 PM

My real estate agency just sent me an email regarding the creation of a new "security related" email address

Arminius

What's that

Benoit Esnard

They give some tips regarding the creation of a good password :
- it must be easy to remember for you
- you should end your password with an uppercase letter, instead of starting with one, since everybody starts a password with an uppercase letter
- you should put digits at the start, not at the end. Or put them at the start & at the end

I email the address to ask whether they are working on a bug bounty program

genaray

When i only have one account on my computer... can i login using smb from another one ? My credentials should be right ... but metasploit smb_login always gives me that error : Correct Credentials, but unable to login as : Dell

Arminius

Putting digits in unexpected places - cheeky

genaray

Can anybody answer my question ? :/ Could really need some help right now

Arminius

4:06 PM

Not sure Samba experts are around in chat

Benoit Esnard

@genaray I don't have the answer. You'll have more visibility on the main site, since the chat has only a few users.

genaray

Hmm alright ....

Tom K.

4:18 PM

@genaray remember, we do this for fun, not because we have to ;)

genaray

@TomK. I know ^^

HamZa

5:44 PM

unfortunately i can't participate this time
i'm going to france this weekend

@genaray when in doubt, check the source: github.com/rapid7/metasploit-framework/blob/master/modules/…

Tom K.

alrighty, this thing seems kinda fishy anyway

HamZa

@TomK. you mean the CTF?

Tom K.

yup, I posted some info regarding that before

Rory Alsop

Oh, the rookie I'm mentoring for B-Sides London has just headed off for a CTF in Ireland. Sounds fun

Tom K.

some affiliation with the iranian government

(not the one in ireland)

Rory Alsop

5:59 PM

heh

HamZa

i didn't read the whole source but I can say that ASIS CTF is one of the more difficult ctf's i played at

I actually do not see why a government should NOT empower the youth and encourage them into security

Rory Alsop

UK gov certainly does

they have a series of cyber challenges

pretty good actually

Tom K.

@HamZa agreed, but I guess a CTF that is officially backed by the Atomic Energy Organization of Iran is probably watched by other agencies and state actors

and I wouldn't want to see my name on a watchlist of a three letter agency

HamZa

@TomK. true, but we're just small fishes

Tom K.

@HamZa definitely, and I'm the smallest of them all, but why take the risk if there are a thousand other ctfs?

HamZa

6:08 PM

i don't see a risk at all
you think they are going to track you?

I'm honestly more worried about my own gov. trying to "bust me" when I'm doing pentests < which is admittedly not something i should worry about, they don't care as long you don't bring some major damages

Tom K.

@HamZa my boss calls these risks "nuclear power plant risks". extremely small probability of occurrence, but extremely high fallout

Rory Alsop

@TomK. weird. I would say very low fallout possibility

why do you say high?

Tom K.

if I were a state actor and was afraid of cyber attacks from Iran, I would monitor everyone who's participating

HamZa

@TomK. worst scenario i can imagine is that they backdoor a certain reversing challenge \o/

Tom K.

@RoryAlsop possibility low, damage high. well damage for me personally would be being monitored, being on a watchlist, maybe my domestic intelligence would get a hint about me

which could have implications for my work

Rory Alsop

6:13 PM

@TomK. for taking part in a ctf?

Tom K.

backed by an Iranian agency

Rory Alsop

my assumption is that being a security professional will get you monitored, at least lightly

Tom K.

and that CTF is supposed to be their "recruiting program"

maybe I should've included that earlier

Rory Alsop

that may make a wee difference, sorry - I hadn't realised that :-)

Tom K.

yeah, I wrote that earlier in the first post about it, but that's some hours ago

but I don't know how serious that really is

HamZa

6:15 PM

@TomK. tbh, i think they only recruit locals/same race

Tom K.

there are people organizing and partaking in this that allegedly were involved in some "cyber crime" or whatever you want to call it by Iran

I don't know how serious all that is and as HamZa already pointed out, we and myself especially do not perform too interestingly in these events that we would make good targets

but as I said, there may be a risk, so why take it. (even if it's just paranoia on my part ;)

HamZa

the moral and law system is very different in those kind of countries

Some countries actually do not care if you hack other systems in other countries.
But now a days those hackers living in those countries need to be extra careful. In the sense that if they hack a relatively big target/do a big damage, the authorities might get nagged to track them down. Most of the times these requests are from countries that have some kind of "friendly relationship". But since almost everyone evilizes iran, it's almost a heaven for those hackers (kind of like russia where they don't hand you over)

at least not easy

from a military/economically perspective, it seems to me actually a very good move from their gov. part. Honing raw offensive skills from the streets, and at the same time let them do damage to the other countries so long they don't touch their own systems.

Tom K.

@HamZa well, I do live in a country that is on exactly that side of the fence and for some parts of my job I do need a certain government issued certificate that I'm "clean" ;)

@HamZa agreed. Germany is trying something a bit more civilized and it is not working ;)

HamZa

@TomK. hehe, we have that kind of stuff here too in the netherlands. The highest level of screening: they can look into your past for like 8-10 years, the past of your GF/wife and look which countries you lived in, heck i wouldn't be surprised if they looked into my friends too

Tom K.

@HamZa fortunately I'm one level below that, so it's without questioning friends/family. only you yourself get asked, but also 10 years back into the past. places you've been, if you have debt or other things you can be blackmailed with. that kinda stuff

HamZa

6:28 PM

Today i read an article written by a jurist (law specialist?) in laws of cyber stuff
So a student asked him if he is obliged to report his teacher. Apparently this teacher in cybersecurity class showed them how easily it is to hack phpmyadmin with google dorks and showed them a demonstration

I'm like "what, seriously? he's teaching you responsibly, it's not like he actively did damage"
But according to law, entering any kind of system without permission is prohibited

this kiddo took it to the next level by asking if he's obliged to report him

Tom K.

m(

yeah, we have that same law here, and there's a similar law in the US on the state level

HamZa

this is how you get blocked (development wise)
in countries like iran/russia no one cares if you did this
here you need to think twice, read somewhere that "pure offensive tools", the mere fact they are on your machine, is illegal

Tom K.

don't you make contracts with your clients when you are testing their systems?

you can circumvent this in germany if your client says that you are allowed to do this

or are you talking about bug hunting?

or do you prefer not to comment? :P

HamZa

yes we do, but i'm talking more outside of work
if you want to have the next generation kids to be rockstars, i don't think you can achieve that by restricting them and scaring them to have such tools
on the other hand, if everything is wild and loose, that's also not good

Tom K.

well, the kids that will be rockstars are typically not afraid of this kinda stuff :>

HamZa

6:33 PM

i see some kids in 3rd world countries they don't understand $h!t about CS/algo/and sometimes even programming
but apparently they have so much "raw experience" into pwning stuff (although admittedly quite low hanging fruits if you ask me)

Tom K.

well, the netherlands laws won't apply to them ;)

what is your exact job description?

HamZa

@TomK. i don't know tbh, everyone at my company uses a different title, some use "security engineer, some other "application security specialist" or some other variations

but we do a range of different pentests ranging from web, mobile, windows/linux, networking/infrastructure
also redteaming

Tom K.

oh alright, that 2nd part helps :)

HamZa

i do mostly web, mobile and sometimes infra/windows
although admittedly i don't really have much experience in windows
we get those assignments "here's a hardened laptop, can you become admin"
i need to brush my PowerShell skills

Tom K.

sounds like fun

HamZa

6:42 PM

hahaha

did you know that room owners can see deleted messages ;_)

Tom K.

no, that was news to me

genaray

Anyone here who knows how to run ettercap from terminal ? :/

Tom K.

Google knows: kioptrix.com/blog/ettercap-command-line-basics

HamZa

just "google"
also https://www.bettercap.org/, they say it's "better" :p

genaray

Can i also redirect traffic using bettercap ? ^^

Tom K.

6:47 PM

@genaray It is all there in the internet. We are just way too polite to say "RTFM". :)

also please see the channel description :)

genaray

Thanks a lot and sorry... im still a beginner >.<

Is it possible that sometimes pentesting is really frustrating because nothing works ? Just trying to get ettercap workin... and everytime i fix a error message i get a new one

Tom K.

no problem in being a beginner, just have to learn to ask the right questions ;)

Arminius

7:04 PM

Any time I leave chat for an hour there a removed messages I'm curious about

There must be some bug to uncover removed messages...

AndrolGenhald

Well at the very least it shouldn't be too difficult to log all messages as they arrive

genaray

7:24 PM

Where the hell are the ettercap plugins located ? -.-

Why do they hide them >.<

Arminius

strace may show you

genaray

Well i found them... but they arent compatible with ettercap windows instance... dammit...

HamZa

@Arminius become room owner :P

Arminius

The only trick I know is how to stop being room owner :/

genaray

are there similar tools to ettercap ?

HamZa

7:38 PM

@genaray what is your endgoal? what are you trying to do?

genaray

I just wanna redirect the traffic of a certain pc :/

But ettercap always gives me errors...

HamZa

@genaray redirect? you mean mitm?

genaray

exactly

HamZa

wait, you're on windows?

genaray

Im trying to be flexible... I have windows and kali linux

and as an addition kali linux as a windows subystem ^^

HamZa

7:41 PM

@genaray dude, google "bettercap mitm", you'll find tons of tutorials

for "sec purposes" i usually setup a wifi network (well because mobile app pentests)
and then capture all traffic with wireshark on the wifi network interface

genaray

Alright thanks :) ... btw you dont know what a "Error 94 : Socket type not supported" means ? I cant find anything regarding ettercap...

HamZa

no idea, i'm more of a software guy

Tom K.

8:16 PM

@HamZa that's the sweetest execuse

just fill in the opposite *-ware

for whatever question comes up

HamZa

hahaha
to be honest I think i can figure it out if the problem was in front of me
but i'm writing a security report and don't have time to debug such matters

Tom K.

@HamZa wait, how do you respond w/o the @username?

HamZa

@TomK. hover on the message, on the right side, there's an arrow

more specifically, you need to prepend your message with ":<message id>"

Tom K.

@HamZa uuh

@HamZa no..

I use the arrow on the left usually ;)

HamZa

@TomK. lolwut maybe i'm confused what you meant

Tom K.

8:20 PM

@HamZa here's a response without "@TomK."

HamZa

different color :P

I guess
multiline :P

Tom K.

and I was wondering how you did that, I am aware of the typical reply feature

is that
it?

HamZa

FWE driven debugging hahaha

Tom K.

:44218998 trying yourself now? removing messages to appear more interesting? :P

@HamZa the best kind of debugging

so single newline does not suffice

Arminius

Still couldn't find a way to access removed messages :/

Useless CSRF of the day: Forcing users into mobile view

HamZa

8:30 PM

@Arminius r u testing with a room where you're an owner already?

Arminius

@HamZa To be precise, I'm testing with a room where I removed myself from the owners

genaray

Hmm it seems like im unable to redirect traffic... Everyone who visits microsoft.com should be redirected to my ip adress... that doesnt happen somehow... the victim can still visit microsoft

Arminius

What protocols are you redirecting?

genaray

http ... i just see it always switches to https in the url bar

Arminius

That's because of HSTS

Try with a plain HTTP site first

Try http://example.com/

genaray

8:43 PM

Alright :) is there a way to bypass HSTS ?

Arminius