Is anyone of you guys interested in browser exploitation but has near to zero experience in it? I'm thinking to start diving in it playing with some very outdated software - maybe that Tim Berners Lee browser running on NextSTEP - and gradually moving to newer and more interesting targets.

At the very least, it could be interesting from an historical perspective. If you like the idea, we could start a Slack Channel and 'sploit software no one cares about anymore for a lot of fun and no profit (sort of a CTF, but with real-world software). Given the fact that I was thinking to start on old systems with zero mitigations, it could even be a general intro to binary exploitation.

Let's totally rock pwn2own 1991

Exploitation of browsers from that long ago would have little relation to exploiting modern browsers. The classes of useful attacks have changed significantly.

Sure, a lot of the stuff that is commonly targeted now didn't exist back then. Still, I think it would be useful as an introduction to basic binary exploitation - before moving to more interesting stuff.

I wonder why StackExchange is so damn protective of a user's email address. I recall not being able to recover a previous account because I forgot the 10minutemail address even though I had the password, since the staff refused to give me the email. But I just realized that gravatar is used so the emails are already virtually public...

Anyone know what the exact format of a 10minutemail address is?

Gravatar leaks users' email addresses?

Well sort of. Gravatar images are created using an unsalted MD5 of the user's email address, after converting to lower case.

So I just have to find out what 10minutemail address resolves to 581daa3d4178be147f10687d92723c38 and I'll be able to get into my old account.

And yet Stack Exchange staff still refuse to merge accounts...

Its looks like they are using f[7 digits]@nwytg.com at the moment

Not sure if they're using different domains

I seem to recall nwytg.com was not the domain used when I signed up.

Oh wasn't it trbvn.com last time?

Not sure

MX records don't match

Perhaps it's not using that one anymore.

10minutemail is 10minutemail.com right ?

There's also .net & .info, with different domains

Well, f[7 digits]@[5 lowercase letters].com is bruteforcable in one week, with 2 GH/s

Indeed, but right now I'm not at my cracking rig and I'm hoping I can get it working tonight on a free shell I found, which can do like 1000 H/s lol.

@forest Would you mind putting these three comments into one answer? I think it's basically a copy/paste job and the case can be closed

@TomK. Done

cool, thanks

Huh, I wonder why this isn't getting my email... bpaste.net/show/5866f1b66bb4

I'm 90% sure it was an @trbvn.com address.

seems you are a few percentage points off :>

Well yeah but most likely I just made a mistake and am not using the right format.

Or I misunderstood exactly how gravatar hashing works (but I don't think so).

It doesn't add a newline or null terminator when it hashes, does it?

btw, don't have time to write an answer right now for this question, but is this what you are looking for?

specifically this: msdn.microsoft.com/en-us/library/windows/desktop/…

Nope, that's the API to use, not the entropy sources.

true, but

erm

I think this is supposed to show (at least) part of the entropy sources: msdn.microsoft.com/en-us/library/windows/desktop/…

I don't see where it mentions any entropy sources.

Seems to only talk about the uses of the CNG.

ah... yeah, nevermind. I thought the image was showing win32 applications as an input for rng

as possible sources for number generation

(was just skimming through the text)

@forest: K Alzhrani: Windows and Linux Random Number Generation

Thanks! I'll read that.

if I have time, I'll write an answer, but now back to work ;)

Skimming through the paper, it looks like it uses a few HWRNGs (TPM, UEFI, RDRAND), as well as "timing information" (a bit ambiguous), and a seed stored in the registry (kinda like Linux's /var/lib/misc/random-seed). It doesn't make any mention of those >150 entropy sources described on the Microsoft blog.

Oh yeah I forgot it also took stuff from ACPI's OEM0.

@forest en.gravatar.com/site/implement/hash

md5(lower(trim(email)))

So I think you got the format right

I bruteforced all [lowercase][7 * digit]@trbvn.com without success

Huh, I guess I'll have to see what previous domains were used. I know I recognize trbvn.com, but perhaps a different one was used when I registered.

@forest note that the paper was released in 2015, so I'm not sure if it includes win10 solutions

I think it's likely that Windows 10 is not significantly different from Windows 8 (which the 2015 paper uses) in how it collects its entropy.

if you have any plans/program please let me know

@forest if nothing works, you know what to do

What, exploit SE? :P

flood the system with electricity

I see a pattern, people who hang out in The DMZ are more likely to get locked out of their accounts.

Haha

Well if I flood it long enough I can capture the internet! Then it's just a hexdump away from seeing what my original email is.

exactly

@forest: meta.stackexchange.com/a/204540/284468

Looks like they're salted now

tomanthony.co.uk/blog/… $1337 is way too low :(

The fact that gravatars can be used to reveal emails was actually used in a major journalistic scoop a couple of years ago in Sweden. A tabloid could publish the batshit crazy rasist and sexist comments politicians from a nationalist party had been writing all over the internet, in the naive belief that they were anonymous.

@BenoitEsnard agreed, they should have right padded it with a few more zero's

^

I'd love to see an estimation of potential revenue of a scam like that

SEMRush estimates the traffic he got at $33.2k

I guess it could have done much more by using more domains, more keywords, etc.

The traffic was still increasing by a lot

but isn't that just cost?

or do you approximate revenue from traffic cost? O.o

This is cost indeed, my bad

Hey guys, would it be possible to do, more or less, a reverse DoS.

What do you mean? Send less traffic to a site?

I can take it to its extreme and send no traffic to a particular site

@RoryAlsop You would send too much data to the computer instead of the server.

Eh? That's a DoS. Whatever the target is, you are denying service.

I'm not saying doing a DoS on a server, but giving the client too many packets of the website. Instead of the computer getting one series of packets, the computer would get multiple series of packets.

@ds_secret DoS just means Denial of Service, it does not specify what type of service that is

@ds_secret still DoS

not a widely-used practice, but still the same principle

@TomK. I'm asking is it possible, or would it be blocked as a malicious attack by a computer

it's possible. if it gets blocked depends on a variety of things.

my first guess though: the way you describe it, it sounds as if only the browser would crash

if at all

@TomK. Thanks Tom K.

hi

hi @user3865772

@HamZa We're in a similar situation then. I come from a web/mobile app sec background and I've only recently started to studying binary exploitation (Corelan Tutorials, The Shellcoder's Handbook, etc).

The plan is to build home labs with relevant versions of major operating systems equipped with major releases of common browsers (I was thinking of Internet Explorer, Opera, Firefox, Safari and Chrome) and developing exploits for them starting from the first versions, using both already known vulnerabilities and the ones we discover (shouldn't be hard, in hindsight, at least for the very outdated software

I've seen things like title[256], where title is the content of the <title> tag. Also, we now have modern static analyzers and fuzzers).

If you're interested, drop me a mail at totallynotmyrealemail.browsexp[at]gmail.com and I'll invite you to the Slack channel I'm creating now

@NotNow my email is in my profile, thx in advance

Done, you're welcome

If you know someone else that could be interested, let me know