The DMZ - 2018-08-13

« first day (2797 days earlier) ← previous day next day → last day (2088 days later) »

9:07 AM

hm

whats the markdown for tags?

security.stackexchange.com/questions/tagged/baseline

I have to say, I kinda like this one...

the name is kinda .. not fitting.. but I get the idea

3 hours later…

12:21 PM

Do you all have a root-me profile?

yessir

and I have not used it ... in 6 months or so

12:58 PM

wow, that question went off better than expected

1:22 PM

welcome to HNQ! Please, take a seat between "My carrier pigeons have been replaced by spoons: how can I send messages?" and "Is it unprofessional to car share?"

Anonymous

:p

Anonymous

lol

seriously, HNQ is really great. I really like the concept puting several question of realy diferent SE network on the same place

I kinda thought that it was HNQ material

but not that it went off so quickly

Anonymous

Is that sarcasm Kepotx?

Anonymous

1:24 PM

I can't tell :(#

well, there was only one other sec.se question on HNQ

@Joshua.J no, i really like HNQ

Anonymous

Oh.

Anonymous

(Sorry)

and i really like spoon-related question

Anonymous

Really?

1:25 PM

but yes, sometimes those who reach HNQ are... weird

98

Q: My carrier pigeons have been replaced by spoons: how can I send messages?

Yup. All my pigeons are now spoons. I knew my court alchemist was a sore loser, but I still think it's inappropriate to do that for a chess game. He vanished and I no longer have any means to communicate. Horses can also send messages, and are useful for long ones, but I still want a way to send...

medieval communication

Anonymous

I agree some of the questions are just stupid.

Anonymous

However you do occasionally get things like "Why am I not dead?"

Anonymous

And those make up for the stupid ones.

well, this one is more hilarious than stupid. and some answers are great

same for tom question, it's a good one

Anonymous

I'm really struggling with sarcasm today :'(

1:28 PM

and understandable by everyone, not sure that a cisco question will reach the HNQ

Anonymous

What Cisco question?

security.stackexchange.com/questions/tagged/cisco

I just meant that cisco questions are too specific, so it would hardly reach the HNQ

Anonymous

Oh right, yes.

Anonymous

Yes they are.

while tom question is much more general, everyone, including not security guys can understand it

Anonymous

1:31 PM

Yeah that's true.

Anonymous

I tend to answer specific questions.

Is it just me or is this stupid:

My school as a publicly accessible (no password required) listing of every student in the school with their corresponding grade.

it gets better

full name and everything @JBis?

yes

yeah.. that's not really .. good

1:37 PM

@JBis what country?

normally you have a ID that only the student knows which is also different to your student id

I mean, behind ethic/security, I'm not even sure if it's legal in some countries

One selects their name from that list and is prompted to enter a 6 digit only numeric "password". Password can't be changed and was not chosen by students it was randomly given to use while back.

US

Once logged in with the password you can see all community hours listed with dates organization and contact person for these events. You can edit, delete, and insert new records.

Note: These passwords are the same used as the student identification number from K-12. Many attendance list contain this number for each student.

My school also had a similar horror: you had to be connected, but once you get connected, you couls do some request to gather marks. You just had to change the userId to have marks from another student. Those ID where the same as the id readable in the trombinoscope. Basically, every student could see other students grade

Anonymous

^ Same here.

Anonymous

1:41 PM

Via our Intranet portal.

Anonymous

You could just go to your grades folder, back out one and you had access to your whole years grades.

So crazy but normal

Anonymous

Back one again and all years grades.

Anonymous

lol.

P.S. I wouldn't be surprised if they didn't use prepared statements. I typed something in accesdently and I got sql error page.

1:42 PM

depend of your definiton of normal, but yes. Unaceptable but still common

Her daughter is named Help I'm trapped in a driver's license factory.

user image

@Kepotx of course little bobby tables. Wanted to do that just so they would have it in there logs.

Anonymous

Yeah you didn't even need to do that with ours.

Anonymous

Just poor administration on our Intranet page.

Anonymous

But it think it's pretty common.

lol were a top rated school in state & very good in country

user image

Anonymous

1:45 PM

Usually, at least from my experience, it's because the people that work in I.T departments at schools aren't very technical.

Anonymous

Some of them might be hobbyist programmers and the like, but mostly it's just first line.

same for me, a quite well-known engineer school. Still have a crappy intranet

top logic here make them require 2 digits yet put the input big enough to see 1

Anonymous

They just don't expect people to break things.

Anonymous

I had the same issue, especially with our network.

1:46 PM

@Joshua.J or it's student project

Anonymous

It was horrendous and as I sat my CCNA R&S when I was still at school, I offered to help but they said no.

Anonymous

Or that Kepotx.

Anonymous

:D

so, guys who just know how to code but don't know how to code well, and no idea of what security is

Anonymous

Yeah exactly.

1:47 PM

bonus point if it's not well-made enough, and become a project he next year

Anonymous

Our I.T guys at school were more networky guys.

@Joshua.J Love the logic. "Oh no one will ever hack us" - Equifax at some point

Anonymous

But they refreshed the network with Cisco kit.

Anonymous

Yet none of them knew how to configure it.

new technology because new teacher (who don't bother learn old technology), and student who still don't know what they are doing

Anonymous

1:47 PM

It made me laugh when they first setup our Cisco Aps.

Anonymous

They were running them in standalone mode.

ou intranet used several diferent languages, it was just a disaster

hey lets see if there validation is through only JS and not php

@Inspect_Element

Anonymous

When we moved to digital payments.

Anonymous

Instead of using a solution made by someone.

Anonymous

1:49 PM

My school made their fucking own.

Anonymous

That was a disaster.

@JBis also use inspect element to see the request sent

you can be surprised by the number of request for a simple thing, and what/how parameters are send

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

request data contianes mime type application/x-www-form-urlencoded with Grade name and password

no cookie

Anonymous

What I always hated in school was people that installed those apps that would interact with the projector.

Anonymous

They thought they were so f*cking cool.

1:54 PM

omg

for every kid in school they have document.getElementByID("kid55").inexHTML = "";

fucking clogging up the dom

@Joshua.J well, they have more skill than other teachers at least

on ou our teacher just want to show us a movie, he struggle to do it. That wasn't a big surprize as he try to read the movie as an mp3

Anonymous

Hahha :D

@Kepotx lol

he also had a very poor version of the movie, and by big coincidence, i had it on my usb key, in 1080p. I plug my usb and use my version

Jesus at the top they misspelled document

someone isn't going to be able to clock hours

1:58 PM

he though i somehow improved the quality

we also had a computer room (that was uqually flooded with water by the way). One day, someone just unpluged a cable, so no one had acces to internet

the cable was swaying from the ceiling during all the hour, and the teacher cancel the class for internet problems

a funny thing to do is also to bring a wireless mouse, plug in on the teacher computer, and profit

bonus point if he use a projector so everyone see the teacher's screen

for fuck sake

sql inject worked

' or 1=1; --

im legit mad

I think I should email the school

@JBis you should be but you should also tread lightly now

@TomK. ik. I get aggravated easily at things like this. Need to stay calm.

and this is a high school

I guess your school will also be "legit mad" if they see one of their students trying injects at their DB :P

@TomK. Yes but in my defense it was 1. Only my account 2. I didn't pull a bobby tables 3. Just did 1=1

2:08 PM

@JBis don't email them. make an SQL injection to insert a message

@Kepotx thats funny

Not a 100% sure on the law in the US, but afaik it doesn't matter if it's only your account, it's still punishable

@TomK. how? Your not gaining access without permission.

don't know the law on US but in france you can also have problems if you go to admin pages, even if they are not secured

you have gained access to the DB now

2:09 PM

@TomK. Only to my account. (I could use it but im not)

ethicality is key here

so yes, sql injection are funny, but i shouldn't encourage you to really do it

@Kepotx im not just a simple test and now im done.

just looking out for you ;)

I think the ethical thing to do is make them know there is a problem, so they could handle it

thx

2:11 PM

there have been some weird convictions lately

@Kepotx yes.

you could however ask them if you can continue to investigate it

I just don't get it. You can't break into your own house. If I pick the lock on my own house its not illegal.

hold on im testing something

yeah, but it's not your house. they just gave you an apartment in their housing complex. and you are checking if your key works on all doors

@TomK. well I am taking a different key and trying it on my apartment. Using logic if it works on it mine it works on everyones but I don't know that for sure.

same thing as if they hashed their passwords (prob don't) and found another thing the hashes to the same hash and entered that.

2:14 PM

potato - potahto

:P

I would say a more image one would be: they gave you a key to unlock a gate, you try to open it without the key

@Kepotx and what's the problem with that

they also got bigger issues then this

still, you have enoguh information to know their system is bad. know, all you have to do is more or less choose the color of your hat and ask yourself if you want to continue by yourself or not

@Kepotx greyish white.

I can understand the "I know something is bad, i want to discover everything so i could help them", and to be honest Im ok with that. just telling you that not everyone is ok with that

2:20 PM

@Kepotx I got kicked out of school activity for admitting to dosing a consenting friend.

then I'd report this anonymously if I were you :P

wired.com/2015/10/…

did they catch me with their "advance security system that monitors everyones activitys" no. A teacher overheard me and reported it. And I stupidly admitted it. Now I know I didn't even Dos the person. I arpspoofed.

this is from three years ago, criminal prosecution of crimes and more importantly perceived "cyber"-crimes has only become harsher

ridiculous.

don't get me wrong, I don't approve of this. I'm just telling you, that the criminal prosecution of cyber crimes in the US is harsh

2:23 PM

A kid could kick another kid and lie about it: "Plz don't do that". Dos a consenting friend and admit to it: treating of suspension and legal action.

fuck off

@TomK. yes I understand

and institutions on the federal or county level (such as a school) do not wait their turn on stuff like this

wansnt there someone who found child porn on some judges computer and got in trouble for hackign

I am a part believing in natural punishment.

If you run onto a patch of ice and fall. Your fault. Next time don't walk on the ice patch.

anyway....

Im not going to alert the school. I alerted them to something worse last year and they didn't want to listen to it.

Teachers entering their username and passwords on non SSL websites (http) on every kids personal computer infront of them on an open wifi network.

Are they not asking for it?

When I saw this my jaw legit dropped.

Oh wait one last thing

Recently saw an article in the local news about how our school is extremely protected against "cyber attacks"

</rant>

<sigh>

Sigh

ah well

</sigh>

alright back to making my login site

Quick question:

over in php chat I got in trouble for using <?= $username; ?> due to xss

how can this be a problem?

(and thanks for suggestions)

2:38 PM

what do you mean by "php chat"?

SO php chat?

yes

by "got in trouble" I mean "you shouldn't do that"

and what do you mean by "got in trouble?

O.o

ah okay.. not for using it in the chat, but for using it on your site?

they yelled at you but didn't tell you why? O.o

yep

"You need to learn escaping data and stop letting your users get hacked"

in PHP on Stack Overflow Chat, 1 hour ago, by PeeHaa

You need to learn escaping data and stop letting your users get hacked

in PHP on Stack Overflow Chat, 1 hour ago, by PeeHaa

Not sanitize. Escape

They are probably correct just unsure how.

If the username is sanitizes beforehand then it should be fine

@TomK. they didnt yell that was a bit of an exaggeration :)

any ideas @TomK.?

well.. still a bit rude

well, do you know how escaping works?

don't have much time right now, got a bit of work to do

@TomK. the gist. You want characters to be treated as text rather then a command or syntax in a command like ls /Foo\ Bar.txt. You escape the space so it is treated as part of the file name not as a new argument

2:48 PM

correct

@TomK. no problem what ever you can do works :)

I am unsure how that is implemented in php

@BenoitEsnard should know something about this, but I'm sure there's a lot of reading material on the interwebz

the cruel truth is: if you only know the gist, you probably don't know enough to do it right. I surely don't know more than the gist, I just know that you have to do it

but luckily that's all I have to know for my profession ;)

I'm just not sure what could possibly go wrong

as long as there username is sanitzed

@TomK. what do you do if you don't mind me asking :)

<?= $username ?> is the short version of echo $username;

BTW just checked school page again. I was mistaken. The SQL injection doesn't work. It changes to the the page containing all the data but then immediately redirects back to login page with error. So they used prepared stamens but don't sanitize in php they rely on the JS to do it.

@BenoitEsnard yes. My original question was how to short that.

2:56 PM

If $username allows any HTML string, then you're prone to XSS attacks

You can either validate the syntax of the username (f.e. alphanum characters only), or use htmlentities while rendering the page

@JBis I'm a security analyst and consultant

@BenoitEsnard I will make sure it doesn't. But how could that be used. I get if I enter <h1>Hello</h1> then it will parse as "Hello" within the "h1" tag but how does that affect other users?

@TomK. Nice. Want to go into cyber security myself (very general on purpose not sure what yet but def not cryptography) :)

People ask me if $THING is secure and I take a hard look and tell them yes/no/maybe. If no/maybe then I furthermore tell them how to make $THING secure.

Well, what you're describing is self-XSS

@BenoitEsnard yes. How could it be used any other way?

2:59 PM

It's not dangerous by itself, but it could still be dangerous if you managed to find other minor vulns on the website, like a session fixation vulnerability

@TomK. work for company or nah

@JBis yep, company

@BenoitEsnard well I can show you code for the token gen. Its saved as cookie.

whoa, sorry Benoit ;()

Do you have any CSRF protection on the login form?

If not, then an attacker could force someone to login as its own crafted username

And then executes JS on your website

3:02 PM

ok a couple things

I do not have that thing (not sure what called) where each form has a hidden input the makes sure the form in from the website and not from someone elses crafted form.

You can only create a user from a one time referral link that is given out by me to specific people.

@BenoitEsnard not 100% sure what that is.

@BenoitEsnard I don't get this. If the username doesn't match up they can't login.

CSRF protection is the "hidden input". :P

Well, if I craft a self submitting form on my website, which will send valid credentials to your website, with a malicious script as username

This will login anyone who visits my page, and will executes JS on your website

confused

so you got a website with a form. this form does what exactly?

excerpt from token check:

    $stmt = $conn->prepare("SELECT user FROM tokens WHERE token = ?");
    #$stmt->bind_param("s", $username);
    if (!$stmt->bind_param("s", $token)) {
        echo "Binding parameters failed: (" . $stmt->errno . ") " . $stmt->error;
    }
    $token = $_COOKIE['token'];
    $stmt->execute();
    $stmt->bind_result($bla);
if(strlen($bla)>0) {
//Correct
} else {
$error = "Token was Incorrect";
}

I don't love the strlen($bla)

from signin page

$conn = new mysqli($GLOBALS["servername"], $GLOBALS["username"], $GLOBALS["password"],"login");
	$stmt = $conn->prepare("INSERT INTO tokens (token, user) VALUES (?, ?)");
	$stmt->bind_param("ss", $token, $username);
	$token = bin2hex(openssl_random_pseudo_bytes(16));
	$stmt->execute();
	$stmt->close();
	$conn->close();
setcookie("token", $token,.....

@BenoitEsnard

3:18 PM

Sorry, I have some work to do aside of this chat, and this discussion is turning into a code review / main site question

@BenoitEsnard ok no problem. May open a question but can't just paste code :)

brb

3:34 PM

@JBis there is a code review stack exchange site

3:45 PM

@TomK. Should use the more often :)

(y)

3:59 PM

Being told in PHP to use PDO.

3 hours later…

7:08 PM

@JBis So you're inserting the token into the database... seems like every time someone logs in, you're inserting a new token, rather than updating the current token value.

Somewhere along the line, the code is going to/could break and all of those CSRF tokens would be valid.

For a long-time user of the website, you may end up with a bunch of improper CSRF tokens that allow anyone to use them against a victim if there's a big enough sample size, or if a previous token was compromised in the past for any reason.

Also seems like the DB's gonna fill up very fast with a lot of users. Does not scale.

@MarkBuffalo just the person I was looking for

Yeah, this seems like it would eventually become significantly slow. You would need to run an indexer on that after a while. With millions of users logging in, constantly selecting by a large amount of rows to find a token for the usernames... like wtf:

`SELECT token, user from [db] where token = 'username'` = returns all tokens. LIMIT 1 also seems like a bad idea for this too. lol

HI

Why are you looking for me :(((

(meaning a high rep user who is not Schroeder)

lol

could you do me a favor?

7:19 PM

depends

takes like 5 seconds

okay I lied, takes 2 minutes

whaddaya need

I have this question here. Schroeder answered the question in a general way and another user later answered it very specifically

I think neo

so Neo has the correct answer, but Schroeder has the overarchingly true answer

you get me?

So you check Neo's post

which one should I mark as accepted?

7:22 PM

as the accepted answer

yeah, I thought so

They're both right

Pick the best answer for you

thanks, Mark! you are the best! :thumbs up:

exclamation mark

never gets old, right?

You know what gets old? All these recruiters hitting me up for software engineering roles

I feel like I'm in a youtube ad right now

are you looking for jobs?

7:25 PM

I think you'd be a great fit for this 6 month contract-to-homeless Javascript Engineer role in San Francisco. Pay is $15 per hour, and relocation is not covered. Are you interested?!

I heard CtH is the new hot shit right now

If I'm looking for jobs, it'll be FTE :p

so why are recruiters hitting you up?

just from SE?

or other sites as well?

Recruiters hit me up on an hourly basis on LinkedIn

Lots of irrelevant roles. It's tough to wade through the waters to find something interesting enough.

sooo why don't you .. shut down your profile?

7:30 PM

Nah, I use it to network :p

But yeah, even on SE

"Hey Mark, wanna do Javascript Testing with us?"

put some weirdo stuff on there that frightens them away

I'm already in infosec, it doesn't get any more weirdo than that

=p

2001 - 2003 California State: Remodeling of Prison Walls

What about Graffiti of External Prison Walls?

honestly though: if you are using LinkedIn to "network" then you are not allowed to whine about the recruiter spam

7:33 PM

true

I get it, it's annoying, but that's your tradeoff

Well, I mean... they're just mass-spamming random roles.

Test Engineer, Javascript... etc.

a friend of mine is in one of these "become a data analyst in 3 months"-courses and the trainer told them not to put this on their social pages because of recruiter spam

lol

Interestingly enough, I have only gotten 2 data analyst / science reach outs on LinkedIn...

In spite of the fact that it's all over my profile since I'm a data lunatic

it's currently everywhere in germany

if you are in Berlin and shout "Data Scientist" loud enough, you'll have a job by the end of the day

7:52 PM

@TomK. LOL! When you accepted neo's answer, I got the gold Populist badge! It's hard to feel snubbed when you get a prize!

^ I knew you'd get that

That's why I told him to do it lol

And yeah, neo's answer covers the "why", mine covers the "security theatre" angle

@MarkBuffalo lol

0

A: What is a difference between RFI/LFI and SSRF?

Server-Side Request Forgery CAN be an RFI It's almost the same as RFI. The same two vulnerabilities can exist within the same function. Imagine you have a web app which asks you for a specific URL, and outputs information based on the url. Let's assume RFI is blocked, and only internal hosts ar...

I'm trying to update this before getting back to work

8:09 PM

@MarkBuffalo those tokens are for login not CSRF. I forgot about the concept of change. Will...change. :p

@MarkBuffalo Why would it fill up fast? (I still care, but my site will have a max of 30 users)

sec phone

8:46 PM

@schroeder well.. erm.. you're welcome?!

when you don't comment and explain your code so you take an extra 20min figuring out what the hell you did

and when you finally figure it out you still don't comment or explain it

ah, ok

Session token then?

@MarkBuffalo Yes. But I save them as cookies (which I think is how your supposed to).

ok, so how many sessions are allowed to be active? I didn't see the rest of it

@MarkBuffalo If you woundnt mind explaining how its could fill up so fast it would be great. P.S. Isn't just easier to 1.delete and 2.add vs 1.check 2. change or 3.add

@MarkBuffalo 1 session per user at a time. May extend in future.

9:01 PM

yea, I mistook the purpose of it

If it's 1 user session at a time, you're filling up every time someone logs in

@MarkBuffalo well to deletes the token then adds a new one.

ah, ok

Device A logins in. Device B logins in to same account. Device A is kicked out.

gotta get back to work

@MarkBuffalo K thx for suggestions.

2 hours later…

11:19 PM

Back from DEF CON. Was a good year.

Sadly the closing ceremonies seem to have been at capacity.

« first day (2797 days earlier) ← previous day next day → last day (2088 days later) »

Transcript for

Aug '1813

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile