The DMZ

« first day (2835 days earlier) ← previous day next day → last day (2050 days later) »

3:00 PM

I actually got my marshall badge flagging spam - and there was a joke that the mods could save a lot of time since I could handle my own spam flags ;)

Tom K.

clever

Anonymous

3:34 PM

I'm Forests' daughter?

Anonymous

I wish.

Anonymous

But now I'm confused because I thought Tom was my dad... :p

Arminius

forest took you with him from his first marriage

Anonymous

Arminius

You've got two dads now

Anonymous

3:36 PM

But wait, I'm not a female - this point is vital...

Arminius

Modern times, I guess

Anonymous

How could I be his daughter?

Benoit Esnard

@Joshua.J Can I be your 17th cousin?

Anonymous

Can I just turn 18 so this dies? lol.

Anonymous

Or are you then going to advocate the numbers 1-8?

Anonymous

3:37 PM

lol.

Benoit Esnard

Actually, maybe we are already.

Don't use the 18 meme yet. We're hoarding it for later. Use 17 until further advice.

Anonymous

Hehehe.

Arminius

17 + 17 = 42 ...coincidence? I don't think so.

(I already did the math, you don't need to double-check)

Journeyman Geek

@Joshua.J I'm not going to judge and assume you can't be his daughter just cause you're male

Anonymous

But if I am male then technically that makes me his son.

Anonymous

3:40 PM

As I identify as a male.

Anonymous

Arminius

You can identify as anything you like

Benoit Esnard

17 everywhere!

Anonymous

I accidentally just sent :p in an email to a customer.

Anonymous

Facepalms

Arminius

3:41 PM

At least you never signed off an email with "Best retards, ..."

Anonymous

Oh my, you did that!?

Anonymous

Haha, that is so bad but so funny.

Anonymous

Someone broke the number 17 appearing in every message! tuts

Arminius

I genuinely did "Best redards" in a bug report email which I copied over to a few other emails until I noticed. That's bad enough

Anonymous

Yeah that is quite bad.

Anonymous

3:47 PM

I imagine you got the piss taken out of you for a while from colleagues?

Arminius

It was a mail to Paypal

Anonymous

Oh.

Anonymous

Do any of you have any experience with pen-testers exploiting DoS vulnerabilities during pen-tests?

Anonymous

I was under the impression most pen-tests scopes say not to exploit such things especially in cases where you gain no extra control over the device, you're just merely knocking it over..

Anonymous

In this case, our customers contracted pen-tester exploited a vulnerability in a Cisco ASA that knocks it over.

Benoit Esnard

4:05 PM

I guess it depends how easy it is to DoS.

If I can DoS by doing one single HTTP request, then I consider it as a serious vuln

Anonymous

Basically, if you send specific UDP packets when the device is running IKE it will just kill the ASA because of the way it handles the session.

Anonymous

But, they did this during business hours and not only did they run it on the primary after they knew it was vulnerable to this attack, they ran it on the second ASA as well.

Anonymous

So they killed the failover by running the exact same attack.

Arminius

Well, yeah, it's irresponsible of a pentester to attempt a DoS on a live system if they know it's going to impact the business

Anonymous

Yeah... I'm a bit confused why they would try this.

Arminius

4:11 PM

But I wouldn't say DoS is categorically out of scope during pentests

Anonymous

Especially as they ran a vulnerability scanner against the device beforehand and they knew it was vulnerable.

Anonymous

And then they just knocked it offline anyway.

Anonymous

I'm slightly confused as to why they would do it.

Anonymous

But hey! Not part of my job description so :p

Arminius

That's why you need to clarify scopes

Anonymous

4:12 PM

Yeah :p

Anonymous

Well that's the customers problem, not mine :D

Anonymous

Heh, they hired the pen-testers and didn't consult us on anything that could affect the network so.

Anonymous

There is the reason for the network going down for 10 minutes I guess.

Anonymous

My job done! lol.

Rory Alsop

4:31 PM

@Joshua.J yep - I have run a couple of these for global corporates. Usually using a whole ISP to properly stress test.

rare though

and only for specific purpose

@Joshua.J that makes no sense though - unless the client disbelieves the vuln, in which case they may need to see it exploited

maybe

Anonymous

5:12 PM

@RoryAlsop Well, I know that's my entire point. I don't know why they still ran the exploit.

Anonymous

They knew it would crash the ASA, ran it anyway, then when the primary went down they ran the exploit on the secondary as well.

Anonymous

As for our client disbelieving the vulnerability, that was not the case.

Rory Alsop

5:26 PM

@Joshua.J that just seems reckless, zero value add, and causing impact. We used to only ever run dos or ddos with a contractual term ensuring we were not held liable for cost to the business of outage.

Wouldn't even think of doing it without that, as the client could hold the tester liable

Anonymous

6:22 PM

Yeah, I really just don't get it.

JBis

10:05 PM

How is the certificate valid for 1.1.1.1?

the cert is a wild card for *.cloudflare-dns.com

1.1.1.1 != *.cloudflare-dns.com

Arminius

10:21 PM

@JBis

X509v3 Subject Alternative Name: DNS:*.cloudflare-dns.com, IP Address:1.1.1.1, IP Address:1.0.0.1, DNS:cloudflare-dns.com, IP Address:2606:4700:4700:0:0:0:0:1111, IP Address:2606:4700:4700:0:0:0:0:1001

JBis

@Arminius Oh.

Arminius

God... formatting in chat is so painful

JBis

@Arminius +1

Thanks for that. Should have looked harder.

Arminius

@JBis Yeah, it wasn't obvious for me from inspecting the cert within the browser either

Exporting and $ openssl x509 -in cloudflare.crt -noout -text gave me all the information

JBis

@Arminius ah