googleprojectzero.blogspot.com/2018/09/…

This is an interesting bug. It's also why I always keep kernel.panic_on_oops = 1!

The idea that a BUG_ON() does not trigger a kernel panic by default is so stupid. One of the first things I do with new machines is set it to panic when that happens.

Hell, even a WARN() should trigger a panic.

I don't really like their fix though. Changing a value from 32 to 64 bits to avoid a refcount overflow seems sloppy, even if it would likely work. I far prefer PAX_REFCOUNT.

Homework question? security.stackexchange.com/q/194553/2113

Not even sure... it's totally unclear though

To the CTF team: does anyone even know when / where we can register for the CTF this week-end?

@TomK. @Arminius @HamZa

uuh

good question

no idea

didn't check anything yet

can you try ctf.dragonsector.pl ?

it's blocked by my work's proxy

@BenoitEsnard

No DNS record for this host

ah.. then it's not the proxy

hm, dunno

page says nothing

blog says nothing

there's an email address

twitter says nothing as well

I'll send a mail then.

I think they'll probably take the CTFtime list, won't they?

Well, I've just registered our team on the CTF Time then.

Let's wait 24 hours.

it's only 24h

and you can hop on and hop off

it's like a bus ride

it's probably also the best training for your OSCP ;)

I don't understand why some people go through all the trouble of writing an answer that basically repeats everything in all other answers

@TomK. it's a frown upon technique called "hop on the rep-train" :_)

ps: i didn't read the answer nor the question

don't trouble yourself. here's the essence: browser security is important

what does "locally" mean here?

do you download the DB first? O.o

ah no, "returned by HIBP"

well, that's the idea of HIBP

Hey all, I've got a weird question that (as I see it) won

Oof, hit enter too soon

Hey all, I've got a weird question that (as I see it) won't be a good idea to post as an official question. I've made a site that sorta steals login information and then posts the info stolen to a public seven days later after sending the victim a popup telling them that they should change their login information not just for the site they're accessing but for all their other ones too due to how easy it was to get that information. I was planning on getting it up and running yesterday but...

A friend found out about it and is of the opinion that it's a pretty scummy thing to do. Honestly, I don't think so, but I'd like to hear more opinions on this matter

I mean, the way I see it, by making the users aware of their poor practices, they'll do better next time

^ this

Eh, probably, but I'm sure I could work around that. I'm really only worried about how moral it is

but are you really stealing their passwords or is there just a banner that says "I could've stolen your password. you shouldn't trust everyone on the internet, lulz."?

Morality is very relative to one individual / community

for questions wrt moral you should probably enter the philosophy channel.

It steals the info then there's a popup telling them about the password being stolen and telling them that they have a week to change it, then a week later, it goes live on the wall of shame

I wouldn't go so far

but it is definitely amoral in my book

'Hello, your password just got stolen. Please change it in the following week, because we're gonna publish it anyway. We're really nice to say that to you, but not enough to not share the infomation'

the important point here is: they haven't asked for any of this

That's fair, glad I asked. The intention was to really shock people into not falling for this kinda trick as if it's not extreme enough, I doubt anyone would actually change their stuff. But yeah, thanks for the input, this won't be happening.

it's something else if someone goes to your site and you'd guess the password or you'd crack a hash on demand. but nobody that tries to sign up on your page wants to be pentested

last thing

some people could probably lure victims to your site to steal their passwords the minute it goes onto the "wall of script kiddo"

ehm sorry "wall of look at me, I'm a cool dude"

Hahaha, yeah

Hence the seven day delay

But I get why that isn't enough

people might not change the password on all sites

Yeah

this serves no purpose but to promote yourself

I see why one could be of that opinion :)

Even worse, I thought this was right

welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf

probably the first UEFI rootkit found in the wild

Wow.

Someday we'll find the first exploit transmitted via electricity.

looking forward to that day

a german article where they report about this rootkit has this nice quote: "..we already knew that the NSA and other professional cyber criminals used eploits like this.."

just to fuel some of your nightmares

reddit.com/r/whatisthisthing/comments/9ixdh9/…

Yes it is

ah, sorry for not mentioning

wow, crazy

too bad the contents weren't uploaded to github

uh, here is more: reddit.com/r/Scams/comments/2vd1g8/scam_rentyouraccountdotcom/…

sfw

thanks for sharing @Federico

no problem at all

one more close vote plx: security.stackexchange.com/questions/194487/…

Why the fuck this answer has two upvotes??

because .. people?

The question itself is quite nice

Yeah, I favorited it because I'm curious to know the answer

Not sure there is one

It boils down to: Can you do DOM XSS without HTML attributes?

Unless there's a weird encoding trick

Haha yeah

Btw, I tried DOM XSS challenge on Root-Me

But the thing is, with DOM XSS, encoding etc are already set - less room for tricking parsers

Solved it?

I have a solution which works on my computer, but I can't get the bot to send me its cookies :(

Got a link to the challenge?

But I didn't use any "DOM XSS" as I understand it, just a typical XSS

root-me.org/fr/Challenges/Web-Client/XSS-DOM-Based

(French link sorry)

Récupérez le cookie de session...

RECUPEREZ!!

IMMÉDIÈTIALY!!

:<

And they say German sounds aggressive

no idea what "they" are talking

To be fair, French is a beautiful language & German sounds aggressive.

sure

Halt! Administrationssitzungskekseroberungsbefehl!

Sounds beautiful to me

<3 <3 <3

maybe we should just start talking in German

so people will acknowledge the beauty

or something

das kann man natürlich auch machen

Oh come on

Google detects "Administrationssitzungskekseroberungsbefehl" as French.

hahaha

Adminstration is a French word, but Sitzungsomething isn't, as far as I know.

Ich bin ein Berliner.

I see your "correct battery horse staple" and raise you a "Vorschriftsmäßige Stromspeicherpferdeanhäufung"

To get somewhat back on topic again

Are you trying the DOM XSS challenge? :o

I had a look

Did you solve it?

Not yet. Sure you didn't use DOM XSS?

Oh well...

Give me a sec

Well, I'm not sure, but it doesn't look like a DOM XSS to me

From OWASP

Yeah I found the non-DOM XSS

I guess you found the one I used

Didn't poke the params at first because I expected something DOM-related

That's also what I expected

I exploited the non-DOM XSS, and got my own cookies successfully

But I can't get the flag when submitting my payload to the bot :(

@BenoitEsnard bottom line: signing up with ctftime won't suffice

@BenoitEsnard I'll have a look in a sec

First need to fix my payload

Didn't expect these "fun" bonus filters

@TomK. Well, not surprising, I haven't heard about one CTF without its own registration system

@Arminius You mean the location one?

This is the only one which is "fun", as far as I know

Yeah

Shouldn't be an issue though

Yeah, easy to bypass once you know some JS magic

@BenoitEsnard yeah it's kinda silly

I have a dozen username/passwords in my pw manager for some weird ass CTFs we attended ages ago

Why don't you delete them? :o

because I'm too lazy

:s

sue me!

I'm leaving now

work is over

Guten Tag!

@Joshua.J Maybe if you ask nicely

Wow, I am about to hit 100 rep :D

@BenoitEsnard The bot doesn't like my solutions either

BTW, instead of accessing window.location you could also just realize there's an iframe on the page...

Did you try other XSSes - did the submission work there?