The DMZ - 2020-01-30

« first day (3332 days earlier) ← previous day next day → last day (1553 days later) »

8:10 AM

@ConorMancone Yeah boy!!

Also I'd like to sign up for your website for preemptive nuclear strikes. Does it use HTTPS?

@ConorMancone Yes. Community edition does not allow you to save projects, which is most useful in commercial settings anyways. What you will care for the most is the proxy, the repeater, the interceptor and the intruder

and by "proxy" I mean HTTP history

Oh wait, I think intruder is not part of burp community

Whatever. Repeater is the meat of Burp for me

Anonymous

8:34 AM

@JourneymanGeek @MechMK1 those pings were rather... Cheesy.

Anonymous

So hey, listen to this story, you'll love this.

Anonymous

Here I am staying in a hotel, they offer complimentary breakfast I decide - I'll have some of that, so I walk on down to the lobby. I get to the lobby, I go on over to the breakfast area and get myself a nice plate of food; some bacon, hash browns, sausage, egg, bit of toast and a lovely cold glass of orange juice.

Anonymous

I sit down, everything is normal so far, however, guy on my right? Well, he's on his lovely corporate macbook, all good so far though.

Anonymous

What ever could happen you wonder? Mr. Corporate laptop man decides "I need to use the restroom" so he get's up from his shiny MacBook and he wonders off to the restroom leaving... Wait for it... leaving his lovely corporate MacBook unlocked and out of all the people in the world he could leave his laptop unlocked next to he leaves it next to me, the hacker.

Anonymous

Story continues...

Anonymous

8:40 AM

He eventually comes back, I finish my breakfast, get another glass of OJ and as I'm walking out I turn to him and say "you should not leave your laptop unattended and unlocked next to strangers" and he turns to me and says "why not? what are you some kind of hacker?" and I laughed and said "yes I am, lets hope your wife doesn't find out"

Anonymous

Now, you may be wondering why I said that last part, well, here's why - you see, when he left his laptop unlocked I could see his screen and he made a big error, he also left a chat window running (minimised) he just forgot it had push notifications so what did I see oh that's right I saw a chat with a woman who was not his wife (his wife and him were his background which I saw when I sat down) the woman in the picture of the notification was not his wife.

Anonymous

I have never seen a mans face drop so quickly as I did when I said "lets hope your wife doesn't find out" - and that ladies and gents is why you don't leave anything unattended at all, let alone unlocked.

Anonymous

By the way, I realise I've written this like a comedy post or some kind of stand-up joke, I am afraid to say; it's not. This really did just happen and I wish I was joking.

9:33 AM

Ohhhh yeah boy, big dick hacker moment

9:59 AM

Guy: "So how serious is your job?"
Me: "I'd say very serious. After all, the security and privacy of people world wide depends on people like me."
Also Me: "Haha, look at this gif of Squidward dabbing!"

user image

Gif for reference

Oh no it doesn't stop. Squidward will dab on the DMZ for all eternity now

Anonymous

To be honest @MechMK1 I was only a dick to him and said that because he was being a sarcastic twat when he said "what are you some kind of hacker?"

Anonymous

That just pissed me off.

Anonymous

It was either, be a dick or punch him.

No, I didn't mean that as being an asshole. It was, how to say, very "chad" of you

Anonymous

lmfao

Anonymous

10:11 AM

A guy asked me to watch his laptop on the train the other day

Anonymous

I just said "no" and he tried to tell me how I'm a bad person.

10:27 AM

No no no, a much better answer would have been
"How do you know I'm not a hacker?"

11:16 AM

@venter Hello there

I assume you're here to talk about how to get into security as a developer?

@▲MechKM1 General Kenobi

Ah finally someone gets the meme

I couldn't resist

@venter You can reply to a specific post by clicking on the little arrow on the right side to the post, like this

Then when you hover the mouse over the post, you see what it references to

Anyways, so you're a developer and you want to get into security, right?

@MechMK1 Yes, that's it

11:19 AM

So how many years of development experience do you have?

@J.J A week from now someone is going to show up here asking: "I talked about Eggos in my kitchen and five minutes later an ad for Eggos played on my TV. It's totally this hacker dude who took over the all the EMF waves in my apartment after I left my computer unlocked at a hotel. How do I clear out the viruses and restore my EMF?"

Doesn't need to be exact, just so I can gauge your experience level

@ConorMancone Though I have to admit it's scary how you think about something and like 2 minutes later there is an advertisement for that exact thing

@MechMK1 Counting education around 6 years

Anonymous

@ConorMancone Hahahaha

@venter Which languages or technologies?

Like, mobile, web development, low-level C/ASM?

11:22 AM

@MechMK1 Web mainly, learned c and c++ some years ago but didnt really touched them since

@MechMK1 And most things devOPS

Alright. So first of all, Security - like development - isn't one unified field. There are many different roles, jobs, interests, etc...

So for example, there are people who do nothing but Reverse Engineer stuff. They buy a simple 5 buck gizmo and the first thing they do is to take it apart, construct a circuit diagram and dump the firmware of that chip

There are people like me who are cooperate pentesters. I get a project for a company, I test their application or whatever for a week or two, and then I write a nice report with all my findings and how to fix them.

@MechMK1 indeed, but it usually boils down to Apophenia. No one ever gives much thought to the thousands of times each day that you think of something and don't see an ad about it.

@ConorMancone Yeah, it's probably just a coincidence.

It is - Except when it's not!

Or...that's what THEY want me to think? Are you one of them!? The real Conor would never say that! Where is he? What did you do with him?

11:27 AM

Why do you assume I was ever real?

@MechMK1 Okay, i would like to move into your current field of work

@venter As for the paths you can go to get into security, there are many different ways. I don't claim to have the one true way, all I can tell you how I got into security, and how others did

My first contact with security was actually Backtrack 4 back in the days. It was a Linux Distro for...well for security!

@MechMK1 Far enough, i would like to hear it

It had a bunch of tools for all kinds of work, and I just tried every single one of them. Some made sense, some I didn't understand at all

It was really more me trying to learn how to use Linux rather than learning much of security

But it was worth it, because by learning how to use Linux (especially the command line), I understood how a computer actually works

How commands are processed, and the mental model I had of a computer slowly became more and more accurate

Then I went to university to study Information Security. I had classes like "Introduction to Information Processing", "Operating Systems 1", "Malware Analysis", etc...

These went really deep into the matter. For example, we didn't just learn that Windows and Linux and MacOS exist, we learned what the kernel did, how task scheduling works, and memory management (frames, pages, etc...)

After I graduated, I had very very limited pentesting experience. I did an internship, where my task was basically to run an automated vuln scanner and look at the results pretending to understand what any of this means

But as I stared at the results, I started to google things. What is cross-site scripting? What is a CSRF attack? Why would I care about HTTPS? All those things

For you pentest jobs, in the contract, do you usually have a clause like "[Our company] may use information about the operation for training and educational purposes. Do you agree to this?" ?

11:35 AM

@JohnZhau No, we don't have such a clause. Because we have hand-made applications to test new applicants.

It's very similar to a (very simple) CTF

@MechMK1 Okay so it's not a question of where you start but more about that you start

Exactly!

One of the tips I can give you is to just read things that you don't understand. It's okay to not understand, but the words will stick to you

And one day, you will encounter them again, and again, and again.

And at some point, you will be able to put it all in perspective

Suddenly all of these things will make "sense", in a way

@MechMK1 That's acutally alot like learning to be a dev

Yes, I studied programming before going to university, so I know that feeling quite well

I don't think that learning for a specific certificate is a good idea though

Much like with other tests, you will inadvertently study to "succeed", not to "know"

So immerse yourself in the world of security, and don't be afraid to ask "basic" questions

Like "Why is integrity important?", "Why is MD5 bad?", "What even is a hash? How does it work?"

@MechMK1 That makes alot of sense. I'm down to learn in my spare time but what is a good project to start?

11:38 AM

@venter Good question. Also a bit of a tough one

@MechMK1 I agree, but maybe you can come up with just a trail i can follow

OWASP is always a good resource to start

owasp.org/www-project-top-ten

The "Top 10" are 10 kinds of vulnerabilities that happen the most in web applications

Yes, it's a strong focus on web applications and doesn't have much binary exploitation inside, but it's still nice

@MechMK1 That's pretty interesting

youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w

LiveOverflow also has amazing tutorials and in my opinion they're very beginner friendly

You could watch some videos of the Black Hat Conference or DEFCON, but most of them are like "Bleeding-edge" security, so you will already need to have a firm grasp on the basics to understand what's going on in most talks

Some talks may be easier to get into, and the presenters try to make their knowledge accessible, but if you have very little security knowledge it may be a bit too advanced

@MechMK1 I'm open to educate myself, if i find something i do not understand yet.

11:44 AM

@venter That's good! Also, OWASP offers the Juice Shop, which is a web application that is purposefully insecure

You can try to hack it yourself

There are many many ways to get inside

@MechMK1 Wow, that's super cool and some handsdown stuff is always good to acquire knwolegde

@venter Yes, it really helps. You can also use OWASP ZAP or Burp Suite as HTTP Proxy

Most people associate "proxy" with "hiding your IP", but in this case the idea is to route your traffic through a purpose-built application to be able to see all HTTP(S) requests

The idea is that you can analyze what the application does, and modify the requests as you need them. You can also just write your own requests from scratch

So for example, imagine you register and then you look at your profile. You see the function to change your password to a new one, and you do. And then you see it sends a POST request to /profile/123/password

@MechMK1 Like using postman and modifying the header to get a maybe unintended result

Now a hacker would say: "Hmm, I wonder what happens if I change that ID". And then you send a request like POST /profile/1/password and suddenly you changed the password of the admin

@venter Exactly. Except that it's not just the header, but everything

@MechMK1 So it's about awareness?

11:50 AM

@venter It's about trying to see what you can do. Not just what the developer intended

Because you may find code in that method that goes like this

if(request.user.isLoggedIn != true)
    return Error.NotLoggedIn;

@MechMK1 Feels like being a tester but in further scope

@venter Well, that's what a pentester (or by extension a malicious hacker) is. They test your application, and see what they can do

Have you heard of SQL injections? And if so, do you know how they work?

@MechMK1 I did one to show my boss that his login was dangerous

That's cool. It's good to have this drive to break stuff :D

But do you understand, under the hood, why SQL Injections exist?

I find fun in that :D
I now it exist and how to explode it on a basic level but not why they exist

11:54 AM

Okay, so imagine you write some code where you want to authenticate a user. And that code looks like this:

@MechMK1 Honestly i'm a bit shocked why i didn't asked myself

userId = db.Execute("SELECT ID FROM USER WHERE EMAIL='" + request.email + "' AND PASSWORD ='" + request.password + "';");

And if userId is a real ID, then you are logged in as that user and if not, then the login failed

And a regular request would then end up looking like this:

"SELECT ID FROM USER WHERE EMAIL='foo@bar.baz' AND PASSWORD='hunter2';"

Now imagine, instead of entering my email regularly, I enter admin@bar.baz'; --

Now my query looks like this:

"SELECT ID FROM USER WHERE EMAIL='admin@bar.baz'; -- ........."

And suddenly I am logged in as admin

@MechMK1 That would be insane

Why did this work? Because the SQL database can't decide if ' is part of my e-mail adress or part of the SQL syntax

@MechMK1 That makes a lot of sense

11:59 AM

@venter No, it is insane. SQL Injection is very much a thing still in 2020

@venter Yes, and this is also what being a hacker is about. Not just being able to exploit something. Exploitation is step 2. Step 1 is to understand how something really works.

Because if you try to exploit without understanding, you're just a script kiddie

@MechMK1 I really like that way of thinking

Good, because this is what my job is every day

of course, there are other jobs in security, and those are equally important

Information Security Management, Internal Security, etc...

@MechMK1 I'm really sorry but my lunch break ended just now and i have to take care of a ticket. But i really enjoyed this conversation and i will check back later

@venter Sure. Feel free to come here at any time, and of course to the main site as well

@MechMK1 Thanks!

12:03 PM

Speaking of which: Does anyone have like a compilation of infosec jobs?

12:49 PM

@MechMK1 if only!

No, I mean like "Pentester, Information Security Managment"...

Just a list of stuff you could get paid for doing

Filipe dos Santos

1:08 PM

@MechMK1 This PDF kinda covers some of the careers paths in infosec and the average seniority of each role: infosecskills.com/images/Infosec_Career_Paths_v8.pdf

A document with roles, a brief description, related industry certs, would be nice to find.

@MechMK1 Also, a website for preemptive nuclear strikes is too important to use common security tools. Everyone already knows all about them and we know that makes hacking them much easier. As a result it uses HTTP with a custom encryption algorithm. Waaaay better that way

Anyway, on a (slightly) more serious note: my job hunt is still going pretty slow. I'm applying for remote jobs only, and (not trying to make excuses) the competition is clearly much tougher.

I've had a couple positions that I got to the very end before getting cut because they had someone that was a slightly better fit (the companies in question have been very nice and informative about their decisions, which is good)

but anyway, that's not where I'm going: in those positions where I got through a few interviews, and in all of the hundreds of job ads I've read, can you guess which I never saw mentioned - literally - once?

Any topic about security what-so-ever. Unless it was a security job of course

And I recently realized how crazy that is.

I'm applying for lead engineering positions - many involve building applications from scratch, or guiding/mentoring a team of engineers.

And no one has asked me a single question about basic application security, nor listed any security knowledge as a requirement on job ads

Is it just me, or is that absolutely bonkers???

It's bonkers for us security people, but not for the non-security people

They want "makers". they want people who can make something

Security is an afterthought

And this, by extent, is the reason why I have a job

I asked questions about the general security approach of a company in a technical interview with three other engineers, and the guy who was generally leading the interview responded fairly dismissively (something like): "We hire senior engineers and so of course expect them to know these things and write secure code".

You're not taught security, you're expected to just do it right

I moved on of course, but I know what that answer means: they don't give much thought to security and have plenty of vulnerabilities waiting to happen

I've seen programmers with 10 years of experience put in stupid obvious SQL injection vulnerabilities, as well as other classic security blunders

1:22 PM

Just like how we teach children until the age of 16 to not think and blindly obey, and then expect them to be responsible adults with their own opinion of everything

@ConorMancone Because in those 10 years, this code did what they wanted that code to do: Fetch this result set.

@MechMK1 100% correct

It's one of those things where different people (or different job roles have different expectations of what they want stuff to do)

Look at locks, for example

You might think people want the beefiest, most secure locks with like weird cores and tons of other security features

But no, people want a lock that is easy to open and close, and it shouldn't be too heavy. in fact, if a lock was too big it wouldn't properly fit their cellar door

So the people who buy a lock primarily want something "easy to use", not something secure

That's a great analogy.

I had a class in project management, and despite how much I disliked the teacher and how much useless crap we learned, he taught me one thing:

When you define requirements, don't just define functional requirements. Also define everything else that you think is implicit: Execution speed, security, etc...

(random anecdote). I have a storage unit I'm using at the moment, and brought a lock when I showed up to rent it. Didn't realize that this company will give you a lock for free, but I used mine anyway. Their's look quite a bit beefier, and my oldest made a comment about how puny and weak mine looked.

1:27 PM

What's stopping you from using both? :D

My response was simple (although he already knew this anyway): all of these locks would be easy to remove for the company or anyone else with a strong pair of bolt cutters. The lock only helps keep honest people honest

Just in case their lock has more than one set of keys?

And if your - ehrmmm - THREAT MODEL includes people with bolt cutters, you can get locks for that

@MechMK1 There's nothing valuable in my storage unit. As long as I pay my bill they won't bother it :)

Which is also worthy of security wisdom: Your security requirements should match the value of your asset.

@MechMK1 Are there actually "standard" sized locks that can protect against bolt cutters?

@MechMK1 We've talked about that a lot. It came up years and years ago because our bank has a double-door man-trap thingy

1:30 PM

@ConorMancone I don't know what size standard size is, but the defining factor is the material, not the size

@ConorMancone a wat?

It started many conversations about how security measures only have to be "secure enough"

Mantrap (access control)

A mantrap, air lock, sally port or access control vestibule is a physical security access control system comprising a small space with two sets of interlocking doors, such that the first set of doors must close before the second set opens. Airlocks have a very similar design, allowing free ingress and egress while also restricting airflow. In a manual mantrap, a guard locks and unlocks each door in sequence. An intercom and/or video camera are often used to allow the guard to control the trap from a remote location. In an automatic mantrap, identification may be required for each door, sometimes...

And that is for every customer?

Damn!

They have it on their front doors, entry and exit

And what happens in the event of a fire?

The entry one has a metal detector. It unlocks automatically when the first door closes, unless the metal detector is triggered

There is a standard emergency exit without a man trap

snicker

1:32 PM

So...people who are close to the main entry/exit who panic because there is a fire will have to override their instinct and move away from the nearest exit and find a different one?

Maybe it automatically turns off when an alarm is triggered?

This was a big part of my conversation with my son actually - about how things like this look intimidating and impressive, but the reality is that there is always another way in

That maybe will end in a newsarticle about how 5 people burned to death in a bank.

The main point isn't to stop robberies so much as it is to stop people from thinking about robbing you...

@MechMK1 Hopefully not...

@ConorMancone To make you, as the customer, feel as if nobody could rob you

I actually never thought about what might happen in the event of an actual fire

@MechMK1 Indeed.

1:34 PM

It also illustrates how "security" and "safety" are sometimes two contradictory goals.

Ya' can't 'ave it all

Anyway, I need to go finish some automatic infrastructure deployments...

Enjoy your (afternoon?)!

Oh my god, I feel scammed

@ConorMancone Yes, afternoon. Likewise

I was playing Hill Climb Racing and there was a course called "Miner's Mile" and the distance it shows is 1000m

What the fuck?

lol!

There isn't even an american counterpart where it would make sense that 1000 something is one mile

So i could say they just changed the units without really doing it correctly

But what the fuck is this?!

Journeyman Geek

2:17 PM

Its a french mile

Hon hon hon!

3:02 PM

My 12 year old is (successfully) making his 7 year old brother do his math problems for him... I'm legitimately unsure which one of them I am more irritated with. The 7 year old has a natural head for numbers (in this case, simple fractions), and while the 12 year old is perfectly capable of doing these problems, he hates all forms of math and avoids it like the plague...

Who taught him fractions in the first place?

The 7 year old? No one, but he's just being asked about halves. "What's half of 12?" - "Well 5 is half of 10, so 6?"

3:19 PM

Sweet

Street Smart versus Book Smart

Can I ask for an amateur opinion? :D

Why not?

I have two flowcharts, which one of these do you think is more easily readable on a website?

Damn url too long :D

wow, bitly thinks it's not a valid url

LTR version: shorturl.at/kxD26

Top to Bottom version: shorturl.at/aEJK4

3:43 PM

have you tested the links?

Yes, they work for me

They don't work for you, I assume?

3:56 PM

@MechMK1 Both just redirect to shorturl.at

1 hour later…

5:19 PM

@ConorMancone same for me

@MechMK1 in your browser's console: btoa("my too long url")

5:38 PM

@A.Hersean Except base64 encoding actually makes ascii text 33% longer?

@ConorMancone weird they worked for me

@MechMK1 Try in an incognito window

I did, before.

5:57 PM

@ConorMancone Yes of course, but I guessed that SE limited the length of links, not of messages. I did not assume that his link was so long: URLs are de facto limited to 2000 chars.

There's pastebin.com for very long text.

6:14 PM

@A.Hersean Ah, that makes sense

6:31 PM

Hi everyone o/

I have a question on XSS via $_SERVER["PHP_SELF"]

http://example.com/login.php/"><svg onload=alert()><!-- works and makes sense

But why http://example.com/login.php"><svg onload=alert()><!-- don't work?

I mean we are not using / in 2nd example

But <form> tag is still closed, so it should also work, right?

Or application determines the end of url by seeing / in url?

But I don't think that's the case because initially url was only /login.php

6:53 PM

@daya What is the HTML your application is returning? Note that you need to use curl, postman, or "View Source" to determine this. If you inspect element to look at the DOM tree you'll view the HTML as understood by the browser, which is frequently much different than what the server returned

7:08 PM

@ConorMancone Both in DOM and "view source" are in the form http://example.com/login.php initially

And it changes accordingly when I modify it

@daya What is it though? Can you post the snippet where it is getting injected?

It is a XSS exercise

<form action="/xss/example8.php/"><svg onload=alert()>" method="POST">
  Your name:<input type="text" name="name" />
  <input type="submit" name="submit"/>

form is filling it's action attribute via $_SERVER["PHP_SELF"] (which I can modify)

But the question here is how /xss/example8.php/"><svg onload=alert()> is different from /xss/example8.php"><svg onload=alert()> ?

(/ after example.php)

@ConorMancone

@daya You keep skipping details :p What is the returned HTML for both requests? Is the above html for the working XSS payload or the broken one? What is the returned HTML in the other case?

7:24 PM

Ist one is for working alert box

2nd one don't work

@ConorMancone In 2nd case it returns 404 :P because of url /xss/example8.php"><svg onload=alert()>

@daya Oh, that's the part I was missing

This has nothing to do with XSS and has everything to do with server configuration and routing rules

When you said "doesn't work" I thought you meant that the payload simply didn't fire

Again, it depends on the server configuration, but I can guess what is happening with high certainty.

with /xss/example.php/blah the server is using something like mod-rewrite, notices that /xss/example.php is an actual file, and so processes that PHP file passing in the rest of the URL as input, so PHP_SELF ends up with /xss/example.php/blah

In your second example (/xss/example.php">blah), the server can no longer recognize example.php as a valid path. Again, the exact behavior would depend on the server, but most likely the lack of a forward slash causes it to interpret the ">blah as part of the actual filename. Since it finds no file named example.php">blah, it returns a 404.

In otherwords, the / is important because it is a path separator

This is probably related

cnedelcu.blogspot.com/2010/05/…

@ConorMancone Yes this is exactly what I was curious to know that how the server is misinterpreting the second url as a non-existent resource

Because as you know in general cd dir is same as cd dir/

So that was my whole point of confusion

@ConorMancone Thanks :)

7:48 PM

@daya Indeed, in this case though it is mainly about the server trying to be "nice" and match a path even though it didn't find anything. When it sees: xss/example.php/blah1/blah2 it knows the file doesn't exist and starts walking up the path, trying xss/example.php/blah1 and then xss/example.php. It finds the latter and so stops there, calls example.php, and passes in the full path.

For xss/example.phpblah It doesn't find anything, but also has no way to recognize that you meant xss/example.php. xss/example.phpblah is simply another file in the same directory as xss/example.php The lack of a / was critical for the routing and taking advantage of the server behavior

@ConorMancone I see

« first day (3332 days earlier) ← previous day next day → last day (1553 days later) »

Transcript for

Jan '2030

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile