« first day (3599 days earlier)      last day (42 days later) » 

7:20 AM
Is it normal to see a Microsoft server with some http ports (but no web) and ports 515 (LPD) & 631 (IPP)?
Seeing the printer ports, I'd assume it's a printer, but I'm not sure why printers would run on Windows and have a bunch of http ports open...
I'm not sure how common it is for servers/workstations to have ports 515 & 631 open though
 
 
5 hours later…
12:31 PM
@JohnZhau How would you know it's windows?
 
 
1 hour later…
1:47 PM
0
A: Attack against OTP Cipher

MechMK1How does a One-Time Pad work? Imagine you have a message M which is encrypted with a key K, which then results in a ciphertext C. Let us assume that the process through which the encryption occurs is an XOR, which I'll show by the ^ symbol. Furthermore, we assume M, K and C all have the same leng...

Heard y'all want to crack some OTP ciphers
Here are the rules quickly:

You intercepted three messages. You know they're all encrypted with the same key. You know all messages only contain either uppercase ASCII or spaces.
C1 = 553a9026b3b648376fc145f7e84761782152
C2 = 42339755cab04e3761ca24f9e63466712f44
C3 = 4826f938d2a63b596dcc45f8e8347778354e
 
@MechMK1 Ports & services for Windows (SMB, MSRPC, etc), Windows IIS default page on HTTP ports, multiple banners of Windows services, none typical of Linux
 
@JohnZhau And you want to know why the printer ports are open?
It could be a printer, it could also be a server which "acts" like a printer and distributes print jobs to other printers
 
2:03 PM
Actually I think it didn't have a ton of services but certainly weird
Well an acting-printer seems like a good reason
 
If you look at the description of CUPS, that's exactly what it does:
CUPS (formerly an acronym for Common UNIX Printing System) is a modular printing system for Unix-like computer operating systems which allows a computer to act as a print server. A computer running CUPS is a host that can accept print jobs from client computers, process them, and send them to the appropriate printer. CUPS consists of a print spooler and scheduler, a filter system that converts the print data to a format that the printer will understand, and a backend system that sends this data to the print device. CUPS uses the Internet Printing Protocol (IPP) as the basis for managing print jobs...
> A computer running CUPS is a host that can accept print jobs from client computers, process them, and send them to the appropriate printer.
Now I'll be the first to admit that printers are fucking voodoo to me, but that at least would make sense in a corporate setting. Configure one print server on all workstations and then have IT configure all printers on the print server.
 
I'm totally new to this too. First time working with UDP scan & UDP services.
 
@JohnZhau The thing to know about UDP is that most UDP fingerprinting does not work nearly as accurately as TCP
I assume you know why programs use UDP instead of TCP?
 
yes
 
Alright
 
2:11 PM
speed > integrity
The uncertainties make scanning slower & less accurate
UDP is for when you just wanna yeet stuff over as fast as you can without caring about how the deliveries arrive
 
Exactly. And due to this, most UDP stuff uses custom protocols to be as fast as possible
 
It's like trying to hand out eggs by facing a pile of eggs & continously throwing them behind you without looking and hoping someone catches the eggs
It's fun trying to come up with UDP examples
 
If you encounter a UDP port, check if it's DNS and if not just let it be
 
Printers are known to be very insecure so I think they should be an easy way in with some common tools right?
 
Depends, I'm not really the internal security guy
 
2:20 PM
I'm learning both internal & external
I do a bit of everything so I never get bored with all the stuff I can switch to and try
 
2:56 PM
@MechMK1 K = 0172d97593ff1b17229865baad1432396617
@JohnZhau That's what I heard. Printers get overlooked, but network-wise have access to a lot (because everybody needs to print). So outdated firmware/default credentials + network access = great pivot point
 

« first day (3599 days earlier)      last day (42 days later) »