« first day (3459 days earlier)      last day (34 days later) » 

9:09 AM
Good morning, my fellow Hackers and Hackresses
 
Good morning! Quiet Friday...
 
Oh dear, I can change that
I just had a call with a customer, who was really uncertain what the next pentest is going to involve. The test will start next week
I honestly wish customers would be more prepared for upcoming pentests...
 
9:24 AM
You get to be both a security dude and a security teacher
It doesn't actually surprise me. I'm guessing that behind the scenes (on their end) someone was like:
Person 1: I hear hacking happens. That would be bad
Person 2: Yeah, we should do something. What do we do?
Person 1: I heard we can hire someone to try to hack us first
Person 2: That sounds interesting, let's do that. (google's "Hire a hacker", somehow finds a link to your company, signs up for a pentest with no idea what it means)
 
More like absolute infighting between teams and applications "Our application must be given priority!", "No! We are more important!", "We should test those apps too!", "No, they're just internal and we know they're insecure", etc....
 
I think I'll end up on a pentest myself next week, although an incredibly simple one. I wasn't hired to do any pentesting but our primary pentest person is out for 6 weeks on PTO, so I volunteered.
 
Oh? Do you have any pentest experience? Or is this you getting experience?
 
9:40 AM
I have some experience with bug bounty programs. Nothing crazy, but I'm not completely new to it. In this case though all the customer is requesting is automated scanning, even without validation, so it's more like "running a tool" than "running a pentest"
 
Alright, then!
If a customer would request that from me, I'd say alright, but I would lowkey think it's a waste of money
 
I don't want to transition into full time "red team" work but was hoping I might be able to join a pentest occasionally. I learned a lot of new things when I started playing around with bug bounty programs, and a little bit of variety keeps me entertained
 
Yeah absolutely. Just recently I had to do some off-the-wire reverse engineering
1
Q: Why does Wireshark not recognize WCF traffic as TLS encrypted?

MechMK1In a .NET application, communication between client and service can be implemented using various different bindings, NetTcpBinding being one of them. The class defines an attribute named Security, which, according to this article, defaults to Transport. This further article explains how Transpo...

 
From what little I know so far they are brand new to the security side of things and just trying to get a general understanding of where they stand on the app
 
^- This question came as a result
@ConorMancone Sounds like a good opportunity to sell some coder training
 
9:45 AM
:) We do that too, and while we charge money for our services, "sell" is not quite the right word for us because its a large company and our "customers" are actually just the other "companies" owned by the parent company (which I work for directly).
No answer? So sad
 
Well, the answer "Because there is no TLS handshake. It's GSS-API" is good enough
But as for the training situation, at least it's a good thing. I love giving out some training for coders
 
lol, that's what I get for skimming. The answer was so short it seemed unlikely it was a helpful one
 
"You think your code is good, huh? You think you're some kind of pro, some kind of "rockstar" programmer because you included a library and copied some code from Stack Overflow, huh?

Who here in this room thinks they're a good programmer!?" (*MechMK1 slowly draws a gun*) "I ASKED WHO THE FUCK HERE THINKS THEY'RE A GOOD PROGRAMMER!?"
 
I learned about metadata endpoints from reading bug bounty vulnerability disclosures. They never made sense to me until I started this job and we use them extensively
 
Sure, my methods seem unorthodox, but I assure you, they work
@ConorMancone Ohh, what are metadata endpoints?
 
9:51 AM
lol!
In all the major cloud providers there are HTTP endpoints available to the machines that will spit back your access credentials. These make SSRF very dangerous, because it means that an SSRF vulnerability will allow an attacker to literally gain the access credentials on the machine, and therefore whatever access those credentials have.
In many cases people don't know about these, and so there have been many cases where those access credentials are effectively root users in the cloud provider
so all of a sudden SSRF leads to complete takeover of the hosting account - which is obviously very bad
Here is a relevant example
 
10:32 AM
Thanks, I'll read through it!
Also, song of the day out of the blue:
 
 
3 hours later…
1:27 PM
sup
 
Sup?
 
Sup - verb (used without object), supped, sup·ping. - to eat the evening meal; have supper.
 
sup
A term that cool people use because they are too damn lazy to say What's up. (Too much effort involved there man.)
 
The austrian equivalent would be "seas"
I know, but "sup" is generally a question, isn't it? So "Sup?" is a perfect thing to ask
I realize that now that I have written "seas", hundreds of angry austrians will yell at me for not using the spelling they prefer, such as "seawas", "zeas", etc...
 
Do all of those spellings make the same sound?
I'm disappointed. Google Translate doesn't have Austrian. It also doesn't even attempt to translate "wassup", even though it recognizes it.
 
1:43 PM
They're all different spellings of "servus", which is latin as far as I know, meaning "I'm at your service", but used commonly to mean both "hello" and "goodbye"
 
Is Latin slang common in Austria?
 
Good question. I suppose quite a lot of words in the german language as a whole are derived from latin
 
That makes American slang seem so lame
I thought Germany mostly had their own language because the Romans couldn't conquer everything?
 
I'd say the most closely related abbreviation is pronounced like "seawus", in which the hard "r" from "servus" is softened to an "a" sound and the more f-like "v" sound was replaced with a softer "w"
@FireQuacker I'm not a linguist, but as far as I know, latin still had a very important influence on what we now know as the germanic language. Also keep in mind that while they may have problems conquering it militarily, roman culture was still very important
And given that for a thousand years everyone and their mother spoke latin, it's no surprize that the germanic language back then started to become "latinized", just like how english now influences so many other languages
Anyways. From "seawas", we reach "seewas", in which the "ea" is turned into a long "ee" sound. You can still hear a hint of an "a" right before the "-was", but not nearly enough to really write it
And from that, we reach "seas", in which the "a" and the "w" completely disappear. You'd have to know what the word is supposed to be to have any idea it means that.
 
@MechMK1 I think the "w" sound was how "v" was pronounced in Latin already
 
1:53 PM
@FireQuacker That could be the case, but I don't actually speak any latin. In german, "w" is generally pronounced roundly as in "wool", "warm" or "woman". Whereas "v" has a bit of an "f"-sound to it. It's the reason many schoolchildren write "vogel" as "fogel"
Since it's pronounced like that.
 
> An ellipsis from the commoners’ greeting once said to feudal lords, "servus humillimus (Domine spectabilis)", in Latin meaning "(I am a) most humble servant, (O) noble lord".
> No subservience is implied in modern use, and the origin of the term is not commonly known. Educated usage may be sincere, jocular or ironic.
 
Knowing austrian culture, most likely ironic
 
Yes, I almost thought so
Sarcasm and dark humor are very much part of regular, every-day language.

For example, we love downplaying grave things as having a heart attack, calling it "having a little heart clown" (literally. Kerzkasperl)
 
I was more expecting that "servus" would have come from the Latin "salve" (sal-way, not salve like the medical stuff)
 
1:58 PM
@FireQuacker I was aware of the connection to "serve" and "servant"
Though as the article mentioned, no implication of subservience is given. "Servus" however, is only used in informal contexts. For example, when I go to a nearby "Bosnerstandl" (hotdog stand), I greet the people there with "Seawus, griaß di"
 
Damn...
Also "Helldesk" in the tile
 
The Register tends to be very much in the humor/sarcasm business.
 
Austrian newspaper is terrible
Okay, not all of it. Der Standard and Salzburger Nachrichten are good
But the vast majority is shit
 
3:08 PM
I actually don't read newspapers much
I'm what's killing the industry
 
@FireQuacker lul @ that register story
 
3:47 PM
@FireQuacker The industry is shit and deserves to die
95% of newspapers out there are glorified advertisements and PR platforms for large companies
And "newspaper" that releases articles like "10 reasons you should be excited for <companyname>'s new product" deserves to die
 
@MechMK1 Completely agree on that
 
Sadly, newspapers that aren't just propaganda machines for companies of <arbitrary political ideology> are few and far between
 

« first day (3459 days earlier)      last day (34 days later) »