« first day (3497 days earlier)      last day (1380 days later) » 

Conor Mancone
Conor Mancone
1:26 AM
This one is.... Unique?
0
Q: Beyond unauthorized data access, what security considerations should I have regarding a user-facing language based on SQL SELECT statements?

JoLI'm considering making a new language based on SQL SELECT statements to allow users to export CSV data in the manner they please. I'm confident in being able to interface this with a permissions system by inspecting the resulting AST from parsing before turning it into a SELECT statement to execu...

databases mariadb
 
 
7 hours later…
John Zhau
John Zhau
8:38 AM
I'd like to pull some attention to my post...
https://security.stackexchange.com/questions/234460/what-allows-meterpreter-to-migrate-processes-and-how-to-defend-against-it
how to you make the big box for the link?
>>https://security.stackexchange.com/questions/234460/what-allows-meterpreter-to-migrate-processes-and-how-to-defend-against-it
Same link, just trying to make it big...
 
Conor Mancone
Conor Mancone
9:05 AM
@JohnZhau the chat usually expands Stack overflow links itself. Try posting it on a line by itself (or in a comment by itself) without any attempts at formatting at all: literally just the URL
 
 
2 hours later…
Anders
Anders
10:41 AM
Hi everybody! I've got a random question about one of the two hard problems in computer science.
I have a pipeline like this: StepA -> Buffer1 -> StepB -> Buffer2 -> StepC -> Buffer3 -> StepD. I want to name my buffers after A, B, C, D. Should buffers be named after the step they come from or the step they go into? Is it buffer A to C or buffer B to D?
Naming after both is not an option as names would get stupid long.
Flamewar plz.
 
 
1 hour later…
Conor Mancone
Conor Mancone
12:09 PM
As much as I love a good flamewar, I think the answer is pretty simple. Just use the proper preposition? to connect the dots
BufferToB or BufferFromA, etc...
Otherwise it doesn't really matter
 
reed
reed
12:32 PM
StepA -> BufferedA -> StepB -> BufferedB
my opinion is that names are always going to be ambiguous, you can't avoid that, but you can keep that under control by: refactoring when needed, reducing scope by encapsulating code inside functions or classes, and good comments / documentation
 
Anders
Anders
@ConorMancone @reed Those are both very good suggestions that don't rely on anyone guessing what they mean. You ruined my flamewar. Thanks a lot guys.
 
 
1 hour later…
John Zhau
John Zhau
2:02 PM
3
Q: What allows meterpreter to migrate processes and how to defend against it?

John ZhauI mainly use Linux so I'm not well-versed on how Windows and its privileges work. I've recently learned to use Metasploit and meterpreter on Windows boxes. Previous research This answer has given an overview of how meterpreter migrates on Windows. This article has addressed process migration on L...

meterpreter
 
Conor Mancone
Conor Mancone
2:14 PM
@JohnZhau You are now a SO master!
 
CaffeineAddiction
CaffeineAddiction
sup, been trying to brush up on metasploit before one of my certification exams ... did the background get removed? The lab I am working on says to use ctrl+z or the command background to switch sessions ... but background says its not a command and ctrl+z kills the program entirly. Thoughts?
 
John Zhau
John Zhau
@ConorMancone SO master how?
 
Conor Mancone
Conor Mancone
You got it to provide the big box
 
John Zhau
John Zhau
lol
Has the Coalfire-Iowa incident changed how your pentesting company works?
 
 
6 hours later…
reed
reed
8:29 PM
1
Q: How can I stop fraudulent credit card submissions on a donation site?

Ben DavisWe are a small nonprofit that accepts donations online. Our site is being hammered by hundreds of fraudulent credit card submissions per day, coming from multiple IP's all over the world (a distributed attack). 99% of these are declined, however our merchant services provider (Braintree) has aske...

credit-card fraud captcha
I don't understand that question. Is the attacker trying to "donate"? What kind of attack is that? Are they testing if the cards are valid? Why should they not be valid? Also, won't a donation send an alert to the owner, so you would be "burning" the stolen card which will then be blocked?
If I were an attacker with some stolen credit cards, I would probably try to use them in better ways than that, I guess
 
MechMK1
MechMK1
8:52 PM
I recently did a science!
And I found out that more expensive ammo may actually be worth it
I shot one box of the cheapest stuff the gun store had, and two boxes of match-grade ultra-premium AccuShot™ Hyper Ultra Über Ammo
Just for comparison: Both boxes costed 50€, or close enough to that. The cheap box had 100 rounds and the premium box had 25 rounds.
I loaded one magazine with premium ammo and shot at a target at 125 yards, and my groups were about 1.5 MoA.
I loaded the cheap ammo, and it was like 4 or 5 MoA.
I went back to the premium ammo, and it was back to between 1 and 2 MoA
Back the cheap ammo, again ~5 MoA
Sure, it may have all been psychological, since I knew what ammo I was shooting
But even then it surprized me a lot!
I may need to do a blind study
Or even better, a double blind, where I prepare 5 magazines á 5 shots of premium ammo, and 5 magazines á 5 shots of cheap ammo
 
 
3 hours later…
Conor Mancone
Conor Mancone
11:34 PM
@reed Most likely it is being done to validate cards before using elsewhere. It's common to attempt low-risk transactions before going for the "real" money - I've seen this in my own cards when they are stolen (the fraudsters usually start with small transactions on common services before going for larger transactions that are more likely to get them actual money). Non-profits are likely (at the moment) in a "low risk" category so they are less likely to be blocked
This gives the attacker a better idea of whether the numbers are good with a lower chance of being flagged. That's my guess anyway
@MechMK1 Science! Do it and report back! I'm usually dubious about "name" brands (not that this is exactly a name brand thing), but I can believe it here
The handful of times I've gone shooting I've also seen the ammo make a difference in frequency of gun jams, so that's a plus too
I take this as evidence that you are enjoying your vacation :)
These make me sad, which makes me wonder if a different approach would be in order, although I doubt there is really much I can do (requires "View deleted post" privileges):
A user posted about this crazy idea they had, and my comment was "This will end badly...". The OP asked for clarification and then deleted their post.
Why delete your post instead of talking through it?
It makes me feel bad for them, and while I strongly suspect that it really was a bad idea, that doesn't mean that it isn't worth talking through or trying out anyway!
My very first web application was a clone of PHPMyAdmin (because I hadn't heard of it yet) except that it was completely vulnerable to every manner of SQLi and had no authentication... in retrospect it was a terrible, terrible, terrible idea, but I learned a ton!
Perhaps I could have been more polite, but all-in-all I think that was a pretty innocuous comment...
 

« first day (3497 days earlier)      last day (1380 days later) »