The DMZ

« first day (3735 days earlier) ← previous day next day → last day (1145 days later) »

Anonymous

4:00 AM

Just in-case they come here... Since this is InfoSec related.

Anonymous

Oh only 4am. Wow.

Anonymous

THought it was later than that, earlier, whatever.

forest

heh

Anonymous

What worries me significantly about this is I have 600 pages to read. With like 15GBs of video and a billion exercises.

Anonymous

I am genuinely worried about time on day two.. Not a good start.

forest

4:02 AM

What are you studying right now?

Anonymous

Just this course material i mentioned yesterday.

forest

Is the entire course win exploitation?

600 pages of it?

Anonymous

Yeah, pretty much, here, I'll tell you what it contains.

forest

I forget, why do you need to do this? For a cert?

Anonymous

Yeah, well, I like exploitation too but I get a cert at the end, yes.

Anonymous

4:03 AM

Which allows me to look for jobs which are more exploitation based rather than what I am now which is basically a pen-tester with some of this thrown in very rarely.

forest

Sounds like it'll lock you in.

Not as varied as if you stay a pentester and branch out when you find what you like.

Anonymous

Oh no, I want to do this.

Anonymous

I like this :D

forest

If it's 600 pages then it's probably very specific to Winblows without that much information being applicable to Linux.

Anonymous

I just want to move more into Linux after.

Anonymous

4:06 AM

So we got:
- Stack BoF
- SEH Overflows
- RE with IDA Pro
- Egghunters
- Custom Shellcode
- Further RE
- Stack Overflows and DEP Bypass
- Stack Overflows and ASLR Bypass
- Format String Specifier Attacks

forest

Anonymous

That is like the high level breakdown. There is a bunch of stuff within each section, ROP chains, rop decoding, etc, etc.

forest

You know, the creator of IDA Pro is on Reverse Engineering SE. :P

Anonymous

A lot of the theory for sure carries over.

Anonymous

Like of course there are differences.

forest

4:07 AM

Yeah.

Anonymous

But these bug classes are the same.

Anonymous

SO it isn't a total waste of time. It is a really nice step into what I wanna do in a strructured way.

forest

ROP/BROP/JOP/LOP etc apply to Linux and Windows. SROP however does not apply to Windows!

Anonymous

I could learn all this free, sure. But my brain doesn't work without structure. So thats why I do courses, really...

Anonymous

Yeah, even though it is on Windows, and it does use Windows examples, Windows labs. It is like the most clear paid course I could find that introduces this side of security.

forest

4:09 AM

Anonymous

OffSec make OSCP too and that was a really good course so I kinda' went with them over SANS or something else. SInce I had a good experience with them already.

Anonymous

The IDA section is going to be super cool.

Anonymous

I know NOTHING about RE, like this. Really.

forest

Neither do I. I'm sure you'll learn a lot. :P

Anonymous

It is super impressive though, just reading bugs and stuff online.

forest

4:10 AM

My reverse engineering tool is pretty much limited to objdump lmao.

Anonymous

Hahahaha, yeah likewise :D

forest

Although I want to get better at r2.

Anonymous

I can do the basics just by being familiar with programming in general.

Anonymous

But I am not fast nor skilled at it.

Anonymous

I just know what I am looking for roughly.

Anonymous

4:11 AM

Having written code most of my life, it does make it easier for sure.

Anonymous

You just kinda' understand how things work like on a basic level.

Anonymous

Of course, if the app is huge, different story.

forest

I find that it's much easier to read the disassembly of non-x86 machine code.

Anonymous

But for small CTFs binaries it is mostly the same things and you get a feel for it.

forest

Z80 and the like. Very easy to understand.

Anonymous

4:12 AM

Yeah, I have a 600 page book on x86 I am reading right now.

Anonymous

I am considering reading the manual...

forest

The Intel document?

Anonymous

Yeah. I don't need to, not for this course.

Anonymous

But I do decide to stay with intel chips then.

forest

I'd suggest getting used to assembly in general before learning the specifics of x86.

Anonymous

4:13 AM

We'll see I guess. The book I have is really good for what I need it for. It is quite large, a lot of it isn't that useful for this course specifically and it is more around asm in general but it uses intel examples.

Anonymous

Yeah thats the whole book :D

forest

The book is assembly in general, you mean?

Anonymous

Yeah, mostly. But uses Intel for its examples.

forest

Anonymous

There's a couple of chapters which are intel specific here and there.

Anonymous

4:14 AM

It is a pretty well known book, two seconds.

Anonymous

It is uh " assembly programming" or "assembly language" by richard blum.

Anonymous

SOmething like that.

forest

The thing that's nice is that they're all fairly similar. Even two ISAs so different as Z80 vs MIPS vs x86 are more similar than C vs Perl vs Java. But they're still quite different in their quirks.

Anonymous

I got it because it was the course textbook for the intro to x86 course i did on open security training.

Anonymous

But yeah, I won't be going much more into x86 just yet. I just did that course because it had everything I needed to know for this one.

Anonymous

4:15 AM

And I got the book for extra reading, I guess.

Anonymous

Plus I like books :p

Anonymous

By the way, you might know the answer to this.

Anonymous

Is there any actual reason that intel is [dst] [src] instead of [src] [dst]? Like some technical reason? I guess not, right?

forest

It's actually assembler syntax.

Anonymous

I couldn't come up with a legitimate reason in my head.

Anonymous

4:17 AM

Oh so other processors are actually going against asm? And Intel is not?

forest

The gas syntax is [src][dst] and the intel syntax is [dst][src] ("intel" meaning a specific syntax, not Intel chips). Compare objdump -M intel vs objdump alone.

Anonymous

I see.

Anonymous

Yeah, I found it odd. I didn't think there was any real big difference just wondered.

forest

So in other words, they're two different ways of displaying the same exact thing.

Anonymous

Thanks, figures.

Anonymous

4:18 AM

As I said, I didn't think there would be some kind of mad technical reason.

forest

It's not like the CPU itself understands what the "mov" mnemonic means. But the assembler can. In some cases you'll have things like "movq" which isn't actually a different instruction from, say, "movl", but it's just part of gas (AT&T) syntax, whereas with Intel syntax, you specify register size differently.

Anonymous

Yeah, makes sense.

forest

@J-- You might want to look at how x86 instructions are actually encoded.

The assembly syntax used by whatever assembler you use is independent of that.

Anonymous

That is a good idea. Don't think the Intro to x86 really covered that.

Anonymous

Well, it did. But, not on a super deep level.

forest

4:20 AM

Stuff like wiki.osdev.org/X86-64_Instruction_Encoding can teach you a level in between "raw machine code" and "higher level ASM". It'll show you things like prefixes which are literally prefix bytes for the instruction.

Anonymous

Oh nice, thanks. I think I've seen this site url before but didn't have it saved.

Anonymous

Well, back to studying :)

forest

You should save OSDev. It's a wonderful resource designed for people who want to write their own operating systems (on bare metal), but it's great for people who just want to learn more about low-level system programming on hardware.

Anonymous

^ I will now :D

forest

Also: cs.lmu.edu/~ray/notes/x86encodedecode

Anonymous

4:22 AM

Thank you :) Probably see you not later but later :p think im going to sleep in another 2 hours.

Anonymous

@forest woah this is hahaha "geek" is for sure a good title.

Anonymous

thanks :D

forest

@J-- changed link to one on a higher level (contains the geek link within)

Anonymous

got it :D

Anonymous

Thanks again :) see you later.

forest

4:23 AM

> So what's the relationship between assembly and machine languages again? Let's examine this in detail for the x86.

very useful

@J-- later!

@J-- Oh btw the reason it's often "mov dst,src" is so it reads like "dst = src" (as in C and pretty much every language but TI-BASIC). It's actually makes a lot more sense when you start using it a lot, and eventually "mov src,dst" just seems... wrong.

2 hours later…

Anonymous

6:23 AM

lol. Just realised my holiday wasn't approved.

Anonymous

Oh great... Time for actual work in a few hours.

Anonymous

@forest Ahh okay. Makes sense! Thanks :)

Anonymous

Guess I'm not sleeping

forest

9:43 AM

pipewire.org interesting

7 hours later…

Conor Mancone

5:02 PM

What, what what????

Q: Security risks of using SQL Server without a firewall

My question is prompted by the fact that WinHost.com has some really cheap shared hosting for SQL Server where you don't need to manage your own Virtual Private Server. Unfortunately there is no firewall so you can access the server from anywhere on the net as long as you know the username and pa...