So I was put on an engagement over the last week and I found a potential XSS when using Burp's intruder/repeater. However, the strange thing that I noticed was that the response in Burp is different to when I request it in the browser (Firefox & Chrome).
At first I assumed it was a different UA...
We bought a relatively big place which had been rented out previously - the tenants had left it a bit of a mess cosmetically, but it was structurally sound
If you're ever able to "send back" the password, through any channel, then you're not handling passwords correctly. Period.
If the password can be retained in the form via client-side caching, that's perfectly fine. Arguably still riskier than not, but certainly much safer than: (a.) sending the...
I need to know the square footage of a home before buying it, obviously. Never mind if it seems big enough on the inside. The number has to line up with something that can give me face.
@MarkBuffalo Well, according to Google maps, it's about 9.5m by 7.5m, so assuming the walls are a total of 0.5 m in each direction, that's about 125sqm, or 1350sqft
Are there any ways to privatize the actual location of the ISP. Some of them use this information for many purposes. So even changing it to a different location will be acceptable. In addition, I would like to know how can the ISP know what is you current location?
@M'vy I don't understand why it's off topic. Privacy, generally speaking, has always been on topic here, save some oddly specific or intractable questions.
@schroeder In order to request to take money out of my account, I just need to provide the account/routing information. On the rare occasion where I need other sensitive information, it's almost always my social security number... and that already exists on dumps
Why I am unable to find any Java card 3 connected edition development kit with smart cards?
Does it mean that the connected edition are not manufactured by any company currently?
The idea of connected edition is interesting and I would like to try it in real situation.
> Gobby TV presenter Jeremy Clarkson has been forced to reverse his position after he lost money after publishing his bank account details in a newspaper column.
> The Top Gear presenter rather rashly published his account details in a column in The Sun to back up his claims that the child benefit data loss furore, which resulted in the loss of unencrypted CDs containing bank details of 25m people, was a lot of fuss about nothing.
> "Contrary to what I said at the time, we must go after the idiots who lost the discs and stick cocktail sticks in their eyes until they beg for mercy,"
Yeah, but the problem is still there: if I have your bank account information, and I have hacked/found a personal information dump, impersonating you is EASY.
If the bank calls you up to confirm the transaction, that's one thing... and that will likely stop it, but this isn't the case everywhere.
My entire argument lies around the assumption that your personal details are in the wild. It probably depends on the country, though
What happened to US-CERT weekly bulletins about new vulnerabilities? It was one of my sources to get updates about new vulnerabilities and I received nothing since January 25.
On the website, also nothing since January, 25.
https://www.us-cert.gov/ncas/bulletins
Anyone know the reason?
Will ...
I first voted to close, then retracted it... it's about an infosec resource and we have many similar questions all over the network that did OK. I expect it'll eventually be answerable, since it's a gov't site.
@Ohnana US-CERT is not a vendor, it's a government run program and changes to its service should be governed by changes in policy, so public information
@MarkBuffalo we are talking about 2 very different things. According to your logic, we should give up banking entirely because all that data (bank account, routing numbers) is already in the public domain, and is required to be made public in order for people to do basic banking functions..
@MarkBuffalo of course it is possible to convert any public information into a lever in order to get access, but that is not what the question is talking about
personal banking advice is not on topic here, and that's what's at the heart of the question
Oh, I'm not giving up on banking entirely... I'm just saying you shouldn't willy-nilly throw your routing/account number on random websites/the internet/etc.
It's more of a possibility of it happening. The kind of website the OP was describing made me think of the multiple types of scams that use the same methodologies
But when I first saw that post, I was pretty out of it at the time. Conked out on allergy medicine. Woke up for a few minutes, and derped around, then went back to sleep... sorry, lol
@MarkBuffalo but in order to do banking activities, which is what the OP is asking about, you need to release that information, and the OP isn't talking about tattooing it on their forehead, but to communicate it to a buyer
mind that the story is written by The Register... you can't really expect quality or indeed credibility there any more than if it was written by the Huffington Post
I'll think about fitting it in there somewhere. No guarantees.
@MarkBuffalo I dunno about the proxy. What I meant is that for any long-range radio service that's authorized to hams, data transmission isn't exactly expedient.
@MarkBuffalo Hm. I guess I didn't really cover satellite Internet services. Though, they pretty much fall victim to all the issues affecting cellular anyway.
Actually, that almost makes it more probable that you do. Your mom grounded you from the Internet, so you're working around it with your little phone deal.
@MarkBuffalo I think some providers/phones actually use a mechanism that bypasses user disabling of location services. Or, of course, they could just fall back to the "we own the towers" bit.
@MarkBuffalo Not really. Can sort of hide, but they can triangulate you, and if someone decides they want to find you precisely, they have the equipment to do it easily.
@MarkBuffalo But you can't turn off the radio and continue to have Internet access. RFDF has been good enough to find individual tranceivers since at least WWII.
You build a two-radio cellular device that acts as a proxy. One of the radios links to an interface that'll be the one you connect to remotely, and the other one links to the ISP that the phone will be using to give you Internet. Put an accelerometer in there, and set it up so that any substantial movement triggers a full wipe of the device automatically.
@MarkBuffalo So, I'm not going to suggest that it isn't possible to do this and not get caught. It certainly is. But the chance to slip up somewhere along the way, and leave evidence that leads back to you is not insignificant. What I am saying is that it isn't reasonable to think that this guarantees that you won't be caught, or that you're untraceable. It doesn't.
@Xander I agree, it's only possible if you don't slip up.
@Iszi Just because you're using TOR doesn't mean you're really anonymous
ISP's generally log all connections to/fro at a specified time
The NSA logs all connections to/fro at every hop. Just finding you connected to that IP address at a specific time, and that was associated with a VPN chain, is enough to potentially unmask you
"oh we're in small town x. there's only one person using tor here. Score!"
Okay, so it's probably not impossible. But really, I'd be interested to see if there's actually been a case where a TOR user has been de-anonymized just by tracing back the ISP's connection logs.
[10:00:33] **User A** connects to **Proxy A** (User A) [10:00:34] **Proxy A** connects to **Proxy B** (User A) [10:00:34] **Proxy A** connects to **Proxy B** (User B) [10:00:34] **Proxy B** connects to **Proxy C** (User A) [10:00:34] **Proxy C** connects to **Proxy D** (User A)
So you get a list of likely connections at those specific time frames, and you have a list of proxies that are interconnected
@MarkBuffalo The problem with that is it's not a proper representation of TOR. With a path properly set up for anonymity, the links will be spread across several ISPs and jurisdictions.
And now for the part where the anonymity starts breaking down:
You are sending specific data, even though it's encrypted, at specific times. The Proxies you are chaining are sending different data because it's encrypted on their end too... so you're running an encryption chain... but....
Eventually, a pattern emerges, and you are able to unmask the entire route, start to finish, to show a handful of very likely connections
You then investigate each starting connection individually
@MarkBuffalo Okay, so you can detect that somebody made an international connection with TOR across a specific link. And, assuming you have access to all domestic infrastructure, you could trace that back to an individual. But you still don't know which connection - there must be hundreds at a given time - led to the exit node of interest, unless the idiot made the exit node his only international connection.
@MarkBuffalo You can't find anything for certain except the next link. And that's beyond your jurisdiction. It's like getting away from Texas Highway Patrol by crossing the border into Mexico.
Are there any ways to privatize the actual location of the ISP. Some of them use this information for many purposes. So even changing it to a different location will be acceptable. In addition, I would like to know how can the ISP know what is you current location?
Why I am unable to find any Java card 3 connected edition development kit with smart cards?
Does it mean that the connected edition are not manufactured by any company currently?
The idea of connected edition is interesting and I would like to try it in real situation.
What happened to US-CERT weekly bulletins about new vulnerabilities? It was one of my sources to get updates about new vulnerabilities and I received nothing since January 25.
On the website, also nothing since January, 25.
https://www.us-cert.gov/ncas/bulletins
Anyone know the reason?
Will ...
