« first day (1914 days earlier)      last day (3264 days later) » 
00:00 - 18:0018:00 - 00:00

00:19
@MarkBuffalo I did it
I BOF'ed
T__T
00:39
@MarkBuffalo Did you ever try VB5 or VB6? That's the easiest (not necessarily best) development platform I have ever seen bar none in terms of allowing people to develop simple stuff quickly.
@MattClendenen Dumping packets = any kind of taking them off the wire. Tcpdump puts them into a file for reading by another file. You could just parse them to stdout, or else do what aircrack-ng does and look for WEP IVs, then load them all into memory and crack WEP.
As for Intel, well, analysing captured packets of any kind is still a hard problem - on say an ISP level you might call it deep packet inspection and one use is to see if what's going over say port 80 really is HTTP traffic. That's a bit too easy obviously, as you can read it, so what about 443?
@diagprov or something to do with sneaky vlans? vlans always trying to be sneaky and seg them juciy parts of infrastructure e_e
This is all "Intrusion Detection" and there are various IDSes of various kinds... people have varying opinions on their efficacy too since they've got a near impossible job (find a needle in the haystack).
I'm only really suggesting this as an exercise and it is only one area, but, if you don't already know it parsing raw packets will teach you about ethernet frames, vlan frames (for @silverpenguin), IP frames etc.
In other words you get a nice look at a packet.
There are plenty of other options though - dig around for an open source project you like the look of.
@diagprov i should do something like this... I have a networking degree lol but have never handled the raw stuff
e_e i should
@silverpenguin I actually did it with libpcap in C. It was... interesting.
Anyway there are other things you can do too. If you think webapp security might be your thing, you don't have to write code, you can try taking apart OWASPs vulnerable web apps.
I think i would try in python... and just slowly look at packets brick by brick...
00:49
If you like the idea of learning exploitation then exploit-exercises.com
sadly webapp sec is my thing :<
In fact, there's a huge list here: captf.com/practice-ctf
@diagprov :P i am playing a ctf right now xD
I couldn't remember the name of smashthestack, but that's one of the more well known ones. smashthestack.org
@diagprov VB6 and VB.NET, yes... horrible.
00:51
@diagprov Ooooh... that's really cool. That's actually why I came to this room, and I didn't even have to ask.
@silverpenguin Nice, did it work?
yes though maybe you can explain it in further detail
(I linked you to the code above if you are interested)
I put in exactly 81 chars...
(80 chars and enter)
and that got me the flag, I was going for a BOF, but im not sure thats what i accomplished
Yes, but did you get the flag?
lol
yes i did
I got the flag yay me, but its victory is a little sour
Why?
A buffer overflow is simply going outside the bounds of the buffer
00:54
because it was so specific
retdec is awesome
I love it
i dont 100% understand why 81 chars exactly was the answer... i found the flag while debugging the buffer size so it was by educated accident
I was just wondering if you could teach me a bit??
Another list - this time (deliberately) vulnerable web apps. securitythoughts.wordpress.com/2010/03/22/…
@diagprov I wish there were better web vuln books... most books have to many words... I want to see code with comments
thats the best way to learn
00:57
@silverpenguin Watching ip man
what do you need to know?
I was just wondering if you could skim the code, and tell me why 81 chars exactly worked... not over not under
check the OWASP entry for buffer overflows
thats whats confusing me
I didn't look at the code
link it
pastebin /\
00:58
or do you mean the pastebin?
Here's another project: build a web application firewall. Use something like python's tornado to proxy web application requests. However, before you do, decide if they represent an attack, and return some appropriate page for those that do.
There's literally tons you can try to do.
@diagprov head explodes
> memset((char *)&str, 0, 80);
00:59
I should be getting a pen testing job offer next week
tumble weed
Ahhah WebGoat was what I was looking for. owasp.org/index.php/Category:OWASP_WebGoat_Project
@duzzy You're welcome :)
@diagprov ahahah
web goat!
I have used tht it was painfully basic
until i got to the ruby stuff then i was lost
my isp is fluffing me over... im getting 1/6th of my paid speed
@silverpenguin Well there you go :)
@diagprov im normally good at identifiying exploits, normally.... but so so bad at exploiting them...
I did an XSS the other day... I did a pop up box..
after tht i was lost
xD
Anyway I actually came to drop this link in for @RоryMcCune - there is actually a commercial haskell special interest group looking to make haskell a viable language for commercial development: github.com/commercialhaskell/commercialhaskell
@silverpenguin if you get your offer to become a pentester I'm sure by the time they have finished training you, you will not be lost.
01:08
@diagprov im just worried they are to confident in my abilities... im a Web dev (back end) ... I understand networking and I love cracking wifi and MitM attacks xD.... i dunno, my pay is going to be higher than most jr pentesters because of my web experience
gah
im just worried
@silverpenguin I'm the wrong person to advise here, I don't work in security. However, I'm sure it'll be fine. I guess most junior pentesters are graduates and therefore you do have more experience than them.
@MarkBuffalo reassure me, tell me im a pretty manatee
currently trying to exploit malloc in c
this will be interesting
 
1 hour later…
02:42
@silverpenguin freak
@MarkBuffalo you love it :D
Cannot believe 6 hours later and im still trying to capture these flags
yawns
if anyone is interested... I am trying to trick a if statment in C to think that I have entered the same values as another var ... though being C I cant remember if == is valid for comparing strings... if not then i need to try and copy the mem addresses over
I wish I had time to play CTF...
today, I only had an hour of free time to learn python
:8(
:-( stop having a life
the only time i get to learn python is while at work
when i get projects and decide i want to learn a new language xD
Work's been somewhat busy lately, fortunately.
fortunately?
does not sound very fortunate
fgets((char *)&str, 5, (struct struct__IO_FILE *)&stream);
got my eyes on the line
e_e
@MarkBuffalo i hope that is not true
Of course it is
or Im going complete PGP VPN LOL BRB JK AFK what ever acronyms I can find
@MarkBuffalo the more dickheadish they want to be, the harder the future will be for them... people will create harder security to crack and people will use it
Or they'll just start backdooring everything
Oh wait... luls
@MarkBuffalo thats the beauty of open source I guess... back door all you want, if we create good enough software that wont matter.
eventually
03:05
@silverpenguin You're open source
clearly you are a spy
 
1 hour later…
04:29
So So very _____.
04:40
Hey I'm about to buy a new pc (would run microsoft and linux alongside). I was wondering what processor should I use, what graphical card, etc. What are your thoughts on that?
what brand also
 
1 hour later…
05:42
Depends entirely on your needs. Logical Increments is a good resource, though. logicalincrements.com
(but pls no hardware support here, I think?)
ahh It is written in the description! (mybad)
but yah, check that link out and you should be on the right track (:
wow thanks!
 
2 hours later…
07:42
@ThomasPornin dropped you an email with my homework for feedback :p
@kalina Pfffft eating is over rated
@Gilles oh. Damn.
 
6 hours later…
14:09
afternoon all
afternoon
Happy mildly deaf me today - Machine Head rocked an amazing 3 hour gig last night
soooo loud and sooo tiring
watcha'
@RoryAlsop ear plugs -.-
14:15
@kalina yeah
@DavidFreitag tell me about it, nothing like hunger pains
needed to take them out to hear the girl I went along with telling me how cute the lead singer and the bass player were :-)
@David - you may like these guys:youtube.com/watch?v=tQK-xw44x2M
Or even better:
The beardy guitarist who looks a bit like Dimebag played guest guitar at our Monster Magnet support last year. He's good
@RoryAlsop that's a poor excuse for hearing damage
I got home like 30 minutes ago, didn't realize how hungry I am until I went in the cupboards and they're all empty
@kalina take-away time!
mmm no my stomach is a bit weird due to the uppers I don't really want to be putting fast food into it
14:24
@kalina I sort of dread to think what I would be like if I took drugs. I have to admit it's probably my fogey nature but I don't quite get the point
I totally get that others enjoy them, but no-one seems to get out of them anything more than I get without them
normally as willing as I am, I don't really want to have a drug discussion right now
@kalina me neither
drugs...
I'm tired but there's no way I would be able to sleep
I'm hungry but I'm not motivated to get up and get food
My eyes hurt but I'm unable to close them
I'm dehydrated regardless of how much water I seem to consume
Thanks to ear plugs my hearing is fine but I can't make music because I immediately start tripping out the moment I press play
so an all round bad idea then!
on an entirely unrelated note, anyone got a recommendation for a good Geforce 980 class Graphics card? ( cc @DavidFreitag )
@RоryMcCune basically any 980 card
what do you plan to do with it
14:34
@kalina HTC Vive
for testing or serious use
@kalina ahh wasn't sure if there were major differences between the card with that chipset
"major" differences -> does the cooler look like it will work
@kalina well planning to use the vive a fair bit
the only real difference with graphics cards at that tier is that modern AAA games are more content heavy than last generation's AAA games and a card with more than 1GB is basically a requirement now
so actually getting a card with 4GB of ram is worth while if you're going to be using highest level texture settings and what not
14:36
@kalina Isn't 2GB more or less standard now?
@kalina yeah I'm probably not going to AAA on it , but the missus fancies Doom 4
@TerryChia think my card has 1.5GB on it but I don't really play games
@RоryMcCune which is a AAA game
personally I think doom 4 in VR will be horrifying
but hey it'll be amusing to hear the screams
Even the GTX 660 that @JourneymanGeek sold me has 2GB.
@TerryChia 2GB on that card would have been classed as high end
14:38
Is 4GB actually required if you are still running 1080?
@TerryChia yes, I can't play GTA5 with all options on full because I'm limited by memory on the card
@kalina Ahh interesting...
I can run all of the "technical" options on full
but the ones that require storage result in a massive impact to performance
Well, can't say I know too much on this topic. The only game i play uses a 10yo graphic engine anyway :P
(GTA 5 has the memory meter in the settings page)
@RоryMcCune looks like most 980s do start with 4GB of memory
but for the price difference why not go for a 980 TI?
14:40
@kalina yeah you might be right, they're all pretty expensive, but there's not a huge gap from 980 to 980Ti
and most of the price difference could be attributed to the jump from 4GB to 6GB
yeah the rest of the PC has easily past the needed specs but I've never bothered with much of a Graphics card as I don't game much
@kalina would I be right in saying you need to watch power requirements with bigger graphics cards
@RоryMcCune well everything uses power
my gaming PC has a 970 in it which is on the low end because I've gone off gaming and primarily play older games but that's on the bottom end of "possibly OK for casual VR" scale and I'm not upgrading
I will upgrade when there is a game I want to play that doesn't run
@kalina aye just wondering if these cards draw huge amounts which might leave me needing to upgrade my PSU...
which for not VR will probably be several years
@RоryMcCune yes they will, they'll require two power connectors in most cases as well
14:45
@kalina yeah the graphics card people will be very happy about VR I'd imagine...
@kalina righto will need to check what I've got at the moment/free
minimum recommended psu = 600W
hmm some crawling around under desks will be needed , been a while since I looked
you mean you don't memorize all of the things?
@kalina well the PC was a present , so i didn't precisely spec it :)
I'm surprised that HTC have randomly come out with a VR headset
I find it hard to believe that it will be better than the oculus
14:48
@kalina well it could be a saviour for them as their phone business ain't going great
@kalina if you watch the reviews that are coming in, the controllers and the room-scale VR stuff is really good for Vive, and Oculus doesn't have it
the base hardware is very similar
@kalina people seem very taken with the idea of being able to stand up and move around in VR worlds
sounds like running into walls to me
Next up: the VR headset from Allstate Insurance
@kalina ah they have this cool safeguard, where it knows where the real wall is and you get a hologrid effect over the game if you're about to run into it
not sure that'll work in the heat of battle every time, but looks pretty good
sounds like it would appeal to the ingress crowd, maybe they could finally see the portals they've been freaking us normal people out chasing
@kalina lolz
14:51
Hah
I spent four hours wandering around ISU campus last night
..just one more field
suddenly ingress becomes the most addictive MMO ever with 74% of the world's population playing it
until someone remembers that you can put porn in VR
Larry leans over to Sergey and says "I told you we should have done VR earlier"
world economies collapse, fire rains from the skies
@etherealflux yay, something else for me to ban from relationships
15:00
wow people here on a sunday
sorry
1
Q: The Requirements of a Cryptographic Algorithm

tacomaI remember reading a book on cryptography with a section detailing the objectives that modern cryptography must accomplish, one being that even if the algorithm is known, the method remains secure. I.e. the so-called Kerckhoffs's principle. What are the other standards an algorithm must accomplis...

this has 3 close votes as too broad but it probably isn't, is it? OK, it would be better off sent to crypto
does this look like the support channel for security.se?
anyone here has a bit more insight into SUF/WUF-CMA and what's the distinction / definition of the two?
one has three letters the other has six separated by a hyphen
15:03
the requirements are crypto are simple
1) must prevent your IP from being traced by a visual basic GUI
2) must involve green text falling down the screen
@kalina it's SUF-CMA and WUF-CMA ;)
@TildalWave yay me
well then the difference is one starts with S and one starts with W
yes, and they stand for weak and strong
but why would they both be desirable properties of crypto?
beep happens
15:09
@kalina mid range, IMO. High end of that era was 4gb I think
^ what happens when you hack too many ddoses with your LAN
I've blown up two PSUs by different methods before
15:25
@LucasKauffman Unfortunately, you use Hotmail, and Hotmail refuses to receive emails from me (both because of the IP address of my mail server, and because my email address contains a "forbidden word"). You won't get an answer from me if you do not find a better-behaved email provider.
(I mean, I wrote a nice answer, and it bounced.)
basically hotmail don't like you
I might have just heard the worst joke ever
@TildalWave @Simon?
> How many ears does cpt. Picard have?
Three. The left ear, the right ear, and the final front ear.
@ThomasPornin also that's some serious discrimination going on there
@TildalWave #lame
15:29
told you
I can't do it, I need food
I'm not sure I'm in a suitable condition to drive though
@kalina you could walk :)
no I don't have that kind of energy
call a cab, rent a jet, or whatever you hipsters do
innovate a disruption
15:31
"taaaaxxi, take me to ..... the food!"
kebaaaaaaabb
I'm assuming this is after some party?
@TildalWave I think renting a jet would be a little overkill
a helicopter then
I'm usually just fine on a bicycle but that's un-hip I guess
I'll drive, my car can detect lanes
brb food
16:04
@TildalWave I have access to private jets :< I get to sit on them and pretend im rich
16:26
Fire! Burn! Die weeds! Mwhahaha!
16:36
@RоryMcCune mine happily drives 3 4k monitors at crazy refresh rates. It's one of the 980 Ti range
@RoryAlsop yeah ideally sounds like a 980Ti might be good, but I may have to go for a straight 980 to keep inside my power budget (I don't fancy changing power supply as it means I'd need to redo all the power cabling)
@kalina yeek
17:21
well that's much better
Well - Scotland won the rugby (and Hamish was at the game holding the huge Scotland flag at the start), Eilin's team won their netball, and now I have wine. Life is good:-)
now I'm just going to sit here in a daze for the rest of the day and watch netflix
@kalina ? food baby daze?
We have selected various Harry potter films from my Plex server
With wine and Pringles
@RoryAlsop ew that does not sound a nice mix
17:24
It's a perfect mix. Salt and vinegar crisps and a merlot
suppose im just more of a cider fan
its my old farmer instincts
im currently trying to forensically investigate some images
there are secrets within them
baby i dont need dollar bills to have fun tonight D:
I miss @Simon where is he
^A bit of musical oddness for you
Blue Monday as it might have been recorded in 1933
you can't get harry potter on netflix
but you can get the hobbit movies
and I've been meaning to watch those
I'm still confused as to how they made 3 movies out of that one book
@kalina they are not to bad.... took me ages to watch them...its a big comitment
@Matthew they have made dozens of movies out of the bible
17:39
maybe I will spend the day deleting stuff out of storage that I can now just watch on netflix
that should free up some space
@Matthew yeah they shouldn't have... 2 would've been much better...
@silverpenguin There are a few more stories in that, as I understand it
@Matthew I know i just wanted to be difficult :<
@silverpenguin They've also made the Spiderman origin story a good few times...
@Matthew and its starting to get annoying lol e_e just stick with one pls
17:53
^noice
although I shudder to think how long it took to make that....
old
@kalina it was published 13 days ago
old... rly?
I'm sure it was mentioned in here too
since I wasn't in any of those places at the time iirc
@kalina well I didn't see it in here :op
bla bla
I am not rising to your provocation
00:00 - 18:0018:00 - 00:00

« first day (1914 days earlier)      last day (3264 days later) »