The DMZ

Micheal

00:26

Came here for the discussion on this post. Was not disappointed.

David Freitag

@Micheal We aim to please. Bowchickawowow.

Celldweller - Goodbye (instrumental)

►

Interesting track ^

Mark Buffalo

00:42

@Micheal hai

Micheal

Howdy

Mark Buffalo

Philip removed the angry Arnold Schwarzeneggar image :(((

Micheal

Awwww. :(

Mark Buffalo

I cried for 2 hours

David Freitag

@MarkBuffalo Wut?

Mark Buffalo

00:43

Hopefully I can get 11 upvotes though

so I can get that gold badge

Micheal

I've given you my all.

Mark Buffalo

danke

David Freitag

What question you guys talkin' 'bout

Mark Buffalo

1

Q: my site was hacked can someone explain what the attached code is exploiting?

Please see below the log entry from the hack, I have decoded the base_64 code and ultimately some files are dropped onto the server and a directory listing becomes available among other niceties! Could someone please explain what weakness this is exploiting? Our site is running Joomla 3.4 I ha...

Micheal

bitte sehr

David Freitag

00:46

Oh I didn't know there was a schwartzy in there

Nice touch

Mark Buffalo

Methinks Basicmanthz and Honze are the same person.

I hope they are... so I can get the gold populist badge.

David Freitag

02:08

So glad burger doodle didn't fuck up their hot dogs

Mark Buffalo

i should sleep because

im tired

David Freitag

I should sleep because I only got 2 hours last night

Iszi

03:33

You might be a nurd in need of a haircut if: Not owning a blow-dryer, you find yourself tempted to use the exhaust air from your laptop instead while the CPU is under full load.

Micheal

You mean not everybody does that?

Journeyman Geek

Laptop? Noob.

There are probably children out there holding down spacebar to stay warm in the winter! YOUR UPDATE MURDERS CHILDREN.

Micheal

03:50

I chuckled.

MickLH

Sup noobs

Micheal

oh hai.

Journeyman Geek

press down spacebar, fans go crazy, stick your head behind your PC....

Micheal

I start up hashcat, to each their own.

Lucas Kauffman

06:04

hello

David Freitag

@LucasKauffman o/

Lucas Kauffman

\o

Rory Alsop

07:33

Sup

Henry WH Hack

07:48

I posted a photo on this site wow

sorry for deleting but I posted a photo on this site amazing

Lighty

08:11

Morning

Arperum

\o sleepily waves

Lighty

Morning my favourite belgian

also

-2

Q: Does is it secure to use Lastpass to safe my passwords?

I am a Premium user from m Lastpass app and I love it, but I don't know how safe is it that to put all my paaword in the cloud?

password-management

AviD

08:30

@Lighty you mean waffles, right?

Rоry McCune

mornin' all

Lighty

@AviD confirmed it, @Arperum is a waffle

Mornin Rory #2

Arperum

@Lighty is creeped out a bit

Lighty

@Arperum You're the only Belgian person I know, so It's not that creepy

AviD

@DavidFreitag jeeeeZZUSSS

WTH

@RоryMcCune seems you were encouraging this bunch, instead of being the occasional adult

I like that, I think I will use that as my title on LinkedIn

M'vy

08:33

hello

AviD

"AviD, Occasional Adult"

Arperum

@Lighty What about @LucasKauffman?

Rоry McCune

@AviD huh whut, me encouraging things, when did I do that?

AviD

@RоryMcCune starwall

Lighty

@Arperum I don't really know where everyone lives, that's the NSA's job, BUTT! I do know you live in Belgium, Simon in a cold place, and AviD lives under your bed.

Rоry McCune

08:34

@AviD Ah that's just documenting them, I'm like the watcher :)

AviD

@Lighty wat

Arperum

@Lighty I hope he's not allergic to dust. And ready to move.

AviD

@RоryMcCune its like quantum comments, you cannot document without encouraging

Lighty

@AviD No offense, you look like the guy that hides under your kid's bed to scare them if they misbehaved :3

AviD

@Lighty pls, thats kid gloves.

I rig up springs to their bed, and a harness from the ceiling.

Lighty

08:37

Or place a "Babyphone" under their bed and whisper satanic curses at night

Arperum

@Lighty Are you implying I'm a misbehaving kid?

Lighty

@Arperum no, maybe, sometimes, only on Wednesdays...

Arperum

@Lighty I don't even. It's not even wednesday.

Lighty

@Arperum Then I'd say you're a lucky man

Arperum

@Lighty I've been feeling a lot like a very lucky man lately. SO I guess you goit that right.

Journeyman Geek

08:41

@Arperum only on days ending with Y

Arperum

@JourneymanGeek Basically.

Matthew

Morning

HamZa

morningz

Lighty

oi

Adi

08:59

H

Rоry McCune

@Adi I?

Adi

09:10

@RоryMcCune This "H" is used in Finnish chat rooms

As a shortcut for "huomenta"

Matthew

I need 14 magic internet points...

HamZa

@Matthew welcome to the 10K club

oh wait, I don't have 10k on sec.se :p

Matthew

Woohoo! I got 10k! I made it on the internet!

HamZa

Do you now have access to mod tools?
AFAIR a few years ago the bar was lower?

AviD

@Matthew congrats! so like 10 times as much as @Simon!

Matthew

09:26

@HamZa In theory. Sadly, it doesn't come with a manual saying "look at all these new things you can do". Although I now see dead posts

HamZa

@Matthew security.stackexchange.com/help/privileges

Matthew

Also, the orange number in the bar at the top is now bigger, and always there

silverpenguin

@Matthew 's e-ween grew 10 sizes that night

HamZa

I didn't know there was a big queue here as well...

TildalWave

09:43

@Matthew here's your manual: security.stackexchange.com/help/privileges/moderator-tools :P

ah already linked

silverpenguin

I want 10k rep :<

HamZa

@silverpenguin you need to repfarm :-)

Adi

Anybody heard this story? bloomberg.com/news/articles/2016-03-13/…

silverpenguin

@HamZa i just poked my self in the eye... clearly i do not have the intelligence to rep farm

Adi

Basically hackers stole $100 million dollars from Bangladesh Central Bank

TildalWave

09:47

@silverpenguin it can't be that difficult if even @AviD got there like 4 times

silverpenguin

@Adi what part of the story specifically the heist or this development of said heist

HamZa

@Adi wow...

Adi

The funniest part for me is the finance minister's name

Abul Maal Abdul Muhith

Abul Maal Abdul Muhith (Bengali: আবুল মাল আব্দুল মুহিত; born 6 October 1934) is an economist, diplomat, and a Bengali Language Movement veteran from Bangladesh. He has been the country's Finance Minister since January 2009. == Early life and education == Born in Sylhet, Muhith passed the matriculation exam from Sylhet Government Pilot High School in 1949. He secured first place in his Intermediate examination in 1951 from Sylhet MC College. He stood first class first in B.A. (Hons.) in English Literature in 1953 from University of Dhaka and passed his Masters with credit from the same university...

@HamZa You might know why I find it funny :D

silverpenguin

@TildalWave thats sir buzz killington to you sir.... swishes away

AviD

@TildalWave what are you talking about? @Simon's mom?

Adi

09:48

The Finance Minister's name literally translates to "Father of Money" :D

I wanna know is it his original name and that's why he's Finance Minister

or did he change it after becoming Finance Minister

So many questions!

TildalWave

@Adi any idea where the money went?

Adi

@TildalWave From what I gathered, Philippines

TildalWave

oh yeah it mentions that further down

@AviD no, I was talking about you climbing the irn bru mountain

hipster

:P

AviD

@TildalWave oh is that what we're calling her now?

Rоry McCune

@Adi it's a bit of nominative determinism, ain't it

TildalWave

09:52

LOL

Rоry McCune

Nominative determinism

Nominative determinism (ND) is the hypothesis that a person's name may have a significant role in determining key aspects of job, profession, or even character. Writing in 1953, Carl Jung gave the example of a food minister named Herr Feist ("Mr Stout"). He also mentioned his own last name and that of fellow psychiatrist Sigmund Freud, which respectively, mean "young" and "joy" in German. He pointed out that these are potential examples of what he called the compulsion of the name, considering Freud's pleasure principle and Jung's idea of rebirth. Such a connection between name and character was...

Adi

@RоryMcCune This is probably as nominative determinism as one can get

TildalWave

you're forgetting about @Simon

Matthew

@TildalWave He has a compulsion to repeat things in ever increasing lengths?

Adi

@RоryMcCune Thanks again for that. It was a very informative read

TildalWave

09:55

yes while pressing four big knobs

Rоry McCune

@Adi no worries, it's an interesting phenomenon

silverpenguin

@RоryMcCune I sent in my awful C.V. to your workplace today! hopefully they can see past my awful C.V skills and into tech knowledge e_e

TildalWave

@RоryMcCune we used to have a prime minister whose family name literally translates into "theft" LOL

Rоry McCune

@TildalWave lolz

@silverpenguin good luck :)

ozo.nokia.com/ozo-vr-capture-device <-- gotta love the optimism of this $60k product with "add to basket"

who buys $60k worth of kit in an online shop

silverpenguin

@RоryMcCune thanks :P if nothing else I hope for free advice LOL ... hey man rich people do it

TildalWave

10:00

there's of course many cultures where family names would be conceived out of someone's profession, so if that was a family trade it kinda makes sense that it would carry on

I suspect that @AviD's family name is just a fancy translation for a donut

Matthew

@RоryMcCune Can I pay with a test card... Then I'll take 10!

AviD

@TildalWave oohh that would be AWESOME

TildalWave

@AviD it isn't? :O

AviD

Imma start misspelling my own name now

@TildalWave not as far as I know

silverpenguin

@Matthew give it a go! you should know the test cards off by heart! 6464 6464 6464 6464 :P

AviD

10:03

it is an Americanization of a Russian name. No idea what it originally meant, but now I claim it is hebrew for "flag waver"

Adi

@silverpenguin Now I'm intrigued. It cannot be more awful than mine

AviD

"flag bearer"?

Adi

@RоryMcCune "Quantity"

:|

silverpenguin

@Adi what the C.V. ? :P

Adi

@silverpenguin Yep

I have the most unprofessional CV in the universe

Rоry McCune

10:04

@Adi inorite, "hmm how many 60k 3d cameras do I need.. 4... or maybe 5"

TildalWave

@AviD flagster

silverpenguin

@Adi get lots of words like PHP, CSS, JAVA, Python and throw it at a page....

Rоry McCune

Whilst they're a bit country specific I'm sure if you want examples of ones that work mr @RoryAlsop would be able to provide advice given his role in HR :D

Adi

@silverpenguin The unprofessionalism in mine is more about the design

It's not even suitable for a designer job

I went a little overboard

silverpenguin

@Adi does it have a hello kitty border?

HamZa

10:05

@Adi hahahaha

TildalWave

@AviD it doesn't really say anything to me if I try to imagine what it could mean in Slavic languages

there's of course a chance that the original didn't have any specific meaning at all

or that it was lost over the time

closest root I can think of cold be доҗ from Latin dux for duke

Adi

@silverpenguin Basically,

I regret using too much blue

HamZa

@Adi that's some fancy design skillz

Adi

and I got some negative feedback on that last bit in the bottom

HamZa

I got a word thingy, used tables with transparent borders hahaha

best thing I got is stack careers

Adi

10:11

Especially from UK and US-based recruiters

Apparently, that sort of design only works in Western and Northern Europe

@HamZa Do you give it in Word format?

HamZa

@Adi yes mwahahaha :-)

silverpenguin

@Adi aw man you make mine look like dirt

HamZa

well internz, so I guess it doesn't matter much

Adi

@HamZa Probably not the best idea

HamZa

@Adi you mean copy paste issues?

Adi

10:12

@silverpenguin Don't feel bad. I'm changing it to a more classic look soon

@HamZa No. Compatibility

silverpenguin

@Adi :( mines just 2 pages of text

Adi

@HamZa PDF is the best format for such things

silverpenguin

pure text that i squeeeeeezzzeedddd onto a page... im a developer keeping the 2 page rule is hard

Lighty

@Adi Fancy CV..

HamZa

@Adi oh, never thought about that. Thx for the pro tip

@silverpenguin scratch everything that's not relevant

silverpenguin

10:14

@HamZa I have... thats why its no longer 8 pages

Adi

@Lighty Honestly, I think so too, but I'm forced to dial it down a notch

TildalWave

@Adi they thought it represents chemical components?

Lighty

@Adi It has a real "IT" vibe though, if it were a website, fancy indeed, but too fancy for a CV

TildalWave

@Adi I think it looks awesome

Adi

Here's a unblurred version of that part

Lighty

10:15

@Adi "I think I can make the best pancakes in the world"

TildalWave

hahaha well it has "target shooting"

silverpenguin

@HamZa I used to be a farmer, I worked on alot of farms and have multiple qualifications related to animals, science and other such things... I have 3 C.Vs now 1 for animal work 1 for computer science and 1 for general... im also about to get my teaching qualification .... which means a 4th C.V.

Matthew

@Adi Ah, so you're a fat alcoholic who might shoot me. Not hiring you!

Adi

@Lighty Because I do.

Lighty

people heavily advice against "off-topic" on CV's, but that is ather cute :P

HamZa

10:16

@silverpenguin are you serious or is this another dmz joke?

silverpenguin

@HamZa im serious

TildalWave

@Adi I'd just omit that and replace it with professional skills

but that's just my 2 cents

silverpenguin

100% serious

HamZa

@silverpenguin soooo, what's the sudden change in career?

Adi

@TildalWave I have a section for that

In Northern Europe, having "hobbies and interests" on your CV is considered a plus

TildalWave

10:17

@Adi yeah I meant to use such visualization for those

Matthew

@Adi Don't know that it's the case in the UK so much

silverpenguin

@HamZa I decided to go to university to do computer science after not liking my first year studying mixed animal sciences (was going to be a vet)

TildalWave

and not use any such visualization for "social skills" et al., just a simple list

silverpenguin

programming was my hobby while farming

HamZa

cool

silverpenguin

10:19

@HamZa i get REALLY bored REALLY easily

AviD

@TildalWave lol

Adi

@Matthew What do you mean? I'm not sure I understood that sentence

AviD

@TildalWave well no, it was americanized

TildalWave

@Adi sure, but it probably steals attention a bit with that design even if it's the last item on the page... I like it, but I can see how some wouldn't

AviD

a couple generations worth

Adi

10:21

@TildalWave Indeed. That's why I'm changing it soon

Matthew

@Adi It's not uncommon to have a couple of lines about outside work interests, but that would be all I'd expect to see

HamZa

@silverpenguin ikr

silverpenguin

@HamZa the good thing about it though is I have alot of stories to tell at parties ^_^

HamZa

@silverpenguin IT guys don't go to parties, ~~noob~~ newb

silverpenguin

@HamZa yes we do D: untill people realise we work with IT... then e_e

HamZa

10:26

you know, it's kinda funny...
At school, they think I'm a nerd. At my part time job, since it's a non-IT job, they think I'm some kind of handy man. Conclusion: revealing your job title has influence of what people think of you

silverpenguin

@HamZa you need to keep your shit a secret... telling non-it people you know shit means you are fixing printers for life as a "favour" soon realising that what it was is they just got a new printer and want you to set it up and then after that they have more things to set up and while your there you might as well and then and then and then sobs uncontrollably

HamZa

@silverpenguin hehe I was fortunate I didn't have much requests

I did get the occasional "can you hack this FB account for me" requests though

silverpenguin

@HamZa why does everyone think we can just hack things like that

its just a massive social engineering venture

HamZa

Because we can if we wanted to haha?

Adi

@kalina What's a nutty face?

HamZa

10:31

@silverpenguin Sometimes I argue that if I would have the ability to do so, I would have applied for the white hat bounty program :- )

silverpenguin

@HamZa maybe we should try a few bounties out together? im sure with our knowledge we could atleast accidentally succeed

HamZa

@silverpenguin imho I think it's a waste of time. The time investment will be huge, the chance of finding something is slim and the reward is kinda small if you found something not-so-critical...

In a sense, it's a great way to get cheap pentesting done.

silverpenguin

@HamZa true :< .... gah i just wana learn more in a practical way that isnt making my own labs (making my own labs is just to easy you know all the answers) .... cant wait to start my OSCP :3

HamZa

27

Q: Vulnerable OS's?

Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?

penetration-test professional-education exploit known-vulnerabilities operating-systems

silverpenguin

@HamZa I am already working through web goat and other such things... I enjoy the CTFs i feel like i learn alot more with those... if i get a damn security job it will be easy to learn :3

HamZa

10:41

@silverpenguin I think security job might get boring with the paperwork/documentation. Well, that's at least the thing that's holding me back a bit...

silverpenguin

@HamZa see I love research and development. also paper work some days is nice, means i can chillax... though who knows maybe il hate it

HamZa

@silverpenguin now let's hope you won't become something else haha

silverpenguin

@HamZa im running out of professions

I might just become a cage fighter... when my life calms down il go back into trainning xD LOLL

or maybe next il just stop working and become an unemployeed has been

silverpenguin

11:10

why is everyone doing their jobs when i require entertainment :<

HamZa

@silverpenguin lunch maybe?

I will also probably post some writeups later on

I'm wondering, should we post a separate answer per challenge?

silverpenguin

@HamZa ahh yes them write ups... I think we should do different pages for write ups... or atleast title the answer with a CTF link

Also I have a great bussiness Idea if anyone wants to give me some investment

HamZa

@silverpenguin explain? I was unable to parse that sentence

silverpenguin

@HamZa never mind i mis read what you said, yes a different post per challenge

HamZa

cool~

Rоry McCune

11:20

^@kalina anatomy pic

silverpenguin

@RоryMcCune do you often spend your work days googling "my little pony" ? :P

Matthew

@silverpenguin I think it's pictures for reports...

Rоry McCune

@silverpenguin no. I have a security researcher in my twitter follows, who's also an MLP fan

Lighty

@RоryMcCune I expected a dickjoke here

Rоry McCune

so it's "crypto, software radio, rainbow dash"

silverpenguin

11:24

@RоryMcCune you doing RnD?

Rоry McCune

@silverpenguin nope just runnin' scanners at the moment for an inf test

Simon

3 pings, none worth reading. Typical DMZ day.

Rоry McCune

@Simon you're up early

Simon

I'm always up this early you donut.

Rоry McCune

@Simon and you always rush onto the DMZ, not usually .

Simon

11:26

pls I always come here as soon as I'm at work and yesterday I was even 15 mins earlier.

Adi

@RоryMcCune What's a "Dashie"?

silverpenguin

@Simon you are at work early and still do as little work as i do .... pfft

Simon

@Adi It's a shittier type of pony.

Rоry McCune

@Simon it's 7:27 over there... you start work then!

Adi

I regret Googling that pre13.deviantart.net/839a/th/pre/f/2013/347/8/b/… (NSFW)

Simon

11:28

@silverpenguin Son, I get shit done.

Lighty

@Adi thats not nsfw xd

Simon

I was given the ability to multi-task.

Matthew

@Simon Don't need to know about your bathroom habits in the morning

Lighty

@Simon taking a shit AND chatting here on your phone?

Simon

@Lighty It is when you don't want your co-workers to think you're into Hentai.

Rоry McCune

11:28

@Simon but your hours start at 7:27, when do you get to leave?

Adi

@Lighty Yeah, I'm a big fan of not being thought of as someone who jerks off to horses

Simon

@Matthew pls

Lighty

@Adi understandable

also

Simon

@RоryMcCune Whenever I come in at ~7:15, I leave at either 3:15 or 3:45, depending if I want to bank an extra 30 mins or not.

Lighty

0

A: I'm a White Hat and I develop my own viruses. Should I report it when almost all scanners say the executable is safe?

No you should give that to me......... I know how to use them......

what the acual frick?

Simon

11:29

Did he instantly delete it?

Rоry McCune

@Simon nice hours with an early finish. I wouldn't have thought you were an early riser..

Adi

Avi deleted it

AviD

@Simon no, I did.

also, what the frick about the question too.

Simon

o wow I did not think ovid could be this efficient.

AviD

@Simon wouldja believe

Simon

11:30

@RоryMcCune That's pretty much my donut's schedule so I try to time mine with hers.

Matthew

@AviD I don't recognise any of the names involved in it...

AviD

@Matthew what?

Simon

Oh no, I'm drinking some David's Tea at work and it's amazing.

I think I'm becoming a.... TYPICAL WHITE GIRL.

Mark Buffalo

www.wfaa.com/news/local/tarrant-county/fwpd-investigating-video-showing-officer-‌allegedly-spraying-bikers/82200692

> Fort Worth Police Officer caught on video macing motorists as they drive by

Matthew

@AviD Well, there isn't a response by either bear, or by buffalo, or by anyone who crops up lots in the recent changes list

Lighty

11:33

@AviD invent a WTF flag plz

Adi

@MarkBuffalo So, he's gonna get a medal?

AviD

@Matthew ah, well there ARE a few other users besides the usuals here...

Simon

@Adi fkin_american_police_rekt

AviD

@Lighty actually top answer there is pretty great.

Mark Buffalo

@Adi Medal, paid vacation

Adi

11:34

Nice

Rоry McCune

@Simon nah you'd need to be drinkin' starbucks whilst wearing ugg boots for that to be the case

Matthew

@AviD Yeah, it's just unusual to see a high rated question without any of them involved!

Adi

I approve

Simon

@RоryMcCune One step at a time roro.

Lighty

@AviD was talking about the linked answer though

AviD

11:34

pfft

Adi

Fuck 80% of bikers

Mark Buffalo

@AviD Lol @ deleting that other post

Simon

1

Q: I think my site was hacked. Can someone explain the "GET / HTTP/1.0" garbage in this error log, and what it's doing?

Please see below the log entry from the hack, I have decoded the base_64 code and ultimately some files are dropped onto the server and a directory listing becomes available among other niceties! Could someone please explain what weakness this is exploiting? Our site is running Joomla 3.4 I ha...

php exploit apache

Man, this guy's life must be miserable if he instantly thinks an attempt = rekt.

And lol @ the accepted answer.

Mark Buffalo

too bad the accepted answer won't have a score of at least 10

so I can't be a populist

Matthew

@MarkBuffalo Yeah - I've got that with a few questions...

Mark Buffalo

11:40

@Matthew damn you

Matthew

@MarkBuffalo What? For having the same problem?

Simon

loooolo

That was ambiguous.

Mark Buffalo

@Matthew No, you have a few populist badges?

Simon

Nah he doesn't: security.stackexchange.com/users/89876/…

Mark Buffalo

I re-added Arnie

Philip removed it

Simon

11:45

ok thnx markus

Mark Buffalo

you're welcome

silverpenguin

I was thinking about asking a big question on SE about steganography ponders

Simon

@silverpenguin Let me correct your grammatical errors first.

Matthew

@MarkBuffalo No, I don't. I have few questions where the accepted answer has fewer votes (or negative votes)

silverpenguin

@Simon i would appreciate it

Simon

11:46

@silverpenguin How does it feel that someone whose second language is English makes a such request?

Mark Buffalo

lol

Did anyone check the IP address the OP pasted in that thread?

silverpenguin

@Simon quite good, it means you have nothing better to do

Simon

@silverpenguin !!!!!!!!!!!!!!!!!

silverpenguin

@Simon <3

Simon

@MarkBuffalo Nah, since anybody who runs at least one public facing web server has 700 million of those logged.

Mark Buffalo

11:49

Yes, but it's supposedly coming from a cloud hosting company's email server.

Simon

Probably someone who thought he could run a mail server got rekt.

Mark Buffalo

I found the owner's linkedin, etc

silverpenguin

@MarkBuffalo face palm

Mark Buffalo

also, the email address of the "hacker"

Matthew

@MarkBuffalo Was it the OP? Please be the OP...

Mark Buffalo

11:55

[email protected]

Simon

There goes the email on a spam list.

Mark Buffalo

Yeah, and if you google the email, it shows a bunch of other sites he's "hacked"

Matthew

@MarkBuffalo Yeah, apparently, he's not keen on Isis

Mark Buffalo

<div style="text-align: center;"> KurDish HaCk3rS WaS Here [email protected] FUCK ISIS !

lol

silverpenguin

guys can i have some feed back please ( before i get down voted to hell) security.stackexchange.com/questions/117492/…

Simon

11:57

downvoted

Matthew

@silverpenguin Few grammar issues, and probably a bit opinion based. Also, start a "photos of cats" Twitter, and you'll be able to send as many cat photos as you like, without an explicit link to the recipient...

silverpenguin

@Matthew yea i guessed that but i was more interested in direct communication with shorter data

Transcript for