I think we should start a campaign to bring back punctuation

is currently dead; suffocated after reading that comment due to lack of punctuation informing me that it's okay to breathe

3 freaking question marks in there.

on an unrelated note, has nobody owned up to running our resident bot yet?

@RоryMcCune ? heh

@RоryMcCune Wait, he's still here?

@silverpenguin @HenryWHHack is a bot, who kind of wanders in and out of the room

whilst saying even more random stuff than @Simon

Oh... yeah... ignore has been so effective, I haven't noticed him

He's not a bot, ffs.

@RоryMcCune oh i see

@RоryMcCune I think it may be my fault that he's here. I annoyed a troll in another channel, and that's when Henry showed up...

@Simon of course he is... did you see his posts this morning?

No I did not.

He's not a bot anyway.

^the deleted item was a youtube video of @RoryAlsop doing a presentation

He's just a huge troll.

@Simon I don't think the evidence is compelling either way...

@Simon he's your bot, isn't he

pls

@Simon a PHP bot

@Simon you're bored so you've written a PHP bot

I cannot be that bored.

It's impossibru.

@AviD, would you mind removing the featured tag from the CTF Question, after all, the CTF is over

@Simon goddamn it, so when are you going to train it to say "pls"?

pls

@Simon yeah, like that

@Simon is it going to start calling you dad soon?

If this bot is written in PHP, I'm ending it all

Have you seen how dumb his name is?

Even I can't make up something this dumb.

I have to agree. Simon is not on that level of dumb

I blame @Matthew I can see the vengeance in his eyes

Hey, does anyone know of any good cyber security attack data sets? (Also can I ask this as a question on the forum or is it off topic?)

@Crizly You're a cyber security attack data set.

I am?

Ok, looks like I'm gonna be gone most of the day

You can't just do that to newcomers Markus.

later

Did you just rejoin the room like twice?

@Simon Does it matter to look like one at least!

Is the chat going mental?

@Crizly What kind of data sets? Like indicators of compromise?

@HenryWHHack Ask my left nut.

@Simon as usual

Ah, hello @HenryWHHack

ohnuhnuh

@Simon going, going, gone

@Ohnana my octopus friend ... dance for me :@

@Simon wat

@Xander Yeah, and like how the attacker got in, what they did once they got it, what technologies they jumped to etc

@Ohnana ^_^

@Crizly verizon DBIR?

can we call him ohnana montana?

@silverpenguin no

verizonenterprise.com/DBIR

@Ohnana Just looking now, does the report come with an actual data set?

@Crizly eeeh i think it's just a high-level executive report

the data set itself is sensitive information

@Ohnana >.< I need some data

@Ohnana You're sensitive information ily

i don't think what you're looking for exists

wot

for starters, that's quite broad, and it would be a massive amount of data. second, that's a lot of privileged information that companies would not release.

@Crizly So that sounds like a threat intelligence feed, of which many are available commercially. They're very expensive, and the anecdotal evidence is that they may not be of commensurate value. Given that the vendors are making a ton of money off of them regardless, I'm not sure what you're going to find publicly available, for free or inexpensively. Something like the Verizon Data Breach report might be a good start though.

Although the top vulnerabilities it talks about are...questionable, there's definitely some good data in there.

@Simon yw

@Adi idk

@Ohnana whats my name @Ohnana whats my name yea whats my name

@Xander hey come on now, I'm sure Pablo FTP is totally one of the top-exploited products in the world :op

ttfn

@kalina short and sweet!

@RоryMcCune Ha ha, yeah, that. :-)

@RоryMcCune I don't appreciate being called short

rekt

@kalina What's wrong with being short?!

@kalina I was referring to your visit, not your stature (which would make no sense as I've never met you)

cant reach the good cereal

@RoraΖ try living your life being eye height with everybody else's chin or neck or chest

@kalina I do

@kalina easier access to the kneecaps

@Crizly you could try looking at WASC's web incident DB

@RoraΖ well then you must hang out with really tall people

projects.webappsec.org/w/page/13246995/…

@kalina try living your life looking down all the time D: its like permanently expecting to step in something

@RoraΖ How tall are you?

Or rather how short are you? huehuehue

5'6"

Most of my friends are taller than me

@AviD Thanks i'll check it out

see, you're taller than me

That's not insanely short.

@kalina how tall're you?

Average height for men is 5'10

Maybe 5'9

@RоryMcCune 165cm

That's not even that short for a girl.

@kalina You're taller than most of my dad's family.

@kalina so only just shorter than @RoraΖ

@Simon I'm shorter than literally every other girl I'm friends with and actually literally every guy I'm friends with

Stop being friend with giants.

I'm taller than you by an inch

@RoraΖ you make such throwaway comments but an inch can be the most important thing ever

@Simon i find that racist and stuff... probably

-.-^2

You're the average female's height

I don't think you can claim being short

^

you are all short

What a faker.

now bow before me mortals

At least I'm below average

I'll bow after you.

@RoraΖ I did and I am and shuttup

moo

Logic wins!

longer legs would make such a difference in a dress

Heels make a difference

but no, it's fine

@kalina everyone has always said my legs look fabulous in a dress twirls

whistles

@RoraΖ yea but have you tried finding size 15 heels?

@RoraΖ heels means I can clippity clop down the street and pretend to be a pony

@kalina i think your hieght should be the least of your worries

lolheels

@silverpenguin I have not!

But my legs aren't sexy

@RoraΖ get sexy legs and then we will talk

:P

Hairy legs are rarely sexy.

@Simon one of my friends calls me bob kelso

Wax it is!

@HamZa p0wnlord :) nice writeups

My wedding is coming up... should probably prepare

@silverpenguin Maybe that'd be funny if I Knew who Bob Kelso is.

@Simon Who has two thumbs and doesn't give a crap?!

He looks like a murderer.

@silverpenguin hahaha, fantastic episode

@TildalWave one more to go, which imho was the most fun I could solve :_)

@Simon you have never seen scrubs?

@Simon mine are totally hairy sexy :P

today I was told my latest track sounds very "retro" but it was said in a negative way

@silverpenguin No.

@TildalWave Ew.

I don't actually know what that means

It means that you're not Porter Robinson.

ok guys grab your pitch forks, we need to draw and quarter @Simon

well I know I'm not porter robinson

@Simon what's wrong with guy's legs being hairy now?

for starters I have breasts and he doesn't

@AviD See what happens when you're not here for <time>

Oh look, another person who's trying to murder me because I haven't seen something.

I'm also shorter than he is

@TildalWave Nothing but that does not mean that I enjoy them.

@Simon or because you have

o

@Simon oh no I wouldn't even let you lol

ew^2

@Simon Join the club, I can probably count the number of movies I've seen on both hands

@DavidFreitag Haha.

@kalina breasts are not hard to accomplish... get me 3 tacos 2 burritos (extra cheese) 7 milkshakes and a large ice cream... lets make this happen

I do watch most of the recent movies though.

I don't know who Porter Robinson is

Everytime someone finds out that I've never seen "The Goonies" they have a shitfit

@DavidFreitag crickets

@DavidFreitag Well because your parents didn't love you.

@DavidFreitag lets take this out side

And we feel bad

@silverpenguin pls, I got mine without getting fat

the goonies is a fine movie for its age

@RoraΖ Orrr it was because we could barely afford food, let alone movies

@DavidFreitag Minor details

get rekt roraz

STFU @Simon

GET REKT

@TildalWave Yeah but for how old I am it was like the movie to watch as a kid

@kalina pfft lucky

Oh I'm gonna get rekt. Heading to Vegas tomorrow for the NCAA tournament start.

get rekt

@silverpenguin oh, lucky am I?

So anyone my age is like "WAT You've never seen it? ASDHAISKJSELKFJ"

@DavidFreitag To be honest, I was never that blown away by it.

I could take it or leave it.

@DavidFreitag I secretly think that anyone who says that is a bad person.

@kalina its not an easy job eating all these burritos you know only to squeeze out a b cup

@RoraΖ I think it's more of a nostalgia thing?

Must be

@DavidFreitag it's still enjoyable even if you're not a kid when you watch it imo

Now Indiana Jones, that's a whole other story.

Haven't seen any of the Indiana Jones.

@RoraΖ Haven't seen any of them

@silverpenguin sigh

@DavidFreitag Wait, how old are you? Because that movie is 31 years old.

@kalina :D one day i will make you laugh

I watched the Star Wars for the first time in 2015.

@Xander Is it? Well I'm 24

@Simon Indiana Jones > Star Wars.

There I said it.

@HamZa you got the randy chall!!! what!! when?!

@DavidFreitag Yeah, that's what I thought. I wouldn't necessarily expect anyone younger than me to have seen that movie.

I've seen all your moms naked though.

@Simon yeah but you were born like in 2013

@silverpenguin you didn't know? last minute maaan!

I love seeing the one random G+ email like it's still relevant

@silverpenguin is that a challenge?

@RoraΖ Stargate > Indiana Jones

@silverpenguin Btw, we got 59th place :D

@HamZa out of 58?

@Xander my kids have seen it

@Xander Which is weird because pretty much everyone I know that is my age plus or minus a few years made a big stink about it

@silverpenguin ~600 participants?

we believe in giving our kids a proper education in all the classics.

@HamZa D: no way!!!

@DavidFreitag what movie

@AviD what movie

what movie

@HamZa top 10% !!! even though you did most of the work!

wat movie

@DavidFreitag hasn't seen it, and I'm 3-4 years older than you.

again

mooo wat vie

@kalina The Goonies

GOONIES

vie ooom taw

@AviD You also believe in religion which makes everything you just said irrelevant.

I've never seen it

@kalina goonies or something.

OH YEAH I WENT THERE

@silverpenguin meh, you helped as well. Also you let me look into the right direction for randy :-)

@Simon yes I agree

@Simon where did you get that from?

@AviD I just watched Batteries not included the other day... not necessarily what you might consider a classic but it's pretty watchable

@Simon BOOM

goonies is awesome, star ship troopers is awesome, werewolf in paris is awesome.

religios nuts

@AviD Well sure, lots of younger people have seen it, but I wouldn't assume by default that anyone who wasn't born in the 70s had seen it.

@Xander IN THE SEVENTIES?

@AviD You're not religious?

@Xander ... or have parents who were born in the 70s

half of the room wasn't even born in the 70s

@Xander That's ancient history ages you are talking about.

most of that half are the most awesome people in here too

@Simon religious != believing in religion

fogeys

... wat

@AviD lol what

@kalina No, nearly all of the room wasn't born in the 70s. But that's neither here nor there.

religion is a way of life

this chat got suddenly too active :o

Oh yeah, I just remembered that it was irrelevant to argue about anything with you.

@kalina nice!

@Xander sure, but all the important ones were.

except for @RoryAlsop

Apparently Red Bull freezes at a lower temp than -10°C

@RоryMcCune I was actually talking about Simon and I

@AviD True, that is certainly true.

@kalina oi I was born in the 70s what's now wrong with that? :O

Which is awesome because I left one in my car and it was that cold overnight

@TildalWave old

@kalina more of a goal...

@TildalWave so old

you jelly for missing out on the most awesome century in the history of mankind?

wot

@kalina yes it was an ironic nice at your dismissal of us older people :op

@TildalWave most awesome decade, too

@TildalWave What? The 1960s?

@silverpenguin you will never succeed

well, the last few decades of it at least

@RоryMcCune a sarcastic nice?

@TildalWave I think they probably got to see some of the century. ;-)

@kalina yes

Oh man I am apocalyptically tired

@Xander yeah the 90s... yuck

@TildalWave you were born in the last few decades of the 1970s?

@TildalWave Yeah, the decade of music revolution, yuck.

oh right

more reading

@TildalWave pls the 90s was the popularization of dance music

@Simon what music revolution?

without that I would currently not be doing the thing I wanted to do

@TildalWave Techno and all the damn genres that were inspired by it?

@RоryMcCune you are old? I dont know why but i assumed you were in yours late 20s

@Simon pls acid house and the genres inspired by it

@Simon dude techno was old in the 90s

@TildalWave Grunge!

@kalina Acid House was before the 90s.

@silverpenguin yes I'm old

@kalina And grunge. RIP Kurt.

it's just that people before had a better sense of taste in music :P

@Simon and techno isn't? lol

@kalina Been a long time since I've seen Stargate, but I'll have to respectfully disagree.

pls it all unleashed in early 90s in Berlin.

@RоryMcCune old people know things, one day i hope to know things!

in 80s even techno was awesome

@RoraΖ well you can be respectfully wrong all you want

I don't understand though

@RоryMcCune how old were you when you got into info sec? if you do not mind me asking

What the actual fuck?! secure.php.net/manual/en/language.operators.logical.php

Stargate was good but went wrong

why does this sound retro and why did he single out the vocal I ripped off a random track using phasing as "nice"?!

Like so many other TV shows

something && somethingelse isn't the same as something and somethingelse in PHP

@RoryAlsop Wait how did it go wrong?

aaaaaaahhhhhhhhhh explosion

@DavidFreitag syfy cancelled it

@Adi it is?

@Adi is learning PHP ZOMG

@kalina Yeah but the show didn't go wrong, Syfy did

Can't remember which series it appeared to lose its way

@Adi Huh? It is unless I can't read.

@Adi Binary and logical and, what's the problem?

Just like it's not Firefly's fault Fox is a bunch of morons

@DavidFreitag I know that, you know that, fogey got senile and forgot that

Sort of got it back eventually

Or is the outcome different in the examples?

Hang on.

@RoryAlsop but yes, the end of season 7 to the middle of season 10 was a dark time

@DavidFreitag Now Firefly, that's a show I can get behind.

@RoraΖ AFAIK, binary logical in php is done with "&" (not &&)

I never use and in PHP.

Firefly was boring

@DavidFreitag we had to bury it under @AviD's pyramid

I just wish there were more episodes of Stargate Universe

(said nobody ever)

Firefly just never grabbed me at all

wot?

@RoryAlsop what are you, a Fox executive?

@kalina i did not enjoy firefly

@silverpenguin But Firefly was so awesome

@RoraΖ They are both logical ANDs.

@RoryAlsop Really? Were you watching it? It reached down the front of my pants and I haven't looked back since.

It was boring. Plots sucked and were derivative, acting was terrible

@TerryChia And produce different results?

@RoraΖ they don't

I wanted it to be so good, but it had nothing

@RoryAlsop yet you like Dr Who, the king of derivative plots

Because we go to SyFy and Fox for great acting...

@RoraΖ Operator precedence.

@kalina Hahahaha

@HamZa No it's not. That's @Adi's point.

If I list my all time favourite films you will understand

@kalina ehh it just felt like everything else at that time... i never enjoyed space exploration based scifi shows

@silverpenguin Firefly wasn't exploration

@TerryChia Why is this a thing?

@RoryAlsop OKAY WHO HIJACKED @RORY'S ACCOUNT

@Arperum Because PHP.

@kalina He keeps using this word, I don't think it means what he thinks it means.

@RoraΖ firefly?

@RoraΖ "The" ?

@RoryAlsop you would think if someone were to hijkack a moderator's account, they would have better things to do with it then to post non-sensical gibberish in the chat.

@HamZa @Simon @RoraΖ Basically what @Terry explained

Yeah I see.

@TerryChia WHy would anyone ever think that was a good idea? Even if a blind monkey would understand how dumb that is.

I learned this while fixing a bug that has puzzled a couple of devs for a week now

@kalina @RoryAlsop smbc-comics.com/index.php?id=4043

@Arperum @TerryChia @RoraΖ @Adi Que my favorite article ever: eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design

@Xander That article is a classic.

@TerryChia So... basically... proper use of parens?

@HamZa This isn't an edge case.

The shitty part is that it had real severe security implications.

Brazil, 2001, Dark Star, Life of Brian, the Shining = good movies. Good TV series are much harder to find...TBBT, series 1 of Lost, original Star Trek, Ultraviolet, series 1 of Being Human...

@DavidFreitag No. You do not get the point.

They were playing with fire using and in an authentication logic

Most of Walking Dead, but not the current series

@kalina do you like warehouse 13?

@Adi ahahhahhaaha

@DavidFreitag Reread the example.

@RoryAlsop not seen, boring, not seen, woo, not seen, seen, seen, not seen, not seen, not seen

@TerryChia sighs @ php

yes I just called 2001 boring

There's no good reason the 2nd case should ever be required. At all.

@TerryChia $h = (true and false); is not the same as $g = true && false; ?

yes I'm being 100% serious

no I have no regret

@TerryChia I spent a few hours explaining that to them.

They had a "debugging backdoor" to elevate any user to admin

2001 is boring for most folks. I found it very peaceful. I found Firefly boring, as it did less than 2001

@Adi What about it, you mean the operator precedence? Like true && false = false but true and false = true?

@TerryChia I read the example. I realize the implications.

@RoryAlsop Firefly had dialogue

2001 didn't need any - it had music

:-)

@Adi haha, this might be a good ctf challenge :-)

but due to this and poop, you can cause a function to return early and get yourself a nice admin session

It took me a while to understand it

Like, I can run the code, see that it actually fails and exploit the issue

@TerryChia Fuckin' PHP

@RoryAlsop I want to say BOOOOOOOOOORING

but it took me a few days to get it in my head how it works

@Xander That is also one of my favorite articles!

but that's a bit contradictory

@TerryChia yeah thanks, I see now

@HamZa we doing another one this weekend right? e_e

@silverpenguin ooh I was 25-26'ish

@RоryMcCune good! you feel me with hope

@silverpenguin I did 5 years in general IT first

@silverpenguin are we haha?

@silverpenguin didn't get into testing till I was about 30

@Adi But the beauty of PHP can only be appreciated if you don't understand it, don't you know that? Now that you do, you'll never see how awesome it is again.

@HamZa yes :< make it so!

@RоryMcCune you didn't penetration test once until you were 30?!

@Adi It's just completely non-obvious. Any programmer will not expect and to work the way it works in PHP.

@kalina :|

@kalina well ,not professionally

@Adi what is your problem

@kalina :|

@RоryMcCune thats cool... e_e I have been a professional programmer for 2 years e_e i am trying the info sec life before its too late to change my career e_e

how descriptive

@TerryChia 100% agreed. The issue was sitting there for years. They're so lucky they had a bug in the same method so we managed to catch the vuln.

@TerryChia Hmm.. I really wanna try to isolate and see if I can reproduce with a simple one page script.

To show some real-life implications

@silverpenguin I want to participate @ lasactf ctftime.org/event/list/upcoming

@Adi Might make a good blog post for somewhere. It's a classic case of a logic bug.

right well I'll leave the grown ups to have their boring conversations

o/