The DMZ

Mark Buffalo

00:00

wtf. just saw a video of a cop running over someone crossing the street

David Freitag

Sounds like karma to me

Mark Buffalo

"suspect behaved recklessly by crossing the street"

suspect was a teacher.

a random pedestrian

David Freitag

I love how ruinously awful Fuller House is

Mark Buffalo

I refuse to even watch it

it looks awful

David Freitag

It's surprising how different tasting home made apple juice is from store bought stuff

TildalWave

00:07

OK movie time, then launch time cc @DavidFreitag

Mark Buffalo

Homemade everything is almost always better, no matter what

David Freitag

@TildalWave I just put Blade Runner on

TildalWave

I'll watch Seven Pounds

David Freitag

@MarkBuffalo Not always.

Mark Buffalo

@deed02392 welcome back, I was just thinking about you.

David Freitag

00:08

@TildalWave Cool

Mark Buffalo

I was watching LOTR

TildalWave

and then it's Atlas V / Cygnus launch

David Freitag

@MarkBuffalo Is that why you mentioned lotion?

Mark Buffalo

@DavidFreitag Why would I need lotion while watching Lord of the Rings?

David Freitag

@MarkBuffalo That's not what I replied to.

Mark Buffalo

00:09

@DavidFreitag Why would I need lotion while drinking homemade apple juice?

David Freitag

@MarkBuffalo Also not what I replied to...

Mark Buffalo

hmm... why would I need lotion while watching Fuller House?

David Freitag

...

Mark Buffalo

Okay, so I put lotion in the apple juice and feel a little funny.

Weird suggestion, @DavidFreitag.

David Freitag

@MarkBuffalo Is that a euphemism?

Mark Buffalo

00:16

you're a euphemism #simon

David Freitag

No, the correct syntax is @Simon, not #simon

Mark Buffalo

now you channeled him

we're doomed

German neo-Nazi politician rescued from car crash by Syrian refugees

LOL!

Well, I hope he has a change of heart.

David Freitag

Hope your face has a change of heart

Mark Buffalo

Lol

www.sadpapaw.com

David Freitag

fail

Mark Buffalo

00:26

@Xander Hey you got a few minutes?

Xander

@MarkBuffalo Unfortunately, not at this moment. Logged on to get some pressing work finished up. Perhaps a bit later.

Mark Buffalo

no worries

David Freitag

01:03

Ooooohhh Mmyyyyyyyyy

Mark Buffalo

@DavidFreitag Niiiice.

That looks like it would decapitate me in a car crash.

David Freitag

dat booty

Colin Cassidy

Morning (that'll throw the canonical time zones)

Journeyman Geek

01:19

Its morning here, so clearly its the correct time.

TildalWave

01:42

@MarkBuffalo actually, it has two reinforced arches and they're usually much stronger than roofs on normal cars, especially when they're so close together like on this one

you'd also sit a lot lower and usually in a much better seat in cars like these

you do not want to go upside down off-road tho

did I say arches? I meant arcs LOL

David Freitag

Nah they're arches

TildalWave

they are? I thought that sounded too ... erm, Roman and charioty

half way through that movie, it's interesting enough so far, bit slow

David Freitag

02:06

@TildalWave what's a good action movie?

TildalWave

@DavidFreitag dunno what you'd like, "action" is pretty broad definition

David Freitag

@TildalWave Use your best judgement

Otherwise I'll probably end up watching django again

TildalWave

dunno try Predators, and if you haven't seen them before watch Predator I & II first

David Freitag

seen 'em

TildalWave

all three?

David Freitag

02:11

Well they aren't on Netflix anyway

TildalWave

try Capricorn One, it's so old you're unlikely to have watched it and it's decent enough + there's OJ Simpson in it

David Freitag

nah it'll only take a minute or two to download

OJ was an actor?

TildalWave

among other things yes

Daybreakers?

Nightcrawler?

David Freitag

@TildalWave Predator just finished downloading

@TildalWave you finish seven pounds yet?

TildalWave

-25 min.

David Freitag

02:25

And Age of Ultron just finished too

Wow they managed to design an albuterol inhalant that tastes like cherries

TildalWave

yeah I didn't like that one, but it's action-packed

the movie, not the inhaler :)

David Freitag

I always forget that Arnaldo was in predator

TildalWave

oh look that's another movie with 7.8 user score and 3.6 meta score imdb.com/title/tt0093773 what, they forgot to quote Shakespeare while whooping interstellar asses?

David Freitag

omnomnom real apple juice is the shit

TildalWave

brown or clear?

Mark Buffalo

02:36

@DavidFreitag Are you from Pittsburgh?

Because you're a stealer :(

David Freitag

@TildalWave brown

TildalWave

good :) yum

David Freitag

Got it at an apple orchard

As well as some apple fritters

Mark Buffalo

@DavidFreitag agreed

David Freitag

My fingers smell really good

I got burrito juice and sriracha on them when I had dinner

Mark Buffalo

02:40

nice

Man. oclHashcat is insane

David Freitag

yo momma's insane

TildalWave

that movie reminded me of this:

Fargo S01 - "A rich man who gave everything" scene HD

►

David Freitag

@TildalWave So, what did you think? Good? Bad?

TildalWave

02:59

@DavidFreitag watchable, predictable but I didn't care

it's a good storytelling

BTW there's a launch in about 4 minutes youtube.com/watch?v=HDh4uK9PvJU

Mark Buffalo

just realized how bad my answer was

spent some time editing it, because I kept mixing shit up on accident

David Freitag

@MarkBuffalo which answer?

Mark Buffalo

29

Q: Is it possible to get hacked if my bcrypt hash is publically known?

I just checked https://haveibeenpwned.com/ and I have noticed that I was pwned, therefore I checked the file that hosts the details of my "credentials", however, I see my email in plain text but the password as a bcrypt hash. Since hash functions are one way and cannot be reversed, should I sti...

I have a habit of going from A to C, without explaining B

Really need to work on that...

David Freitag

"configurable slowness"?

Mark Buffalo

yea

TildalWave

03:18

computational cost factor

David Freitag

^ that

Mark Buffalo

FINE. you kids with your terminology

shakes cane

David Freitag

@MarkBuffalo Who do you think you are, huh? @RoryAlsop? I don't think so.

TildalWave

ZZ Top - Gimme All Your Lovin' (OFFICIAL MUSIC VIDEO)

►

this is my usual reply when I'm asked how much is enough

David Freitag

AC/DC - Thunderstruck

►

that was recorded a year before i was born

TildalWave

03:34

Ace of Spades- Motorhead

►

since we're sharing alarm clock music :)

David Freitag

Twisted Sister -- We're Not Gonna Take it [Extended Version] OFFICIAL MUSIC VIDEO

►

TildalWave

Anti-Nowhere League - So What

►

obviously NSFW

David Freitag

it's obvious that it's nsfw?

not to me it isn't

TildalWave

it's Anti-Nowhere League

David Freitag

uhm

ok?

TildalWave

03:43

right, I forget it's from before you were born

Mark Buffalo

@DavidFreitag shakes cane Not that old...

David Freitag

@TildalWave Well I've heard of a few things from before I was born

Pink Floyd - Another Brick In The Wall (HQ)

►

TildalWave

@DavidFreitag sure, but I'm not sure how big of an influence UK punk scene had over the pond

you had your own

David Freitag

@TildalWave Yeah exactly

I mean, I know some UK stuff but only the really big stuff like the beatles etc

TildalWave

Metallica-Master Of Puppets (Lyrics)

►

also pretty good to wake up to

David Freitag

03:52

cc:\ @RoryAlsop some good tunes above ^

TildalWave

and @RоryMcCune

David Freitag

Tool - Right in Two [1080p HD]

►

TildalWave

kinda Good Morning Vietnam style

I mean the list up

David Freitag

haha

Yeah I kinda broke it with that last one

TildalWave

oh yes and Dead Kennedys Holiday In Cambodia... or California Über Alles, depends what type of work you expect that day

David Freitag

03:56

AC/DC-Its a long way to the top (if you want to rock n roll)

►

He looks freaking hysterical with that bagpipe

Black Sabbath ~ War Pigs

►

TildalWave

heh I just played it

Get It On - T-Rex

►

^ when you're having a meeting in that company where that sweet girl that brings you donuts works

David Freitag

Man I forgot how long of a song War Pigs is

Rage Against The Machine - Killing In the Name

►

TildalWave

04:12

oh yes

probably followed by some older NiN or Primus

David Freitag

Muse - Knights Of Cydonia (Video)

►

God Muse is fantastic.

System Of A Down - Chop Suey!

►

lol it's funny how AC DC turns into slipknot

TildalWave

04:40

yeah I got to Woodstock videos :)

Rory Alsop

06:53

@DavidFreitag if it has Jackie Chan or Bruce Lee in it then yes I am! :-)

David Freitag

@RoryAlsop Interesting, not sure why I though that

Rory Alsop

Awesome videos to listen to on the commute - not sure why I decided to take the train today. It'll probably turn out to be a mistake somehow

Ahhh - starting the day well. Found a bar of chocolate in my jacket pocket. Nom nom nom

And we have a free fruit basket at work as well - result!

Journeyman Geek

07:23

@RoryAlsop heh, there's some newer stuff that's pretty good

I mentioned watching this yesterday, plot was meh, action sequences were pretty darned good

er en.wikipedia.org/wiki/Chocolate_%282008_film%29 this

and the two raid movies are pretty good.

M'vy

08:15

hi

SmokeDispenser

hi

Lighty

hi

Rоry McCune

hi

Adi

08:37

hej

Matthew

Morning

SmokeDispenser

awww, 'hi' train wrecked

can you guys close this? I'm tempted to answer but it's off topic, so I have to restrain myself from that

Matthew

Someone needed to, else we'd have been going "hi" until lunch...

Lighty

@SmokeDispenser FLagged to migrate to "SE:TechSUpport" AKA SUperUser

SmokeDispenser

@Lighty, did you see the comment that it's OT there, too?

i flagged as 'not security'

Rоry McCune

08:45

@Adi watcha' not sure if I asked you this before but, when you did the OSCP did you have any problems with other users breaking/rebooting test boxes in the labs? Wasn't sure if they were still doing shared boxes or had moved to a dedicated env. per user...

@SmokeDispenser I suggested apple.stackexchange.com

Adi

@RоryMcCune They're shared. However, there are several subnets for each group of students. The guys at OffSec make sure that each group doesn't contain too many people in the same timezone.

@RоryMcCune Generally, you go to your control panel and revert the machines before you start working on them.

If, however, some student is being purposefully destructive, then OffSec will act appropriately

Rоry McCune

@Adi cool, ta :)

kalina

oops

" "

Adi

No

kalina

sorry I was just trying to fit in

Adi

08:50

@kalina We all love you and you always have a place here.

kalina

I can't take that seriously, you said it

next week you'll be making "jokes" about me that you think are too intelligent for me to get

you're right, why wait until next week

M'vy

hey sleep-deprived pony's back :) \o

kalina

I am sleep deprived

o right

@M'vy heeeeeeeeey \o/

M'vy

reading the transcript will be creepy or anyone don't know about edit function now

kalina

either that or they'll make assumptions

M'vy

08:53

@kalina ahh that might actually be funny

I should sleep a bit more as well I guess. Long drive to parent's home that week-end, I don't want to sleep while one the road.

That would be bad

kalina

driving while tired, story of my life

brb coffee and comfy

M'vy

happy coffee

SmokeDispenser

@RоryMcCune might be a good call. I'm not sure if it may be too CS-y for them, but we will see :)

kalina

09:10

I achieved basically zero sleep tonight which is definitely going to catch up with me this weekend

so I'm going to spend all day in bed

just to further compound the issue

SmokeDispenser

@kalina sleep tight then.

Rоry McCune

@kalina I'd suggest that getting a regular sleep pattern is a good idea, but kind of difficult in your line of work...

kalina

@SmokeDispenser who said sleeping?

@RоryMcCune oh it was worth it

SmokeDispenser

@kalina well. have fun then.

kalina

@SmokeDispenser I sense you're trying to get me to leave

SmokeDispenser

09:13

@kalina nah.

M'vy

ahah

kalina

@SmokeDispenser I cannot deny my senses, and they're read only to you

if you're lucky

SmokeDispenser

deleted by op?, cannot see it due to the lack of imaginary unicorn internet points.

kalina

unicorns have nothing to do with internet points

SmokeDispenser

@kalina you may need to recailbrate your senses. Maybe they got fubar'd during the not-getting-any-sleep of last night?

kalina

09:17

ha well that's possible

but no

I figured you think that bed is a place to sleep exclusively whereas bed is the home of many activities

SmokeDispenser

(which I'm a bit envious about, but I'll hopefully manage the same or better tomorrow;))

kalina

including - for me - sitting on the internet for hours in a dazed state procrastinating

Lighty

@kalina Don't forget the "Takeout Dining Place"

SmokeDispenser

@kalina 'procrastinating' is my favourite euphemism.

kalina

but crumbs

Lighty

09:18

@kalina Chinese doesn't crumb.... right?

kalina

I don't eat chinese food

too close to fried dog

Lighty

Takeout or home-delivered BBQ Ribs here come in these foamy packages

they float on water

:3c

SmokeDispenser

@Lighty there may as well be born a new conspiriacy theory

M'vy

If dog barks, dog's not cooked enough.

Rory Alsop

09:36

@kalina tut tut tut :-)

Comments like that? In the DMZ? Euphemism central, this place...

M'vy

@RoryAlsop that'd make a great room name

samgak

dog meat is delicious

it's very very soft

Adi

Hwahahahahahahaha!!! Badlock vuln found

kalina

@RoryAlsop :D

SmokeDispenser

@Adi yeah? and is it deserving that campaign?

Adi

09:42

@SmokeDispenser Too early to tell. We only have the vuln

Rоry McCune

@Adi I saw a tweet from Dave Litchfield that implied he had some ideas too...

SmokeDispenser

@Adi grats though. There might have been some effort involved on your side;)

Rоry McCune

Comment in smb2/lock.c "/* this is quite bizarre - the spec says we must lie about the length! */" #badlock

Tweeted by dlitchfield on March 23, 2016 at 8:24 AM

Adi

@RоryMcCune Yup.

Colin Cassidy

@RоryMcCune if I didnt know any better I'd think that the person who found the bug was the person who put the bug in there in the first place

Rоry McCune

09:45

aannd now they'll have a vulnerability window with no patch in sight for 2-3 weeks.

muppets

Adi

@ColinCassidy It says in the code comment

SmokeDispenser

@RоryMcCune :D

Colin Cassidy

because if we're doing that now I've got 15 years of bugs I can cash in on

Adi

@RоryMcCune I think we can get an exploit out in 2-3 days

Already located exactly where the vuln is, how the exploitation would look like

Now it's just a few sessions with the debugger

HamZa

morningz

Lighty

09:52

0

A: Help generating wordlist using crunch

You Can Create Password List By using this following command: crunch min max input-list -t pattern -o output-filename crunch 10 10 abcdef23456789 -o output_file.txt

I dunno, its a correct awnser, but it's so... short xd

Adi

If any of you guys are looking in the same issue and want some tips, then I recommend looking into the Wireshark SMB dissector. It was very helpful.

You're already good with C and know the SMB specs, then the dissector is not that helpful, though.

HamZa

root@kali:~/ctf/lasa# crunch --help
crunch version 3.6

Crunch can create a wordlist based on criteria you specify.  The output from crunch can be sent to the screen, file, or to another program.

Usage: crunch <min> <max> [options]
where min and max are numbers

Please refer to the man page for instructions and examples on how to use crunch.

kalina

ffs

HamZa

SYNOPSIS
       crunch <min-len> <max-len> [<charset string>] [options]

kalina

pinging me with your stupid inferior operating system pasting

HamZa

09:54

@Lighty seems legit

Lighty

Wtf?

HamZa

@kalina oh my bad :/

Lighty

I edited a post, and then... someone else edited?

I thought It was impossible to edit if it was being edited!

kalina

@HamZa it's fine I can't really care about people pasting copies from kali in here can I?

SmokeDispenser

hahahha

HamZa

09:55

@Lighty it is

Adi

Hahahaha

Lighty

then wtf is this shit

HamZa

@kalina you hurt my feelings... but then again I'm a nobody here :P

SmokeDispenser

@Lighty, me

@Lighty I ninja'd you

Lighty

@SmokeDispenser hmpf ;(

HamZa

09:56

@Lighty get 2K rep oh wait I've got less than you :P

Lighty

@HamZa huh? xd

Rоry McCune

@Adi nice!

SmokeDispenser

@HamZa, off by order of magnitude?

HamZa

rep = reputation
When you get 2K, you don't need to wait for approval

Lighty

@HamZa Oh, in that way, yeah, I know xd

HamZa

09:58

@SmokeDispenser use the arrows, I don't know @ which message that's directed to

kalina

@HamZa hardly, don't you actually get involved? That would make me the nobody and you the somebody

SmokeDispenser

@HamZa that one.

... as the hoover-highligt indicates;)

HamZa

@kalina hehe, I hope you aren't irritated

@SmokeDispenser well, I meant 2K on sec.SE

SmokeDispenser

@HamZa, damn, that trap again.

Adi

Order of magnitude

Orders of magnitude are written in powers of 10. For example, the order of magnitude of 7003150000000000000♠1500 is 3, since 7003150000000000000♠1500 may be written as 1.5×103. Differences in order of magnitude can be measured on the logarithmic scale in "decades" (i.e., factors of ten). Examples of numbers of different magnitudes can be found at Orders of magnitude (numbers). We say two numbers have the same order of magnitude of a number if the big one divided by the little one is less than 10. For example, 23 and 82 have the same order of magnitude, but 23 and 820 do not. == Uses == Orders...

SmokeDispenser

10:01

@Adi hu?

HamZa

I do get flag notifications here though

Adi

@HamZa I'm sorry to hear that

HamZa

@Adi haha no worries, that's only when I'm in one of the SE rooms (not SO)

Btw this blog has some awesome exploit tutorials: blog.techorganic.com/2015/04/10/…

kalina

@HamZa a frequent misconception

HamZa

reading the question's requirements again, it seems that the answer doesn't fullfil:
- Contains **exactly 4 letters**, which have to be a-f (all lowercase)
- Contains **exactly 6 numbers**, which have to be 2-9

@kalina not sure if you're trolling or serious ...

SmokeDispenser

10:14

@HamZa you can never be, I came to understand.

kalina

@HamZa I don't troll

Adi

@kalina Hahahahahehahahaehehahahaha

kalina

I was merely stating it is a frequent misconception that somebody has irritated me

Adi

kalina

9 times out of 10 when I actually am bothered I will just leave

look at @Adi doing the trolling

they don't know any better and will just believe you instead of me

Adi

10:24

2 hours ago, by Adi

@kalina We all love you and you always have a place here.

2

Lighty

We love you for who you are Kali.... except @AviD, he prolly doesn't feel love ;(

deed02392

@MarkBuffalo thanks ;)

silverpenguin

my belly is making the grumblies :(

kalina

@Lighty I'm not convinced he knows how to feel

deed02392

eat the foods @silverpenguin

samgak

10:44

a question. how political is this site? for e.g. would it be frowned upon to ask a question about facebook censoring links to the clinton email links using the pretext that they are a security threat?

silverpenguin

@deed02392 man im trying D: i have been late to work by 20 mins today in a row....sneaking off for a mars bar is a little much... :P

Lighty

@samgak People here at the DMZ aren't political... I know I am a Catholic whore, currently enjoying congress out of wedlock with my black Jewish boyfriend who works at a military abortion clinic. So, hail Satan....

free cookies for the one getting the reference

silverpenguin

@samgak if phrased right and doesnt sound like you are hiding in a plastic bubble wearing a tin foil hat then im sure the question will be welcomed what ever it may be... its all about how you ask it

samgak

ok thanks

deed02392

@silverpenguin man's gotta eat. just stay late?

silverpenguin

10:49

@deed02392 yeaaaa :< I always make up the time....ish..... but im getting evils xD awkwardness

deed02392

evils from perfect people who are never, ever late, i suppose

Rоry McCune

@silverpenguin that only hands can satisfy?

Lighty

-1

Q: How make 'select' without comma?

I try SQLi and comma was filtered there. How make SELECT sql request without comma?

sql-injection

deed02392

anyone got any experience with sqlmap when halfway through doing blind-based enumeratino, it comes out with gobbledygook?

silverpenguin

@deed02392 haha just from people who dont like me ;) my boss always makes jokes about me being late but he accepts i do my own thing here xD I come and go as a please... but i think others dislike the favouritism

deed02392

10:53

letting it run for now, should i kill it and fix the session sqlite db?

silverpenguin

@RоryMcCune carrrrrrrrllllll that kills people

deed02392

lmao, carrrll reference

i very much appreciate that

silverpenguin

getting assigned a task with a given time of 4 days to complete it kicks back and enjoys the next 3 and ahalf days

deed02392

i envy you

silverpenguin

@deed02392 PHP developer, the ninja of the I.T world (no one argue this....)

deed02392

10:58

i love php dev

Transcript for