The DMZ

« first day (1952 days earlier) ← previous day next day → last day (3226 days later) »

Ohnana

01:26

idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side DON'T CURL | BASH KIDS

Some Guy

That was such a fascinating article!

Ohnana

apparently you can do tomfoolery with ^W so cat won't display part of a malicious line

Some Guy

Really?

Where do I read more about that?

Ohnana

reddit.com/r/netsec/comments/4fi3hn/…

^^ comment of someone explaining

Some Guy

Neat

Gilles

01:39

Q: Can "cat-ing" a file be a potential security risk?

I often use cat on the console to view the contents of files, and every now and then I accidentally cat a binary file which basically produces gibberish and system beeps. However today I've encountered a situation where the output from the cat utility got redirected to the console input so I got ...

Some Guy

I remember reading about how running strings was dangerous too

Ohnana

yep, that's a weird one

Some Guy

@Gilles God damn

Gilles

@SomeGuy is it? Oh, I guess if the file is in a format that string recognizes, and the symbol table contains control characters

Some Guy

lcamtuf.blogspot.in/2014/10/…

Gilles

01:49

@SomeGuy that's just a bug in the parser, not an interaction with the terminal

Some Guy

Yeah, fair enough

Still makes me a bit wary

Bob Ebert

02:20

hey I was wondering if one should learn python socket or rather learn twisted library in order to learn exploits written in python?

Should I write a question about this in the forum, or it would be too vague, unclear?

Ohnana

that's not on-topic for infosec

it's also opinion based.

personally, I would start with the socket library (since it's basic and built on C) and work your way up to the twisted library

Iszi

@Ohnana Ah, good. I was about to say it seems like it is on-topic, just too opinion-based.

Ohnana

@Iszi TOO SLOW

Iszi

@Ohnana STFU I'm just now leaving the office.

It's been a long day.

:-P

Bob Ebert

my question was following the answer of this question stackoverflow.com/questions/4987077/…

Ohnana

02:24

@BobEbert yes, but writing the exploits sometimes requires the fine-grain control of the low-level socket library

Iszi

@BobEbert Prior responses still hold true - would be closed as opinion-based.

Bob Ebert

tl;dr using a higher api (twisted) would be better because low lever api can't follow the updates made to python

Thanks to both of you!

Iszi

Seriously though, I do need to GTFO. See y'all later.

Bob Ebert

have a good day

5 hours later…

M'vy

07:36

morning

Rоry McCune

07:48

mornin'

Matthew

morning

Rory Alsop