« first day (1953 days earlier)      last day (3225 days later) » 

Bob Ebert
Bob Ebert
01:49
Hey, for web application exploit development, should I focus on writing exploits with low level libraries (in python) or rather use higher ones like requests (if it's possible)
I'm trying to learn how to write some efficiently
diagprov
diagprov
02:32
@BobEbert yes, what did you expect? Microsoft operating systems are pay-for operating systems. They're not available for free.
tylerl
tylerl
03:03
@BobEbert I don't think anything in python is low-level. But if you're skilled enough to actually develop exploits, then whether you're using requests or urllib or socket.connect isn't going to matter at all. But first figure out what you're doing.
@BobEbert This is a bit like asking "when I learn to fly an airplane, should I wear sunglasses or a hat?" First learn to fly the airplane before you start worrying about insignificant details.
user image
aarg. The OCD horror. I can't take it.
Journeyman Geek
Journeyman Geek
03:23
python. Low level. Lol.
Python's an interpreted language
Bob Ebert
Bob Ebert
thnx for the answer
Journeyman Geek
Journeyman Geek
@tylerl ugh.
Bob Ebert
Bob Ebert
yea I also thought python was high level
Journeyman Geek
Journeyman Geek
and its pretty hard to get 55,555
Bob Ebert
Bob Ebert
what language is python built on?
Journeyman Geek
Journeyman Geek
03:54
you really should google that
 
1 hour later…
bilbo_pingouin
bilbo_pingouin
05:07
I'm wondering whether legal questions regarding the security are on-topic? For example about things like the Talinn Manual?
 
2 hours later…
M'vy
M'vy
07:20
monrning
@bilbo usually I think we avoided legal question as they are very difficult to answer without the exact proper context (country, laws, situation, ...). But there might have been exception to this.
 
1 hour later…
Colin Cassidy
Colin Cassidy
08:42
morning
Matthew
Matthew
heya
Some Guy
Some Guy
09:09
Hello!
HamZa
HamZa
morning
Some Guy
Some Guy
How's everyone doing?
I'm having such a good day. Freedom tastes so good
(I've got 2 weeks of "study leave" for my exams)
HamZa
HamZa
@SomeGuy good, a little bit behind schedule. What can I say? The weather is also nice, can't complain.
Some Guy
Some Guy
What's the schedule for? (What are you working on?)
HamZa
HamZa
@BobEbert what are you trying to do exactly?
@SomeGuy Internship, was too busy with CTF's lately that I kind of skipped the work I should have been doing :P
Some Guy
Some Guy
09:24
Haha nice. What do you do for them?
I had to turn down an internship where they wanted me to work with Java and ASP for $100/mo. Noped the fuck out of there :P
HamZa
HamZa
We have a "smart floor". Basically some tiles with sensors, connected to a raspberry pi. The PI serves as a gateway to the internet. Got a backend in java/spring/mongo and an android app.
The areas I touch here is variant, sometimes I'm writing java, sometimes python and sometimes I'm working on the devops stuff like Salt or Docker
@SomeGuy depending on your level, age, living situation and country. 100$ per month might be enough
Some Guy
Some Guy
@HamZa What's the point of the smart floor? To automate turning on / off appliances based on where people are?
@HamZa I wouldn't mind working for free if I knew I'd learn a bunch or got to use technologies I enjoyed. This place offered neither
HamZa
HamZa
@SomeGuy health care. Example: detect if a patient falls, give a notification to a nurse (android app)
@SomeGuy I see, too bad...
I get around 400 euro per month and work part time mostly on Saturdays plus an extra evening
Some Guy
Some Guy
@HamZa Ah. That's interesting. Are y'all just messing with the idea, or is it for real clients?
@HamZa That's neat. I'd have to work 4hrs/day + 8hrs on Saturdays
HamZa
HamZa
@SomeGuy I guess we're still in the prototyping phase. The hardware is getting improved and we're still working on improving the software.
@SomeGuy my boss is the client I guess. We do have some installed already for "testing"/"show" purposes
Some Guy
Some Guy
09:38
Sounds interesting. I assume it won't be open source?
HamZa
HamZa
@SomeGuy not sure. My boss was talking to a colleague of mine to open source the gateway (raspberry pi) solution and to write a blog post about it since this isn't the real income (deal breaker) and we're building on OSS projects. But my colleague didn't have time to do that
Some Guy
Some Guy
That's awesome
HamZa
HamZa
@SomeGuy They also maintain github.com/AxonFramework/AxonFramework
 
1 hour later…
HamZa
HamZa
11:10
@Ferrybig (nl) stagiair == (en) intern
Ferrybig
Ferrybig
@HamZa Thx, :)
HamZa
HamZa
welcome
 
3 hours later…
Bob Ebert
Bob Ebert
14:24
@HamZa Write exploits from flaws I find on exploit_db
Some Guy
Some Guy
Probably best to use Python, since it'll be fastest
But you'll probably also want to learn how to program
Or at least how to read code, for white-box testing
 
6 hours later…
HamZa
HamZa
20:11
it will depend on your goals. If you already fully grasp the concepts then I would highly suggest to use libraries to do the heavy lifting for you.
I might even go further and look for frameworks that would facilitate this. For example in the binary exploitation scene, you might see several usage of https://github.com/Gallopsled/pwntools .
@SomeGuy I can't imagine a professional pentester without programming skills...

« first day (1953 days earlier)      last day (3225 days later) »