The DMZ

Wally

07:18

Is having 10-13 IPs in the middle in my traceroute normal?

All of them seem to be my countrys ISP related.

Barry Carlyon

07:53

Yes

~ish

Sometimes you'll get some "messy" routing in a data center somewhere

Barry Carlyon

08:06

Also your packets have been selected for a random search today and routed to the TSA touchy feely line

Wally

10:12

Hello guys I'd like a command line tool or Python script for Hidden SSID detection.

I need to be able to log or parse the output if it's not python

Rоry McCune

10:24

kismet would seem like a good option for that

you can definitely punt the logs to xml

and parse the XML for stuff

although it's a bit old github.com/raesene/TestingScripts/blob/master/kis_analysis.rb is an example of a script that parses kismet logs

Terry Chia

@RоryMcCune It's ruby though so you'll want to rewrite it in a real language. ;)

Rоry McCune

to quote a long departed person..... PLS

actually IIRC kismet are adding an API to their product

so it'll be available over REST

which would be kind of cool

Terry Chia

@RоryMcCune Hipster yes... useful... not really...

Rоry McCune

well it means you can get info from remote kismet sesnors

also parsing JSON is easier than XML :)

albeit once you get XPATH hanging XML isn't too awful

AviD

11:02

@TerryChia isnt that the definition of hipster?

AviD

11:30

FYI: <ಠ_ಠ> is a valid XML tag. I trust we will use this only for good. <ಠ_ಠ/>

Tweeted by elliewix on January 26, 2016 at 10:44 PM

M'vy

syntax error?

shouldn't that be </ಠ_ಠ> ?

AviD

that depends, if you assume the main part of the tweet is intended to be inside the tags.

M'vy

Either way, there is a syntax error

AviD

nuh uh.

M'vy

unmatched tag

AviD

11:40

the first tag is just a statement of fact.

M'vy

hm

AviD

the seond one is irony.

M'vy

yeah ok.

AviD

or maybe there is a syntax error.

M'vy

I need to fetch my irony module back from repair

StackExchange

13:20

Learning arcane bullshit from the 80s can break your computer, but if you're willing to wade through arcane bullshit from programmers in the 90s and 2000s, you can break everyone else's computers, too.

AstroDan

14:39

Ok, this is weird: security.stackexchange.com/questions/121203/… what should this be flagged as?

M'vy

yeah that could prob be deleted

Iszi

15:44

Wow. Too bad there's a timeout before we can flag to delete.

Sent a custom flag to the mods.

schroeder

taken care of

Developer

16:49

hi

any security expert here ?

CodesInChaos

@Developer Everybody has different areas of expertise. Few people are experts in all aspects of security.

Iszi

It depends. How do you define "security"? Or "expert"?

Or "any"? Or "here"?

Developer

Is it possible for you guys to find my ip address ?

Mark Buffalo

hi

I am security expert #023.4

Developer

is it possible @security wise.. ?

Mark Buffalo

16:56

how can I help you?

Iszi

@Developer Very possible. Any provider whose content you access can see it.

Mark Buffalo

If I link an image here, and you click on it, and it's on my web server, yes

or even if it gets oneboxed by stackexchange, I'll get everyone in the room

Developer

@Iszi providers can, but can anyone randomly find my ip address from here

Mark Buffalo

solution: vpn?

Yes, I can do it by that method

Iszi

@Developer Like Mark said, if one of us posts an image hosted on our own webserver then we'll have your IP in the logs once your browser loads it from the chat room.

Developer

16:58

@Iszi we can then put anything in url and get lots of information, is there any passive way , i think ones you mentioned are active

Hosch250

So, right now, SE has your IP, but we do not (I don't think) because SE is acting as a man-in-the-middle between you and us.

Mark Buffalo

and from there, I will stalk you

Thomas Pornin

@Developer: like that:

Mark Buffalo

and now he has our IP addresses

now he has your IP address

Hosch250

@ThomasPornin Doesn't click it

Mark Buffalo

16:59

You have been found out :(((((

Iszi

@Developer In many ways, this method is passive. We could leave hotlinks to images all over the place in areas you might stumble across them.

Mark Buffalo

You didn't have to click it. IT was loaded by SE chat.

Developer

@Hosch250 I won't

Thomas Pornin

@Hosch250 Too late. OneBox!

Mark Buffalo

You are already in the list of people

Onebox'd

Iszi

16:59

@Hosch250 You don't need to.

Mark Buffalo

Mouse-over the image

CodesInChaos

Embed an image loaded from your own server. It will automatically be loaded and the server learns the IP.

Mark Buffalo

^ Bingo

Hosch250

Oh. I "visited" it just by having it OneBox?

Mark Buffalo

The IP of everyone in here

Yup

Thomas Pornin

16:59

Exactly.

Mark Buffalo

It was loaded by OneBox

Hosch250

I didn't know that.

Developer

sorry but I didn't get it

Hosch250

Wow. Scary...

Developer

i am a bit lost

CodesInChaos

17:00

If you want to hide your IP, use some kind of trusted proxy service. A VPN, Tor whatever.

Developer

@CodesInChaos don't want to hide, it, I just want to see what's possible

CodesInChaos

Every server your computer talks to learns your IP.

Mark Buffalo

@Developer Sorry, essentially... here's what happened. He put an image from his server into this channel. SE Chat loaded that image into this channel, and your browser connected to his server to access / load that image

CodesInChaos

Since the above image is on @ThomasPornin's server, he learned your IP.

Thomas Pornin

@Developer I wrote a message with a URL in it, pointing to an image on my own Web server. When you saw the image, it is because your browser just downloaded it from my server, so your IP shows up in my Web server access logs.

Mark Buffalo

17:01

79

Q: Script Kiddies - how do they find my server IP?

I've set up a site on Digital Ocean without a domain yet, so there is only the IP. Despite telling no-one of its existence or advertising it, I get hundreds of notices from fail2ban that various IP's are trying to hack my SSL port or are looking for PHP files. But how do they know that I do exis...

2

Developer

@ThomasPornin that's awesome, excellent

Iszi

@Developer Whenever someone posts a link to an image in here, the chat application converts it to a hotlink to the resource. So instead of just seeing http://somedomain.com/image.jpg you see the actual image. But to get the image, your computer has to request it from the server that's hosting it. So whoever runs the server at somedomain.com will have your IP address in the logs when that happens.

Mark Buffalo

Yeah, that.

Hosch250

Now, I heard that IP addresses change periodically. How does that happen without getting duplicates?

Mark Buffalo

Your ISP would change your IP address

Developer

17:02

@Hosch250 i too think that sometime

Mark Buffalo

Dynamic addresses, for example

Thomas Pornin

@Developer: so, to be specific, I don't have your exact IP address, I have a list of 26 IP addresses, corresponding to 26 people in this room.

Developer

brb

Iszi

@Hosch250 Google "how does DHCP work".

Thomas Pornin

Your IP address is in these 26.

Hosch250

17:03

Does the ISP just have a block that they randomly swap?

Mark Buffalo

DHCP.

Hosch250

OK, looking it up.

CodesInChaos

Thomas Pornin

@Hosch250: it is more allocation than swapping. In DHCP, a machine asks for an IP address, and gets it for a given amount of time. It must periodically "renew" it, otherwise it becomes free and may be allocated to somebody else.

Hosch250

@CodesInChaos That's me.

And I'm not using FF.

Mark Buffalo

17:04

@Hosch250 That's all of us

With what our browser is reporting

Each image is individually generated

Hosch250

We all have the same IP and use Century Link?

Mark Buffalo

Nope. The image is dynamically generated

Ohnana

Nope, it autogenerates based on browser fingerprinting

Mark Buffalo

I see my info, you see yours, and so on

Ohnana

mine says "cogent communications" and reports linux and chrome

Hosch250

17:05

Oh, that image is auto-generated.

Rоry McCune

and mine says "Andrews and Arnold"

Hosch250

I thought it was static.

CodesInChaos

Ohnana

@Hosch250 same, i had to go to the website to figure it out :P

Hosch250

Let's see. Can I hijack my browser to say Chrome, or something?

Rоry McCune

17:07

@CodesInChaos interesting, I guess that one must be browser geo-location

Mark Buffalo

You mean can you change your browser's headers? Yeah

Rоry McCune

but I didn't get a permission prompt

CodesInChaos

Those danasoft signatures were popular in German forums 15 years ago.

Mark Buffalo

You can change your user-agent, etc.

CodesInChaos

@RоryMcCune GeoIP, I assume. Since images have no access to the geolocation API.

Mark Buffalo

17:08

addons.mozilla.org/en-US/firefox/addon/random-agent-spoofer

Rоry McCune

@CodesInChaos ah, that's interesting, I wonder how my little highland village got into the geolocation database... but you're right

CodesInChaos

I think the most popular one is the maxmind database.

Mark Buffalo

Yeah, I remember the danasoft images from 1997 or 1998

Or something similar

Rоry McCune

@CodesInChaos hmm maxmind has me where my ISP is down in England

danasoft must have a better database...

Mark Buffalo

CodesInChaos

17:20

For GeoIP the main limitation seems to be that some ISPs use one IP pool for a large region.

Mark Buffalo

That is true

Developer

back

Hosch250

Got locked out of chat for a while.

Developer

quiz time: is iis server crack-able ? can you harvest passwords out of it ?

CodesInChaos

only if the admin fucks up or the hacker discovers a new vulnerability in the server (rare).

Developer

17:33

*btw i know the anwer already

*answer

CodesInChaos

there is an edit feature.

Developer

@CodesInChaos if they already hve access to it

as an admin*

CodesInChaos

and which passwords are you talking about?

Developer

application pool account's password

usually admins already have access to service account, but at few companies I seen developers using own accounts as application pool account

CodesInChaos

If you have admin access, why do you care about the password for a lower privileged account?

enderland

17:38

@MarkBuffalo that picture is sweet

Developer

@enderland did you clicked it ? it was a torjan

enderland

@Developer it's an imgur link

Developer

@CodesInChaos if hacker somehow gets access to a web server, they can harvest application pools account password and use that as backdoor

sharepointpolice.com/blog/2010/08/18/…

CodesInChaos

If the hacker has admin access to your server, you're fucked.

They can backdoor it a billion different ways.

Developer

@CodesInChaos i feel dumb now :/

Aaron Hall

17:42

When I was a kid I got in trouble for googling "backdoor."

and it messed with my fragile li'l mind.

Developer

can a domain admin log into any workstation in domain

security flaw

Jacco

18:01

hi

Developer

hi

i want to learn about intranet security, what would be the best resource

I watched most of the courses here -

pluralsight.com/blog/tutorials/learning-path-ethical-hacking

but i think am still missing a lot

specially when a user already has access to a intranet, what can they do to it

and how we can make it secure

Jacco

that's a very broad question.

Developer

yes, that's why I am after a resource I could read or watch :)

Jacco

hmm, maybe start with reading Security Engineering — The Book (link). after you've read it, you should be able to figure out what your interested in learning next.

Mind you, there are no simple answers to your question.

Developer

@Jacco thanks

looks like a really good book

Jacco

18:20

it is a good book, it touches a lot of subjects and shows how interconnected the various areas are.

Gilles

20:18

0

Q: Username & Password Keystroke Pattern

Hello thank you for taking time looking at this question. Is it possible to determine the keystroke patterns for a certain user? My idea is that, when the user enters their username & password it must contain a specific keystroke pattern that when analyzed it could probably predict the actual us...

security research

Jacco

Sound like a system that would lock you out after a good night out.

M'vy

23:11

@CodesInChaos You're near me?

ah ok it's automatic image. got it

Transcript for