The DMZ

Anonymous

02:18

Hey folks. Just dropping this link in here in case any experts want to weigh in:

Anonymous

2

Q: Should "Run Snippet" option have a reputation requirement? (To prevent... user stupidity and SE as an attack vector)

This question (it's an obfuscated JS hack) allowed this user to randomly click the "Run Snippet" which then got his router hacked. Should the Run Snippet option require a minimum reputation to prevent using SE as an attack vector? Because... um, this proved that it works...

Anonymous

(I've given my two cents, but I'm sure most of y'all are more qualified to comment.)

Mathematics

06:07

why is this address taking me to google signup page ?

blog.security4all.be/2008/07/…

Lucas Kauffman

@Mathematics because it's only for invited users

Mathematics

06:21

oh, I was trying to this book 2nd edition like a complete pdf
https://www.cl.cam.ac.uk/~rja14/book.html

there is a link for 1st edition but 2nd edition is broken into parts, but I prefer a complete pdf, instead of downloading each part and combining it

M'vy

07:24

mrning

Mathematics

Morning, it is :)

M'vy

[input coffee]

Yuriko

07:43

Morning! I was wondering: does questions like "Is X due to security reasons?" or "Would not(X) causes a security risk?" are on-topic?

X is the use of private windows instead of private tabs; as it's a common feature among every browsers (the majority at least), I don't see that as opinion based. :-]

Mathematics

Yes, go for it, let someone else confirm too...

M'vy

08:12

might be too broad per se

did you try to search for it? I'm sure they are already question about this kind of thing

Yuriko

08:40

Well I think I remember having read something a long time ago on the topic. However, I searched and nothing came up. Even if the answer is somewhere (which is probably the case), the information doesn't seem easily accessible.

M'vy

08:58

yeah me too.

You can probably make a Q then.

Try to not be too broad and focus on what's really your problem

Yuriko

09:09

I don't have any problem, I just found the fact that I need a separate window annoying, and nothing showed up when I looked for a reason. I think I recall that it was because of a security issue that could arise when data are shared between tabs, but I'm not sure. I'm only interested in the security aspect. :-]

Anyway, I'll think about it. Thanks.

Mathematics

11:20

chaps.... anyone ever read any appraisal which is full of criticism, think I read it but can't find it anymore now...

HamZa

@Mathematics about?

Mathematics

about job.. an employee criticising there management...

Yuriko

Does the company involves food delivery?

Mathematics

11:38

Social Engineering, is what you applying on me ? :P

Yuriko

Nah :] I found this however, I just had a quick look at it but didn't read it at all, so it might be off-topic: medium.com/@taliajane/an-open-letter-to-my-ceo-fb73df021e7a

Mathematics

12:12

true, not so relevant

this is more relevant

smallbusiness.chron.com/…

Mathematics

12:51

Someone here worked with OData ?

StackExchange

I get that there are security reasons for the schedule, but this is like the ONE problem we have where the right answer is both easy and straightforward. If we can't figure it out, maybe we should just give up and just replace all the portraits on the bills with that weird pyramid eye thing.

Mathematics

perhaps someone can provide me link to vulnerability website I could use to check voulunterbity OData has, please

Matthew

13:24

OData is a protocol, rather than a product, isn't it?

Rory Alsop

17:49

10

Q: Can cell phones be turned on remotely for surveillance by the NSA?

Edward Snowden had previously revealed that NSA has the capability to turn on a cell phone even when it is turned off ( but with batteries on ) and can then record conversations. Others like CNN state that : ..But government spies can get your phone to play dead. It's a crafty hack. You pre...

surveillance nsa

@MarkBuffalo ^

(hahahaha)

Mark Buffalo

Pol

Ywah, I can answer that

MickLH

> I got plenty of rep, but I would click that button too.

please, do it.

I seriously hope it leads to horrible, horrible things

Mark Buffalo

The other answer seems to suffice

Rory Alsop

grand

Developer

19:59

SAM + System file = ?

anyone around got eme

Ohnana

20:15

if you mean SAM as in SAMdump, then the SAM is the security Account MAnager

Security Account Manager

The Security Account Manager (SAM) is a database file in Windows XP, Windows Vista and Windows 7 that stores users' passwords. It can be used to authenticate local and remote users. Beginning with Windows 2000 SP4, Active Directory authenticates remote users. SAM uses cryptographic measures to prevent forbidden users to gain access to the system. The user passwords are stored in a hashed format in a registry hive either as a LM hash or as a NTLM hash. This file can be found in %SystemRoot%/system32/config/SAM and is mounted on HKLM/SAM. In an attempt to improve the security of the SAM database...

Developer

I know what it means, I need to recover domain cached credentials from it

but i don't think it is where it keeps domain credentials

here is the scenario, I have a internal network, I forgot password of domain admin account which has access to my database, domain controller and web server only

I can access my domain worker system using a local account

Ohnana

in that scenario, thou art fucked and stupid :)

but let's go with it

you'd have to pull the server offline

and pray that you didn't encrypt the drives

labs.neohapsis.com/2014/07/01/…

Developer

it's just a development server, worse happen I will have to re install them,

Ohnana

^^ that's a guide to use cachedump.py on modern windows

Developer

@Ohnana U was reading it an hour ago

Ohnana

20:22

that pulls the hashes, which can then be run through a cracker

Developer

I*

so basically I need to mount this VHD i have in my kali box

Ohnana

or boot kali live on the device

both will do

Developer

umm, i think booting with kali would be easier

Ohnana

quite.

Developer

there are several options in kali, should I go with Live (amd64)

i think it doesn't matter

so basically I'll be running these commands if I am booting using live Kali

Ohnana

20:27

no, that's a bit situation specific

you'd mount the target drive according to the man page for mount

and yeah, the kali options don't matter too much

Developer

@Ohnana think this will help

tecmint.com/…

seems like kali doesn't likes yum command

what am I doing wrong

MickLH

Woah seriously?

You didn't put a space between the command and its arguments, if you're really asking

Developer

today is first time I am trying kali

MickLH

try instead cd '/Media/Media No./Windows/System32/config'

Notice the space after cd and the single quotes around the path with a space in it

Last time it thought you wanted to call the "cd/Media/Media" command with argument "No./Windows/System32/config"

Developer

20:43

still doesn't likes it

MickLH

It likes it a lot better lol, now it's at least trying to change directory, but the problem now is that the folder doesn't exist.

Developer

lol

that means I need to mount this ntfs disk but got no clue

ntfs 3g is required I guess but not sure how to install it

do I need to use apt-get..

MickLH

I thought you said you had a yum based system

Sorry, I don't use Kali Linux

Give me a second and I'll google it

Developer

I found this link - but it only says to mount it but not how

cyberpedia.in/…

MickLH

ok back

Ok so Kali is built on top of Debian, so go ahead and use apt-get

APT is your package manager

Developer

20:50

i see, thanks

what is live cd kali if you know by chance

MickLH

What specific version, and also what exactly are you asking?

Developer

toor

found it

its default root passwoprd

MickLH

Also there is a mount command which goes something like mount /dev/disk /mount/point

Make a folder somewhere like /mnt or /media as your mount point, then fire that command at your disk

Developer

done

when i do ls i don't get anything

i got ntfs 3g installed

trying to follw this now

How to mount/access your windows partition (drive) from backtrack\linux...

►

MickLH

The mount command is the important one to see the output of here

Gilles

21:12

0

Q: How Can a Network Server Identify a Specific Computer, Is There a Computer Fingerprint?

Most of websites put some restrictions on how to use their services; the following paragraphs are taken from “Terms of Service” of such website: Only one account per computer is allowed to view ads. If more than one account in a single computer view ads, all of those accounts will be permanentl...

computer-networks security protocols

2

Q: Hash function which is invariant under small changes

I am looking for a hash function which is invariant under small changes. E.g., if I have two strings MyString and MySttring which slightly differ, their hash values should only differ slightly as well. Actually, this is the opposite of the normal concept of a hash functions (Avalanche effect) w...

algorithms cryptography hash hashing

Developer

@MickLH here it is

Gilles

I think that hash guy is doing it wrong

Developer

i got that feeling too, but I am not able to find any good alternatives either

Gilles

@Developer You should post text instead of a screenshot. Reading the screenshots is a pain.

Developer

my virtual box is not letting me copying text

Gilles

21:16

@Developer install the VB guest additions

Developer

on live kali cd

Gilles

@Developer You seem unfamiliar with Linux, you should start with Ubuntu or elementary or Mint. Kali is designed for experienced users.

MickLH

Also /dev/sdal is almost surely not what you want, unless you've pulled a rabbit out of your hat and have some custom kernel stuff going on

Developer

@Gilles I read that too, but I won't going to get john the ripper or credential dump @ ubuntu, even though I used it several time in past but not for penetration testing

MickLH

You probably meant /dev/sda1

Gilles

21:20

@Developer Run cat /proc/partitions to see what storage volumes are available

MickLH

(one, not L)

Gilles

@MickLH oh, right. @Developer This is why screenshots suck.

Developer

I totally agree

Thanks for help guys, need to shoot for now

will try it later on :)

it shows several partitions, but will look into it later on

bye

Transcript for