The DMZ

1:06 PM

Is the chat bugging out or are there two Mius?

@HamZa?

Oh wow it is bugging out.

OK so, apparently on some of the chat user icons, my profile picture is showing for about half of @HamZa's.

And when I right click and "copy image" for his icon and load it in a new tab, it shows his correct image, but here where it's embedded it's showing a copy of mine...

Kepotx

@forest half picture of Hamza? do you see a ham?

forest

Hold on

Like what the fuck is up with that.

But when you go to the URL being highlighted, it's not Miu, it's that weird electric man thing.

Benoit Esnard

Invasion of the Mius

forest

:O

Run away!

HamZa

@Kepotx hahaha bien joué

Benoit Esnard

1:13 PM

I'll flood them with electricity!

HamZa

@forest i did not try to hack SE

forest

lol

My browser is going insane.

First time I get on a fucking Windows machine in like, 2 years and this happens?

Benoit Esnard

@HamZa Encore une de ces expressions françaises reprises telles quelles en anglais j'imagine ? :P

Not sure if the problem is Windows

HamZa

@BenoitEsnard #busted

Benoit Esnard

Are you sure your browsers are updated?

forest

1:15 PM

Yep

Firefox ESR

HamZa

hard refresh?

forest

Yeah I did that after I took the screenshot (it fixed it)

So clearly it's not a remote issue but rather my browser bugging the fuck out.

If I was on Linux I could have run gcore and found out why :/

I mean what could it even be? The reference to one image in the DOM being corrupted and pointing to another image?

Benoit Esnard

While I was working for one of the most visited website website in France, we had sometimes people with random bugs like that one

My recommended solution was to clear the cache

Unrelated: I'm pentesting a website and found one error with Google ReCaptcha

"This reCAPTCHA is for testing purposes only. Please report to the site admin if you are seeing this."

Is this a vuln?

Looks like a captcha bypass, I'll test further

forest

Yep it is.

I mean, it's a vuln only in that it is a captcha bypass.

Guh, random bugs like this totally creep me out :/

Just yesterday, a Linux system with a high uptime for the second time decided fuck it, let's not support vDSO anymore! (breaking my seccomp policies because obviously I don't have gettimeofday() whitelisted...)

HamZa

@forest tbh, i encountered similar quirks in SE chat as well in the past
can't remember the specifics though
I usually just brush them off

forest

1:26 PM

I bet half of these creepy bugs are exploitable :/

@HamZa Oh yeah it's not concerning me, I'm just pissed that the bug occurred on a Windows system for the first time in forever, where I don't know jack about debugging.

Benoit Esnard

Was the chat open in your browser for a long time?

forest

Nope, just turned on the computer thinking "I think I'll take another jab at learning a bit about Windows", decide to open SE, log in, open chat...

And I see Miu staring at me out of HamZa's profile picture.

Kepotx

@HamZa also seen a bug in SE chat, where a user was on sci-fiSE chat and had his historySE profile pic, despite having sci-fi as the main account

and it wasn't from the browser, everyone in the room had the same problem and see his historySE profile pic

forest

@Kepotx But then you'd think that the imgur link would actually be wrong

In my screenshot, if you actually type out the URL I'm hovering over, you'll see it's different. So unless imgur actually briefly served the wrong image, then it's gotta be the browser's fault, no?

Tom K.

@forest Hamza's profile pic was successfully flooded with electricity

forest

1:34 PM

Seems like it.

Tom K.

Miu captured the internet

and cut off the signal

forest

And released stress on the processors?

Dammit Miu!

Tom K.

damn, how badass of a name is Don Coppersmith?

(kinda unrelated)

back to topic: browsers, huh? those darn things

forest

Makes me think of Don Corleone.

And yeah, fucking browsers man.

Kepotx

@forest it wasn't only imgur pic, but whole profile with diferent name

forest

1:39 PM

Eh?

The profile link was @HamZa's, the only thing that wasn't his was the image being displayed (even the imgur image URL was his).

Kepotx

in The Quill and Tankard, Apr 23 at 8:05, by NSNoob

@Edlothiad Idk there's something funny going on with my username here

"NSNoob" is his historySE profile, he should have "Aegon" profile instead.

forest

@Kepotx Well that's clearly a server-side issue there. In this case, the only disconnect was between what resource the browser thought the URL provided, and the URL that was actually there.

Kepotx

and when i clicked at his name, i could see "Aegon" as main SE profile

forest

Yeah that's not what happened here. This is 100% client-side.

Like I'd understand if the link for his profile image was accidentally replaced with my profile image, but in this case, it was his, but the browser cache thought it was mine.

My whole world has been turned upside down, black is east, up is white.

I'm too tired for this shit. I just want to go back to bed and pretend I actually know how to debug Winblows.

Benoit Esnard

1:55 PM

What are you calling "this shit"?

How can a Miu invasion be a "shit"?

forest

Trying to figure out how to create the equivalent of a coredump on Windows.

lol

Benoit Esnard

The dev recaptcha I've found was on the staging environment

It looks like I can't login though, since there seems to be a IP verification

And captcha keys are different

Not sure if I can do anything with that

Well, the staging environment is IP-restricted on /, but not on all other paths

That looks like a misconfiguration

HamZa

@BenoitEsnard try to mess with x-forwarded-for headers

Benoit Esnard

2:16 PM

Well I'm not sure which IP are allowed

So that might be long to enumerate all IP adresses

I guess they only allowed /32 IPs

And I'm not going to make 4 billion HTTP requests to guess which IP is allowed, if that bypass works :D

I think I'll report the IP protection bypass on staging environment

HamZa

something along the lines of this: https://www.sjoerdlangkemper.nl/2017/03/01/bypass-ip-block-with-x-forwarded-for-header/

In a whitebox pentest, i once found a function "isAllowed" which does the following:
if x-forwarded-for headers NOT present:
DO IP blacklisting stuff
if x-forwarde for headers present: then parse this header
an attacker could set the x-forwarded-for header himself and bypass the restriction

@BenoitEsnard haha i see

my bad

Benoit Esnard

I tried 127.0.0.1, that didn't work :(

HamZa

tomorrow is king'sday here, i'm kind of in need of a nice weekend

Benoit Esnard

I guess I could stalk the admins, guess which IP ranges might be, and target those IPs to speed-up the bruteforce

What's King's Day ?

HamZa

@BenoitEsnard it's dutch thingy: iamsterdam.com/en/see-and-do/whats-on/…

"The royal celebrations were first held on 31 August 1885 in honour of the birth of Queen Wilhelmina, and the Queen’s Day (Koninginnedag) tradition was born. After Wilhelmina’s daughter (Juliana) succeeded to the throne in 1949, the day was changed to 30 April in accordance with the new Queen's birthday. "

Benoit Esnard

2:22 PM

Is it something important for your country?

A lot of such days are quite unimportant in our culture (France).

And people don't celebrate them.

HamZa

@BenoitEsnard it depends who you ask, some people find it an important tradition and some say "screw tradition, screw royalty, viva la democratie 100%"

but in the end, it's a free day and everyone is outside celebrating
imho it's a day where people drink a lot

it's also a day where you can sell your stuff outside on the streets without getting sued
a lot of activities for adults and kids as well

Benoit Esnard

"your stuff" like illicit things?

HamZa

@BenoitEsnard i mean more like it's a mess, everyone putting their stuff outside on the streets, kind of like a free market

Benoit Esnard

Or only stuff you don't care anymore so you basically sell them?

Oh okay.

HamZa

can be cool for kids earning some moneyz

Benoit Esnard

2:27 PM

I think the drinking part is similar to Saint-Patrick's Day, which is an Irish thing

French people celebrates that, even if that's not our culture :D

HamZa

right, i guess so

Tom K.

@BenoitEsnard King's day is the best!

I've been to the netherlands like 10 years ago on King's day and had a blast

(no weed involved)

HamZa

yeah, a LOOOOOT of tourists :P
that said, if you do plan to come on King's day, then please make sure you're coming on the right day

Last time tourists came on the wrong day (the old queen's day)

Tom K.

I live in a city that hosts a lot of tourists as well, so don't shame me :P

Benoit Esnard

Would you consider accessing to a staging environment a vulnerability to report?

Tom K.

2:43 PM

@BenoitEsnard from where?

From anywhere

then definitely

Okay, thanks!

I think that's the important part. If it's only accesible internally, then I wouldn't necessarily include it, but in this case: deffo

Benoit Esnard

Only accessible internally is quite normal imo

Tom K.

2:48 PM

but it would be restricted for admins and devs or whoever needs access

but unrestricted internal access is.. noteworthy I'd say, but probably not in a security report (that's what you are doing I presume?)

Benoit Esnard

It's for a bug bounty program actually

Tom K.

counter question: if a LAN with several clients has a firewall but it doesn't filter anything (allow any/any) is an adversary able to analyze network traffic of that LAN?

Benoit Esnard

I'm don't know the answer sorry :(

Tom K.

3:17 PM

alright, according to the server fault room, the adversary is not

AndrolGenhald

3:29 PM

Should this really be a duplicate? Its constraints are very different (basically anything vs single 2 GHz cpu) and it has better answers.

It also has more votes but idk if that should really be a consideration.

HamZa

4:23 PM

not per se, it depends if debugging features are enabled or not
also mostly depends on the policies (aka accepted risks)

i once had a pentest, the website was behind cloudflare, aaaand cloudflare does do some XSS filtering among other stuff
So i did some recon and bruteforced a certain IP range (looking for robots.txt files with specific signatures) and found out the servers behind cloudflare, this all because a staging environment was not protected by cloudflare (duuuh)

so basically they forgot to turn on the firewall and only accepts connections from cloudflare

also later i discovered: https://dnsdumpster.com/
which sometimes can give you pretty nice subdomains that are related to the website

^ oh and since i bypassed cloudflare, i could perform some reflected xss
so technically a normal user is not affected but it's nice to fix the root issue (xss)

Benoit Esnard

5:00 PM

The dev captcha can be used to bruteforce dev accounts, so I guess that can count as a vuln

It could even be used to bf prod accounts if accounts are imported on the dev db

I also guess that someone could diff dev & prod to guess which vuln have been fixed in dev but not in prod (yet)

Benoit Esnard

8:43 PM

Stack Overflow Isn’t Very Welcoming. It’s Time for That to Change.

Jay Hanlon on April 26, 2018

Let’s start with the painful truth:

Too many people experience Stack Overflow¹ as a hostile or elitist place, especially newer coders, women, people of color, and others in marginalized groups.

Our employees and community have cared about this for a long time, but we’ve struggled to talk about it publicly or to sufficiently prioritize it in recent years. And results matter more than intentions.

Now, that’s not because most Stack Overflow contributors are hostile jerks. The majority of them are generous and kind. Sure, a few are… just generous, I guess? But our active users regularly express thei …

Arminius

8:56 PM

Interesting read

I'm wondering how much of that feedback relates to SO specifically or other sites such as Sec.SE as well

Anders

@Arminius That is a great question, and I do not know the answer. It is hard to step out of the box and experience the site as someone who is new would.

Arminius

I've just been skimming through our latest questions with negative votes

Here's an example:

-9

Q: Who can see what I’m doing on my computer?

I record extremely private videos on Photo Booth. Is it possible that someone with good hacking skills can see them during and after my recording?

privacy

Anders

9:12 PM

Hmmm... Not sure what I think. But interesting example.

Arminius

From a beginner's standpoint it seems like a logical and innocent thing to ask. Sure, it's not a good question, it's not researched at all. But I can totally see how that person will perceive us as unwelcoming and snarky. (There are probably more extreme cases, I just looked at the most recent)

Anders

Yeah, the question makes perfect sense and it's from someone having a real concern. It's not just a lazy copy paste of homework or something. Adding more detail would probably have made the question worse, since OP would not know what details to add.

And the comments are snarky, but at the same time they do come with a relevant message. Like the dworning in water comparison, it's quite apt. But perhaps not so nice.

AndrolGenhald

9:42 PM

great, now I can second guess myself even more :P

Do I downvote this or not? It doesn't add anything useful and it doesn't have great grammar, but it's a new user and I don't want to be mean...

Anders

@AndrolGenhald If the grammar isn't great, you can edit. If you downvote, you can explain why in a nice an polite ways that makes it possible for the poster to understand the problem.

Not pretending any of this is easy, but I want to highlight that there are more options than "ignore" and "silently downvote".

Tom K.

I think downvoting is "good" when a poster understands why you are downvoting the post

Arminius

Yeah, it's not so much about voting, but adding respectful, constructive comments

Tom K.

a new user will probably not understand why you are downvoting

Transcript for