The DMZ - 2018-09-29

« first day (2844 days earlier) ← previous day next day → last day (2334 days later) »

forest

01:59

@Joshua.J It's no more secure in practice. As in, they're both well into the realm of "absolutely unbreakable by exhaustive search".

@BenoitEsnard AES256 is more vulnerable to related key attacks than AES128, to the point where, under specific conditions, an attack against AES128 has a higher complexity than that of AES256. But the conditions are where the attacker gets to choose an arbitrary key, which isn't the case for virtually any protocol.

Wow, why does the stupid chat give me 10 seconds advance notice before a comment is too old to be edited? That's just retarded.

daya

02:14

Again, I just saw an another example how important is crypto from security point of view I.e,

@forest would not be able to give above comments without having knowledge of crypto

2 hours later…

daya

04:05

What you guys would want to say about facebook data breach

2 hours later…

Benoit Esnard

06:10

Well, I now understand why I've been logged out yesterday

daya

lol I didn't checked my facebook yesterday

@Benoit So are you able to log in?

Benoit Esnard

@daya Yeah, I did log in back a few minutes after

I'm using Messenger on a daily basis, so I almost saw the logout in real time

FB isn't sure which data have been accessed, and I guess it wll be fun for them to find out

It worked!

@TomK. Still no information for the CTF :(

daya

Well, I use facebook app more often but I didn't checked facebook yesterday so I didn't saw that logout

But I am really not sure if my account was accessed improperly, are you?

Did you changed your password?

Benoit Esnard

06:27

I didn't

daya

Neither I

Benoit Esnard

Even if they got access to my hash, I'm confident they won't ever be able to crack it

daya

It is really not the case

They are generally very smart and have high computing resources

Benoit Esnard

Based on the attack description, they can't have my hash anyway

Even with high computing resources, you can't find long passwords

daya

Yeah, this attack is carried out by stealing access tokens(not know much about it)

So that means they don't have any credentials, right?

Benoit Esnard

06:34

Right, unless you can access your own hash somewhere, which I doubt

daya

How can I access my own hash?

Not sure if I understand

Benoit Esnard

You can't, that's my point

Tom K.

@BenoitEsnard gotta check their IRC then

daya

@BenoitEsnard Ah, I see what you mean

Benoit Esnard

07:16

@TomK. I'll do in a few hours if we still haven't any new information

Tom K.

07:31

Yeah, no hurry

Ill have a look myself in half an hour or so

Tom K.

07:53

@BenoitEsnard ugh, you have to register a name first..

Benoit Esnard

What does that mean?

Where do we need to register? On IRC?

Tom K.

no, you have to register on free node to join the irc channel

registration starts in 30 minutes

Benoit Esnard

08:20

@TomK. Nice!

Tom K.

08:59

hm nothing there yet

I'll be afk for a while

Benoit Esnard

09:37

@TomK. I've registrated the team. :)

Tom K.

10:04

Cool

daya

11:02

While accessing root-me labs I should use virtual machines or my host os?

Is there any security risk if I access directly through my host machine?

Benoit Esnard

11:22

Well, I guess there are security risks as soon as you connect to the Internet

I use my host machine though, it's quite safe

But it's better to use a virtual machine :)

Sam

hello

daya

@BenoitEsnard I should use VM because I might need a Linux machine during pwning :)

You use Linux as host?

Benoit Esnard

@Sam Hello!

Sam

Anyone here familiar with JWt authentication?

@BenoitEsnard Hey!

Benoit Esnard

@daya Sometimes Windows, sometimes Linux

@Sam I am

Sam

11:32

@BenoitEsnard yay! Mind if I pick your brains about refresh tokens...

I've actually written a question on stack so if you know the answer you may as well get the xp instead of me asking here: stackoverflow.com/questions/52567837/….

@BenoitEsnard Does that question make sense do you think?

Benoit Esnard

The question makes sense

Sam

Great

Benoit Esnard

Check this answer: stackoverflow.com/a/7209263/4523901

Sam

> attacker requires the client id and secret in addition to the refresh token

Client secret? I'm not sure I have this..

Is this my server secret?

Benoit Esnard

Well sorry, the answer was about Oauth token,not JWT ones

Sam

11:44

Ahh right. Client secrets is Oath specific is it?

Benoit Esnard

I guess so, I'm not good with oauth

Sam

Yup I don't want to use oauth

Benoit Esnard

JWT refresh tokens can be revoked, as far as I remember

Sam

Yup they can get revoked by hitting my end point.. although by default have quite a long life span

I guess I can have a db table with a users and refresh token attributes to relate a refresh token to a single user right?

does that seem plausable?

Benoit Esnard

Access token should have a short lifespan

Sam

11:49

Yup - I'm talking refresh tokens

Benoit Esnard

Oh, that's great then

Sam

Yeh?

Benoit Esnard

The point is: whenever the client tried to generate a new access token (because the old one expired), you should check if the refresh token has been revoked, and prevent the server to generate a new access token

Sam

by using the above model, if an attacker gets hold of a refresh token, they'd also need to be logged in as the user who the refresh token belongs to

In what instances would a refresh token be revoked?

Benoit Esnard

If the refresh token is stolen, then the theft can generated access tokens very easily, it just needs to call your endpoint

Sam

11:52

@BenoitEsnard Yeah exactly

Thats where I think storing the refresh tokens along with the user would come in handy

Benoit Esnard

Using a DB with a list of revoked tokens is fine.

Sam

OK but suppose the attacker obtains the refresh token and it hasn't been revoked. There is no logic to say revoke this token as we do not know its been compromised

Benoit Esnard

Storing all tokens isn't, since your server shouldn't have access to the refresh tokens once it issued them

There isn't, indeed.

That was the idea behind the FB hack lately

Sam

So how would one ensure against this?

Benoit Esnard

Don't make them steal-able :P

Use HTTPS, prevent any XSS flaws on the site, etc.

Sam

11:56

@BenoitEsnard Famous last words :p

I still feel I should have some additional layer.. like a user refresh token storage

Also, in my logout endpoint, should I blacklist both access and refresh tokens @BenoitEsnard?

1 hour later…

Anonymous

13:24

@BenoitEsnard Hey, are you here?

Anonymous

@TomK. Or you?

daya

14:45

Why the f*ck I am not able to root any machine on root-me

frustated

After finding open ports such as telnet, ssh, http etc.

The only thing came into my mind is just bruteforce

But this is really not going to work

2 hours later…

Sam

16:32

@BenoitEsnard I figured out how to properly secure the token.

3 hours later…

Benoit Esnard

19:13

@Sam How?

@Joshua.J I am

@daya Which one are you trying?

Anonymous

19:25

@BenoitEsnard I'm looking at the Teaser Dragon challenges.

Anonymous

I. Am. Fucking. Lost. Man.

Anonymous

They use the word "easy" and I think their "easy" should be hard lol.

Anonymous

How are you guys getting on?

Arminius

We're waiting for them to fix their infrastructure so we can pwn the web services!

Anonymous

Why, what is wrong with it?

Anonymous

19:34

I've not looked at the web-stuff yet, I've spent most of the day on the AES-128-TSB challenge, and I've really made no progresss.

Arminius

They probably bought the cheapest AWS instance so the Python web challenge is running very slow and unreliably

Anonymous

I am failing to figure out what input it actually wants, I literally cannot get a response back from the server, it's just... Sigh.

Anonymous

Oh, I see. Well this AES-128-TSB one is running fine, I'm just bad.

Anonymous

This CTF really is no joke, or I am just shit lol.

Anonymous

Things like this really make me realise how much I don't know. It's just insane.

Arminius

19:43

Keep in mind though that many successful teams are fairly big and their members often specialize in areas

Anonymous

I know, but I thought I would be able to get one flag on my own that isn't the join the IRC flag.

Anonymous

I guess I've still got time but I have a feeling I will not get this flag.

Anonymous

I'm just so stuck. I cannot get anything back from the server, and I've been trying to figure out what input I need to give to just return something but no cigar.

Benoit Esnard

@Joshua.J I've tried it too.

I can't get anything back.

Anonymous

You as lost as I am?

Anonymous

19:49

Yup.

Anonymous

Cannot get anything

Benoit Esnard

Same for me, don't worry

Anonymous

I've been banging my head on this challenge for hours and hours now.

Benoit Esnard

Have a break then.

It helps, sometimes. :)

Anonymous

I've had three, one hour breaks lol.

Benoit Esnard

19:53

Are you good with Python?

Anonymous

I'm meh.

Anonymous

Probably worse than meh.

Anonymous

It's the input I've been stuck on, if I could just figure out what kind of input it likes I might be able to get somewhere, but I've not been able to get anywhere with the input honestly.

Arminius

Don't wanna join us in the Slack?

Anonymous

I can :p

Benoit Esnard

19:58

Just join the Slack imo

Send an email address

Anonymous

Can I use a throwaway?

Benoit Esnard

Of course

As long as you're the only one who can access it.

Invitation sent.

Sam

Hashing and persisting the refresh tokens using my applications secret key

2 hours later…

Rory Alsop

21:38

@Joshua.J just thought I'd clean that up

Anonymous

22:16

@RoryAlsop Thank you :P

Anonymous

I forgot! :D

Anonymous

It's a throwaway anyways but thanks nonetheless.

« first day (2844 days earlier) ← previous day next day → last day (2334 days later) »

Transcript for

Sep '1829

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2025 Stack Exchange Inc; legal

mobile