« first day (2848 days earlier)      last day (2330 days later) » 

Anonymous
07:17
@TomK. I think I understand this attack a little better now.
Anonymous
But I'm reading Emms writeup and I don't really understand his Python code :p
Anonymous
I think I need to write the code myself and learn what a few functions are doing, sadly he doesn't explain how he drew certain conclusions so it's a little hard to follow.
Tom K.
Tom K.
08:10
@J.J writing the python code is certainly a good idea
Anonymous
:p
Anonymous
Yeah.
Tom K.
Tom K.
@Arminius schönen Feiertag!
Anonymous
I need to understand the code though :p
Anonymous
I still need to write the code for Flatcrypt.
Anonymous
08:13
Which was the challenge I did in another CTF, or rather a challenge I didn't do.
Sam
Sam
10:34
I've asked a question if any of you people are knowledgeable in the area security.stackexchange.com/questions/194774/…;.
Arminius
Arminius
@TomK. To you too :)
Sam
Sam
Hello btw o/
Anonymous
@Arminius Morning sir.
Arminius
Arminius
Hey
Tom K.
Tom K.
11:14
@Sam your use case seems pretty "typical" to me. I wonder if there isn't a framework that already implemented a solution to your problem
Anonymous
11:44
Wow! One of my colleagues bought me a bottle of Scotch for my birthday :p
Benoit Esnard
Benoit Esnard
But it's not your birthday!
Anonymous
I know.
Anonymous
But it's an early present because he was in a Whisky store the other day :D
Anonymous
I've already had two of the best presents for my birthday, a bottle of Whisky and a web-site, a Python script and a store lol!
Sam
Sam
12:02
@TomK. I've seen oath.. they probably do something similar. But I don't really want to use it. Seems quite heavy.
Tom K.
Tom K.
12:20
@Sam and do you know how they solve the problem you are having?
Sam
Sam
Not entirely.
Ah wait... I think it might
I'm reading through the docs now.
> The API first validates the application credentials and then verifies whether the token was issued to the application making the revocation request. If this validation fails, the request is refused and the application is informed of the error. Next, the API invalidates the token.
I guess my implementation is kinda the same
Tom K.
Tom K.
13:18
@Sam the typical advice we have here in cases like this is: "don't roll your own" as in: if there's a working and tested solution out there, take this one before you try to build something yourself that might put your users in jeopardy
Sam
Sam
But that's no fun!
I mean, I'm only making my own end points.. I'm still using a JWT library.
I'm using flask-jwt-extended.readthedocs.io/en/latest to do all the heavy pulling.
Tom K.
Tom K.
13:33
using a library does not prevent you from implementing it in an insecure way
Sam
Sam
It's more fun to implement it myself. When going into production, I will consider switching. It shouldn't be too difficult to switch the auth module anyways. Plus its good to learnn
Also, aren't there ways you can test the security of your website? I'm pretty sure I seen a web service which grades your site against a number of different attacks.
Tom K.
Tom K.
I highly doubt a web service like this would find (sophisticated) attack vectors typically involved with insecure implementations of authentication schemes
Sam
Sam
So you advice I use oauth?
Tom K.
Tom K.
I advise you to use something that has been tested by others :)
if you want to learn, try to understand their code
Sam
Sam
Damn. OAuth costs!
I'm going to stick with my own imp for the time being.
Maybe once I'm done I'll offer money on a Reddit post for users to issue a security report :P
Anonymous
13:39
Does anyone know what has happened to Forest? He's disappeared.
Anonymous
Couldn't find him in The Side Channel either... o.O
Sam
Sam
@J.J Cut down and turned into an A4 booklet I believe.
Anonymous
@Sam Did you just insult our friend that asks questions nobody can answer? :O
Anonymous
Take that back, or you will be the A4 booklet! ;)
Sam
Sam
Nope, not an insult
lol
Anonymous
13:41
I'm joking.
Sam
Sam
I know :P
Tom K.
Tom K.
@Sam isn't django free and open source and compatible with JWT?
Sam
Sam
Meh - I don't want to use Django. Doesn't fit my needs.
I've seen many implementations with flask-jwt-extended so hopefully I'll be able to stick in on code review to get some feedback on my implementation.
Django is too bulky.
Tom K.
Tom K.
okay, if you want something that is pre-cut to your every need and not to bulky and has everything you want, you will probably have to pay :P
Sam
Sam
I shall construct my own
It will be called samAuth
Tom K.
Tom K.
13:44
you really shouldn't
Sam
Sam
Tom you need to let me spread my wings.
lol
Tom K.
Tom K.
A lot of posts about crypto, some about authentication schemes: have fun reading
Sam
Sam
This guy has a similar imp to mine github.com/karec/cookiecutter-flask-restful
Tom K.
Tom K.
oh cool, another dude with a bad idea
no idea man, maybe it'll be great, maybe it won't. I don't know. As I said:
> the typical advice we have here in cases like this is: "don't roll your own"
Sam
Sam
Yeah I take your advice
Tom K.
Tom K.
13:48
Ah, here's a canonical question
Anonymous
14:01
Sam are you using this application publicly or its just a project
Anonymous
Because please don't roll your own for a project you will actually release >.<
Sam
Sam
ATM its just a project... if i were to release it, I'd switch the auth module to OAuth or similar.
Anonymous
I see.
Anonymous
Yeah. Please don't roll your own for a public project.
Anonymous
That's never a good idea.
Sam
Sam
14:04
My own Crypto?
I'm not building my own algorithms if this is what you mean.
OK this looks very good docs.authlib.org/en/latest/flask/oauth2.html.
Sold guys. Sold
Anonymous
:p
Sam
Sam
OK so the idea is... use an oauth server for authentication... then just protect my own endpoints using their decorators i guess?
Please don't say I shouldn't make my own end points... otherwise I'd be writing 0 code haha
 
1 hour later…
Julián
Julián
15:27
Hi guys :p
Anonymous
Afternoon.
Julián
Julián
How are you? I have a pretty big question about Windows tasks...
Anonymous
I'm good thanks, you?
Anonymous
Why don't you ask the question on the site?
Julián
Julián
I'm good friend, I have a doubt which I think is basic.

I'm recently making a pentest to a machine, I connect via telnet to this and I need to scale privileges, it's a Windows Server 2008 machine, I already know how to exploit it using a PowerShell script, the problem is that when you run the exploit, it creates a cmd.exe window (task) with the administrator session ... I can not "see" this window from the windows shell, I do not know if you understand me hehehe the point is that is it possible to open the task from the cmd knowing the PID ?, this would be equivalent to an Alt + Tab
The exploit is a script in powershell (ps1) and I execute it from the telnet connection, I do not do it through Metasploit or something like that..
 
3 hours later…
xorist
xorist
18:22
You should make a question on the website
so more people can be exposed to your question and give you a good answer
Benoit Esnard
Benoit Esnard
^ this
Tom K.
Tom K.
(also: be a bit more specific)
xorist
xorist
I might want to participate in the CTF
I guess I should probably install Slack
even though I don't wanna
Anonymous
18:38
Well, you can use Slack in the web browser.
Anonymous
:p
Nzall
Nzall
Is there a big difference in security between doing your normal day to day gaming with a normal user account on a machine with UAC set to max, or doing the same with a local admin account?
Because it's really annoying that I have to enter my admin user password every time I want to start a game, and sometimes 5 times for the same game
Tom K.
Tom K.
19:22
@Nzall with proper polp then only the process(es) of that game runs with administrator privileges
and we have seen instances in the not so distant past where especially gamers where targeted for e.g. ransomware attacks
 
1 hour later…
Nzall
Nzall
20:38
@TomK. The main annoyance is for Ubisoft games you buy on Steam. The first launch has 5 different UAC prompts: first for installing dependencies, then for launching the Ubisoft DRM client Uplay, then for patching Uplay, then for patching the game further, then for launching the game.
and I'm fairly sure that beyond the first one (which is for DLLS and DX), you don't need any of the later one
Also, does the complexity of my admin password matter, or is the barrier less how hard it is to guess the password and more that there is a password to begin with?
 
3 hours later…
Arminius
Arminius
23:23
Since we talked so much about security keys (like the Yubikey) here -- If you're interested in a FIDO 2 key, you may want to consider backing Solo on Kickstarter. Their keys are open source and seem affordable

« first day (2848 days earlier)      last day (2330 days later) »