The DMZ

2:05 AM

@Soteri it's not really something language specific; C and C++ allow you to manage memory directly in potentially dangerous ways (no bounds checking), which makes overflows possible. That said, keep in mind, lots of higher-level languages (e.g. CPython, Java?) are implemented in C, so there could still be buffer overflows possible in the low-level code that runs the VM.

Soteri

7:05 AM

@multithr3at3d thank you

Soteri

7:15 AM

Generally spoken: if I would try to pass the OSCP exam .... and I would like to get some privileged access with a buffer overflow.... my possibilities are: enumerate the target and get the application and hopefully the correct version of it

search for exploit in e.g. exploit-db
if I can't find something I would get a copy of the application and the appropriate version locally and would debug it

Please correct me if I'm wrong

MechMK1

8:32 AM

Good morning my friends

@Soteri Oh hey, glad you made it to the DMZ

For OSCP you will likely get a custom executable where you can't find a pre-made exploit on exploit-db

The whole point of OSCP is to certify that you understand what you are doing. Searching exploit-db, running every exploit you can find and then maybe having a shell is not "knowing what you are doing".

Soteri

8:50 AM

@MechMK1 ok then let's forget about searching in exploit-db

MechMK1

@Soteri I can highly recommend watching LiveOverflow

youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w

He does really good introductory videos

Soteri

@MechMK1 so in OSCP it's all about getting a local copy and debug to find a buffer overflow?

MechMK1

It might

How much experience with HTB do you have?

Soteri

Not that much
I have a account but never made it

Can you recommend where to start with htb?

MechMK1

Try any "easy" box

Try it as much as you can, and when you get stuck, you can ask for help

Soteri

8:53 AM

I appreciate you

MechMK1

9:12 AM

Completely off-topic question: Does anyone of you know some nice flowchart software?

A. Hersean

MS Visio

It's far more powerful and easier to use than all the alternatives that I've tried

MechMK1

@A.Hersean Yeah but I sadly don't have it. I'll have to make due with draw.io for now :/

But thanks, I've heard good things of Visio before

A. Hersean

9:29 AM

I guess you will not find anything better than draw.io in free to use apps.

MechMK1

LibreOffice Draw is okay too

A. Hersean

From what I remember, it's export functions are poor, and it quickly becomes a pain to use if you want to have something looking nice.

MechMK1

I just want a quick flowchart to help remember how each phase of 40k combat works

Like setting up, shooting, etc.

A. Hersean

If your flowchart is very linear, you can try XMind. You can also try "yEd Graph Editor".

MechMK1

9:47 AM

It's not that complicated, I'll show it to the class when I'm done :D

Xavier59

10:15 AM

@ThoriumBR I do not think it is a good idea to reward for 0day in vendor packages and it is not a recommanded practice anyway.
Otherwise, instead of reporting it one time directly to the vendor so they can fix it for everyone, bug hunters report it to every website using this package EXCEPT the package vendor, this in order to collect more bounty. This is very unethical.

Imagine finding a vulnerability in Google Chrome and reporting it to every people using Google Chrome instead of just reporting it to Google ...

MechMK1

My flowchart is done :D

Gaze at its glory

And drop shadows as well

MechMK1

11:07 AM

1

A: Why define CIA in security like this?

I received training that specified CIA is not just a mnemonic for the three words, but also a way to remember their preferred order. That is, there is an established priority of: Confidentiality Integrity Availability in that order. The line of reasoning is as follows: If you have to lose...

This answer actually upsets me. The guy claims that confidentiality is "in general" preferable to integrity, and integrity is in general more preferable than availability.

The comments point out that such a general statement is wrong, and he claims he understands all of this, then keeps arguing how he is still right.

> The confidentiality clause is only intended to apply to information that needs to remain confidential.

^- Despite saying that, he still claims it's more important.

It sounds a bit like "It's generally more important, except when it's not.", which is a worthless statement.

MechMK1

12:38 PM

0

A: if Application has XSS vulnerabilty, can we bypass CSRF specially with referer header?

If there is an XSS vulnerability, the attacker has won. If you can execute arbitrary JavaScript on the victims machine in the target origin, you can do whatever you want - you don't need to bypass any CSRF protection to wreak havoc. Also, no CSRF protections survive an XSS vulnerability. A refer...

MechMK1

12:51 PM

@Anders I made you a meme :D

Anders

@MechMK1 Oh. My. God.

I'm gonna be just as cool as XSS when I grow up.

alert(1337) lol

MechMK1

Chad is just that alpha

Anders

Can't even issue DELETE requests? CSRF is such a neeeerd.

MechMK1

>he does not even DELETE

Anders

That is so lame, dude. I heard CSRF hasn't even mined a single bitcoin.

MechMK1

12:58 PM

Yeah, there is a reason CSRF just keeps hanging out with BEAST

Anders

And CSRF keeps saying he would have stolen all of our bitcoins if it hadn't been for the X-Requested-With header... Like who can't even beat that?

MechMK1

Yeah, I heard that it's not just X-Requested-With, but the presence of any custom header that the application checks for. Like seriously, CSRF can be stopped by X-No-Virgins-Allowed: True

Xavier59

Investigated that wordpress xss and yep, that was a 0day in one of the plugin we're using. 10K+ downloads.

MechMK1

@Xavier59 Chad XSS strikes again.

ThoriumBR

@Xavier59 nothing stops you from reporting to the vendor. Your priority is taking care of your business, but you can and should (or must) report it upstream.

Xavier59

1:50 PM

@ThoriumBR Sure. I did report it to them straight after issuing a fix on our installation :) I wouldn't want this "bug hunters" to try to extort more people.

ThoriumBR

2:06 PM

I think it's best for you if they report to you, you acknowledge them and reward them in some way, even if it's just a small gift card, and report the vuln to the vendor.

this way you keep those bug hunters happy, the vendor happy, the ecosystem safe, and your site safe

Xavier59

I'm sorry but no. It's too easy not to tell the vendor and try to collect the bounties from all the website using the plugin ... that's nowhere near "ethical" hacking.

I'm okay to reward if the bug is in a vendor package and that we forgot to update.

ThoriumBR

2:21 PM

this is not a strong opinion of mine... so you may be right. it's not ethical hacking, but from the looks of it, isn't criminal hacking too... they could have exploited your site for profit without telling you anything

they are interested in financial gain, sure, but looks like they aren't extorting you.

Soteri

I'm a Java Developer with 3 years experience.
I'm working with Ubuntu so I understand Bash and can write scripts
I know and understand TCP/IP, UDP, the osi model...

I want to become a pentester and want to pass the oscp exam...

can you give me some advice where to go on and what next thing I should learn to pass the oscp exam one day?

Conor Mancone

2:38 PM

@MechMK1 Indeed. The counter example I had in my head was, "If I need to launch nukes in response to a first strike nuclear attack, then availability an hour from now will be less-than-useless - I need availability NOW". Still, I ended up making a completely different point.

MechMK1

@Soteri First of all, congratulations to having the post ID 53335353. Second, it's good if you have a background in programming, understand linux and how networks work

Giving concrete steps for "How to become a pentester" is difficult. Every pentester I know took a different path, and so everyone will recommend different things

I would recommend having a look at the OWASP Top 10 and the OWASP Testing Guide

Have a look at every vulnerability they outline, and try to understand it

It's not enough to know that XSS, SQLi, CSRF, Buffer Overflows, UAFs, etc. exist

Conor Mancone

@Xavier59 I actually disagree with you strongly. You were using software that attackers knew was vulnerable, but you did not. This put you in a real risk category. Most companies deal with things like this by having a security program in place to make sure and keep up with new vulnerabilities and keep software fully up-to-date. In this case an outside person discovered your lack of up-to-date software before you did.

MechMK1

You need to be able to explain what they are, how they work, how to exploit them an how to mitigate them

Conor Mancone

In essence, they have fulfilled a very valuable role for you that you have chosen not to spend money on, and in doing so have brought real value to your business

In other words, they have saved you actual money. They helped you outsource a critical part of your system security

why wouldn't you pay them for that - they are doing actual, important work for you after all

MechMK1

One thing that is valuable that nobody can teach you is the Hacker Mindset

Bruce has a good article on it:

schneier.com/blog/archives/2008/03/the_security_mi_1.html

> Security requires a particular mindset. Security professionals -- at least the good ones -- see the world differently. They can't walk into a store without noticing how they might shoplift. They can't use a computer without wondering about the security vulnerabilities. They can't vote without trying to figure out how to vote twice. They just can't help it.

> SmartWater is a liquid with a unique identifier linked to a particular owner. "The idea is for me to paint this stuff on my valuables as proof of ownership," I wrote when I first learned about the idea. "I think a better idea would b…

Because as a programmer, you're a builder. You think functional. You think how to make stuff work.

Conor Mancone

2:45 PM

@Xavier59 Or to put it differently: part of good security is spending time (aka money) on keeping systems up to date. Your company has decided not to do that, saving yourself some money. That choice put you at risk for a dangerous vulnerability. Fortunately for you, there are ethical hackers out there that keep themselves up-to-date about vulnerabilities, find companies that are dangerously out of date, and inform them of the risks.

MechMK1

As a hacker, you're a breaker. You think how you can get past filters, make things work in ways the builders didn't think you could.

Conor Mancone

They are effectively providing you with an important service that your company decided not to spend money on, putting your customers and business at risk. It seems quite reasonable to me to take some of that money that you should have spent on keeping your own systems up-to-date, and sharing it what that person

MechMK1

A good example is an application I tested recently. When modifying your profile, you send a PUT request to /users/123456 and it would edit user 123456.

I found out that you could use any user ID, not just your own. I could edit anyone, including the admin, and give them a new password.

@Soteri That's the hacker mindset. I hope you found that useful

@ConorMancone Lots of public infrastructure has no need for confidentiality, but their systems need to be primarily available, with integrity being a secondary value

E.g. a system that gets the position of a bus and calculates when it will arrive at a certain stop

Also my friend, how are you doing?

Conor Mancone

@MechMK1 Been busy lately. We're hoping to move (to a new state) in 1-2 months, so I've been packing, organizing, repainting the house, and a long list of other things!

@MechMK1 Such a classic blunder! I never found any easy ones like that! (although I only have maybe 10 hours of pentesting in total, so that's not really a surprise)

I've also been learning a number of new tools at work (at the moment I'm redoing all of our infrastructure with terraform), so my brain has been super fried from too much thinking (although that's not really a bad thing)

MechMK1

@ConorMancone Oh? Why the move? Another job oppurtunity?

@ConorMancone I would love to say those vulns exist everywhere, but each individual application is a total wildcard. May be stable like a fortress, may be more broken than a house of card after trying to stop a hurricane

Conor Mancone

2:58 PM

@MechMK1 No. My mom is retiring and leaving the state. My wife and I consider having family around to be very important (especially for the kids), and she was a big reason why we've still been where we currently are. She's actually leaving the state tomorrow, and otherwise we don't especially like this city anymore.

MechMK1

@ConorMancone Then I wish you the best in your new home

Conor Mancone

A large chunk of my wife's family lives in Kentucky (we're in Florida now), so we're going to go try that out

Cross-state moves really suck though

MechMK1

I can imagine that

Conor Mancone

I think it's like 1200 miles (2200 km?)

MechMK1

I heard that Kentucky have nice gun ranges though :D

Man, what would I give for a 1km long range...range

I'd be out all day shooting with my DMR

Conor Mancone

3:00 PM

lol, way off 750 miles, 1200 km

MechMK1

one mile is 1.6 km

Conor Mancone

My father in law has plenty of guns. That will hopefully tide me over until I start collecting them myself

Yeah, I was trying to do a rough conversion in my head. Failed miserably.

MechMK1

Do times 1.5 and then add some.

So 1200 * 1.5 is 1800, plus some is 1900 or so

1931 km :D

Conor Mancone

:) I have the same problem with feet -> meters. I wish USA had managed the switch to metric...

MechMK1

One yard is roughly one meter

Conor Mancone

3:02 PM

We'd be up one martian space probe if we had!

MechMK1

100 meters are 109 yards

I'm alright with length conversion to imperial

or "standard" as some americans call it :D

The only thing that fucks me up completely is temperature

You could say "this has X°F" and I would stare blankly at you

All I know is that 0°F is very cold and 100°F is very hot

1 Mile is roughly 1.5 KM
1 yard is a bit more than 1 Meter
1 Foot is roughly a third of a Meter
1 inch is roughly 2.5 CM

I hope that's a useful conversion chart

So if someone says to me "this is 42 inches long", I think "oh, so a bit more than a meter"

Conor Mancone

@MechMK1 Other than 20°C being "room temperature" (and of course 0 and 100), I can never make much sense of Celsius. I think the trouble is the crossover. 100F is cooler than 100C but 0F is colder than 0C. It's not just a simple multiplicative factor like length

MechMK1

Yes, and that's what throws me off all the time

According to River, 'adequate' vacuuming systems drain the human body at about half a liter per second.

xkcd is being ever helpful

3L = Two-Liter Bottle :D

0.3 L is a typical can of cola
0.5 L is a typical "small" bottle of cola
1.0 L is a typical "large" bottle of cola

Journeyman Geek

actually

standard cans are 330ml, though a slim can is 250ml/0.25l

MechMK1

true that

Journeyman Geek

3:13 PM

Large bottles tend to be 1.5 and 2L :D

MechMK1

Eh, I have seen all 3

1.0, 1.5 and 2L

Journeyman Geek

Never seen 1l

MechMK1

Though 2L is usually advertised as like "family sized"

Journeyman Geek

not for mass market sodas anyway

MechMK1

Really? We have 1L bottles for sale here all the time

1L and 1.5L being very common

Xavier59

3:38 PM

So again, I'd like to go back to my previous example. If your company is using the last version of Google Chrome and someone report that you are running a vulnerable version - even though it's the last version and it is believe to be secured - would you reward the hacker ?

No. The hacker should directly go to Google to report it. Not go to every company using Google Chrome.

@ConorMancone I'm not sure that you got what I'm trying to explain. We didn't fail to update our systems. There was no update available with a fix of the exploited vulnerability. That's the essence of a 0 day. It was never disclosed before.

Sorry, bad connections ... message didn't go in the right order. You can read 3 then 1 then 2 :(

ThoriumBR

I believe what is "best" to do depends on your definition of "best". For me, the best is to patch the system, report to the vendor, and reward the hackers, in that order. you accomplish 3 things: keep yourself and your company secure (1st priority), keeps the vendor informed (2nd one) and keep the hackers happy, so they won't wreak havoc against you later.

they could have hacked your site, infected your clients, stolen your data and mined some Monero while doing it, but they informed you. I believe they deserve a little compensation.

Conor Mancone

@Xavier59 I think you missed thee most important part here: you are operating a website with a known vulnerability. It doesn't matter if it is the vendor's fault or if no update is available yet. There is a critical difference between me using a vulnerable version of Chrome and you operating a vulnerable web application. In my case, the only person I hurt is myself. That's not true for a business. Any business has a responsibility to protect their user's data (see the GDPR for instance).

If you end up with a data breach and claim, "Not my fault, our vendor had a problem!" it won't fix anything, make your customers feel better, or stop you from getting fined.

Especially because (and this part is also important) - it was a known vulnerability.

The weakness in the plugin was already common knowledge (a fact that is clear because a pentester was looking for sites using the affected plugin), and you certainly knew that you were using the plugin in question. As a result, there was a mistake on the part of your company - you were using known-vulnerable software, but nobody realized it, leaving a window of opportunity for hackers

ThoriumBR

and as the hacker let you know instead of hacking, I believe they deserve to be paid. imagine the amount of damage they could have caused, and they didn't.

Conor Mancone

This is the exact situation that happened to Equifax, just on a larger scale. Their breach came down to a vulnerability in the framework they were using. The vulnerability became public but it took months for them to upgrade their systems. In the meantime, they had ridiculously large amounts of data stolen, impacting customers across the world

"It was our vendor's fault" didn't get them off the hook for a $1.5 billion settlement.

To be clear, whether or not you pay the reporter is obviously your own business decision. I think you should, but the part that I am more focused on here is responsibility. You seem to be approaching this from a perspective of, "This is not my fault". Certainly, this is a hard thing to catch, but that doesn't change the fact that catching things like this should be a primary concern for companies

Companies that don't invest the necessary resources in keeping their systems secure will eventually be hacked, and won't get much sympathy for complaining about it

Sorry if this comes off rather strong. I'm really not trying to "yell" at you. I just think it is important to realize that things like this are preventable mistakes. It's easy to see this as someone else's fault, but the reality is that a very large percentage of data breaches are very preventable. Further, wordpress has a long history of vulnerable plugins, and when stuff like this happens it is only a matter of time before someone setups a botnet to scan the internet for vulnerable sites

As a result, this guy really did you quite a favor. A few more months and you would have found out about this not from a pentest report, but because you found that your servers had been hacked and couldn't figure out how they got in. That would have been a much, much, much more expensive problem.

(this is also why I avoid wordpress like the plague and why, when I did have to support some wordpress sites, I always put them on their own server)

ThoriumBR

4:01 PM

even those who invest lots of money will be hacked... and even as this isn't @Xavier59 fault, or his company, the guy really did them a favor and should be compensated. or for telling them the port was left unlocked, or for not entering and stealing the place over...

Conor Mancone

@ThoriumBR You're right, I'm probably being a bit to "strong" here. As I said, this probably would have been a hard one to catch (although I'm still super dubious about using wordpress plugins for just this reason). The situation does very much remind me of Equaifax though, and I really don't have any sympathy for them. I do think it's important to try to learn from situations like this. Certainly, this was the best possible way this could have gone for @Xavier59

Having someone report the vulnerability is so much cheaper then the other ways you usually find out about one, so in all likelihood this guy really did save the company a lot of money.

@ThoriumBR that guy arguing for client-side Argon2 accepted his heavily downvoted answer.

I find that funny

-3

A: Password checking resistant to GPU attacks and leaked password files without introducing a DoS attack on the server?

We start by the assumption that the attacker only has access to the leaked password file: He is neither a user nor root on neither the client nor the server. He may be able to eavesdrop on traffic at a midpoint, but not on the actual end-points. Thereby we make the fairly ordinary assumption that...

ThoriumBR

@ConorMancone if they pay the hacker the equivalent of, say, 4h of one of their support guys, everyone will be happy... and the hacker did a good thing not hacking them. it may even create an unnoficial symbiotic relationship, the hacker probes them all the time, and reports anything he finds. win-win

@ConorMancone yes, that was very funny. I posted in the chat some calculations on a argon2 breaking gig, and he replied that the gig would take ~3 years to execute ONE hash... and I asked how he thought it was a good idea to implement that on a cellphone...

"let me just download 1GB of instructions on my rate-limited phone, in 12h I am back... ok, instructions here... I need 1GB of ram, my phone have just that...enter the password... what is this message? hashing the password, please wait. remaining time *12 years, 7 months, 4 days, 14 hours, 22 minutes*"

Conor Mancone

4:16 PM

@ThoriumBR Indeed

@ThoriumBR Yeah, he clearly wants this really bad. Sad that life doesn't always work that way

ThoriumBR

his profile is funny:
"Top answers: 1 (-3 points)"

maybe he wanted the Scholar badge: answer his own question with score 3 or more...

Vipul Nair

4:41 PM

lmao then he even accepted the answer??

ThoriumBR

4:53 PM

yes... he asked, answered with "run argon2 with 1g instructions client-side using javascript on a cellphone", got downvoted, and accepted the answer...

OakSecurity

6:22 PM

@MechMK1 How so?

Xavier59

7:07 PM

Thanks for your answers @ThoriumBR and @ConorMancone. Don't worry, I'm not taking this badly and I'm glad to know everyone opinions, otherwise I wouldn't have asked my question !
I get your respective points and we do store some very very sensitive data so you're right that this incident could cause us a lot more money than just a bounty. And my head will be the first to fall aha.
I recontacted the bug hunter, which I denied bounty and I offered him a bounty.

I still highly disagree with the method, bug hunters should go to the vendors first ! I have contacted the vendor and he had not bee…

Xavier59

7:19 PM

And by encouraging this system, more bug hunters will go directly to the users instead of the vendors ... so more bounty to pay ... that's a vicious system. I'll be honest with you, I'm basically doing it because you guys are senior so I trust your judgement but I'm still not convinced inside ...
About my example on Google Chrome, then maybe change it to nginx ? apache ? Millions if not Billions of website run on this. Imagine some attackers making a script to report it to everyone running a bug bounty and applying your law (so technically, he would have reported it to everyone before it ev…

Conor Mancone

10:01 PM

@Xavier59 I still don't quite understand why you think what the bug hunter is doing is unreasonable. Your hacker is spending time identifying bugs in websites that can easily be actively exploited. They are spending their time and the internet is a safer place. I would consider it reasonable to pay them for that reason. Again, if the person in question didn't do this, then it is quite likely that you would not have learned about this until your system was hacked.

Which option would you prefer: finding out about n vulnerability in your website because someone reported it before you were hacked, or finding out about a vulnerability in your website because you get hacked? The answer there is obvious to me. And again, it's not like the person who reported this to you isn't doing any work: keeping up on these vulnerabilities and finding vulnerable sites is not actually easy

However, if you really disagree with this, then there is an easy solution

In the terms of your bug bounty program you can simply add a note to your "rules of engagement" about how you won't pay out for vulnerabilities from third party libraries. These sorts of conditions are pretty common. I've often seen notes along the lines of, "Any known vulnerabilities from 3rd party libraries are out of scope for the first 60 days after being published". Note though that if you declare that, you may simply not find out about such things in the future, and you might get hacked

Still, the fact that a vulnerability is caused by a third party library doesn't really change anything in my mind. Going back to Equifax, they were hacked because of a known vulnerability in Apache Struts which they did not patch quickly enough. We're not even talking years here - just months. They just settled for over a billion dollars. The fact that the breach boiled down to a third party library didn't get them off the hook, or stop attackers from stealing their customers data.

Which is just the long way of saying that ultimately, as application developers, the only one responsible for securing our customers' data is ourselves. Staying on top of all the libraries and systems we have to use to build complicated apps can be difficult bordering on impossible. Given that fact, we should use all the tools we can to keep our customers secure.

By refusing a payout for a real vulnerability in your systems, you're basically telling bug hunters that their contributions are not welcome in your system. That's not the craziest stance to take, but if you're going to do that then you need to make sure you have another plan in place on how you will make sure that your systems stay up-to-date.

Keep in mind that vendors can be slow. If the author of this wordpress plugin takes a year before they push out an update to fix a known vulnerability, do you still think it would be reasonable to say, "Not my problem: vendor hasn't published a fix.". If a vendor stops supporting a known-vulnerable plugin, does that mean you can just wash your hands of it and say, "oh well, I guess we're just vulnerable"? Where do you draw the line?

Transcript for