I have a full PoC sitting in the vendor's bug bounty inbox for the last three days but have heard radio silence. Just wondering if this is such a non-issue that they won't even bother closing as "informational" or what.

Vendors ignoring bug bounty reports are very common. 3 days is nothing. It might be that they don't care, but they could also just be slow. I don't think I would classify it as a critical vulnerability, but I'd probably put it higher than informational.

That's about where I'm at -- It isn't the end of the world, but I don't think it's negligible either, especially if you're one of the top vendors world wide. This is my third bug with this vendor and they've been responsive before. But they don't seem to be interacting with anyone else on the platform, so maybe their bug guy is on vacation.

3 days is still too soon... Even google project zero waits 90 days before going full disclosure

I'm not looking for full disclosure, just wondering if I reported a dupe or paid for my vacation this weekend. :P

no way to know... you have to wait for them to contact you

but it's concerning

"This submission has not yet been examined." I should read the fine print. Must be busy with something at the moment.

If I were perfectly honest: I want to do client side, because I've spent enough time trying to figure out on how to get client-side verification working, that the sunk cost effect is really getting to me.

Erm… for the above question, flip the word "private" for "public", and vice versa.

I've seen nikto report wild card certificates like *.domain.com. Is that something I should try testing?

It's reported as leaks but I'm not sure what I can do besides trying to register a fake domain like bad.domain.com.

@Sal You do not give enough information to get a meaningful answer. Who should sign does not depend on technical choices, but on what purpose serves the authentication. Someone or something (an app) sings to either prove who they are, or to prove the the data was not tempered with. In your case, who needs to prove something: the client, the server, or both? Then you'll have you answer and can start to work on how to do it.

I have an IP which nmap returns OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 but going to the IP in the browser http://$ip returns a "Welcome to CentOS" page. Should I assume the server is CentOS or Ubuntu?

What algorithm is using nmap to guess the OS? Find this answer and you'll find what you are looking for.

How much is binary exploitation used in pentesting?

@JohnZhau I have an Apache installation that returns the IIS welcome page...

@ThoriumBR Just.... no... :)

It's nice to mislead bots... they throwing cmd.exe payloads at it...

even the error messages are from IIS

I tried nc $ip 22 and got an Ubuntu banner. My only clue for this...

my SSH banner says: "Windows 9 OpenSSH-Server 3.11v95"

@ThoriumBR You're evil :)

I, too, love being legally evil.

Anyone ever watch MASH?

It recently occurred to me that the main character is Chaotic Good (in one episode he creates a fake soldier, donates his salary to an orphanage, and then when things get out of hand fakes his death and also donates the life insurance money to the orphanage). His "foil" is of course Lawful Evil. When the rules help him he insists on following things to the letter, and is happy to use the rules to the detriment of those he doesn't like. The thought amused me.

when I was in college, one of my assignments were to create a program using huffman encoding to compress files...

my "test file" was a 300x300 white bitmap, with "FILE CORRUPTED" in red capital letters centered on it

when showing to my teacher, I selected the bitmap without opening it, compressed, selected the compressed file, decompressed, and opened the result

@ThoriumBR yes, clearly you're evil.

the teacher said "your program is corrupting files", and I said "no, this is the original file!"

That would absolutely throw me for a loop in that context, but if you think about it for 10 minutes you have to realize, "This is not what a corrupted file looks like..."

my typical Hello World message is something on the lines of "Syntax error", "Invalid parameters", "HTTP 503 - Service unavailable" and things like that.

Your connection has timed out. Please restart your computer.

my colleagues are always wondering if there is really an error with the code, or is another of my pranks

I'm going to just start posting that in chat/comments and see if I can get someone to restart their computer :p

I had a friend I used to like to mess with in college. I probably over did it a bit when I rebooted his computer and disabled his mouse at the BIOS level...

Although I also fell for the ol' "Take screenshot of desktop -> Hide start menu -> Backup folders/links on desktop elsewhere -> Set screenshot as background"

in college we used to disconnect the mouse cable, and plug another mouse in the port, and hide it

Me: WHY CAN'T I CLICK ANYTHING!!!!!!

so the "pranked" would see the mouse stopped working, reach out to re-plug the cable, but the cable was plugged in...

or we would put a piece of paper under the mouse ball to make it not work

or swap mouse connections with the person sitting opposite (this works in densely packed offices)

or in college...

I saw a guy that got to vacation, and one of this colleagues swapped the M and N keys on the keyboard... he got back, worked half day and before he realized that

a few days later, in the restroom, he heard that colleague saying to other that another guy went on vacation and he would swap some keys on his keyboard too

so the first one knew who messed with his kb... he got a teensy, wired INSIDE the keyboard, to swap comma and period once every 20 times

so the guy press m, a n appears.. he keeps pressing m m m m m m m m... it's working... a while later another n appears

@ThoriumBR that's brilliant

these days doable in kbd driver, I guess

I guess so... but hardware change is invisible on the OS

and nobody would think someone changed the keyboard

@ThoriumBR lol, that was cool

@ThoriumBR My "hello world" or temporary test strings are often swear words or vulgar stuff anyway. Examples: echo crap; alert('shit');