The DMZ

« first day (3840 days earlier) ← previous day next day → last day (1028 days later) »

1:48 AM

I downloaded a fresh kali vm and created ssh keys then a decent vpn and started to look for devices to exploit using shodan website , I am and ethical hacker, if i manage to exploit a device i try to patch it and leave a note for the owner with my email address if he wants to contact me I came a...

honeypot

so a hacker that can hack into vulnerable servers and patch them does not know how amazon keeps vulnerable services up, on amazonaws.com domain...

I am moving tomorrow morning, so no internet for a few days until I find an ISP that has coverage on my new place

one does have coverage but it's a fiber to the home ISP and they equipment does not have any available port, the other didn't called me back in a week, the other have 25mbps for the price I can have 250mbps, and the other needs me to call them tomorrow because I cannot order internet using the internet.

maybe I need to fax them? or send them a handwritten letter and show there in person?

riding a horse, maybe?

7 hours later…

djsmiley2kStaysInside

8:36 AM

Challenge them to a duel, only by winning can you get internets.

MechMK1

9:14 AM

Can someone recommend a wordpress-specific vuln scanner that woks on windows?

1 hour later…

MechMK1

10:39 AM

I just received an e-Mail from Amazon that screams phishing mail, but it's not

1.) E-Mail doesn't address me by my name, just says "Guten Tag" (good day, common quasi-formal greeting in the German language)
2.) Formatting is all odd. E-Mail contains links to "My Account", "Wishlist", "Help" and a shopping basket icon, which doesn't even make sense for an e-mail.
3.) E-Mail congratulates me - which is usually always a red flag - that I receive 40% off my Xbox Game pass if I enter this code on this website.

The reason I think it's not phishing is the fact that all links go to "amazon.de", so unless there is an open redirect somewhere, it seems legit. Also the order number in the email corresponds exactly to a recent order I made.

But fuck, whoever wrote this template needs to fix this

1 hour later…

A. Hersean

11:50 AM

@MechMK1 Maybe the same guy write fishing e-mails too.

MechMK1

Oh my god, that's a genius move

Like the guy who picked the domain for feedback for burger king

Let me ask you, which one do you think is the "proper" domain for sending feedback to burgerking in germany and austria?

1.) de.burgerking.com/feedback
2.) feedback.burgerking.com/de
3.) bk-feedback-de.com

A. Hersean

MechMK1

You wish

It's 3

So, gotta go back to work

Deadlines and all

2 hours later…

Fire Quacker

1:23 PM

Q: How to change a website to no longer needing an SSL certificate

I have recently had an active website that was protected by an SSL certificate. The site is no longer active and the certificate has expired. I have tried to put up a simple HTML holding page but Google will not show it because there is an expired certificate associated with the domain. Is there ...

tls certificates

This should be a webmasters.SE question

I mean, unless disabling your own security features fits in the scope of this site

nobody

1:48 PM

@FireQuacker No one even mentioned HSTS preload.

@MechMK1 None. It's supposed to be 23.248.181.31:3337/bk/feedback.

I know it's legit, because you just have to download the secure feedback application. Or sign in with google.

2 hours later…

MechMK1

3:57 PM

Do we have some audiophiles here?

ThoriumBR

4:49 PM

nope... I listen to music using an iPhone 6 earphone...

or the earphone I was given from the airline the last time I flew, last century or something

ThoriumBR

5:05 PM

@FireQuacker I saw people asking how to receive spam, how to get a ransomware, how to downgrade windows updates...

Conor Mancone

5:55 PM

@MechMK1 That's genuinely awesome

Training people to fall for phishing scams!

ThoriumBR

sometimes I wonder if a full domain is cheaper than a subdomain...

Conor Mancone

@ThoriumBR It's likely an issue of collaboration and organization. In my domain, creating new sub domains requires approval but is otherwise completely automated, so sub domains are super easy to make.

However, I can absolutely see cases where creating a new sub domain requires a manual process from someone who is hard to find and has more important things to do - basically, it's impossible.

MechMK1

Yeah, again, the produc mimics the organization

If this whole feedback thing is solely an "event" from marketing, i.e. not something permanent, then it will likely be easier to just get them a domain on some external hosting service than to just set up a subdomain, change the certificate if it's not wildcard, etc...

Often times "Just buying a complete domain + hosting" is easier on the organization side

Conor Mancone

6:17 PM

Yup, I'm sure that is often the case.

That being said, for a large company like Burger King, you'd **think** they'd have a better method in place...

MechMK1

Usually, it's the opposite. The larger the company, the longer the routes take, the more people want or "need" to be informed or require approval

ThoriumBR

6:30 PM

my energy provider site for paying your bills don't even have a domain

it's a 205.x.x.x IP, with SSL certificate for something else

Conor Mancone

6:41 PM

@ThoriumBR That seems.... sketchy

djsmiley2kStaysInside

loooooool

I've known lots of companies using external domains for feedback

it seems to be quite common in the uK

I suspect, they're prob all ran by a few firms who offer outsourcing of the feedback thing

Also means, said companies don't need to deal with the hassle of gdpr etc

They just get a monthly report with whatever stats about what people are saying

2 hours later…

forest

8:36 PM

@nobody I'm pretty sure you're supposed to encode your feedback as EBCDIC into the Bitcoin blockchain, then refer to it by sending a pointer to the relevant block via URG pointers in martian TCP packets sent to the Burger King CEO's smart refrigerator.

ThoriumBR

that's... convoluted...

forest

Still better than going to bk-feedback-de.com.

For those who don't like EBCDIC, you can use SJIS in a random endianness, and specify the endianness via RFC 3514 (little endian is evil bit unset of course, because big endian is evil).

ThoriumBR

I once gave a gift card to my brother on his birthday. I put the code on pastebin, put the pastebin url on bit.ly, made google spell the url letter by letter, recorded that on my phone, attached the video on a .doc file, zipped the doc, put the zip on an excel spreadsheet and sent him.

forest

pffft nice

nobody

9:08 PM

@forest But... Bitcoin is used by scammers!

forest

That's why you use EBCDIC. Scammers can't decode it.

« first day (3840 days earlier) ← previous day next day → last day (1028 days later) »

all rooms