The DMZ

« first day (3939 days earlier) ← previous day next day → last day (1239 days later) »

Arminius

01:03

Hey folks, I have this mysterious blind injection point, but I can't figure out what language I'm dealing with

It's in REST API that belongs to a Java (Spring?) web app

ThoriumBR

any url/error message/special parameter?

google can help you with that

Arminius

(Let me first write up some more details: )

The server response only tells me whether my injected string is causing a syntax error. So I can experiment with different syntax constructs

The API takes a category name (e.g. help) and sends a JSON reply in the form of [{"title": "Our help", "multicategory": ["help", "home"], "content": "Some help info...", "priority": "0.0"}, ...]

As for the injection point, some examples are:

help'foo -> error

help''foo -> ok

help'-a(b+c+1-0.5e10)-'foo -> ok

I'm getting an error if e.g. the parentheses or quotes don't match or a number literal exceeding the max of a signed 64bit int (9223372036854775807). So I'm clearly interacting with some language parser, but no idea what exactly

ThoriumBR

01:31

you could try some formatting errors, template expansions, things like that

it does not output anything that tells "it's java", nor "it's not java"

Arminius

Also, some characters are banned (including "|^[]{}/)

Tried, but didn't get me anywhere

I tried to find some syntax keywords. Curiously, the only potential one I found is if (but neither else, for, and, do ...)

help'-if()-'foo -> error

help'-anyotherword()-'foo -> ok

And, surprisingly: help'-(if)-'foo -> ok

I suspect this is some kind of framework-related DSL, but who knows

11 hours later…

MechMK1

12:11

@CaffeineAddiction Honestly, if I have music files in the format 05 - Iron Maiden - The Trooper.flac I'd rather write rename 's/(\d+?)\ -\ Iron\ Maiden\ -\ /$1/g' *.flac than to mess around with Python or whatever other language you consider a "real language"

Anything I need to do "just once" is probably good enough to do in Bash

A. Hersean

s/bash/zsh/

Journeyman Geek

@MechMK1 @CaffeineAddiction or a specialised tool

I tend to use mp3tag :D

MechMK1

I like kid3

@A.Hersean 's/.*sh/a shell of your choice/g'

ThoriumBR

12:28

I like mp3tag too

MechMK1

Ah, GUI only

kid3 has a cli tool as well, which can be used both interactively and batchable

Which is nice on the server you're storing your music on

A. Hersean

@MechMK1 Nop. It must be zsh. No compromise. And "pysh" is not a shell (a coworker tried it as a login shell... as expected, but not by him, it did not work...).

MechMK1

I honestly couldn't care less what shell it was

I wonder what I was dreaming to prompt that. I hope it wasn't the Richard Stallman Cirque de Soleil thing again.

A. Hersean

The war between bash and zsh is the same as the one between vim and emacs, or gnome and kde, except that nobody heard of this war.

ThoriumBR

I personally never used zsh...

I used csh as my default shell 20 years ago when I knew nothing about linux at all, but moved to bash 6 months later and still use it to this day

A. Hersean

12:38

And nobody cares. So everybody is stuck with bash. And that sucks, because every time I log on a new server, one of my first though is "oh, right, I'm on a retarded bash shell with zero functionalities". In bash you can't even write something as simple as 'cat */.log'

fuck autocorection

ThoriumBR

do you know what I love about autocorrect? the memes

A. Hersean

there's two consecutive "*" in my previous post

MechMK1

Why would cat */.log not work in bash?

As far as i know, it does

A. Hersean

because that's not what I wrote

ThoriumBR

I've found some memes so hilarious, they must be fake

A. Hersean

12:41

what you read works in bash, of course

s/*/**/

MechMK1

cat **/.log

A. Hersean

I don't know what happend

I even edited the post...

cat**.*.log

ThoriumBR

what would that do? cat all .log files on all subdirs?

A. Hersean

fuck

yeah. I used cat as an example, but could be wc or du

ThoriumBR

try using the code formatting

MechMK1

12:43

four spaces, then a command

A. Hersean

cat **/*.log

ThoriumBR

or backticks

A. Hersean

that's better

ThoriumBR

now it makes sense

A. Hersean

so, cat **/*.log is valid zsh but not bash. ** is recursive *.

sometimes grep, ripgrep of find can do the job, but sometimes ** is so much easier

MechMK1

12:47

Why was my server off??

Ah yes, power outage

I forgot

Had to reboot it with a lockpick

I have a problem

My HDD is ticking as if there is lots of IO

But iotop shows nothing

A. Hersean

What does SMART tells you?

MechMK1

How can I check that?

What...

I rebooted, then it was fine for a while and now it's going again

A. Hersean

@MechMK1 from the bios/uefi or from diagnostic software

MechMK1

Weird, it stopped now

A. Hersean

Comparison of S.M.A.R.T. tools

This is an incomplete list of software that reads S.M.A.R.T. (Self-Monitoring, Analysis, and Reporting Technology) data from hard drives. == Notes == == References ==

On my NAS, the OS (Synology DSM) has SMART monitoring integrated, to be alerted to swap a drive before it completely fails (a SMART scan job must still be scheduled beforehand).

MechMK1

13:03

Drive seems fine

Didn't detect any SMART errors

I think it may have been some process going through my HDD

Like some find command or whatever

A. Hersean

yeah, most likely

(I get why "**/*" was not displayed correctly: it displayed "/" in italics... I feel so stupid.)

ThoriumBR

makes sense... an italic / and normal / seems the same...

@MechMK1 a ticking HDD usually is a dying HDD

I once entered the datacenter of the company and heard weird hdd clicking, and told root about it, and said the hdd was dying. he dismissed it and said "this is an enterprise grade hdd, it won't die so fast"... next Monday I got to work, couldn't login, got to the datacenter, root was there... "we are rebuilding the RAID array, one hdd died the weekend"

MechMK1

It sounded more more like IO

Like it was searching through the HDD

Journeyman Geek

or worn out mounts

I have a HDD that sounds like a dying fan at full tilt cause the case is magnifying the sound

ThoriumBR

that's an issue too

Journeyman Geek

13:21

I'm debating dumping that PC - I'm mostly using it as a proof of concept to test stuff

or sticking it somewhere other than my room :D

MechMK1

14:09

As I said, my HDD is quiet now. It's way more likely that it was just some process instead of my HDD dying

If it were dying, it'd click all the time

gaazkam

14:29

Perhaps I found the solution for constant annoying password prompts

KeePassXC has an option called Global Autotype

No more Alt+Tabbing to Keepass and looking for the correct password in a ridiculously long list of different passwords, yay

But it does require some initial configuration

Of course for this to be really convenient the KeePass database needs to be constantly unlocked, but hey, non stop password prompts would mean that the db is constantly unlocked either way

MechMK1

14:45

@gaazkam You can also use the browser extension

That works really well too

gaazkam

@MechMK1 sadly, not for passwords required to unlock private keys needed to make a git commit

IT demands that all private keys must be password protected

1 hour later…

ThoriumBR

16:10

I sent my address to my manager, so I can receive company mails... and was looking at some "interesting" findings on my neighborhood:
- the one naming (or numbering) the roads were drunk for sure...
- there are the corner of the 13rd street with 13rd street
- the 15th is between 13rd and 14th
- the one after 5th is 13rd
- the 13rd changes midway to 27
- there's a road parallel to it that is the 13rd
- the 14th is between the 15th and the 15th
- the one after 7th is 9th, there's no 8th

Fire Quacker

16:45

Naming things is hard...

ThoriumBR

road++ isn't that hard...

Fire Quacker

Only got ten fingers, man... How you gonna keep track of them after that?

I dunno. Sometimes when you do road++, you get problems when you start adding new roads in between them

If you can name all the roads in the city all at one time, then you can make it logical. But if you have some history and changing designs and such, you get all messed up

That's why all roads should have utterly meaningless names so you can't get confused

ThoriumBR

I lived on a city that had thematic roads. a neighborhood have bird street names, other rocks, other flowers

so if they created new roads, they just picked up another bird or stone or whatever

Fire Quacker

17:03

Yeah, that works

1 hour later…

nobody

18:24

You can now buy the April Fool's Stack Overflow copy paste keyboard

Sucks that J isn't here anymore.

He wanted one.

ThoriumBR

$30 for a 3 key keyboard... a cool gift

nobody

Yeah, anybody want to get me one? :P

Cuz I'm never going to spend 30 bucks for three key caps myself.

3 hours later…

CaffeineAddiction

21:34

@JourneymanGeek exactly ... I would be writing a specialized tool

@A.Hersean pff, the only war that matters ... tabs vs spaces

Sam

22:09

Hey guys! I wanted to ask you guys for some advice if that's okay. What do you think is the best way to make sure your program is only used on one computer (i.e. license verification)? Is there some unique device ID I can use?

CaffeineAddiction

short answer ... you cant, you can only buy time before someone cracks whatever protection you add

its right up there w/ the axiom physical access is root access ... drm is made to be broken

« first day (3939 days earlier) ← previous day next day → last day (1239 days later) »

all rooms