question for the room... anyone played much with External Entity Expansion stuff in XML?
I found one the other day and got the basic grab /etc/passwd and return it working fine, but had problems with other files as they made the response invalid XML
So I was looking into whether it was possible to mark the entity as Not XML so the parser wouldn't barf
didn't get too far with the one in the app I was reviewing but wondered if anyone had seen an XML parser that lets you setup unparsed external entities?
It seemed that the spec would allow for specification of a program which would then be used to parse the entity, looked like a good way to compromise systems if it worked...
chat.stackexchange.com/help is giving me green ok on all the tests, but whenever I go to the DMZ it tells me that "no referer present, this maybe due to browser config"
I was talking to a friend, he told me that he can crash my linux box. (I have a linux box where I host free shell accounts for port-forwarding purposes)
I have set everybody's shells to /bin/false and when they connect they use -N, everything is sweet.
After a couple of minutes I saw that the CPU was at 100%
and 10 minutes later everything slowed down
15 minutes later I was able to do almost nothing with it, it just became unresponsive
@KennyRasschaert I was reading about that yesterday when muts tweeted it. I couldn't quite tell if Backtrack was being fully obsoleted or this was just a new project of theirs.
@ScottPack Yeah yeah, I'm not talking from a security point of view. I always assume that someone who knows everything I know about the system is day-and-night trying to compromise it
To any IT Security newbies and anybody interested. Cryptography I at Coursera is starting on March 25th. I'm certainly gonna take it as I'm fairly new to the subject.
But there's no TTL to decrement here. The analogy is good, though: port forwarding of SSH is like routing packets, except that it routes TCP connections which consume resources until closed. There is no loop-detection mechanism in that.
I feel special that I have the Guru badge that only 39 others have it. A badge shared with other great members like Thomas and Polynomial. But I can't help but to feel dirty for it's been awarded to me based on a shitty answer.
Damn it! Now I'm gonna keep thinking about it for a couple of days
Ah ! When I look at my user page, "summary" tab, in the "badges" section ordered by class, it shows only gold badges. There's no room for other kinds of badges.
@ThomasPornin Well, in summary, the guy is talking about how badges in Stackoverflow support the gamification of the whole concept, to encourage involvement and participation.
havent done it in a few years, but I've made a dual-cpu Xeon with just oodles of server RAM, lock up to 100% CPU, multi-GB RAM usage, for as long as I chose to leave it like that....
Many viewers make a distinction between film and movie. For instance, one would never refer to "Starship Troopers" as a film, but it is definitely a movie. Anna Karenina, however, would be called a "film".
And the douchebags that make such distinctions would never refer to one as the lower form.
@AviD yeah I was specifying the entity in the DTD using <!ENTITY test SYSTEM “/etc/passwd”> but unfortunately attempts to add CDATA to that statement didn't seem to work with that XML parser...
@AviD Sorry. I'm in a highly positive mood today. You think I'm overbearing in chat - should see me in real life. All my colleagues left early for the pub... whoops.
@AviD well that was where I will admit to getting a touch confused. I can use an ENTITY and the substitute it but I was unclear on where the ATTLIST would come into it?
Thomas doesn't need a lair. He's like those big machine things guarding the machine city at the end of matrix III. Nobody's bothered him for 200 years.
@RoryMcCune Did you understand the meaning of ChangeHats from that article OP is linking to, or did you find any other articles about it? I just can't make a sense of it and would be curious to read more on it, if you have something?
Wikipediapa - "Waiting for Godot (pron.: /ˈɡɒdoʊ/ god-oh[1]) is an absurdist play by Samuel Beckett" @RoryAlsop I think the word "absurdist" explains it.
We have some similar play to Waiting for Godot, about a 'happening in the city of Gogi'... where of course nothing ever happens but everyone is involved with what's happening with other inhabitants... always found it quite Beckett-like
from Wiki... the author was inspired by working in the mental institution... it's supposed to be social-criticism play... weird as they come IMO :)
@TildalWave Well from what I understand of AppArmor (which isn't a lot) is that it's a MAC style system that lets you define profles of what an application can do. So it would be one profile per app (say Apache as an app). then ChangeHats allows you to say this one app (e.g. apache) actually has multiple sub-profiles so that some code running under it has more privileges than others
@RoryAlsop What to understand is that the understanding is important. The play is just a substrate on which you are supposed to build your own understanding.
@RoryMcCune I remember this "changing hats" method being mentioned long ago (10 years back? dunno) and some friend was asking me what's it all about. Of course I had no idea, but more worryingly I still don't now that I've heard of it again after so many years. So basically what you're saying is that it's just a way to temporarily raise or lower application privileges and these "hats" are more like policies than "users"?
@TildalWave well from what I read of it, kind of if you think of under a MAC system the profile is like a user then yes it's like having multiple policies for a given user so that bits of what they do operate under different permission levels. (it's late tho' so that may be a sucky analogy)
@LucasKauffman NP that's usually where I get to on Wireless assessments if they've got PEAP and are checking things, TBH these days a decently done wifi network is quite robust..
eitherway I would probably not put it directly in the report ;op
@LucasKauffman ah well that's not too bad just pixelate it apart from the banner and I'd guess you'd be fine (Although never know with Big 4 Partners...)
