@ΛεγίωνΜάμμαλϠΟΗʹ (I also asked you if you were gonna binge-watch all of them, but you never got back to me)

@betseg this is like the have it in hacking competitions

> 1. Apply 2. Make Payment 3. Download

evisa.gov.tr/en

^^

HIT TURKISH NATIONAL INTELLIGENCE ORGANIZATION

WE'RE PROGRAMMERS TOO

JOIN US

WE KNOW YOU'RE THERE.

DON'T TRY TO HIDE IT.

@betseg Preliminary analysis: System not focused on security

11.
00100100 00111111 01101010 10001000 10000101 10100011 00001000 11010011
00010011 00011001 10001010 00101110 00000011 01110000 01110011 01000100
10100100 00001001 00111000 00100010 00101001 10011111 00110001 11010000
00001000 00101110 11111010 10011000 11101100 01001110 01101100 10001001

>   + Server: Microsoft-IIS/8.0
    + Retrieved x-aspnet-version header: 4.0.30319
    + The anti-clickjacking X-Frame-Options header is not present.
    + Root page / redirects to: /en/
    + Server banner has changed from 'Microsoft-IIS/8.0' to 'Microsoft-HTTPAPI/2.0' which may suggest a WAF, load balancer or proxy is in place

@ΛεγίωνΜάμμαλϠΟΗʹ ???

ಥ⁔ಥ

??

ಥ⋂ಥ

@flawr why do you have a pic of uncle roger

are you stalking him

that's his job

1.3 hours left of scan... wtf, nikto is usually fast

Loads of subpages?

no idea

maybe IDS?

It did say "+ Server banner has changed from 'Microsoft-IIS/8.0' to 'Microsoft-HTTPAPI/2.0' which may suggest a WAF, load balancer or proxy is in place"

they are using microsoft products, that's a sign of an exploit

Is it possible to render mathjax in a <title>?

Just curious, what does it give for google.com?

@EᴀsᴛᴇʀʟʏIʀᴋ Nope, it's plaintext

hm, okay

because math.se always has the $ and stuff in the tab title, compared to the title on the page which is nicely formatted

@EᴀsᴛᴇʀʟʏIʀᴋ emojis work though

TASK START

:O got cgi pages

@ΛεγίωνΜάμμαλϠΟΗʹ output so far:

+ Server: gws
+ Uncommon header 'x-frame-options' found, with contents: SAMEORIGIN
+ Uncommon header 'alt-svc' found, with contents: quic=":443"; ma=2592000; v="36,35,34,33,32"
+ Uncommon header 'x-xss-protection' found, with contents: 1; mode=block
+ Root page / redirects to: google.com
- Pausing--press P to resume.
P- Resuming.
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Server banner has changed from 'gws' to 'sffe' which may suggest a WAF, load balancer or proxy is in place

> + The anti-clickjacking X-Frame-Options header is not present.

> + Uncommon header 'x-frame-options' found, with contents: SAMEORIGIN

Turkey, not google

it tests XSS too

sample of verbose mode output

V:Sun Oct  9 11:33:54 2016 - 404 for GET:       /user.php?op=userinfo&uname=<script>alert('hi');</script>
- STATUS: Completed 830 tests (~13% complete, 22.6 minutes left: currently in plugin 'Nikto Tests')
V:Sun Oct  9 11:33:54 2016 - 404 for GET:       /TopSitesdirectory/help.php?sid=&lt;script&gt;alert(document.cookie)&lt;/script&gt;
V:Sun Oct  9 11:33:54 2016 - 301 for GET:       /templates/form_header.php?noticemsg=<script>javascript:alert(document.cookie)</script>
V:Sun Oct  9 11:33:55 2016 - 301 for GET:       /templates/form_header.php?noticemsg=<script>javascript:alert(document.cook…

Does it test for SQLi vulnerability?

hm, I don't think so, but sqlmap does

it's very thorough

I'll be looking more at this when Cygwin finishes updating

mostly outdated software, misconfig, outward facing encrypted passwords

It found apache docs on a public non-test server of a major site!

(I ran it)

@ΛεγίωνΜάμμαλϠΟΗʹ quickstart: nikto -h https://www.sitenamewithprotocol.com -evasion 012345678

@noɥʇʎPʎzɐɹC What's -evasion for?

But yeah, I need Cygwin for Perl

To evade IDS.

Don't forget to install libwhiskers.

Most sites have IDS, they will slow or stop your scan.

IDS?

oic

Intrusion Detection System?

Yep.

But yeah, I just selected to install all packages a couple of years ago

Most have updated, some new ones have been added, but hopefully it has libwhiskers

@noɥʇʎPʎzɐɹC those are plaintext....

Type P = Pause, p = start periodically showing progress, space = show progress now, v = verbose mode

Type P = Pause, p = start periodically showing progress, space = show progress now, v = verbose mode

wot

It's currently in the middle of updating the qt4 docs...

plaintext is without formatting, emojis are actual characters, not formatting

^

libwhiskers is required for IDS evasion

Although Unicode math characters do exist

yeah, but I think mathjax is more common where it's enabled

:O Turkey nikto output:

+ /siteseed/: Siteseed pre 1.4.2 has 'major' security problems.
+ /iisadmin/: Access to /iisadmin should be restricted to localhost or allowed hosts only.
- STATUS: Completed 1500 tests (~23% complete, 1.2 hours left: currently in plugin 'Nikto Tests')
+ /w-agora/: w-agora pre 4.1.4 may allow a remote user to execute arbitrary PHP scripts via URL includes in include/*.php and user/*.php files. Default account is 'admin' but password set during install.

> Access to /iisadmin should be restricted to localhost or allowed hosts only.

Whoops :P

WTF!??!?

> Due to system errors caused by your activities, your access to the system has been suspended. Your access details have been stored and reported to the authorities.

...?????

when visiting evisa.gov.tr/w-agora

nice

turkey hates you

ACTIVATE WHITE HAT LEGAL PROTECTION

‽‽‽‽‽‽‽‽‽‽‽‽‽‽‽‽‽‽‽‽‽‽

@noɥʇʎPʎzɐɹC ...er, they can only be accessed though dial-up

hm?

@noɥʇʎPʎzɐɹC Did you get permission for the sites you're scanning / do they have a bug bounty program?

lol

dammit

dialupsound.com perhaps?

can someone who hasn't been blocked visit evisa.gov.tr/site-seed

it's probably breaking some law/guideline to do that to a bunch of websites

Activate TorBrowser.app

if not a law, then definitely a law-of-niceness

... you really should make sure you have permission first, or else it doesn't count as white hat

@mınxomaτ you are security expert, advise me

@ΛεγίωνΜάμμαλϠΟΗʹ "Image not found"

@noɥʇʎPʎzɐɹC oic there's no hyphen

@betseg Translate this for me:

dude, don't ping random people to ask them for help that is vague/you could easily do yourself

Error
Are there has been an HTTP request failed. If you think you have made a valid request please contact my communication with the technical support team.
:: 515 789 158 327 Reference number for this event.
If you are doing a malicious attempt your request is recorded. legal investigation about the transactions made will be made.

^ From Google Translate

@EᴀsᴛᴇʀʟʏIʀᴋ betseg is turkish native speaker

yes

but google translate is a thing

and betseg isn't here

("4m ago")

just visited "https://www.evisa.gov.tr/IAMWHITEHATSORRY"

@noɥʇʎPʎzɐɹC seriously, you should probably stop doxxing websites.

> search for and publish private or identifying information about (a particular individual) on the Internet, typically with malicious intent.

1. not trying to get private info

2. intent = have fun

wat

I think security vulnerabilities is private info.

@EᴀsᴛᴇʀʟʏIʀᴋ ...(a particular individual)

did not publish

> search for and publish private or identifying information about <websites> on the Internet, typically with malicious intent.

@noɥʇʎPʎzɐɹC yes you did

you posted in a public chatroom

^

this is accessible by google

anybody can run a random nikto scan

yes

anyone can shoot somebody in the head

no intent

you just need a gun

> typically

> Doxing (from dox, abbreviation of documents),[1] or doxxing,[2][3] is the Internet-based practice of researching and broadcasting private or identifiable information (especially personally identifiable information) about an individual or organization.

individual or organization ≠ a website

nothing about intent, or being limited to people

@noɥʇʎPʎzɐɹC turkey's visa system is an organization.

> about an individual or organization.

@noɥʇʎPʎzɐɹC What are you going to do if Nikto finds a vulnerability that ends up breaking their site, costing them revenue? That's why permission and scope is important.

they run a website

yes

I got info on the website, not the organization

which they own

so part of their organization

@noɥʇʎPʎzɐɹC TL;DC: that's really not cool, quit it, and it could possibly have bad (IANAL but maybe legal) reprecussions.

I ctrl-c'ed as soon as I saw that

TURKEY, IF YOU ARE LISTENING, I'M SORRY AND I'M NOT DOING IT AGAIN

ALSO I PUT IT ONLINE TO PROVE I WASN'T BLACK-HAT

BLACK-HATS DON'T PUT THEIR HACKING ACTIVITIES ONLINE

What's with all the caps?

^

spy agencies, man

also you are a chat mod

Mainly from Crazy

so I'm scared

Is it offensive/rude to request a user be kicked?

@EᴀsᴛᴇʀʟʏIʀᴋ Perhaps we need a meta post ;)

I'm not sure if deleting would make it any better

@ΛεγίωνΜάμμαλϠΟΗʹ yes