The DMZ

Scott Pack

00:23

@Polynomial I don't think I understand what that means.

Polynomial

@ScottPack My point entirely.

Scott Pack

Why aren't you in bed yet?

Xander

Ok, just edited another one of his copy/paste jobs if somebody would like to peer review it.

Polynomial

just did

he needs to be slapped

@ScottPack Because I'm a rebel.

and responsible chronology is for pussies.

2

AviD

00:39

Scott Pack

@Polynomial You know what else is for pussies?

Polynomial

@AviD That's primarily where I got the inspiration for that comment :P

Xander

@Polynomial Thank you sir. And yes he does.

Polynomial

@ScottPack Cocks?

Scott Pack

@Polynomial I was going to say saucers of cream.

AviD

00:42

@Polynomial heh, sorry! I didn't know!

Polynomial

@AviD s'all good. glad to see someone else reading TwoGAG

AviD

@ScottPack yaknow, at least @Polynomial was subtle. You didnt have to be so damn graphic about it.

Gilles

@Xander did, and flagged

AviD

and good night.

Gilles

@AviD what, you aren't handling that flag? It isn't even 3am

Scott Pack

00:44

Speaking of pussies.

Gilles

good night (or good morning)

AviD

@Gilles ehh. Doing the damn tax paperwork, have to file tomorrow.

every damn time, I say I'm gonna do this regularly, and every time it rolls around, I have to slog through a big pile of months worth of papers.

Just to prepare for the accountant, mind you.

Being self employed is not all its cracked up to be.

2

Xander

@Gilles Thank you sir. And actually the whole thing (except for the "Sample command utilizing the -s option:" that I added) was taken straight from the PowerPoint. Including the command line example itself.

Gilles

@Xander I can't find the exact same command, that's why I left it out of the quote

Xander

Ah, nevermind. I take that back.

Gilles

00:51

it's very similar, but some of the parameter are different

I did miss out a quote before the next-to-last bullet point

Xander

Yeah, I did a search for "-s 5" and found it, and made a bad assumption that it was the same without checking.

Gilles

oh, no, that one is reformulated too, not quoted verbatim

anyway, enough time wasted on that

Xander

@Gilles LOL! You're telling me.

@Gilles Ah, yeah, You're more thorough than I am, apparently.

It's close, but not quite the same indeed.

Jeff Ferland

01:13

@asadz We need to speak about your recent answers. The last two seem to have some issues with them, possibly including plagiarism (security.stackexchange.com/posts/32756)

D3C4FF

02:16

I see the asadz lulz continue... :P

Terry Chia

@Adnan He is a troll I guess. I have seen people like that on other forums, challenging people to crack their algorithms.

TildalWave

02:35

@D3C4FF yup it is getting hysterical again

@asadz - It's not void of service detection at all, don't know where you're getting that from. The description clearly states Unicornscan has Asynchronous stateless TCP banner grabbing abilities, protocol specific UDP Scanning, and Active and Passive remote OS, application, and component identification by analyzing responses. What more would you want in the service detection sense? — TildalWave 6 mins ago

Terry Chia

@TildalWave I think it's sad really.

I sense a disturbance in the force

TildalWave

03:05

@TerryChia what the..?? This is real ultrasound? metro.co.uk/2013/03/11/…

D3C4FF

@TerryChia I lulz'd

D3C4FF

03:54

ARGH. Turns out, if you scan using Nmap with -verbose and/or -debug flags set and then export the results, you CANT re-import them ;__;

TildalWave

@D3C4FF mind me asking why are you scanning up to /8 ranges? Some research project requires of you to map such large ranges by services? You do realize there are easier ways to obtain her Skype address, right? :P

D3C4FF

@TildalWave xD I didn't know you could pull skype names via pings :P

Its for work.

Terry Chia

@D3C4FF Really? Can't say I tried it out before but that is surprising. Which format are you exporting it as?

D3C4FF

I'm currently consulting for a uni doing an internal pentest. I've got 5 days to scan pretty much 10.x.x.x

@TerryChia both nmap and .xml, i usually do so for posterity.

Terry Chia

04:09

@D3C4FF Ahh.

@D3C4FF Wait, what flags are you using again? A -sV on that subnet is gonna take a hella long time you know. :P

D3C4FF

@TildalWave It also doesn't help that one of my machines is unstable as fuck.

TildalWave

@D3C4FF LOL well at least you're not required to scan IPv6 /8 :)))

D3C4FF

@TerryChia Why/

@TildalWave I lookforward to doomsday coming before widespread IPv6 adoption

Terry Chia

@D3C4FF That really isn't a good idea.

Do a ping scan on the whole subnet first.

Then do a -A on the host that are up.

D3C4FF

about 30% of hosts here don't respond to ping.

Terry Chia

04:12

Gimme a sec, I'll start up my vm to see what flags I would usually use.

Damn windows host...

D3C4FF

nmap -sn -T4 10.1.0.0/16 ?

Terry Chia

@D3C4FF Yes. Do note that the -sn flag isn't only a ping, despite it's name.

> The default host discovery done with -sn consists of an ICMP echo request, TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp request by default.

D3C4FF

Yep

Terry Chia

Then import the list of host that are up for a second scan, using the -Pn flag this time.

You might wanna use the -n flag to skip dns resolution if you can, it's hella slow.

I daresay it's pretty much impossible to scan a whole /8 subnet in 5 days with the -A flag.

Not to mention the -A flag doesn't perform UDP scans IIRC, which might be something you want.

D3C4FF

Well while one PC's been scanning i've been pwning and so i've got the network diagrams so i know what subnets to focus on...

No. UDP is blocked pretty much everywhere here :(

Terry Chia

04:19

@D3C4FF Well, use the -sn or even the -sS options to map out which host are online. Then focus the -A scans against interesting hosts.

There really isn't a point in running the NSE against every single IP in the whole subnet. :P

D3C4FF

See? This is why i come to sec.se! :D

Cheers @TerryChia :)

Lets see how long it takes now...

Terry Chia

lol xander you want me to pastebin the entire scan results of class 16 subnet address im so much amazed neither one of you had the courage to technically debate why this command would fail? xander its not about 10 year paper its pure simple ping scanning how much has that change over past 10 years?i habe supplied this command with its parameters what else is left. — asadz 10 mins ago

Simple ping scanning? That goes to show he has absolutely no idea how a port scanner works.

Nmap has improved A LOT in the recent versions.

D3C4FF

Despite my gripes, i fokkin' love NMAP

Terry Chia

@D3C4FF Yeah. It's my favourite security tool tbh.

Port scanning is fun.

D3C4FF

I think asadz is deleting his own posts? or a mod is?

Terry Chia

04:35

@D3C4FF Hmm? His answer to your question is still there.

But he tends to delete his post once it gets downvoted a bit.

D3C4FF

I'll be back in a few, just gotta grab lunch.

the comments at the bottom sorry

TildalWave

04:55

Hello and welcome to IT Security! Your question seems a bit too open-ended, and might inspire debate. Please refer to the FAQ on what questions aren't expected to be properly answered and why not. But I see some parts of it that certainly need answering, as it suggests some misapprehensions regarding what type-safe and memory-safe actually mean for languages, compilers and their memory managers in terms of system and application level security. If you could re-write it to be more specific for the 2nd part, that'd be fab. Thanks! — TildalWave 4 mins ago

is this acceptable review for the question asked?

Terry Chia

@TildalWave It's ok.

> However, is JVM in general (still) a good choice for high secure server applications? Are other JVMs (e.g. from IBM) more secure than Oracle's for this purpose?

I think changing those two lines will make it a good question.

I wanted to write something up, but I realized I know nuts about Java so screw it.

TildalWave

@TerryChia I asked OP to re-word it and gave him a link, what questions are expected here... I say we let him/her a few minutes first, some do get it, despite some unnamed others showing lack of understanding LOL... I'm optimistic

Terry Chia

@TildalWave Hey, he is a new user. No reason not to be optimistic.

It's actually a good question. I can't remember if it's a dupe though.

TildalWave

i'm just running through JVM questions

Terry Chia

19

Q: Should I be disabling Java?

First it was Apple, now it's the US government... U.S. urges users to disable Java; Apple disables some remotely New malware exploiting Java 7 in Windows and Unix systems How serious is this "unspecified vulnerability"? Should all users be disabling Java until we know things have been patche...

There it is. I knew I read something about it by The Bear.

TildalWave

05:02

yes, but is not quite the same question. neither is this one:

1

A: Is there a need to define "language safety"?

Language safety can be interpreted more broadly than affecting merely security. But as this is a security site, let's just restrictive ourselves to security. Clearly language selection has a significant on whether you will get certain types of vulnerability. Write a non-trivial program in C and ...

Terry Chia

@TildalWave I think The Bear's answer covers it pretty well. It's basically a problem with the client-side apps, server side is fine.

TildalWave

Problem is, how the question is written, it's really a two-part question. First part is OP's misapprehension about language safety, and the other is the JVM part

Terry Chia

Hmm good point. Goes to show how much I know about Java. :P

Damn Java..

TildalWave

@TerryChia Sure, but I can't flag some question as a duplicate of another, completely different one only due to the answer covering both LOL

Terry Chia

@TildalWave Actually, I think the language safety part is irrelevant. He is just explaining why he likes to use Java instead of C/C++.

The main question is the safety of Java for use in servers and the JVM thing.

TildalWave

05:06

@TerryChia hmmm that's a bit unclear to me. I read it as he likes to use Java for being safer to use than C... which is true in the context of programming languages, but does not necessarily directly translate to safe as in non-exploitable

and I think OP seems to be confusing one with the other... I might be wrong, tho

Terry Chia

@TildalWave I guess it's better to wait for him to clarify.

TildalWave

@TerryChia Yup, cheers

D3C4FF

Nom nom. Waddimiss?

@TildalWave @TerryChia Either of you fine folks have a simple way of deleting every second line of approx 1200 lines of text?

or. every line that's 1-3 chars long?

Terry Chia

@D3C4FF Sounds like you need some serious awk-ing.

You could probably string something up, but I wouldn't call it simple.

TildalWave

@D3C4FF fire up some database -> import as CSV -> run "SELECT * FROM table1 WHERE Len(table1.field1) > 3"

D3C4FF

05:14

What about how to rip all IP's out of the Nmap results? :P

Gah. I don't have any Database servers handy .-.

Terry Chia

Deleting every second line is probably simple. Just write a script to iterate through the text and delete every alternate line. Some looping and if/else should do it.

@D3C4FF Work with the XML files. Waaaaaaay easier.

TildalWave

@D3C4FF want me to write some JS? so... you need only lines that would be longer than 3 chars, right?

D3C4FF

grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' file.txt

Yeah

@TildalWave that'd be awesome :D

is there a way to say 'NOT' in regex?

so search anything except for (above regex)

Terry Chia

Regex hurts my brain. :(

Even the simplest ones make me stop and think for a few minutes.

D3C4FF

Same... :P

okay.... ^(?![0-9]*\.[0-9]*\.[0-9]*\.[0-9]*) SEEMS to do something along the lines of what i want

DAMNIT REGEX. FUCK

TildalWave

05:40

@D3C4FF jsfiddle.net/97mpR/4

sorry it took so long but ... DAMNIT JAVASCRIPT. F*** :)

D3C4FF

Haha. I just figured out in Notepad++

(\d+\.\ (etc)).*

then mark all as bookmarks.

and delete the inverse

:D

TildalWave

@D3C4FF well yes of course, or that :)))

D3C4FF

xD

Terry Chia

@D3C4FF That's no fun.

TildalWave

but does notepad++ have a nomnom function that eats all the short lines? :P

Terry Chia

05:44

@TildalWave Javascript is a weird choice. I'd have done it in python (or perl if you are a sadist).

TildalWave

@TerryChia well sure but I wanted smthng that I can give as a working demo, not just copy/paste the code

Terry Chia

@TildalWave Fine, fine. :P

TildalWave

@TerryChia but do think of me next time you make a new EC2 subscription :P

D3C4FF

Hahaha

@TildalWave sadly no it does not

Terry Chia

@TildalWave EC2? I don't have a EC2 subscription.

D3C4FF

05:51

Fark. The 4G here is shocking D:

TildalWave

07:27

I'm answered one question on SO that has a bounty of 500 rep on it. I did post it here 1st, if someone else would be interested to answer and suggested how (what I thought the problem was and how to solve it). OP is satisfied, but the problem is that I've actually helped OP first in the comments, and posted a real answer later, and OP didn't come back yet. The bounty's grace period is now expiring in an hour, and no1 cares to up-vote my answer as the question isn't gaining much interests.

What's the suggested course of action? Is it OK to ask for peer-review here and if some1 feels it's worth an up-vote to do so?

Terry Chia

@TildalWave What's the answer? I'll upvote if it's good. :)

D3C4FF

Link?

TildalWave

10

Q: Intermittent receive failure using mvc webgrid on server only

I am using the System.Web.Helpers.WebGrid extensively throughout our application, and for the most part it is fine and in fact running locally it is always fine or with a self SSL on the server it is also fine. So I don't know if the problem could actually be with IIS or a firewall, or the actual...

c# asp.net-mvc iis webgrid

Answer is what I could muster given the circumstances, but OP is satisfied as he said in the comments.

Terry Chia

@TildalWave Got my +1. You just need 1 more and it will automatically be awarded to you.

But you will only get half of it sadly.

TildalWave

@TerryChia Thanks! I feel rather awkward for even mentioning it and asking for peer-review, but it would be a waste of a nice bounty IMO and I'm kinda capturing the flag for the team, as I probably wouldn't have thought of the solution if I wasn't hanging here so much.

D3C4FF

07:33

CTFFTW!

Terry Chia

@TildalWave If you feel awkward over here, you probably shouldn't be in this room. Just saying.

2

TildalWave

@TerryChia well you know what I meant, not awkward for being here, but it does feel almost like begging for attention, which would be lame on my part,... in this sense ;)

@D3C4FF cheers!

Terry Chia

@TildalWave Well, this room is home to a couple of repwhores, especially @Polynomial. So no shame!

;)

AviD

@TerryChia not being as bad as @Polynomial is not much consolation.

TildalWave

ROFL... frankly, I'd much rather gain more rep here than on SO, but with such fierce competition it'll take some time

Terry Chia

07:38

@AviD Morning.

You wanna throw this over to SU?

1

Q: How can i get a different IP address for wireless connection

I always get same IP address for my wireless adapter. so far i have tried ipconfig /dnsflush followed by ipconfig /renew net stop dnscache but it still keeps getting me the same ip address. does our router at workplace store mac address of machine & then assign same ip address again....

windows operating-systems dhcp

TildalWave

not in a hurry to gain it tho, i'd much rather take time to answer questions that I can and properly than do the aszad on them

D3C4FF

@TildalWave np

Terry Chia

@TildalWave Here's a tip. Answer the questions tagged password.

You will be surprised how much rep you can gain for common-sense answers.

AviD

@TerryChia no, its a crap question. We Don't Migrate Crap.

D3C4FF

poor aszad, he'll become a meme one day xD

Terry Chia

07:40

@D3C4FF We already have an Andrew. It's enough IMO.

TildalWave

@TerryChia yeah I know which questions are rep trains, but I'm actually more into web-app security than really good at expressing myself with others, and of course, some I still don't really get... but we have our Ursus for those LOL

D3C4FF

@TerryChia oooh? Whats an Andrew? (i'm new remember! Don't hate me!)

Terry Chia

5

A: The Memes of IT Security

Meme: Tinfoil Hattery Originator: Some say @Rook invented tinfoil hattery, but that's just a coverup. It was really invented by the Illuminati, in an attempt to make us all look crazy. Cultural Height: TBD Background: Tinfoil hattery is a term used to describe any behaviour that is paranoid be...

Andrew Smith

1 1 11

web-application passwords authentication network hash firewalls email

Note the suspension YEAR.

AviD

@TildalWave so go for the Unanswered questions. It's always a good thing to shorten that pile..

D3C4FF

What about AES? For low wadges, they could be researching and analysing like NSA. Or factoring keys using scientific calculators with wifi. When human decision making makes difference, why not. – Andrew Smith Aug 9 '12 at 21:04

TildalWave

07:43

LOL Rook @ Tinfoil :)

D3C4FF

That's beautiful. It brought a tear to my eye

Terry Chia

@D3C4FF You should go through some of his answers sometime.

TildalWave

@AviD I thought I was? Problem is, no1 really notices those, not even you :P

AviD

@D3C4FF Do yourself a favor - stop reading his work now. Before your head implodes and takes the whole neighborhood into the black hole.

TildalWave

@AviD well not a problem... just a joke

Rory Alsop

07:44

Morning all

Terry Chia

-9

A: Is multiple encryption a good idea?

In the following scenario, the encryption makes sense, because the information is protected when going over the internet the way, that even the internet endpoints are compromised, the data stays secure. This is also reason why to build high security encrypted networks on the back-bone level, and ...

Rory Alsop

just cleaned up a bit and commented:

Terry Chia

This is one of my favourites.

Rory Alsop

@asadz - It's not void of service detection at all, don't know where you're getting that from. The description clearly states Unicornscan has Asynchronous stateless TCP banner grabbing abilities, protocol specific UDP Scanning, and Active and Passive remote OS, application, and component identification by analyzing responses. What more would you want in the service detection sense? — TildalWave 5 hours ago

AviD

@RoryAlsop @Rory!

TildalWave

07:45

@RoryAlsop morning rory... how was your 1st day at the new job?

Rory Alsop

@AviD double pinging, eh

@TildalWave nah - I start next week

:-)

AviD

heh, who doesnt appreciate a good doublepinging in the morning

Rory Alsop

about to fight the blizzards to get the kids to school :-)

@AviD nearly made me snort my cornflakes

Terry Chia

@AviD hahaha!

Rory Alsop

right - snow time. Back in a bit

AviD

07:45

@RoryAlsop ha, bet you miss the mideastern sun now, eh? ;-)

Rory McCune

@D3C4FF @TerryChia Morning guys, just as potential help what I do for discovery is start with -sP -PS<rangeofports> so essentially a modified ping scan with common ports (21,22,23,25,80,135,139,443,445 something like that) then use that as the input to a "proper" scan

TildalWave

@RoryAlsop don't get it, is something wrong with my reply there?

Rory McCune

@RoryAlsop yeah I hope it gets a bit better for tomorrow, I've got an on-site in Dalkeith..

AviD

@TildalWave I think he was just showing appreciation.

D3C4FF

@TerryChia That's the most bizzare thing i've ever seen here. And also the lowest scoring xD

TildalWave

07:46

@AviD oh so that's how it looks like :)))

D3C4FF

@RoryMcCune Morning to you to. Thanks dude :) I rarely have to scan such large networks so quickly so its an unusual challenge for me.

AviD

@TildalWave no, we usually show appreciation with a doublepinging.

Terry Chia

@RoryMcCune I think -sP is an old flag? -sn is the newer version.

D3C4FF

@AviD nothing like a quick doubleping in the morning to wake you up eh?

Terry Chia

But yes, agreed on the -PS for common ports.

TildalWave

07:48

@AviD you should only ever do a single ping, aren't you a security analyst? :P :P

Rory McCune

@D3C4FF I've never had a /8 to do, but have had enough large ranges in tight deadlines that I researched the nmap options a bit. Another thing to look at is the timing flags if you're in a hurry. --max-rtt-timeout --max-retries --scan-delay are all useful and on an internal with a good network you can tighten up a lot from the defaults.

AviD

@TildalWave well I have protection

D3C4FF

-sN Is no port scan.

@TerryChia

Rory McCune

@TerryChia could well be, must admit I still use -sP as it works, but wouldn't be surprised to see it's changed.

Terry Chia

@D3C4FF -sN is the NULL flag. -sn is the ping one. They are two different flags. ;)

D3C4FF

07:50

@TerryChia ah sorry, i missed the lacks of caps

Terry Chia

@RoryMcCune Yeah, -sP is still supported, but -sn is the recommended one in the nmap docs I think.

No clue what's the difference.

asadz

@RoryAlsop thanks for the comments

Rory McCune

@TerryChia dunno for me the -sP makes more sense, but hey it's their program :)

TildalWave

@TerryChia IIRC one is ICMP ping?

Terry Chia

Now that I think about it, the nmap flags are a real mess. I agree with @ScottPack.

asadz

07:52

@RoryAlsop as to really understand how does this works I have an example for some self-reflection. I got (-1) plus a silver badge on question related to 'How to detect if files were saved or copied to a USB drive?'. This is how effective the irony really is.

Terry Chia

@TildalWave According to the docs, -sP is being phased out in favor of -sn.

asadz

-1

Q: How to detect if files were saved or copied to a USB drive?

I want to know if files from my computer were copied to a USB storage device. I want to know if there is a solution that would work in post activity scenario (e.g considering files have already been copied). I have already used a software which would pull the information from registry (HKEY_LOCA...

windows forensics usb-drive

Terry Chia

Not sure if there is an actual difference though.

TildalWave

@TerryChia I've seen some discussion about it recently, let me google for it

asadz

@RoryAlsop i love to read a FAQ about this grey-areas

Terry Chia

07:53

@asadz A widely viewed question might not be a good question deserving of upvotes. There is a distinction.

D3C4FF

@RoryMcCune I'll check em out thanks! :)

@TerryChia Seconded @asadz

TildalWave

@TerryChia hmmm no I was wrong -PI is an ICMP echo, but I'm not sure for inclusion of syn packets with -sn or -sP

asadz

good versus 2500+ people who may have benefited from its analysis? called it quantitative or qualitative analysis its just misses the entire scope and purpose.

I guess silver badge is white silver talking in pixel just a integer value lol

Terry Chia

Also, please understand that votes are an individual opinions. If you are getting a lot of downvotes, it is clear that the community as a whole disagrees with the value of your question/answer. One vote however doesn't really indicate much.

Please do not take votes so personally.....

asadz

lol

i guess its not me lol its the rest of the world having the same issues with SE

but i guess it just need some googling to see what the other side says

i'm not the only ONE

D3C4FF

07:56

Does anyone else feel like they're in the matrix when they VPN into work, then RDP to another machine, boot up a vpn, connect to a different VPN network and then RDP into yet another machine to do work on a remote web-console?

4

asadz

others have been victim too.

D3C4FF

Cause i sure do.

Terry Chia

@D3C4FF That gave me a headache.

What sort of latency are you experiencing?

D3C4FF

@TerryChia Welcome to remote management! :D

asadz

anyhow, i was here for @RoryAlsop

bye guys

:)

Terry Chia

07:58

@TildalWave Yeah, nmap is incredibly complex... IIRC the sn flag does some other stuff besides a simple ICMP ping.

D3C4FF

@TerryChia Y'know. Its not that bad actually. I'm on a lot of fat pipes

@RoryAlsop You can come out now! asadz is gone! :D

Terry Chia

@TildalWave Yeah, it does. nmap.org/book/man-host-discovery.html

> The default host discovery done with -sn consists of an ICMP echo request, TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp request by default. When executed by an unprivileged user, only SYN packets are sent (using a connect call) to ports 80 and 443 on the target.

Mar 8 at 13:54, by AviD

@Adnan First rule of Stack Exchange: BE NICE.

Rory McCune

@TerryChia IIRC the full paper book has more detail as well. 468 pages of nmap goodness amazon.co.uk/Nmap-Network-Scanning-Official-Discovery/dp/…

well worth reading if you do a lot of portscanning...

Terry Chia

@RoryMcCune Yeah, I have that book on my shelf. It's a good read on the workings of nmap.

Lazy to open it up just to search for a small tidbit of information though. Google is so much simpler. :P

D3C4FF

@TerryChia Okay okay! I'll be nice! Sorry asadz!

TildalWave

08:07

@TerryChia Thanks, that's the link I was reading not a few days ago. But I still don't get it how's that different to -sP flag? I'm sorry if I sound anal, but wouldn't -sP do the same one *nix (but not on Windows, obviously)?

Terry Chia

@TildalWave I think the -sn flag is just replaces the -sP flag. Probably no real difference.

The windows thing is just because Windows doesn't support manipulating raw packets I think.

TildalWave

@TerryChia So, me not getting it where's the difference + there is no difference = me getting it? YAY! My Schwartz is strong today!

Terry Chia

@TildalWave My guess is that Fyodor just woke up one morning and decided he likes the sound of -sn better than -sP.

TildalWave

well 'small s, capital P' does sound a bit "dickish" :)

AviD

yaknow, all this nmap discussion, is really disgusting me. It's ruining my morning.

Screw you guys, I'm goin' home.

Terry Chia

08:17

@AviD So's your face.

TildalWave

@AviD what from your office? that's a looooong walk

AviD

@TildalWave hehe, actually I meant to my office. From this hellbound nmap talk.

TildalWave

like the Space balls teleportation scene, or you could do that The Men Who Stare at Goats i'm going to the next room' scene :)))

D3C4FF

Aww @AviD why no love for nmap?

Antony Vennard

Any way this could be genuine?

0

Q: Linux based virus / malware source code in C

I am working on project of metamorphic code generator. In order to test this project I need some virus source codes in C. Since I have developed this tool on Linux. I need virus codes which are Linux based. Are there any good links from where I can download such virus codes?

malware virus

@D3C4FF Wow!!

Polynomial

08:20

no. it's bullshit.

TildalWave

Isn't metamorphic code a way for viruses to avoid detection by AVs? Why would he want more payloads on that, he's building Skynet?

Polynomial

he's talking shit basically.

D3C4FF

@AntonyVennard I think its weird that someone who's trying to make 'metamorphic' code can't find/write his own basic linux malware?

But i could be wrong, maybe he wants something more complex

TildalWave

@D3C4FF you mean like a brain?

Polynomial

@D3C4FF precisely.

plus he keeps saying "virus codes" which is kinda... skiddish

I don't think he's ever written a line of C in his life, personally.

Terry Chia

08:29

@Polynomial G1b c0d3 pl0x.

Polynomial

^

Antony Vennard

@D3C4FF Yep. And you don't need virus codes to write metamorphic code. Any simple program would do.

Ladadadada

4

Q: Grepping for CIDR ranges

From time to time I want to grep CIDR ranges out of my Apache log files. This is easy for ranges that fall on the natural boundaries (/8, /16 and /24) but not so easy for other ranges such as /17 and /25. Examples: # 192.168.0.0/16: (easy) grep " 192\.168\." access_log # 192.168.128.0/17: (mo...

ip regex grep cidr

@D3C4FF Thought that might be useful. :-)

Polynomial

@Ladadadada damn, there's a tool for everything these days

Ladadadada

Oh, and grep -v <REGEX> inverts the selection so it prints out everything that doesn't match the regex.

Polynomial

08:34

yeah, that's a fun one

I use that one to get a list of apache logs that aren't 200 OK or 30x redirects

D3C4FF

@Ladadadada Haha thanks :) I actually ended up using an unholy combination of regex in notepad++ and excel spreadsheets to parse the data.

@Ladadadada That's bloody useful though! Cheers

TildalWave

@D3C4FF oh you ended up doing much more than that and you know it! I felt like an effin AIBO :P

D3C4FF

@TildalWave Yeah, that's true. I spent a good 40 minutes fucking around with that

TildalWave

@D3C4FF what's your progress now? ETA?

Ladadadada

Also securityartwork.es/2013/02/07/…

D3C4FF

08:51

@TildalWave I've actually left the client site and the box is just humming away scanning. It's been going since our intial discussion and hadn't finished yet so... shrugs

I'll letcha know exactly how long it took tomorrow :P

TildalWave

@D3C4FF if you're really doing this on /8 range, that's then 16777216 IPs... just saying that if I was in your shoes, I'd rather have a rough estimate on ETA than be surprised it's still crunching it in a weeks time LOL

Terry Chia

@TildalWave It's lucky he isn't using the -A flag now.

That will probably take a month to complete.

D3C4FF

@TildalWave well, it did /16's in a reasonable amount of time :P So i figure it should be fine.

If not, i've still got other machines scanning away regardless.

@TerryChia xD

(scanning on smaller subnets i should add)

TildalWave

@TerryChia that's resolving DNS, right? by my stats here, you can add roughly 0.2s per each IP then, depends on the timeout on failed ones, which is 4s with my code... so... 38 days, 20 hours,... not nice :)

Terry Chia

@TildalWave No. -A is basically combining the -sV flag with the NSE.

Needless to say, that takes hella long.

TildalWave

09:03

"This option enables additional advanced and aggressive options. I haven't decided exactly which it stands for yet. Presently this enables OS detection (-O), version scanning (-sV), script scanning (-sC) and traceroute (--traceroute). More features may be added in the future. The point is to enable a comprehensive set of scan options without people having to remember a large set of flags..."

It's quite tricky to navigate through nmap documentation, no wonder I'm still lost with it :(

I like the 'I haven't decided exactly which it stands for yet.' part. Makes it so much clearer :))))

D3C4FF

@TildalWave @TerryChia FYI, out of a /16 subnet, approx 600 live hosts.

But that's a 'busy' subnet

Terry Chia

@D3C4FF Oh, don't dump them into a -A scan straightaway. 600 live hosts is still gonna take quite a while. I'd run a -sS scan to narrow them down further first.

I really doubt your pen testing scope involves breaking into what should mostly be workstations anyway.

D3C4FF

09:20

Actually, mostly not workstations....

I've excluded those subnets from the scans

Terry Chia

600 live servers? Woah...

D3C4FF

Yeah.

Its a uni shrugs

Terry Chia

What did you say you were pen testing again?

D3C4FF

oh.

Terry Chia

Ahhh.

D3C4FF

09:21

And they share resources with 'other things'

and companies

Terry Chia

Sounds like you have a real fun job ahead of you.

D3C4FF

I don't know how that works exactly.

Yeah. I'm already in... Just gotta get me some admin privs...

Plan is A) Find computer room, B) flash BIOS, C) bootdisk to recover SAM files D) crack on GPU cluster in other office E) go to different computer using same local admin, recover BIOS password (if possible), F) recover any cached creds G) Assume local admin for desktops is the same as for servers I) ??? J) PROFIT! :D

Rory Alsop

Yay - that was fun. The entire neighbourhood is one big skid pan! Just over 5 inches of snow overnight. If only those other pesky drivers would get off it it would be mine all MINE

Terry Chia

@RoryAlsop You don't sound old. I'm shocked.

Rory Alsop

@asadz - no grey area at all. Comments are for clarification. Once clarified, questions or answers can be tweaked and the outdated comments removed. They are not for extended discussion, name calling, arguments...yadda yadda

@TerryChia ah hahahaha

D3C4FF

09:25

Does anyone know how to pinpoint what version of IBM AIX a server is running via a reverse proxy? :)

Rory Alsop

Also @asadz - you can get whatever badges, upvotes and downvotes on any post. No irony needed - it's all just votes and views, at the end of the day

Terry Chia

@D3C4FF RTFM. :P

Rory Alsop

@D3C4FF fingerprinting ? or have you got command line?

D3C4FF

@TerryChia @RoryAlsop Fingerprinting. No command line. Just a webservice.

command line is just lslpp -L bos.net.tcp.client

Terry Chia

@D3C4FF Can't nmap grab that info for you?

Might not be really accurate though.

D3C4FF

09:27

Apparently not :(

@TerryChia this'll sound retarded but is there any super accurate (probably slow) scan that NMAP can do to be as accurate as possible?

Like if you had a single high value target and wanted to make sure that its scanning correctly etc

Rory Alsop

@D3C4FF hmmm - not sure. Was going to say nmap would probably be your best bet but then saw ^

Terry Chia

@D3C4FF The -sV and -O scans are fairly accurate if enough ports are opened.

If you really want to be 100% accurate, no choice but to enable --packet-trace and sort through the information yourself.

Alright, brb food.

D3C4FF

Packet-trace awayyyy!!!!! woosh!

@TerryChia do you know if -A actually includes -O -sV by default (like does it enable and use them or just 'enable the ability to use them'?)

cause i've always errd on the side of caution and gone -O -A -sV

Terry Chia

@D3C4FF It's on by default if you use -A.

D3C4FF

awesome

so i'm gonna try "nmap -sT -p 443 -T3 -A -Pn --packet-trace 1.2.3.4"

Seem legit?

Rory Alsop

09:38

@asadz - also, regarding plagiarism. Xander and Gilles edited that acknowledgement in - it wasn't you! And remember, on Stack Exchange, people will upvote you when they think your answer is good and downvote when they think it is bad. Simple as that. That is how this site is supposed to work.

D3C4FF

@TerryChia seemed to work, scan took a mere 53 seconds. But still not enough detail. No version info :(

Terry Chia

No, you have to use --packet-trace with the usual flags like -sV or -A. Then trace through the packets sent and received together with their headers to determine if the results nmap displays is accurate.

It's an incredibly time-consuming process though.

AviD

09:56

wholly carp, don't you people ever work?

Terry Chia

@AviD Holidays bitch. Deal with it.

AviD

.... today?

Terry Chia

Until the end of April actually.

Transcript for