4 ms·

You can verify if your credentials have been compromised at https://heroic.com https://heroic.com

by heroiccyber 10y ago

FT_intern 10y ago
Is your service any better than haveibeenpwned.com ?
- heroiccyber 10y ago
  HIBP is a great service and was the first one on the scene. HEROIC has more breached records than HIBP and with a free account on HEROIC you can see more details about how you have been compromised along with better search capabilities.
  - honkhonkpants 10y ago
    But apparently not a strict superset of HIBP, since your site shows nothing for an address that I know was exposed in multiple hacks/leaks.
    - heroiccyber 10y ago
      We should have everything that HIBP has plus another .5 billion.
  - elfchief 10y ago
    HIBP is still useful to me, at least, because it will let me find breaches for my entire domain, rather than just for specific email addresses. This is useful since I use a different email address per-site (username-somestring@domain), so just being able to search on my base email address on HEROIC isn't likely to turn much up...
guessmyname 10y ago
Here is a script for the command line enthusiasts. #!/bin/bash EADDRESS=$([[ "$1" == "" ]] && echo "noreply@example.com" || echo "$1") EADDRESS=$(echo "$EADDRESS" | sed 's;@;%40;') RESPONSE=$( curl "https://heroic.com/wp-admin/admin-ajax.php" \ -H "accept-language: en-US,en;q=0.8" \ -H "accept-encoding: gzip, deflate, br" \ -H "user-agent: Mozilla/5.0 (KHTML, like Gecko) Safari/537.36" \ -H "content-type: application/x-www-form-urlencoded; charset=UTF-8" \ -H "referer: https://heroic.com/email-security/" \ -H "x-requested-with: XMLHttpRequest" \ -H "origin: https://heroic.com" \ -H "authority: heroic.com" \ --data "action=heroic_scan_email" \ --data "data[email]=${EADDRESS}" \ --compressed --silent ) if command -v php &> /dev/null; then php -r "print(json_encode(unserialize(urldecode('${RESPONSE}'))));" fi PS: Using serialized data is a bad idea: https://www.owasp.org/index.php/PHP_Object_Injection https://www.owasp.org/index.php/PHP_Object_Injection
- contingencies 10y ago
  I don't use OO when I write PHP but it seems the real vulnerability there is the use of eval(). There is almost never a legitimate use for that function. I would definitely draw in to question the wisdom of OWASP deciding to classify this as a separate vulnerability. You should use the disable_functions directive in php.ini to hard-disable eval() (and other iffy functions) on production servers. One tutorial @ http://www.cyberciti.biz/faq/linux-unix-apache-lighttpd-phpini-disable-functions/ http://www.cyberciti.biz/faq/linux-unix-apache-lighttpd-phpi...
  - mschuster91 10y ago
    This tutorial disables curl_exec. Good luck getting any popular API client to work, they all use cURL... or if you're lucky, a modern-enough version of Guzzle that can use socket connections, but LOL that's opening another can of worms... HTTP parsing is notoriously difficult and I'd rather trust cURL (which is battle-tested in a load of environments) than a PHP userspace library.
- pault 10y ago
  As long as I have you here... ;) I primarily write JS for a living but because I freelance I often have to work with wordpress. After spending a few weeks digging into the internals I soon realized that every single wordpress project I've inherited–paid themes included–were horrendous and failed to utilize the most basic facilities provided by core. In most of these projects a quick turnaround was more important than clean code (probably the cause of the aforementioned horrendous codebases), so I always just hacked away at the templates without every trying to gain a deep understanding of PHP, its recommended best practices, and security gotchas. My question is, can you point me towards something like "PHP, the good parts"? I would like to know how to write well architected, performant, and secure PHP on the occasions I need to use it professionally. I know that PHP has a reputation as being dangerous by default, so knowing what not to do would be reassuring. So far all of the PHP books I've found have been fairly disappointing; covering all of the features without really detailing any best practices or opinions.
  - 10y ago
MOARDONGZPLZ 10y ago
Do you save email addresses entered into the site?
newscracker 10y ago
For me it shows almost the same information as haveibeenpwned.com. How would someone find out about the breach that this post/article is referring to? Are you loading this one soon?
supergirl 10y ago
do you even have this leak from yahoo loaded? where did you get it from?
nsxwolf 10y ago
The couple in your stock photo looks really enthusiastic about searching for their compromised accounts.
lucaspottersky 10y ago
i always think this kind of sites are there just to get email address that are supposedly "important" or "active"...

You can verify if your credentials have been compromised at https://heroic.com https://heroic.com

FT_intern 10y ago

Is your service any better than haveibeenpwned.com ?

heroiccyber 10y ago
HIBP is a great service and was the first one on the scene. HEROIC has more breached records than HIBP and with a free account on HEROIC you can see more details about how you have been compromised along with better search capabilities.
- honkhonkpants 10y ago
  But apparently not a strict superset of HIBP, since your site shows nothing for an address that I know was exposed in multiple hacks/leaks.
  - heroiccyber 10y ago
    We should have everything that HIBP has plus another .5 billion.
- elfchief 10y ago
  HIBP is still useful to me, at least, because it will let me find breaches for my entire domain, rather than just for specific email addresses. This is useful since I use a different email address per-site (username-somestring@domain), so just being able to search on my base email address on HEROIC isn't likely to turn much up...

guessmyname 10y ago

Here is a script for the command line enthusiasts. #!/bin/bash EADDRESS=$([[ "$1" == "" ]] && echo "noreply@example.com" || echo "$1") EADDRESS=$(echo "$EADDRESS" | sed 's;@;%40;') RESPONSE=$( curl "https://heroic.com/wp-admin/admin-ajax.php" \ -H "accept-language: en-US,en;q=0.8" \ -H "accept-encoding: gzip, deflate, br" \ -H "user-agent: Mozilla/5.0 (KHTML, like Gecko) Safari/537.36" \ -H "content-type: application/x-www-form-urlencoded; charset=UTF-8" \ -H "referer: https://heroic.com/email-security/" \ -H "x-requested-with: XMLHttpRequest" \ -H "origin: https://heroic.com" \ -H "authority: heroic.com" \ --data "action=heroic_scan_email" \ --data "data[email]=${EADDRESS}" \ --compressed --silent ) if command -v php &> /dev/null; then php -r "print(json_encode(unserialize(urldecode('${RESPONSE}'))));" fi PS: Using serialized data is a bad idea: https://www.owasp.org/index.php/PHP_Object_Injection https://www.owasp.org/index.php/PHP_Object_Injection

contingencies 10y ago
I don't use OO when I write PHP but it seems the real vulnerability there is the use of eval(). There is almost never a legitimate use for that function. I would definitely draw in to question the wisdom of OWASP deciding to classify this as a separate vulnerability. You should use the disable_functions directive in php.ini to hard-disable eval() (and other iffy functions) on production servers. One tutorial @ http://www.cyberciti.biz/faq/linux-unix-apache-lighttpd-phpini-disable-functions/ http://www.cyberciti.biz/faq/linux-unix-apache-lighttpd-phpi...
- mschuster91 10y ago
  This tutorial disables curl_exec. Good luck getting any popular API client to work, they all use cURL... or if you're lucky, a modern-enough version of Guzzle that can use socket connections, but LOL that's opening another can of worms... HTTP parsing is notoriously difficult and I'd rather trust cURL (which is battle-tested in a load of environments) than a PHP userspace library.
pault 10y ago
As long as I have you here... ;) I primarily write JS for a living but because I freelance I often have to work with wordpress. After spending a few weeks digging into the internals I soon realized that every single wordpress project I've inherited–paid themes included–were horrendous and failed to utilize the most basic facilities provided by core. In most of these projects a quick turnaround was more important than clean code (probably the cause of the aforementioned horrendous codebases), so I always just hacked away at the templates without every trying to gain a deep understanding of PHP, its recommended best practices, and security gotchas. My question is, can you point me towards something like "PHP, the good parts"? I would like to know how to write well architected, performant, and secure PHP on the occasions I need to use it professionally. I know that PHP has a reputation as being dangerous by default, so knowing what not to do would be reassuring. So far all of the PHP books I've found have been fairly disappointing; covering all of the features without really detailing any best practices or opinions.
- 10y ago

MOARDONGZPLZ 10y ago

Do you save email addresses entered into the site?

newscracker 10y ago

For me it shows almost the same information as haveibeenpwned.com. How would someone find out about the breach that this post/article is referring to? Are you loading this one soon?

supergirl 10y ago

do you even have this leak from yahoo loaded? where did you get it from?

nsxwolf 10y ago

The couple in your stock photo looks really enthusiastic about searching for their compromised accounts.

lucaspottersky 10y ago

i always think this kind of sites are there just to get email address that are supposedly "important" or "active"...