001spartan

18 ms·

31.
by 001spartan 11y ago
It uses a kind of challenge/response, where the device provides a salt that is used with a hardcoded password for that account. It seems to look like 'AK1' + base64(salt|SHA1(salt|password|Fortinet magic)) according to http:
32.
by 001spartan 11y ago
There is a hard coded SSH password, 'FGTAbc11*xy+Qqz27', in Fortigate devices < v5.0.7. You can use this script to access any device before that version. EDIT: 5.0.7, not 5.0.2
33.
by 001spartan 11y ago
The initial announcement of the partnership between WhatsApp and TextSecure ( https://whispersystems.org/blog/whatsapp/ ) states that it was only for the Android WhatsApp client, and I'm unable to find an upd
34.
by 001spartan 11y ago
Offensive security is not just breaking into computers. In the information security industry, it means demonstrating flaws in security in a way that will help your client/employer/whoever defend against these techniques better in
35.
by 001spartan 11y ago
Thanks for the link! I will definitely have to listen to this later. Black Hat Python and Grey Hat Python are great cookbooks and references for learning offensive Python skills, and I've used both books quite a bit to help others lear
36.
by 001spartan 11y ago
SQLmap has been part of many hackers' toolkits for quite some time now. It's very well known in the security industry as you suspected, and many of us penetration testers use it quite a bit for automating web app testing. I do ima
37.
by 001spartan 11y ago
Most users would have a smartphone or other device with 1Password or their password manager of choice on it, so you can copy the password manually from that device. I tend not to log in on any device that isn't mine, though.
38.
by 001spartan 11y ago
Fuzzing is useful for finding bugs that may or may not be serious security issues. If a program crashes when you feed it invalid input, it could potentially crash in a way that allows code execution. After finding a crash, a researcher will
39.
by 001spartan 11y ago
This was after they replaced the keyboards. The keyboard is still terrible.
40.
by 001spartan 11y ago
Unfortunately, I can't recommend a System76 laptop. I use the Galago UltraPro as a work laptop, and it is not an enjoyable experience at all. The construction is flimsy, and the keyboard is _terrible_. I have never used a worse keyboar
41.
by 001spartan 11y ago
This is actually something used by Stuxnet, believe it or not. http://www.theverge.com/2014/8/7/5977885/hackers-made-irans-...
42.
by 001spartan 11y ago
One of the major reasons my current organization uses Hipchat is that it supports XMPP. The importance to us is that it allows us to use OTR between users with clients like Pidgin or Adium. As a security company, that is a very valuable thi
43.
by 001spartan 11y ago
I don't accept this premise. Even if you ban swimming pools, that doesn't prevent children from drowning while swimming in the ocean, or lakes, or rivers, or even backyard swimming pools. All of those environments are just as much
44.
by 001spartan 11y ago
I'm an infosec guy, and I use a 13" retina MacBook Pro. Unfortunately my work laptop is different, but for outside of work (security is my hobby as well as my work), the MacBook does exactly what I need. Long battery life, great b
45.
by 001spartan 11y ago
According to the numbers in the post, it shouldn't be anywhere near as bad, just due to the smaller number of vulnerable servers. 269/530000 servers scanned isn't anything to panic about, unless the problem is larger than it
46.
by 001spartan 11y ago
I stand corrected!
47.
by 001spartan 11y ago
That's a good point. I was thinking about it from the perspective of Earth-launched debris, which would usually be traveling somewhat the same direction, as it's the cheapest orbit in terms of energy expenditure.
48.
by 001spartan 11y ago
On the other hand, in order to maintain the orbit, that space junk is going to be traveling at close to the same speed, if it's at the right altitude to hit you.
49.
by 001spartan 11y ago
That's a pretty silly thing to demand. There are very few things that most people find enjoyable which are "optimally good". Requiring something to be "optimally good" in order to do it would make a quite dull life
50.
by 001spartan 11y ago
I meant that more in the general sense, many of the probes that we have in space have been there for decades. You're right that it is very impressive to have gone so far in so little time!
51.
by 001spartan 11y ago
Heh. s/millions/billions/g
52.
by 001spartan 11y ago
This is so damn cool. It's humbling to realize the scale of the universe we exist in, and how small a part of it we really are. And we're flinging probes around the solar system, millions of miles away, to learn more about our uni
53.
by 001spartan 11y ago
Using a salt ensures that an attacker cannot use pre-generated rainbow tables to crack something. If there is no salt, it is very fast to use rainbow table lookups for cracking. The salt doesn't really need to be secret, as it is only
54.
by 001spartan 11y ago
I've heard of KakaoTalk before; it's one of the most popular messaging applications in South Korea. According to Wikipedia it's used by 93% of smartphone owners in South Korea [1]. Daum Kakao is the parent company, and looks
55.
by 001spartan 11y ago
The way password crackers work now, it is quite easy to crack passwords that are combinations of words, even with alphanumeric substitution. The best passwords are completely random, and 24+ characters.
56.
by 001spartan 11y ago
I switched to using Spacemacs from vim a couple months ago. I find it's a huge boost to my productivity; letting me use vim modes/hotkeys that I'm used to, and adding the handy features that emacs and plugins can provide.
57.
by 001spartan 12y ago
I hope I'm parsing this statement incorrectly, but it seems as though you're rolling your own solution to authentication and encryption, rather than using TLS. According to your organization's website, you're an IoT plat
58.
by 001spartan 12y ago
Again, anecdotal evidence on my part suggests that he's more widely known than Linus Torvalds. I have no solid data to back that up.
59.
by 001spartan 12y ago
More well-known to whom? Most non-technical people I know have never heard of Linus Torvalds, or Linux. Kevin Mitnick is a name that has been in the media in much more prominent positions. As far as the "hacking" vs "cracking
60.
by 001spartan 12y ago
With the number of attacks against SSLv3 and/or RC4, I think it's a good idea. Especially given that it's a government website. With a target that large, it's a safe bet that, at any given moment, someone is trying somet

More ›