vinhboy

54 ms·

1. 511.▲
   by vinhboy 14y ago

   Ehh... I think I prefer it when apps and tools like this stay in the "black market"/"under the table" and you have to jump through a bunch of technical hoops to get it working. I like the idea of it being a reward for paying attention and b
2. 512.▲
   by vinhboy 14y ago

   Damn, that must be frustrating as hell when a third party fucks you like that. And why is it always the DNS providers. Shouldn't that entire industry know they are target #1 by now? On a tangential note, I hate security questions. I do not
3. 513.▲
   by vinhboy 14y ago

   That new Inspector thing is really annoying. I always accidentally open it instead of Firebug. From a developer stand point, Firebug stills beat all other browser dev-tools by a mile and is the main reason I still have Firefox on my dashboa
4. 514.▲
   by vinhboy 14y ago

   I also want an answer to this question... Especially since most android USB stick also have 1GB RAM, where as this only has 512MB.
5. 515.▲
   by vinhboy 14y ago

   "Tran’s only supplier for the past 20 years has been Underwood Family Farms, an hour north of L.A" -- This is a pretty cool little factoid. I would have never guessed. A successful, locally made product, that does not need to sell itself as
6. 516.▲
   by vinhboy 14y ago

   How do you guys create these cool little sites so quickly. I can imagine how you could create the script easily, but making the little icons, layouts, etc... must take a long time. Or am I just really slow?
7. 517.▲
   by vinhboy 14y ago

   "In short, a timing attack uses statistical analysis of how long it takes your application to do something in order to learn something about the data it’s operating on" -- great read.. my mind is blown for today...
8. 518.▲
   by vinhboy 14y ago

   I tried a couple of the links. All SQLi vuln. All using microsoft sql server too it looks like. I don't know why I had this image of .gov and .mil sites being super secure. I no longer think that...
9. 519.▲
   by vinhboy 14y ago

   From a glass half full perspective. You can argue that Amazon is keeping profits in check so they can continue to offer their customers the best prices and services. But that's if you live in a world where bears fart butterflies.
10. 520.▲
    by vinhboy 14y ago

    consider me a fan of your work!
11. 521.▲
    by vinhboy 14y ago

    It kind of says something when people can't tell the difference between your maintenance mode page and a hacked page...
12. 522.▲
    by vinhboy 14y ago

    thanks
13. 523.▲
    by vinhboy 14y ago

    I know you're not supposed to share these things, but I found it really useful how last time there were public PoC we could use to test our patches. Any such thing this time around?
14. 524.▲
    by vinhboy 14y ago

    They made this tweet 10 hours before it went down -- https://twitter.com/OpGJResisters/status/294901397147766784 I wonder how this played into the hack...
15. 525.▲
    by vinhboy 14y ago

    I was impressed when they hacked mit.edu, but geesh, how did they get a .gov -- that's pretty crazy.
16. 526.▲
    by vinhboy 14y ago

    ̡͊͠͝LGΌ ISͮ̂҉̯͈͕̹̘̱ TO͇̹̺ͅƝ̴ȳ̳ TH̘Ë͖́̉ ͠P̯͍̭O̚​N̐Y̡ H̸̡̪̯ͨ͊̽̅̾̎Ȩ̬̩̾͛ͪ̈́̀́͘ ̶̧̨̱̹̭̯ͧ̾ͬC̷̙̲̝͖ͭ̏ͥͮ͟Oͮ͏̮̪̝͍M̲̖͊̒ͪͩͬ̚̚͜Ȇ̴̟̟͙̞ͩ͌͝S̨̥̫͎̭ͯ̿̔̀ͅ) interesting...
17. 527.▲
    by vinhboy 14y ago

    Yea, it's odd to me how much crap you three guys are getting for this. It's not like you guys criticized the person. You criticized code. My goodness. I wish someone would come and criticize my code. It would be a great learning experience.
18. 528.▲
    by vinhboy 14y ago

    I think github should keep an active list of filters that they apply to all code submitted to their service. Such as when it is a key file, or is a known credential file -- "amazon_s3.yml" for example, they should send a warning to the comm
19. 529.▲
    by vinhboy 14y ago

    Is there an "order by" functionality? When looking for code. I like to find the code with the most stars. Ugh.. that reminds me of the good old days when HN had visible karma points...
20. 530.▲
    by vinhboy 14y ago

    what exactly is that little dirt stain that moves from cylinder to cylinder supposed to be? is it supposed to represent tension or something?
21. 531.▲
    by vinhboy 14y ago

    I would love to hear how this could have happened. Social engineering at the DNS provider? Unpatched server? If someone knows, please do tell. I love hearing about how people pull off these things. Maybe even an inside job? a lot of people
22. 532.▲
    by vinhboy 14y ago

    can you share the command to do this?
23. 533.▲
    by vinhboy 14y ago

    I really appreciate these types of articles. I learn a lot from them. I actually also discovered the google thing on Gogo the last time I was on their network. But I never made the connection that the author did. I found that insight to be
24. 534.▲
    by vinhboy 14y ago

    Are you going to release your PoC. Curious to see it.
25. 535.▲
    by vinhboy 14y ago

    You should double check or restart your server or something. I tried it on 2.3.15 and I am getting Disallowed type attribute: "yaml"
26. 536.▲
    by vinhboy 14y ago

    Bad. It means you succesfully made an ActionController object . Good would look something like this: Parameters: {"action"=>"index", "id"=>"--- !ruby/object:ActionController::Base
27. 537.▲
    by vinhboy 14y ago

    run this for rails 2.x curl -i -H "Content-Type: application/xml" -X POST -d '<id type="yaml">--- !ruby/object:ActionController::Base bar: 1</id>' http://localhost:3000 If in your logs the params[:id] is an object, th
28. 538.▲
    by vinhboy 14y ago

    Thanks for the reminder. I totally forgot I have a redmine server running....
29. 539.▲
    by vinhboy 14y ago

    Holy cow. I just figured out how to send the payload. This thing is seriously bad news. I still haven't figured out an attack vector yet, but least I now know that my patches are working!
30. 540.▲
    by vinhboy 14y ago

    Wait, what? What if the app does not parse ANY user provided XML or YAML at all?