The Bowery Presents
No title available
EXPECTATIONS
One Nice Bug Per Day
𓃗
#extradirty
tumblr dot com
h
No title available
blake kathryn
Noah Kahan
occasionally subtle
izzy's playlists!
Monterey Bay Aquarium
Not today Justin
PR's Tumblrdome
No title available
Cosmic Funnies
Show & Tell
Fieri Frames
seen from United States
seen from Paraguay
seen from Brazil
seen from Malaysia
seen from United States
seen from Ukraine
seen from United States
seen from Iraq
seen from United States
seen from Ecuador
seen from Iraq
seen from Ecuador
seen from United States
seen from Norway
seen from Argentina
seen from Ukraine
seen from France
seen from Türkiye
seen from Ecuador
seen from United States
@aggregated1nterests-blog
Repairing blown capacitor on Netgear WGR614. Puffy little guy makes a horrific whining noise when powered on. Any suggestions on what I should use it for? Repeater? DD-WRT based mini server? Mini, portable Minecraft server? Hyperedit: Yeah, memory, I know.
Reading about the javascript crypto used by MEGA
By @liamosaur
Step in the right direction - educationally - but... see above.
Graduated!
13 years of preliminary education followed by another 6 years of tertiary education has culminated in what might be my final full-time student endeavor. 19 of my 25 years on this spinning globe is enough for now - It's time to get my hands dirty. The final 6 years were easily the most difficult and most rewarding. My diploma was studied in parallel with my CCNA certification which was then followed by a 1 year hiatus teaching TCP/IP fundamentals and Active Directory basics at RMIT business (Protip: Striaght HD's gets you a job - kids!). Yearning for a better understanding of security and other complex ICT issues I chose the prestigious Swinburne University to major in Network Design and Security - their new 2013 ready course designed to train tomorrows infrastructure specialists. Throughout my time there I met a lot of good people (and a few not-so-good, requiring all of my risk mitigation strategies!) and was able to study and put into practice some fantastic ideas. Everything from Enterprise Unix Administration, standalone DNS VM construction and run of the mill Active Directory biz. My favourite project was an essay/PoC/project (which I'll publish at a later date) that used an old SSL exploit (marlinspike!) as well as handcrafted TCP packets over ettercap for a MITM platform attack that scraped credentials from the local network's clients. To top it off I wrote a script to determine the nearby wifi's auth type and then crack it, join, scan for hosts and start MITM'ing all clients. (WEP took 5 mins - WPA2 took substantially longer and had to send data to my backend CUDA processor over 3g). My own little autopwn. I'm sad that I will soon no longer have the time to dedicate to grey-hat shennanigans and the pursuit of knowledge. This month I hang up my white, black and grey fedoras and head out into the world of business,, scouring job sites and friends alike for positions that sound like I will suit their challenges - and in turn it will suit me. Goodbye Academia and hello corporate Australia. Pros: ------ * No more mi goreng 5 days a week * Can afford to stop splicing PSU wires to power extra fans for my failing RAID array * Upgrade my television from 'broken LCD digitizer' to 'working LED panel' * No longer a pennyless quasi-student overclocking every piece of hardware he owns just to keep up Cons: ------- * Early starts (thought that depends) * Less time with friends and loved ones * Business attire in an Australian summer (did this for a year - not pretty) * Commuting... forever... everywhere Anyway, have a good weekend tumbl dudes
It's official! I can manage risk, mitigate network attacks and even launch offensives - not that that's industry standard...
iOS 6.1 Lockscreen Bypass Thoughts
Quickie: For Apple to have let this slip through and not patch it immediately is totally absurd given they have ONE freaking OS to take care of with basically ONE hardware platform. I believe the latest revision partially fixes the granted access to the OS once inside. Secondly, to every massive-nub out there trying this - you are essentially DDOSing a serious government service and wasting resources that could be used to save lives. I know that the 'sploit is only supposed to 'attempt' a call but I'm sure there's going to be trillions of two second calls to emergency until this thing gets patched or boring. A two second emergency call can sometimes merit a visit by a SWAT TEAM, internet posts have said. Even if this isn't true you're placing a burden on vital infrastructure that could be much better utilised than sexting your mate's mum while he's hanging a slash. Rather than practicing your finger-agility, spamming a useful government service and then trashing their facebook - why don't you try MITMing their wireless workstation and attempting upside-down-ternet, or make them regret using telnet ever again. Rant aside, I'm interested to see if this will work in other regions as all of the PoC devices I've read about are AT&T US devices. Maybe worth chucking the device in aeroplane mode beforehand and then trying 000. Haven't used an iOS device for three years but it seems like a sensible way to sandbox it. Anyway, MONA.LISA.OVERDRIVE.Y'ALL.
Bypassing Inline Javascript - For Fun and For Job Applications
As a recent tertiary graduate and - now - fervent job hunter, I am becoming very familiar with Australian IT recruiting firms' websites, their submission forms and how to dive into their murkily-coded depths in order to submit as much, little or varied forms of input in order to make my point and stand out from my peers. Most recently I was asked to provide my cover letter in plaintext, and in no more than 300 characters. I understand why they would impose restrictions like this but I simply had a little more to say and a few ideas about how I could get them to read it. First - and foremost - jump into your browser's developer mode (firebug in FF, built in - in chrome, no idea about IE because nobody uses IE...) and examine your opponent's employer's code. In my case the submission sanitisation was written with inline javascript which is totally fantastic for security (oh, oh lol no). I determined that the submission button called a javascript function, which then jumped off into a myriad of hosted .js sanitisation scripts which look like they'd been bought for bargain basement prices. The beauty of this - er - firm's submission scripts was that after the sanitisation all returned true it simply called the 'submit()' function and threw everything at their mail server, as long as the function didn't exit before that final call. Now, in modern browsers you can not only modify js, php, etc. values on the fly - as it's executing - but you can throw breaks into the page and provide your own snippets of code to be executed before the break skips on. In they who shalt not be named's submission form I simply punched in all of the details I wanted sent, threw a break before the sanitisation scripts and then clicked 'submit'. Once the script broke I simply called the 'submit()' function and - TADA! - my details were ferried off to the HR goons' inbox, with all 800 cover letter words included. It was a coin toss, really. Break their code for a security position and they'll be intrigued or they'll hate you immediately. (DNS enum'd another potential employer recently and brought up web-facing - but should definitely be internal - servers and that they were several revisions behind in certain software [read:PoC targets] and I was stonewalled and shown the door). Two days later I received a rejection email from Awful WebDevs Incorporated without a hint of curiosity as to how I'd provided three times as much information as other candidates. Or more importantly how I broke their submission engine and what that means for their systems security. If I were on their team I'd certainly be a *little* curious as to why our shit was wrecked. 500 extra characters sent is one thing - but what if it was an infected .pdf (a disallowed format I sent successfully, subsequently landing in some HR guys inbox), embedded code or something worse. I'll provide some pics at a later date but just thought I'd smash out this rant while it was fresh. Keep your current team, guys, they're doing great.
When I realize the customer's entire network is internet facing.
by @surbo
11.5TB Protected Storage
Latest iteration of the slackware(unRAID) multipurpose NAS I've designed. The swag lighting is usually off so my neighbourhood can sleep.
Second Test
To TEST how my div,div divisions are going.
This is a test caption for the above image
This is my initial test 'tumbl' so that I can play with the CSS in peace. Also dance computer.
