digininja
-
Posts
4,005 -
Joined
-
Last visited
-
Days Won
210
Posts posted by digininja
-
-
Do you have consent?
-
What do you mean by access? Do you have consent to access them?
-
You've got it the wrong way round, he was asking about disabling it in the browser not on a site.
-
It depends on what you allow to run, if you are very careful and selective then maybe. Some sites are insisting that you allow JS to allow their adverts to load before giving you access to the content. If you do, then any malicious advert served through that network gets you owned.
There have also been a few recent examples of sites which have been compromised and things like JS based crypto miners added to their own, local JS libraries so if you allowed that, otherwise legit site, to run JS then you'd be owned.
So I'd say it isn't pointless, just really hard to make work without making it pointless by allowing too much to make it useless.
-
Like you say, good luck using the internet without JS. I tried it for a while years ago and it was a pain then, having to whitelist all the sites that I wanted to use and then tweak the policies to get things working.
I think that it is a nice idea but one that is doomed to failure.
-
It is an amazing area, you just have to keep a very open mind and never rule things out.
-
Even if it was HTTPS not HTTP, it wouldn't matter as I have full control of the content you are viewing, the only difference is whether you are viewing it over an encrypted channel or not. The lesson, not meaning this in a bad way, is never to think that you are perfect and don't make mistakes or do things you really know that you shouldn't.
For anyone who doesn't believe me, read up on how Anonymous was taken down. One small slip by Sabu brought the whole thing down and regardless of what you think of them morally or ethically, they are/were a bunch of very intelligent people.
Back to your original question, as I said, there are loads of different ways they could have got you and, without a lot more info that could only really have been collected at the time, you'll probably never know. You could try keeping an eye on this history list, maybe daily, and if you notice any additions then check your browser history for that day. You can't rule anything out as even top corporate sites can include malicious adverts, but you might be able to spot a pattern and narrow things down.
-
If I'd redirected you to a page that had a bunch of youtube videos embedded in it then that would have achieved the same as you were describing at the start. You don't need to be "attacked" or to be vulnerable in some way, you just have to use the internet.
-
There you just proved that you will click on a HTTP, not HTTPS link from a random stranger. Everyone does it, most people won't admit it though.
-
1
-
-
You can call yourself whatever you want so yes, could be. Or they could have other bits to their bot that also do crypto mining and this is just the bit that you've noticed.
If it is this, you could have got caught in loads of different ways, have a look at this <link removed> for some ideas.
-
1
-
-
I don't see how adding extra videos to your watch list would help in crypto mining. I can see it being used to increase the viewer rate of certain videos. The attack would be to silently open a tab or use an iframe and auto play the video muted so that as far as youtube is concerned you've watched the video in a legit way. There is probably a minimum time that would be needed to count as a watch before the window could be closed.
-
Please don't hijack other people's threads, create your own.
-
Got it all working, I've documented it in the original Github ticket but the short answer was that you need to rename a file so the mysqli extension gets started later in the init process.
https://github.com/ethicalhack3r/DVWA/issues/222#issuecomment-369179468
-
Turns out php runs as a service on Fedora so you have to restart it after making changes. After that I check the status of the service and get this error:
Feb 28 23:14:15 localhost.localdomain php-fpm[893]: [28-Feb-2018 23:14:15] NOTICE: PHP message: PHP Warning: PHP Startup: Unable to load dynamic library '/usr/lib64/php/modules/mysqli.so' - /usr/lib64/php/modules/mysqli.so: undefined symbol: mysqlnd_global_statswhich I think is caused because of a mix between the official MySQL release and the built in stuff that is expecting MariaDB.
The solution I've seen suggested for this is to use the Remi repo rather than the official Fedora one but that hasn't helped.
-
More curious, I've just removed everything from that directory and then restarted apache but the phpinfo() still shows the same list of additional files.
-
Something I've just noticed, in the phpinfo() I have these entries:
Loaded Configuration File /etc/php.ini Scan this dir for additional .ini files /etc/php.d Additional .ini files parsed /etc/php.d/20-bz2.ini, /etc/php.d/20-calendar.ini, /etc/php.d/20-ctype.ini, /etc/php.d/20-curl.ini, /etc/php.d/20-exif.ini, /etc/php.d/20-fileinfo.ini, /etc/php.d/20-ftp.ini, /etc/php.d/20-gettext.ini, /etc/php.d/20-iconv.ini, /etc/php.d/20-json.ini, /etc/php.d/20-phar.ini, /etc/php.d/20-sockets.ini, /etc/php.d/20-tokenizer.ini Yet my /etc/php.d directory has more files than that in it, including 30-mysqli.ini. I've tried copying that to 1-mysqli.ini just in case it was having problems with one of the 20's and so stopping loading the later ones but that hasn't helped.
-
I'm trying to help someone debug why they they can't get DVWA working on a Fedora 27 box so I built my own to test it out.
I've installed MySQL from the official MySQL repo (i.e. no using the default MariaDB) and got standard Apache and PHP installed. PHP is running as php-fpm.
[root@localhost php-fpm.d]# php-fpm -m |grep mysql mysqli mysqlnd pdo_mysql [root@localhost php-fpm.d]# php -m |grep mysql mysqli mysqlnd pdo_mysqlThe mysqli modules are installed but when I try to use mysqli_connect I get an error saying the function doesn't exist. Checking phpinfo() and that agrees, there is no mention of the mysql extensions.
[root@localhost php-fpm.d]# cat /etc/php.d/30-mysqli.ini ; Enable mysqli extension module extension=mysqli.so [root@localhost php-fpm.d]# locate mysqli.so /usr/lib64/php/modules/mysqli.so /usr/lib64/php-zts/modules/mysqli.soThe mysql extension files are on the box and are referenced in the php config so I'm assuming that should enable them, I've not used fpm before.
The php-fpm ini file test says it is OK
[root@localhost php-fpm.d]# php-fpm -t [28-Feb-2018 14:29:21.074218] NOTICE: pid 30341, fpm_conf_init_main(), line 1717: configuration file /etc/php-fpm.conf test is successfulBut I still get this error in the log file:
[28-Feb-2018 14:30:42 UTC] PHP Fatal error: Uncaught Error: Call to undefined function mysqli_connect() in /var/www/html/dvwa/includes/dvwaPage.inc.php:467Can any Fedora experts out there help? I'm assuming that I've not enabled the module correctly but not sure what I need to do to enable it.
And to preempt certain answers, this is a very specific config that I'm trying to debug, I don't need advice on getting this working using different distros or application stacks.
-
Yes, that sounds right.
I am wondering though whether you should actually combine the two so you actually have a string that is between 12 and 16 characters and do the maths on that but I don't think that would be right.
-
I wasn't great at maths stats at college but isn't it:
Number of possible characters in first position = 26+26+10 = 62
For a one character password there would be 62 different possbilities
For two chars: 62 * 62 = 62 ^ 2
Three chars: 62 ^ 3
...
Six chars: 62 ^ 6
Seven chars: 62 ^ 7
Eight chars: 62 ^ 8
For 6, 7 or 8 chars: (62 ^ 6) + (62 ^ 6) + (62 ^ 8) = 221918520426688 = 221,918,520,426,688
So yes, I'd agree that you got it right.
-
5 hours ago, AtomShards said:
Im just wanting to learn then get into the workforce with it
That isn't an answer to the question. Are you worried about getting malware on your machine, being watched by your ISP, being attacked back if you attack someone else, getting caught doing something illegal? An important skill in the security industry is being able to define threats and risks. Who or what is a threat to you, what is the risk from the threat? During the period when the guys from Anonymous were getting arrested, we got a lot of people asking how they could hide from the NSA as they saw them as a threat. The reality for the vast majority of them was that the NSA is absolutely no risk to them as all they were doing was the odd bit of piracy and surfing porn that they didn't want their parents to know about. Those two activities warrant completely different defenses to defending against the NSA.
If you want to learn and stay "safe", stay local. Build yourself a lab with vulnerable apps like DVWA, Metasploitable and other similar machines. You can also build your own machines, get old Linux distros and install known vulnerable apps. You'll learn a lot more doing all this than just randomly throwing tools against stuff online.
You don't need to do trawling dodgy sites, all the info you need is available through legitimate sources.
Use the same commonsense that you would use doing anything online and you'll be fine, browse shady websites and download random stuff from untrusted sources then you'll get screwed.
-
2
-
-
What are you concerned about? What are you trying to guard against?
-
What type of safety? Who are you planning to run your tools against?
-
So you aren't really asking about staying safe online you are asking about how to use tools without getting caught. Two very different things.
-
You asked about staying secure which is what Tails will help you with, what is it in Kali that you want?
New-ish idea
in Interceptor
Posted
I created the first Interceptor on a La Fonera + I think, really old hardware but worked fine. You can build any of the Hak5 products yourself on commodity hardware and that is how most of them start, the Pineapple started on a basic Fonera then developed. If you want to build your own to save some cash the go for it, there is nothing stopping you and it will probably be a brilliant learning experience.
There are two reasons to buy the products, the first is to save time and effort, if you want a tool that works straight out of the box and has active community support, then that is what your money is getting you. The second reason is to support the show, cash raised from the shop goes to keep the Hak5 shows on the air.