Success Stories

What's your latest security related success story? I just managed to remember the passphrase to a couple of SSH keypairs I generated almost two years ago. I was near the point of replacing the box that they were used for entirely.

>>4101 I recently also figured out a password to an old Word 2002 document after years of hundreds of manual brute force attempts. If it were an earlier version of Word, I could have gotten the password by extracting the document, but security is strong in later versions. Still trying to crack another Word doc, but no luck. I don't think there's practical means to do so, either.

Convinced the boss to back me up on enforcing 2FA company-wide. Feels good, man. >>4104 I've never tried it for Word docs, but apparently you can try to use John the Ripper: http://blog.infosecsee.com/2015/02/cracking-password-protected-word-excel.html

I found a VeraCrypt volume I have made long ago and immediately overwritten the medium that contained it. I suppose spooks wouldn't believe me that I burned the paper that used to contain my key to that volume (which I have long forgotten) so I guess I will skip a long waterboarding session should I ever get v&.

>>4101 I got root of the Mr.robot vulnhub https://www.vulnhub.com/entry/mr-robot-1,151/ only took me 2 hours longer than it should have...

I managed to find a missing range check in my mouse's firmware which would allow me to write to any code rom location. ...except that this would write to any location between the start and the target and the boot block is between those. Writing to the boot block, which is read-only, causes the mouse to crash. It could have worked so well...

bought an openpgp card and generated some keys on it - got it to work with ssh, git, and pass with 0 problems and maybe ~5 lines of config. much easier than anticipated, and makes me feel 10x more confident about my keys.

>>4225 Got a link to the card you bought?

Was on a pentest the other week, was nearing the end without finding much. In the last several hours I found an endpoint that was exposing sensitive information without authentication over the internet. Victory in the final hour.

>>4225 Very nice. Are you using pass with a private git server a nd signed commits? I saw some stuff in the man page for that and now really want to try and get that to work. That being said, what system did you get ssh to work on? I have been trying on a void linux client for a little while and haven't had much luck.

Hacked my sister's nudes

Made some good progress making a level generation program.

SQLi in a well tested app that allowed me to dump soykaf tons of juicy data

deserialization son, get some

>>4605 fuarrrk yeah. Deserialization is probably my favorite thing to come across. It's like a code sandbox challenge. There's a cool POP gadget tool for php I came across a while ago, I'll look for it and post it here.

>>4605 Agreed, deserialization is awesome Found the API backend of a huge realty company. It requires authentication, but the generation of the auth token is done via a script that runs client-side...so that's easy enough. It was a custom job so I had to figure out all the functionality by trial and error. Basically circumvents their entire business model, and additionally the API accepts PATCH requests...

>>4540 Can you tell moar? >>4608 > It was a custom job Are you a bounty hunter, doing it for teh lulz or black hat?

>>4609 >referencing colored hats imho I think calling anything X-hat is for the media and people who haven't yet seen that most do side-work and "fuarrrk-off/for the lulz" soykaf. Not trying to dog you on anything you said, I don't care either way. I just think it's an interesting talking point. Maybe I'm wrong (probably). I just think the hat-ness is a poor analogy. Don't trust anyone who says they've "only done white hat work." Everyone that I've met that categorizes themselves with colored hats is a knob. >>4608 j00cy, lainon. I had a recent exposure to a really cool API that sent JSON-RPC requests that had "unix-wildcard" style command injection with sudo. Nothing feels better than getting in with a custom sploit and not re-used/default creds or tomcat/websphere/ipmi/etc...

>>4611 not him but the hats are a useful way to separate into broad categories of motives/ethics. agree with you too somewhat, it's kinda a tool thing to label yourself with 'for the lulz' hacking is straight cringe and should have died with lulzsec

>>4609 Custom job as in they hired a dude to write it for them, which for me usually means poor security. But, it was black hat. >>4611 >referencing colored hats I use the hats for compartmentalization. No one is "black hat" or "white hat", but the current activity you are doing is that. There are less of late, but you always have people who do blackhat/greyhat work around their infosec schedule. Unsurprisingly, you can usually find them by how talented or experienced they appear to be. The reason? Actually having your ass on the line does wonders for due diligence and prep work.

>>4651 >The reason? Actually having your ass on the line does wonders for due diligence and prep work. Could not agree more.

>>4609 Basically, it was an rewritten app that had been tested many many times and aggregated data on this sloppy back end page somehow and spit it back out. Found XSS in one of the forms and smelled blood... went into it and started tossing %27s every where just to see if anything acted squirrely and caught an error initially... from there it was just finding the right query to build on and done-ski

>>4611 >Nothing feels better than getting in with a custom sploit and not re-used/default creds or tomcat/websphere/ipmi/etc... fuarrrking this, so true