Cybersecurity professional with an interest/background in networking. Beginning to delve into binary exploitation and reverse engineering.

  • 0 Posts
  • 119 Comments
Joined 1 year ago
cake
Cake day: March 27th, 2024

help-circle


  • I work on a computer at a desk all day. I’m do penetration testing and red team operations, so I spend a fuck ton of time doing training and development courses and labs which usually just involve typing a bunch of shit into a terminal window, both during work and on my own time (I genuinely enjoy it, it’s not a shitty workplace colonizing my off time situation), and I’ve played games my entire life.

    Idk I’ve never had this problem. Screens recharge me, it’s people that drain me. I’d have the same flipped question for product vendors that are always at conferences and stuff, or business insurance sales people, just wondering how they get through all these small talk conversations, sales calls, dinners with clients, etc., without a chance to just sit behind a screen and answer people at whatever pace they need.

    Oh. I have a variable height desk I got from DeskHaus. I love it. I’m standing a fair amount of the time I’m working. I have a decent SteelCase chair I bought during the beginning of covid. I got it from a refurb reseller, but even brand new it’s not their nicest chair, but it’s expensive enough and holding up well enough that I don’t see a reason to replace it yet. Standing through the workday helps me not feel exhausted and tired of sitting in the same chair for 12 hours since I haven’t been.


  • I’m not saying radiation like nukes. I’m saying that you treat cancer with radiation even though it kills nearby healthy cells. We tried surgery by electing Biden, but he didn’t get all the cancer. Maybe if a fucking rabid dog had been appointed to the DoJ instead of the feckless Garland it could have worked, idk.

    The weaknesses in the American systems of government have been both discovered and exploited. There’s no coming back from these systems being broken. It’s time to treat the cancer with radiation by building new systems.

    What kind of person reads my first post on context and assumes I’m talking about nuclear war? I feel sorry for you bro.





  • No. You can have control over specific parameters of an SQL query though. Look up insecure direct object reference vulnerabilities.

    Consider a website that uses the following URL to access the customer account page, by retrieving information from the back-end database: https://insecure-website.com/customer_account?customer_number=132355 Here, the customer number is used directly as a record index in queries that are performed on the back-end database. If no other controls are in place, an attacker can simply modify the customer_number value, bypassing access controls to view the records of other customers.




  • Just to be clear, I will absolutely create new domain users or add my own ssh keys to an authorized_keys file to escalate privs or move laterally through a network while I’m “hacking”.

    Also a malicious actor opening a reverse port forward tunnel with ssh allows them to punch a hole to them on the WAN side of the network when they’re dealing with NAT or firewall rules. If a system is truly airgapped then that accomplishes nothing. You’d need something plugged in to the airgapped system or airgapped network to bridge that air gap, like a usb adapter that has a SIM card in it.