« first day (4120 days earlier)      last day (812 days later) » 

9:58 AM
morning!
Today I recieved specs of some obscure api the client wants us to use. It is a tool to transfer XML. But I need to encode it in base64 then full urlencode() it (the example urlencoded [0-9a-zA-Z] too) and then put in a soap parameter
To make it easy for us, the result is only base64 encoded xml
 
That sounds like a fun morning :-)
 
yeah the documentation lacked a wsdl, or rather I should say the provided documentation was an email containing 3 xsds, 2 screenshots (one contained a "look it works in soapUI") and some weird comment about a recent change in the schema.
The endpoint ends with .dll?someparam1=foo&someparam2=bar
and contains the word MagicScript
whatever that is
The authentication is HTTP Basic, so that really completes the image.
 
 
3 hours later…
1:12 PM
o/
 
\o
 
o/
 
1:33 PM
\o
 
o/
 
1:58 PM
\o/
.||
/ \
 
 
1 hour later…
¯\_(ツ)_/¯
 
 
2 hours later…
5:20 PM
o/
 
happy new year @ircmaxell
 
5:34 PM
\o
 
6:02 PM
Hi
I am new to websocket programming and getting this error for json string which is big
WebSocket connection to 'ws://127.0.0.1:12345/websockets.php' failed: Invalid frame header

But for simple string it is working fine. Any idea?
 
@Exception What websocket lib are you using?
 
internal PHP functions
 
PHP doesn't have any native websocket support.
 
That is about normal Unix sockets, not web sockets
 
@Tiffany I've just updated all my machines :-S
 
yeah, doing that now
 
which php servers...
 
> Is this vulnerability remotely exploitable?
> No. But if an attacker can log in as any unprivileged user, the vulnerability can be quickly exploited to gain root privileges.
 
Yes, and I tried it. It is trivial.
 
6:14 PM
great
 
@Derick okay, Created a small application with it. but data is big to return from server
 
created a small application with what?
unix sockets?
 
similar to example like this
https://medium.com/@cn007b/super-simple-php-websocket-example-ea2cd5893575
 
yeah, except, as Derick said, that's using unix sockets, not web sockets
 
oh, okay..
So, what is making it to stop large JSON data, any idea?
 
6:27 PM
like, they are sockets that can transmit data over the web, but there's something else that's specific for websockets ... I think ... websockets are something I haven't touched yet, but probably will at some point, so I'm grasping at what I've heard and trying to fill in blanks
what error message do you get?
 
morning
 
@Tiffany Invalid frame header
 
ehhh, is this with a server you have access?
 
yes, it's localhost
 
may need an X-Frame-Options header or something... but would need a more detailed message to know
check server logs then
 
6:32 PM
@Derick Happy new year to you as well!
 
Anyone else have the same impression like with PHP type system being more and more complex presenting expected type as arguments to some functionalities like deserializers/denormalizers etc. in form of a string is getting not enough?
I use for eg. Symfony's serializer extensively, but since the introduction of union types it still prevents me from removing a marker interface implemented by all union types I expect in return. I could implement a normalizer just like ArrayNormalizer works and explode('|', $type) received as a result of implode('|', [Foo::class, Bar::class]) but this IMO is weak
 
@Tiffany ah, okay
 
 
5 hours later…
11:03 PM
 
Ugh
 
11:17 PM
Plot Twist: The person had suffered an unknown injury larping as a macedonian warrior and your expert knowledge allows you to identify the most likely effects.
 

« first day (4120 days earlier)      last day (812 days later) »