« first day (662 days earlier)      last day (1498 days later) » 

Sam
6:00 PM
Room owners...

Imagine Studios
Ahmad
CC Inc
Alex Gittemeier
uınbɐɥs
Outlaw Lemur
Kinected
 
oops, the layout is quite confusing
^ There
Under construction but not bad, eh?
Inspired by the c page
 
+1 for the no-textspeak rule
 
Sam
Yeah, not bad.
 
@Sam @ProgramFOX @Sam @ProgramFOX @Sam @ProgramFOX @Sam @ProgramFOX @Sam @ProgramFOX @Sam @ProgramFOX @Sam @ProgramFOX @Sam @ProgramFOX @Sam @ProgramFOX @Sam @ProgramFOX @Sam Please, for the love of god, DON'T ping spam.
 
@its_justjack Because there is no space between 'ProgramFOX' and 'Sam', I just get pinged once :P
 
6:12 PM
AH CRAP!
 
Sam
lol
 
@its_justjack It gives lots of green, but just one notification.
 
@Sam @ProgramFOX
 
Sam
^
 
Hmm]
Seems like the chat doesn't let you pingspam...
 
6:13 PM
@its_justjack oh
@its_justjack yes
@its_justjack it
@its_justjack does
:P
 
Shutuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuup
No, without changing the message
@Sam @ProgramFOX
See?
 
@its_justjack See what?
 
Posted it 5 times, waited to retry sending, didn't work
 
Sam
@its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack @its_justjack SUPER PING
 
Can you find the secret on mawersoft.co.uk/junk/tpcsite ?
 
6:15 PM
@its_justjack The first second of viewing, the font is smaller.
 
Nope, that's a css glitch. Keep looking!
 
The huge "TEENAGE" at the top?
 
Nope, you're not even on the page!
According to analytics :-P
Oh right I don't have the analytics code there...
facepalm
 
Sam
I've got a blocker for that, so...
 
Really? You disable javascript?
 
Sam
6:17 PM
Nope.
 
I also have a blocker for trackers.
JavaScript is enabled, but trackers are blocked.
 
Sam
^
 
Well that's not nice.
I wanna see how many people are on mah website!
 
Sam
Meh, well you know I've just visited
And fox.
 
Either way, I have a trick that should make your plugins useless!
 
6:19 PM
You can use a server-side thing to count the views, without using Analytics.
 
Sam
^
 
I could just check the logs...
BUT THAT'S NOT USER-FRIENDLY FOR ME!
Would you be as kind as to try again?
 
yep, refreshed
 
Control+Alt+R refreshed?
 
Ctrl+F5
a full refresh
 
6:22 PM
Damn!
@Sam ?
 
I did it again now.
 
Sam
@its_justjack I was agreeing with fox.
 
You win -_-
GOT A PING!
Who right now refereshed the site?
 
I just loaded it.
 
Sam
Yay, finally all errors gone. Starts Pham
 
6:26 PM
Oh right
Cool :F
 
Please for the love of god make your text not all be centered
 
I wanna see what the owners think
But if you say so...
I was going to put it in a 'table' so it's centered but right aligned...
 
oh god not tables
this isn't 2007
 
They still work now and they will work for many years!
 
just because you can doesn't mean you should
<div align="center" style="text-align: right;">
</div>
boom
 
6:29 PM
@zack6849 From the US, right?
 
Yes, why?
 
@zack6849 Just wanted to know, not important
@zack6849 BTW, there's a lot of fun in my junk directory
 
Why not use a web framework like bootstrap
 
Because it looks like what the C room have and they like it over there
 
C devs arent teenaged programmers.
 
6:31 PM
I really like this page: mawersoft.co.uk/junk/boom.html
 
@ProgramFOX Made that when I was about 8...
@ProgramFOX I had just taught myself how borders work
 
That's just rude
Good think firefox blocks popup windows
 
@its_justjack Thanks, Firefox, from saving me from 1000+ pop-up windows...
 
@zack6849 @ProgramFOX ^^ Good joke, weeds out the IE users
 
6:33 PM
Lol
opens IE anyway to see the boom
 
@its_justjack do you ahve some sort of hatred for spacing in between words on your websites?
 
@zack6849 Yes, I ahve hatred on a daily basis!
 
and inline stylesheets
jesus christ why would you do that
 
oh look, your website just dumped your username for your mysql database
 
6:35 PM
Phew, I could kill all instances of IE using Task Manager.
 
There's probably a large amount of personal information in that directory so it might be a good idea to delete links to it :D
WHAT
@zack6849 W...what's the username then?
 
mawersof_uadmin
Something tells me you dont know all that much about web dev m8
 
Sam
And the password...
 
User and database already deleted
 
I never said it told me the password
 
6:36 PM
No, it doesn't exist
 
i said it dumped the username and database name to the webpage
 
I didn't just delete it, it's already gone!
 
Understood
 
Also, which page did you get that from?
Might need to obfuscate that, just in case...
 
your connect.php in your junk folder
it isnt something you can obfuscate
you'll have to error supress stuff with php
 
6:38 PM
-_-
 
i also found your cpanel
 
REALLY?
 
perhaps listing all of these files in your webserver is a bad idea
yes, really.
 
Well you can't login to it!
 
I found a mail thing with authentication.
 
6:39 PM
yeah
programfox, click submit
 
Oh, that's not the actual login
 
it redirects to his cpanel
 
Submit is...
 
@zack6849 I did, but I get "Invalid login"
 
it's a port in the 2000 range is all im gonna say
 
6:40 PM
It's pretty obvious anyway
 
Jack, if i may ask, how old are you?
 
Not hard to guess
 
ah, i wasnt going off of your subdomain
its also listening on your root domain
 
Oh, that's webmail
There's another port for cpanel login too
It's not a BIG security hole, because it still needs authentication
 
well yeah, im just running into lots of things though
 
6:43 PM
Any other problems you can pick at?
 
if soemoen can get to your cpanel and they see a version number, they may figure out a version specific vulnerability
im lookin
 
Shoudln't be any version number
If there is, I can cloudflare the subdomains and block up the ports
 
cpanel version 11.44.1.18
 
Where does it list that?
 
HTTP Response headers
 
6:45 PM
Of course...
 
it also told me in your database page your webroot location
 
Really?
Where?
 
so i know a valid username for your server
 
connect.php?
 
` 'mawersof_uadmin'@'localhost' (using password: YES) in /home/mawersof/public_html/junk/connect.ph`
yes
 
6:45 PM
OH PISSING HELL!
 
the fact you have a cgi-bin folder in here is sort of concerning
 
Sam
/me thinks jack should read-up on basic data security
 
looks like yopu tried messing with some sort of server side python framework as well
agreed
 
There.
Junk is sealed off now
 
lets see what i can find out about your server
 
6:47 PM
Go ahead
 
perhaps just disallow requests for /junk/ itself, not all subdirectories
because you just broke the website for the chat room
 
I would rather manually approve subdirectories, like I am doing now
 
im waiting on my scan to finish, but i see you have FTP, a webserver, HTTPS, MYSQL, and a few other ports im not farmiliar with
it looks like your ssh port isnt default or is blocked, which is good.
 
What are you scanning with, by the way?
 
zenmap
smptd, pop3, mysql, imap, http, ftp, i assume dns
i know you're running linux with kernel 2.6.32
 
6:51 PM
They all sound like the things I use and need, so good I guess?
 
which is rather old, i think
 
@zack6849 And how did you get that?
 
good indeed, i was just telling you what i found
zenmap has a tool that takes guesses somehow (fuzzy on the details)
 
6:53 PM
HTTP Status 403 - Get te fuk outta mi uploads folder
Hehe
 
stalker
 
Lol
 
Well it's natural, isn't it? User provides link to file, explore directory's parent, that directory's parent and so on?
 
now i have your ip too :D
 
FAACK!
 
6:54 PM
not that it really matters
 
I can just kill apache, htaccess deny all and block up cloudflare anyways
 
well you could
or you could do absic security
and not worry about cloudflare
ooh, someone is fancy and using ipv6 :P
 
Well cloudflare is for DDoSsing and a basic way to say FUCKOFF to people who don't know how to DoS servers
@zack6849 Well the IPv4 addresses are gone, aren't they!
 
eh, cloudflare isnt really MEANT for ddos mitigation
 
What IS it meant for then?
 
6:57 PM
well yes, but i generally dont see people running around browsing with IPV6
It minimises content and stuff, mostly just caching for static webpages and making your webpages load faster
 
It's designed for DDoS mitigation, those features were added on!
Like IPv6 support
Anything else, like cpanel passwords?
initiates backup
 
no, cloudflare is a reverse proxy to speed up your website and secure it as well sicne it sort of hides your IP
 
Unless you look at my mx record, because that doesn't run through cloudflare, otherwise it would break mail.
It's a known problem
 
well yeah
I wonder if your website is vulnerable to slowloris
 
Backup initiated
I tested it and it wasn't when I checked
Well?
 
7:06 PM
didnt bother checking
but really, im curious, how old are you?
 
meh
@zack6849 If you must know, I'm 13 :-P
 
one of your pages said 12 and said 'new website', your domain has existed since 2013, so i would guess 13 or 14
ah
 
how old are you @zack6849
 
17
 
i'm 15
 
7:08 PM
@its_justjack Now I am.
 
@speedDeveloper your website is a tad slow :P
 
@bjb568 You're not a room owner, right? If not, nevermind :-P
 
Yeah, I know, the layout is a tad confusing
 
i don't pay much for my webspace and wordpress includes libaries like jquery
 
7:10 PM
You should write vanilla HTML/CSS/JS.
 
i think that can be the reason
 
jquery isnt slow
 
@zack6849 Das ist auch Deutsch!
 
@zack6849 Yeah it is.
 
not to load, no
 
7:11 PM
ok, i didn't know that. i thought because it's a huge libary it needs long. maybe it's the server
 
i have jquery, modernizr, foundation, and a couple other things all loading in 0.3 seconds
none of which are minimized
 
@zack6849 SO no other problems with my webserver?
Wecome back @ProgramFOX
 
couldnt tell you
 
how can i load my website faster?
 
i just know it took like 3 or 4 seconds for me to load it, it could have been content, it could be my connection (though i doubt it, i have 60 down), or it could be something else
 
7:13 PM
ok
 
My school's internet goes past the red bit on speedtest.net
 
also, jack, since you were glancing at my website, i'd be curious to see what you think about the design of home.zack6849.com versus the old one
 
It's more pretty, but it also gives me a chance at guessing passwords at your admin panel
 
good luck with that
i wrote the entire thing from scratch, you arent gonna be able to get past it :P
lol, someone tried to look for robots.txt
 
@zack6849 You using analytics?
 
7:16 PM
no
it's on my local development webserver, im watching the access log in my IDE
 
Oh, i see
Where am I then?
:-P
 
sitting at authenticate.jsp with an invalid password message, i reckon
 
Actually, I'm poking around the source
 
7:17 PM
`Database query for login submitted
No results found, sending redirect to login page!`
its not THAT specific
the webserver doesnt know the difference between view source and a client retrieiving it
 
Yes...
I would have to see the sourcecode to work out what it's POSTing to
 
protip, those pages its posting to don't exist.
it's all smoke and mirrors, its using servlets
 
Ooh, java?
LoginServlet.java
 
the only pages you see in your url bar that exist are login,jsp and a manager.jsp
yes, click my image above
lo
pahahahaha
sorry, but no
/WEB-INF/ refers to a literal folder called /WEB-INF/ which isnt accessible to the internet
 
7:21 PM
the only way you can get access to those pages is if a servlet directs you there
hell, even my index is in web-inf actually.
 
Really?
 
mhm
 
I wonder if I can pull off an exploit with that...
 
i'd love to see you try
i can explain how it works if you'd like
 
Hrm
You appear to have patched that exploit
 
7:25 PM
oh please
i googled that
 
Can you actually see the credentials I'm attempting?
 
that was for a very specific setup
nah, i dont have it set to do that, i could th
o
i can now.
lol
i use preparedstatemnts
nice try though
 
Dammit, you know how SQL injection attacks work...
 
SQLi isnt going to work
Of course i do, i'm a developer
"Attempted login with ' OR 1=1 : ' OR 1=1"
also, that wouldnt work even if i did allow sql injection
I just select all users where the username eqals that username, and then check the password against a hashed password, your OR 1=1 would just make it check EVERY user for that password
aw
@its_justjack thanks m8
Tomcat is stronk
 
@zack6849 Do you even have an admin panel?
 
7:38 PM
I do.
it's very primitave
 
@zack6849 Care to screenshot it?
Huh
And I'd assume that's manager.jsp?
 
yep
pahaha
nice try with the password guessing btw
i'll give you a hint
the username is administrator
 
facepalm
 
the password isnt something you'd guess, it's literally randomly generated
 
500 to go then!
Ah, arse
 
Uhm
∞ Passwords to go then!
 
nice password guess
""GET /XYtest/servlet/jsp/Viewer/Viewer.jsp"
 
Bloody Tomcat, pissing on my progress!
 
I regret to inform you, that's not how servlets work
i wouldnt have any problems giving you the source to some of this, because im damn sure you wont be able to exploit it
 
When I last used tomcat, you could do that
 
7:47 PM
how the servlet URL path works is all completley dependent upon the application
 
well since you're using a random generator, you could probably give me the full source code and I couldn't exploit it
I could if you gave me the line it reads out to you when it initializes though, I would guess
@zack6849 Am I right?
 
hm?
well yeah, if i gave you the initial password, but that wouldnt be an exploit
 
As above
 
that'd be me handing you the keys
 
Precisely
You might as well give me the full code, I can fumble around looking for exploits and you can patch them :-P
 
7:53 PM
well i hardcode lots of stuff in here, plus i have some personal code here that if you saw would result in my garrys mod server being hacked :P
i should probably export that to somesort of init parameter for the servlet
 
I don't play Garry's mod and I couldn't care less about hacking it
And your website is pretty much empty...
And what exactly do you hardcode?
 
well yes, but this is a chatroom with logs and people
and posting stuff that bots index is a bad idea
i have hardcoded values for my source rcon password, and a few other things i think
 
And obfuscated to avoid bot indexing is in a secure email server :-P
 
You have a skype?
 
Not for videocalling, right? :-P
 
7:56 PM
lol, no, i dont do video calls
text
my skype is zack6949
feel free to add me
 
Kk
Just realized I have my phone number in my profile
...
Whatever
 
lel
 
8:40 PM
here I am
I was pinged?
@its_justjack do you want to be an owner? you're pretty active here so why not :)
Oh, you don't have 100 rep yet
I can only add you as an owner if you have at least 100 rep points
 
9:14 PM
@Ahmad Ok, I'll work on it, thanks
@Ahmad I created a website about this room in the style of the C room, i thought it might be useful.
http://www.mawersoft.co.uk/junk/tpcsite/
 
yay! awesome :D
I'll put that in the room description later
 
@Ahmad Any tips on getting rep fast?
 
search for beginner questions
or question that can be easily googled
people don't use google enough
so they ask on SO
 
ping-spam has a dash in it
DON'T should be lowercase bold
Text aligned left is easier to read.
 
Hrm
Anyway nite all
 
9:34 PM
Night!
 
Sam
9:50 PM
Night!
 
 
1 hour later…
10:56 PM
Nullification: UPDATE `Laws` SET `title` = NULL, `body` = NULL WHERE `status` = K_STUPID;
 

« first day (662 days earlier)      last day (1498 days later) »