You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
By querying the site for secrets in the namespace of `%`, you cause the SQL query that is executed to evaluate to `SELECT*FROM secrets WHERE key LIKE%.%` which of course will spit out every secret stored in every namespace, including the password.
@@ -57,13 +57,13 @@ The problem is `extract($_GET)` on line 3. `extract` will take a hash and load
57
57
58
58
There are a lot of ways to do this, but I found it most natural to choose a filename that doesn't exist, and supply an empty string as my guess. Because the script doesn't really deal with errors, this will result in a correct attempt. My final querystring was `attempt=&filename=DOESNOTEXIT`
Level 2 presents you with a "social network," where you have the opportunity to upload your avatar image. The password for the next level is stored in a text file on the server. As it turns out, you can upload any kind of file you want, not just images. And this includes PHP files, which the server will happily execute when you navigate to the URL of the uploaded script. You can even get a handy directory listing:
Above you can see a bunch of files that I uploaded, and even a false attempt at the challenge. Having a place to dump scripts and other files is going to come in handy for the later challenges.
69
69
@@ -110,7 +110,7 @@ Level 4
110
110
-------
111
111
Level 4 is a karma trading game. You register as a user, and then can transfer karma to other users in the game. To keep things honest, if a user transfers you karma, you also get to see their password.
112
112
113
-
113
+
114
114
115
115
The user karma_fountain's password is the password to the next level, so if karma_fountain gives you karma, you also get the password to the next level.
116
116
@@ -120,7 +120,7 @@ The only user supplied value that other users can see is our password after we g
120
120
121
121
Transferring karma to karma_trader from attacker completes the challenge:
@@ -151,7 +151,7 @@ The `params` variable in Sinatra contains both POSTed data and values in the que
151
151
152
152
As a sidenote, after solving this challenge the first time, when I came back to gather screenshots, I found that I could authenticate to the level 5 domain, but was no longer shown the password:
If anyone knows why I didn't see a password the second time around, please tell me!
157
157
@@ -292,7 +292,7 @@ $.get('user_info', function (data) {
292
292
```
293
293
And when the above is encoded with `String.fromCharCode` and put inside a `<script>` tag, the target user will post their password when viewing our post:
This is an order log for another user. We know that this user is a premium subscriber because they are ordering the Dream waffle which is a premium item like the Liège waffles we have to order.
307
307
@@ -322,7 +322,7 @@ The signature algorithm used by WaffleCopter is `sha1(SECRET + MESSAGE)`, so we
322
322
323
323
I found a handy script to perform a SHA1 padding attack [here](http://www.vnsecurity.net/2010/03/codegate_challenge15_sha1_padding_attack/).
To brute force the password chunk by chunk, we send two requests with the same guess to PasswordDB and look at the difference in source ports between responses to our webhook. If the difference when guessing the first chunk is 3, then PasswordDB made 2 requests between responding to us, and thus queried the 2nd chunk server. Likewise if the difference when guessing the 2nd chunk is 4, and guessing the 3rd chunk is 5. I found that due to what's probably other users on the same challenge, I would sometimes get source port differences that were wildly off. I solved this sub optimally: any time that I have a source port difference greater than what I expect I wait 5 seconds and try again. If I keep getting source port differences greater than the expected 5 times in a row, I probably correctly guessed a chunk. This is a very suboptimal way to do it, and my script took a couple of hours to finish.
Copy file name to clipboardExpand all lines: content/blog/2014-02-25-how-to-locate-any-tinder-user.markdown
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -11,6 +11,6 @@ best: true
11
11
12
12
Last fall, while performing some bespoke security research for one of our clients, I found a way to locate any Tinder user using [trilateration](https://en.wikipedia.org/wiki/Trilateration). Here's what the proof of concept looks like:
I did a guest post over at the Include Security blog about **[how I was able to track the location of any Tinder user](http://blog.includesecurity.com/2014/02/how-i-was-able-to-track-location-of-any.html)**.
I'm downloading clojure.jar from [http//repo.maven.apache.org](http://repo.maven.apache.org) over port 80! This means that I'm going to be downloading JARs over unencrypted http. I thought this was an [issue](https://github.com/technomancy/leiningen/issues/1604) with [leiningen](http://leiningen.org/) at first. As it turns out it's not lein's fault at all. Clojure.jar, and a whole lot of other JARs that are important in the Java/Clojure/Scala/etc world are officially hosted on [Maven Central](http://search.maven.org/), which is a public service provided by [Sonatype](http://www.sonatype.com/). Sonatype has a policy that they only allow SSL access to people who have authentication tokens. **In order to get an authentication token and SSL access, you need to donate $10 to the Apache foundation.** If you don't believe me, the donate page is [here](http://www.sonatype.com/clm/secure-access-to-central), and the blog post announcing this policy is [here](http://www.sonatype.com/clm/secure-access-to-central). They even mention man-in-the-middle attacks on it.
24
24
25
25
Because authentication tokens are issued per user/organization, tools like maven and leiningen can't bundle authentication tokens. If you're pulling down some Java project and installing its dependencies, you're not going over SSL. This policy was confirmed by a Sonatype employee when I got into a twitter tiff about this:
26
26
27
-
{% img /assets/images/dilettante/tweet.png 500 %}
27
+
{% img /img/dilettante/tweet.png 500 %}
28
28
29
29
30
30
Unless you take very careful steps that involve paying someone $10, JARs you download can be man-in-the-middled, and code you execute on your system can be replaced by malware.
@@ -41,7 +41,7 @@ Proxying HTTP traffic through dilettante will backdoor any JARs downloaded from
0 commit comments