Pedophiles of Sluthate AND Lookism (MRZ, Brian Peppers and many more!)

  • Thread starter Thread starter JU 199
  • Start date Start date
  • 🏰 The Fediverse is up. If you know, you know.
  • Want to keep track of this thread?
    Accounts can bookmark posts, watch threads for updates, and jump back to where you stopped reading.
    Create account

Which user is a bigger faggot?

  • @drz

  • Marijan Siklic

Results are only viewable after voting.
Ass Manager 3000 said:
View attachment 38549
Click to expand...

MrZ in his natural habitat.

image68.png
 
Not to mention that the source code he grabbed from github is quite different from what we're running here. Catparty has the right of it, he's a charlatan and a fraud.
 
I have met script kiddies who are more technically competent than you, @shittywhat or whatever your next username will be.

We've got the world's first double-hack here!
the-world-s-first-double-hack-o.gif
 
I'm no security expert, but when you do the password reset thing, don't you have to choose the new password yourself?
 
trombonista said:
I'm no security expert, but when you do the password reset thing, don't you have to choose the new password yourself?
Click to expand...
Yes. And the "reset" token is randomized and tied to the user's email account specifically to stop what Captain Script Kiddie here is trying to do. It's like watching a dog run into a wall time and time again.

I wish he'd tell us more about how his revolutionary super-secure CP system works.
 
flossman said:
Yes. And the "reset" token is randomized and tied to the user's email account specifically to stop what Captain Script Kiddie here is trying to do. It's like watching a dog run into a wall time and time again.

I wish he'd tell us more about how his revolutionary super-secure CP system works.
Click to expand...

The reset token is randomized, but it is compared to user input with === which short circuits on the first mismatch. This means that timing the response allows an attacker to determine how many characters of user input match the stored secret value. Since the secret value doesn't reset on incorrect attempts, you can just keep making guesses and taking timing measurements, and you can keep determining how many leading characters are correct in your guess because each new correct character will result in the function taking slightly longer to return, because it does more computation prior to short circuiting. So the randomized reset token isn't actually as helpful as it appears to be, it can be determined by an attacker as previously described. However, it doesn't let you pick a password, rather it randomly generates one and E-mails it to you. This means that you can't use this flaw to take over a targets account, because passwords are done like

$password_hash = hash("password");
$password_hash === "6b3a55e0261b0304143f805a24924d0c1c44524821305f31d9277843b8a10f4e"


$password_hash is put in the database. When you go to login you send in plaintext (well, link encrypted with tls)

$password = "password";

at this point $password is hashed

6b3a55e0261b0304143f805a24924d0c1c44524821305f31d9277843b8a10f4e

and compared to the string in the database

6b3a55e0261b0304143f805a24924d0c1c44524821305f31d9277843b8a10f4e === 6b3a55e0261b0304143f805a24924d0c1c44524821305f31d9277843b8a10f4e

Although it still short circuits on mismatches, I can't directly control the value because it is the hash value of a password, it doesn't directly use the password, so even if I find a password with collisions like

6baaaaaaaaaaa0304143f805a24924d0c1c44524821305f31d9277843b8a10f4e

and it short circuits on the first mismatch, well, I can't easily pick a new password that hashes to everything that I know is a match + an arbitrary character after that to continue testing. So passwords using a system like this are not weak to timing attacks like this.

However, the session cookie isn't using that logic:

f (!$auth || $this->prepareRememberKeyForCookie($auth['remember_key']) !== $rememberKey)
Click to expand...

$rememberKey is user provided, and $this->prepareRememberKeyForCookie() returns a hash value from a static database value.

This means that I can keep brute forcing the $rememberKey value and taking timing measurements, and each time it takes statistically slightly longer than before, I can assume I got another character correct and then move on to the next character just like with the password reset token, eventually this will allow me to grab the session key.

It looks like IP checks will fuck me on this though, but actually kiwifarms.net doesn't have IP checks enabled so I don't need to worry about that. I'm still not confident enough to say I'm sure, but due to IP checks on sessions not being enabled, I think this may be enough to hijack sessions when users set a remember me cookie.
 
Why do want to hack the forum in the first place?

Why are you telling us how you plan to hack the forum? Presumably this would allow the mods to fix any specific issues you point out.
 
I'm really not much of a hacker, I'm just pretty good at hardening systems etc. I do think this is a vulnerability in xenforo though, but again I don't want to claim so with certainty yet because I've not particularly looked into it, it looks like IP checks would definitely prevent me from doing it, but seeing as they aren't enabled I'm not sure what would prevent it from working.
 
Humanoid Email Address said:
Can anyone give me the Sparknotes version because I really don't want to read 20+ pages of a pedophile trying to act like he's some unstoppable hacking machine.
Click to expand...

Mrz chimped out like a mofo earlier today when we called him out on his "2EDGY4U" posts.

He's been banned and snuck back in several times, and he's now currently trying to hack the forum and, rather then, you know, trying to be sneaky about it, has loudly proclaimed "HEY GUIZE, I'M TOTES TRYING TO HACK UR FORUM! LOLZ!"
 
Humanoid Email Address said:
Can anyone give me the Sparknotes version because I really don't want to read 20+ pages of a pedophile trying to act like he's some unstoppable hacking machine.
Click to expand...
Mrz is a TOT4LLY L3G1T L33T H4CK3R, and he's going to destroy the website or hack our accounts or something. To prove he's not bullshitting, I guess.

misterzee said:
I'm really not much of a hacker, I'm just pretty good at hardening systems etc. I do think this is a vulnerability in xenforo though, but again I don't want to claim so with certainty yet because I've not particularly looked into it, it looks like IP checks would definitely prevent me from doing it, but seeing as they aren't enabled I'm not sure what would prevent it from working.
Click to expand...
So you're saying you like us so much you're doing a free stress test of our forum? Do you think we won't ban you out of generosity or something?
 
misterzee said:
I'm really not much of a hacker, I'm just pretty good at hardening systems etc. I do think this is a vulnerability in xenforo though, but again I don't want to claim so with certainty yet because I've not particularly looked into it, it looks like IP checks would definitely prevent me from doing it, but seeing as they aren't enabled I'm not sure what would prevent it from working.
Click to expand...

No shit xenforo has vulnerabilities, you fucking tard.

You should still kill yourself, though.
 
Let's also not forget that so far, he's failing spectacularly at trying to hack the forum. I think that's what makes this even funnier.

"I ARE GUN HACK YOUR FORUMS! MWA HA HA HA! ......Um, shit, hang on, give me a minute...."
 
You must log in or register to reply here.
Back
Top Bottom