Pedophiles of Sluthate AND Lookism (MRZ, Brian Peppers and many more!)

[Emiya Kiwitsugu]

Mrz chimped out like a mofo earlier today when we called him out on his "2EDGY4U" posts.

He's been banned and snuck back in several times, and he's now currently trying to hack the forum and, rather then, you know, trying to be sneaky about it, has loudly proclaimed "HEY GUIZE, I'M TOTES TRYING TO HACK UR FORUM! LOLZ!"

Mrz is a TOT4LLY L3G1T L33T H4CK3R, and he's going to destroy the website or hack our accounts or something. To prove he's not bullshitting, I guess.

Oh good. I always like it when people with no actually education or actual background on networks and security begin to make themselves out to be great hackers. Particularly the pedophiles, because they seem to get cocky, thinking they know everything about computers work because they read a few guides on how to try to download their child porn discreetly, and now they think they're hot shit who can do anything.

I consider killing myself fairly regularly.

Don't doubt your instincts, it's the right thing to do.

 

[misterzee]

So you're saying you like us so much you're doing a free stress test of our forum? Do you think we won't ban you out of generosity or something?

Well I could try to exploit it but I don't really necessarily have the motivation to go to the trouble of implementing attack code for it, especially seeing as it's kind of a hassle to do it from my secured operating environment as it really wasn't set up with doing arbitrary coding / running arbitrary programs in mind, so I dunno I probably won't exploit it, maybe I will just submit a ticket to xenforo and see what they have to say about it. I already ran the timing attack past a truly elite hacker friend and he said it's definitely exploitable at that location, the only question is will something else catch it or is it not actually doing what it looks like to me.

Let's also not forget that so far, he's failing spectacularly at trying to hack the forum. I think that's what makes this even funnier.

"I ARE GUN HACK YOUR FORUMS! MWA HA HA HA! ......Um, shit, hang on, give me a minute...."

Actually so far I think I've identified a vulnerability that will allow arbitrary session hijacking of users who check the remember me box when they login, seeing as IP validation is disabled, I just don't necessarily feel like writing exploit code for it.

 

[sugoi-chan]

Can anyone give me the Sparknotes version because I really don't want to read 20+ pages of a pedophile trying to act like he's some unstoppable hacking machine.

You've actually pretty much summed it up right there.

Actually so far I think I've identified a vulnerability that will allow arbitrary session hijacking of users who check the remember me box when they login, seeing as IP validation is disabled, I just don't necessarily feel like writing exploit code for it.

Go ahead and hack me now.

 

[Rin]

Well I could try to exploit it but I don't really necessarily have the motivation to go to the trouble of implementing attack code for it, especially seeing as it's kind of a hassle to do it from my secured operating environment as it really wasn't set up with doing arbitrary coding / running arbitrary programs in mind, so I dunno I probably won't exploit it, maybe I will just submit a ticket to xenforo and see what they have to say about it. I already ran the timing attack past a truly elite hacker friend and he said it's definitely exploitable at that location, the only question is will something else catch it or is it not actually doing what it looks like to me.

So why do you think we care? Do you think we'll be grateful or something?

 

[Frank Rizzo]

Well I could try to exploit it but I don't really necessarily have the motivation to go to the trouble of implementing attack code for it, especially seeing as it's kind of a hassle to do it from my secured operating environment as it really wasn't set up with doing arbitrary coding / running arbitrary programs in mind, so I dunno I probably won't exploit it, maybe I will just submit a ticket to xenforo and see what they have to say about it. I already ran the timing attack past a truly elite hacker friend and he said it's definitely exploitable at that location, the only question is will something else catch it or is it not actually doing what it looks like to me.

So, that's just your roundabout way of saying you epic failed in trying to hack the forum.

As long as we have that squared away...

 

[AnOminous]

I consider killing myself fairly regularly.

You obviously don't take it seriously enough, though, because you have failed to do it.

 

[Emiya Kiwitsugu]

Well I could try to exploit it but I don't really necessarily have the motivation to go to the trouble of implementing attack code for it, especially seeing as it's kind of a hassle to do it from my secured operating environment as it really wasn't set up with doing arbitrary coding / running arbitrary programs in mind, so I dunno I probably won't exploit it, maybe I will just submit a ticket to xenforo and see what they have to say about it. I already ran the timing attack past a truly elite hacker friend and he said it's definitely exploitable at that location, the only question is will something else catch it or is it not actually doing what it looks like to me.

a truly elite hacker friend

You just unironically used the, "My dad works at Nintendo," excuse.

Also, nice terms you Googled there to make it sound like you knew shit.

 

[misterzee]

So, that's just your roundabout way of saying you epic failed in trying to hack the forum.

As long as we have that squared away...

I'm pretty sure I identified an exploitable vulnerability, I just don't know that it's worth it to write exploit code for it. It pretty much just needs to spoof the user ID of a cookie to one of a user with a valid session and who checked the remember me box, and then brute force test the session ID thousands of times and take timing measurements, and then use the timing measurements to intelligently select characters in the session ID.

 

[Red_Rager]

The CSI team could use someone of your talents @misterzee

 

[Emiya Kiwitsugu]

I'm pretty sure I identified an exploitable vulnerability, I just don't know that it's worth it to write exploit code for it. It pretty much just needs to spoof the user ID of a cookie to one of a user with a valid session and who checked the remember me box, and then brute force test the session ID thousands of times and take timing measurements, and then use the timing measurements to intelligently select characters in the session ID.

So, you don't have the time to write code, but you apparently have enough time to write dozens of posts bragging about how you could TOTALLY HACK US IF YOU WANTED TO.

 

[misterzee]

You just unironically used the, "My dad works at Nintendo," excuse.

Also, nice terms you Googled there to make it sound like you knew shit.

Well I knew about constant time comparison because once I implemented a program that used message authentication codes but I compared the MAC with a short circuiting == and a hacker friend told me I had to use a constant time comparison function when comparing against secret data.

 

[Emiya Kiwitsugu]

Well I knew about constant time comparison because once I implemented a program that used message authentication codes but I compared the MAC with a short circuiting == and a hacker friend told me I had to use a constant time comparison function when comparing against secret data.

Which hacker friend. Is it the hacker friend, or the truly elite hacker friend?

 

[Frank Rizzo]

nerd nerd nerd nerd nerd nerd dork dweeb nerd speak.

So you failed then. Moving on.

 

[Rin]

Well I knew about constant time comparison because once I implemented a program that used message authentication codes but I compared the MAC with a short circuiting == and a hacker friend told me I had to use a constant time comparison function when comparing against secret data.

So you're shitty at programming, is what you're saying?

 

[misterzee]

Which hacker friend. Is it the hacker friend, or the truly elite hacker friend?

A different hacker friend, but both of them are very elite, far superior to me.

 

[Emiya Kiwitsugu]

A different hacker friend, but both of them are very elite, far superior to me.

That's not saying much, you couldn't 'hack' a Hello World program.

 

[misterzee]

So you're shitty at programming, is what you're saying?

At that time I certainly was, though apparently no more so than xenforo developers seeing as they are comparing user input against secret static information with a short circuiting comparison function. Hell I don't think I even knew about pbkdf2 etc back then, I would just hash the password once to make a key from it! That was many years ago now though.

 

[Rin]

A different hacker friend, but both of them are very elite, far superior to me.

See, the joke is you saying that you have friends.

 

[sugoi-chan]

Well I knew about constant time comparison because once I implemented a program that used message authentication codes but I compared the MAC with a short circuiting == and a hacker friend told me I had to use a constant time comparison function when comparing against secret data.

Incorrect, pedos have no friends.

 

[misterzee]

That's not saying much, you couldn't 'hack' a Hello World program.

Hello World programs tend to have very little complexity, usually they are not possible to hack, especially if written in a language like C where there isn't an interpreter to target.