211–220 of 1001 posts
Earlier quoted context omitted.
You don't even have to write a script, all that info is already out there.
I know I could find out by checking DNS, etc., but I'd rather not have to do that for every web site I use... and I'm guessing Cloudflare doesn't publish a list of every domain name that they serve.
Earlier quoted context omitted.
Not only that, but the "reward" in the program is laughable and frankly insulting to any serious researcher considering the scope of CF. Bug bounty platforms are already becoming the fiverr of ITSEC (that's not a good thing), CF just made an extra effort do diminish the value for researchers. Management: "Why do we offer $5k for a small bug again? Look at CF, they don't offer any money!"
If serious researchers are looking to get paid, I think bug bounties are the wrong approach entirely
Anyone know which password manager uses Cloudflare? Just trying to figure out if I'm affected.
Cloudflare isn't just a security hole in the middle of the internet, they're a protection racket. If you wanted to pay to DDoS a site, search for "booter" and you'll get a list of sites that will take another site off the internet for money with a flood of traffic. quezstresser.com webstresser.co topbooter.co instabooter.com booter.xyz critical-boot.com top10booters.com betabooter.com databooter.com etc. etc. - from…
Earlier quoted context omitted.
How do you check if a website uses cloudflare ? Any scripts that do that ?
Response headers will contain a "cf-ray" header or "server: cloudflare-nginx"
$ curl -I okcupid.com
Set-Cookie: __cfduid=...
Server: cloudflare-nginx
CF-RAY: 335f033b77742b76-AMS
Full details from Cloudflare: https://blog.cloudflare.com/incident-report-on-memory-leak-c...
> Incident report on memory leak caused by Cloudflare parser bug This title sounds like Cloudflare doesn't know what a memory leak is or are intentionally trying to downplay information disclosure. Neither option is comforting.
Earlier quoted context omitted.
Does 1Password really send anything meaningful in their API queries, or is it encrypted separately and then just sent over HTTPS?
For what it's worth, I've posted this question in 1Password's support forum, which is frequented by 1Password staff: https://discussions.agilebits.com/discussion/75711/cloudblee...
Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…
I would say the crazy thing is a mere t-shirt as their "bug bounty" top tier award given how they've pitched themselves as an extremely secure service. https://hackerone.com/cloudflare I'm sorry but when the reward for breaking into you is basically a massive pinata of personal information...that simply is a bad joke. Security flaws are going to happen and if you aren't going to even offer a reasonable financial rewa…
> The greatest period of impact was from February 13 and February 18 with around 1 in every 3,300,000 HTTP requests through Cloudflare potentially resulting in memory leakage (that’s about 0.00003% of requests). 1) From the metrics I recalled when I interviewed there, and assuming the given probability is correct, that means a potential of 100k-200k paged with private data leaked every day. 2) What's the probably tha…
Earlier quoted context omitted.
That's also what I'm interested in. There's a lot of talk about the sites that had the features enabled that allowed the data to escape, but it's the sites that were co-existing with those that were in danger. In terms of the caching, knowing the broken sites tells you where to look in the caches after the fact, but do you have any idea of who's data was leaked? Presumably 2 consecutive requests to the same malformed…
> Presumably 2 consecutive requests to the same malformed page could/would leak different data. Wouldn't the second request be served from the CDN cache? Since for Cloudfare that particular page is a valid cached page, it would send you that same page on the second request.