Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If you’re trying to hack/deface a website, don’t submit a pull request

github.com

Post reply on HN
Print view View original

51–60 of 114 posts

Re: If you’re trying to hack/deface a website, don’t submit a pull request

#51

Post by criley »

bratsche wrote: post #16
raimondious wrote: post #12

Earlier quoted context omitted.

Allow? They just released a feature that lets you drag and drop images into comments — it automatically uploads to s3 and inserts the URL in your comment. For some reason, they encourage it.

I assumed that was because of changes in Skitch. Everyone I know used to take screenshots with Skitch, upload them and Skitch would copy the URL into your clipboard and you could post into Github. But since Evernote bought them they closed things down and they're basically useless now, so I figured that was why Github was motivated to add this feature.

A thread about this recently popped up on /r/gamedev over on Reddit. Some recommendations were:

Puush, Greenshot, ShareX, HyperDesktop, Snag.gy, as well as some smaller apps written by users.

Maybe one will be useful for people sad about Skitch!

Re: If you’re trying to hack/deface a website, don’t submit a pull request

#53

Post by gknoy »

alexkus wrote: post #30
noamsml wrote: post #23

Earlier quoted context omitted.

Yep, password is common enough to unhash pretty easily. People need to learn to salt their hashes for fuck's sake.

In this case, salting would give almost no benefit given the poor password choice. The pull request included the code that does the hashing:- if( empty( $auth_pass ) || ( isset( $_POST['pass'] ) && ( md5($_POST['pass']) == $auth_pass ) ) ) $_SESSION[md5($_SERVER['HTTP_HOST'])] = true; else printLogin(); So any salt [was hash] used would have to be present in the code too. Given that such a simple password (8 digits)…

> A password of "p*l12nJ9£l ~98as2389bvkqsopfq£3oef2[olpe]wog!wei^og(8ni" would take an unrealistic amount of time to brute force, even if unsalted, and it's beyond the scope of any precomputed rainbow tables for similar reasons.

Since rainbow tables look up a password via its hashed value, I believe you could find something else that has a hash collision -- for all we know, it has the same hash as 'ponies'.

Re: If you’re trying to hack/deface a website, don’t submit a pull request

#54

Post by jlgreco »

thinkling wrote: post #17
nachteilig wrote: post #10

Earlier quoted context omitted.

A better title might not include puerile memes like "Protip".

Being sarcastic is puerile?

Also, "protip" has been in use for what, two decades now? When does something stop being a meme and just become an idiom?

Re: If you’re trying to hack/deface a website, don’t submit a pull request

#55

Post by RyanZAG »

mseebach wrote: post #50
zheng wrote: post #18

Earlier quoted context omitted.

In fact, I might go so far as to say that this was never intended to be merged. I'll assume whoever did this wants their message heard, and while it will never show up on CoderDojo, the hodgepodge of coding styles ensures that the "pull request" will go viral, thus possibly reaching a far greater number of people than it would have otherwise. /tinfoil

What message? I read through the thing and didn't see any message. There's some encoded arabic, but even if I could read arabic, I couldn't read it encoded.

There is actually a message:

"If there is no check on the freedom of your words, then let your hearts be open to the freedom of our actions"

"The war continues until the last Zionist remains on the beloved land of Palestine"

cough Shouldn't that be until there are no more Zionists in Palestine? Are they proposing to kill all Zionists until there is just one of them left, and then say "you're the last one here, you can stay".

Re: If you’re trying to hack/deface a website, don’t submit a pull request

#56

Post by [deleted] »

mseebach wrote: post #50
zheng wrote: post #18

Earlier quoted context omitted.

In fact, I might go so far as to say that this was never intended to be merged. I'll assume whoever did this wants their message heard, and while it will never show up on CoderDojo, the hodgepodge of coding styles ensures that the "pull request" will go viral, thus possibly reaching a far greater number of people than it would have otherwise. /tinfoil

What message? I read through the thing and didn't see any message. There's some encoded arabic, but even if I could read arabic, I couldn't read it encoded.

[deleted]

Re: If you’re trying to hack/deface a website, don’t submit a pull request

#57

Post by alexkus »

gknoy wrote: post #53
alexkus wrote: post #30

Earlier quoted context omitted.

In this case, salting would give almost no benefit given the poor password choice. The pull request included the code that does the hashing:- if( empty( $auth_pass ) || ( isset( $_POST['pass'] ) && ( md5($_POST['pass']) == $auth_pass ) ) ) $_SESSION[md5($_SERVER['HTTP_HOST'])] = true; else printLogin(); So any salt [was hash] used would have to be present in the code too. Given that such a simple password (8 digits)…

> A password of "p*l12nJ9£l ~98as2389bvkqsopfq£3oef2[olpe]wog!wei^og(8ni" would take an unrealistic amount of time to brute force, even if unsalted, and it's beyond the scope of any precomputed rainbow tables for similar reasons. Since rainbow tables look up a password via its hashed value, I believe you could find something else that has a hash collision -- for all we know, it has the same hash as 'ponies'.

Sure, but a hash collision for a specified value is still a needle in a haystack.

The sheer size of the keyspace (2^128) means that rainbow tables can only ever exist for a subset of the keyspace.

1M machines running for a year each capable of doing 20M MD5 hashes a second will still only cover 1/539514153540300709th of the MD5 keyspace.

But, yes, salting would prevent the use of rainbow tables completely.

Re: If you’re trying to hack/deface a website, don’t submit a pull request

#59

Post by diminoten »

klez wrote: post #44
eykanal wrote: post #19

"Social hacking": the next big thing.

Hacktivism? Has been the next big thing for quite a while actually.

Hacktivism is more like hacking for a cause. This is social hacking, where the hack is perpetrated entirely in the social space - adding a PI as a friend on Facebook, having a rival company able to see your LinkedIn profile page or hanging around in your company Skype channels - that sort of thing.

Re: If you’re trying to hack/deface a website, don’t submit a pull request

#60

Post by hdra »

I can't understand how did someone capable of understanding and doing a git pull request can produce this kind of "code".

Or how did he think that he can pull this thing off? is there a "10 ways to hack a website" where a git pull is one of them?

The fact that there is a code snipped a tutorial on "How to Create a Website With Notepad" and the whole thing seems like it came out from an old WYSIWYG editor, the thing obviously was made by a script kiddie. script kiddies uses git now? wow

Post reply on HN