Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Humiliating IIS servers for fun and jail time

mll.sh

Post reply on HN
Print view View original

81–90 of 106 posts

Re: Humiliating IIS servers for fun and jail time

#81

Post by 0x1d7 »

Tiberium wrote: post #62
xeyownt wrote: post #55

Earlier quoted context omitted.

[flagged]

Why is it stupid to flag genuinely LLM-written content? It might've been thought out by a human, but the final version is clearly LLM-written or extremely heavily LLM-edited.

HN guidelines ask you to not do this.

> Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting.

While few read them, it might be helpful if @dang threw in the ", or LLM generated content".

Re: Humiliating IIS servers for fun and jail time

#82

Post by prussian »

t1234s wrote: post #15

Does anyone use IIS anymore?

I do. As others have replied, Windows Server--including IIS, means you have a domain joined machine, likely with an SPN of HOST/MACHINE.DOMAIN. Windows services and IIS App Pool Identities log in with an (g)MSA or virtual accounts (NT Service*) and you get a fully working and managed Kerberos experience without having to deal with 30, 60, 90 day password rotations. Log into your MS SQL Server with Kerberos, log into some other webapp's oauth2 flow with Kerberos, etc, it all just works. You can use WinRM with your native Windows shell without having to do anything special, and even technically bypass 2FA since that's just how it really works.

Can you do all this on Linux? Yes. Will it ever be set up correctly? Depends where you work, but based on my experience so far, not likely.

Re: Humiliating IIS servers for fun and jail time

#83

Post by zamalek »

prussian wrote: post #82
t1234s wrote: post #15

Does anyone use IIS anymore?

I do. As others have replied, Windows Server--including IIS, means you have a domain joined machine, likely with an SPN of HOST/MACHINE.DOMAIN. Windows services and IIS App Pool Identities log in with an (g)MSA or virtual accounts (NT Service*) and you get a fully working and managed Kerberos experience without having to deal with 30, 60, 90 day password rotations. Log into your MS SQL Server with Kerberos, log into…

> with Kerberos, etc, it all just works

I worked with customer's AD environments in the 2010's and I remember whiteboards of figuring out customer Kerberos config. "it all just works" is not my recollection of that 3-headed beast lmao.

Re: Humiliating IIS servers for fun and jail time

#84

Post by da_grift_shift »

0x1d7 wrote: post #81
Tiberium wrote: post #62

Earlier quoted context omitted.

Why is it stupid to flag genuinely LLM-written content? It might've been thought out by a human, but the final version is clearly LLM-written or extremely heavily LLM-edited.

HN guidelines ask you to not do this. > Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting. While few read them, it might be helpful if @dang threw in the ", or LLM generated content".

HN guidelines also say that HN is for conversation between humans.

If we are having a conversation with the author through their article, then the prose should be human too. :^)

Re: Humiliating IIS servers for fun and jail time

#85

Post by da_grift_shift »

merpkz wrote: post #44
andai wrote: post #14

Earlier quoted context omitted.

Several times, I wondered if Claude wrote it.

"This is the brute-force fallback when the smart approaches fail, and honestly, it works more often than you’d expect." Found the LLM generated part.

Ding ding ding!

https://github.com/blader/humanizer/blob/main/SKILL.md#33-co...

Re: Humiliating IIS servers for fun and jail time

#86

Post by bstsb »

da_grift_shift wrote: post #85
merpkz wrote: post #44

Earlier quoted context omitted.

"This is the brute-force fallback when the smart approaches fail, and honestly, it works more often than you’d expect." Found the LLM generated part.

Ding ding ding! https://github.com/blader/humanizer/blob/main/SKILL.md#33-co...

ironically that guide is AI-generated

Re: Humiliating IIS servers for fun and jail time

#88

Post by bartnp »

t1234s wrote: post #15

Does anyone use IIS anymore?

Yep.

And as an ignoramus: what it is that you are supposed to be using nowadays?

Think in the context of a small company making enterprise .NET (framework) code where Windows is the world, cloud wouldn't fly with the customers, SOAP is still king and your one IT guy is too busy to notice anything happened after 2010. Suppose also that entire software rewrites are impossibly impractical, and that while you'd love to take some security gains, you just don't have the capacity to do configuration deep dives let alone to gamble on something complex like Kubernetes.

Re: Humiliating IIS servers for fun and jail time

#89

Post by kreyenborgi »

raverbashing wrote: post #70
naturalmovement wrote: post #2

I front all my honeypots with the IIS landing page precisely because it attracts black hat jagoffs. Nothing makes me happier than knowing I've wasted hours of their time chasing their own tails.

Sounds like creating an url like aspnet_client/admin.php returning a WebObjects header might be a good hobby

Add in a zip bomb or two?

Re: Humiliating IIS servers for fun and jail time

#90

Post by giancarlostoro »

egil wrote: post #60
bryanrasmussen wrote: post #50

Earlier quoted context omitted.

I think it's from hackers, Joey the youngest hacker found the bad guys computers, not sure if it's an accurate quote since it's been years since I saw it.

"They're trashing! They're trashing our rights!"

"HACK THE PLANET!"
Post reply on HN