~?~

~?~

~?~

¶ ¶ The natas11 problem contains a OTP (one-time-pad) vulnerability called a "many-time-pad". Likewise, the attack is called a "many-time-pad" attack. Below is some code that led to the solution and progression to the next level. The problem includes the server-side PHP source, but with the key used for OTP and the password for the next challenge censored. The goal of the experiment is to flip a "showpassword" flag that will echo the password for challenge 12 into the rendered html. From the source example we can see that it stores an encrypted json blob in a session cookie called "data", so we have an opportunity to inject our own cipher text on the client side. We know our data structure is a jsob blob stored in a cookie value as cipher text because the lab has the PHP source that runs on the server-side with some data censored. And since we have access to the coo...

Projects Data Resume Bookmarks ...

Projects Data Resume Bookmarks ...

Projects Data Resume Bookmarks ...

Projects Data Resume Bookmarks (all) The IRC bot for hackers Tenyks is an IRC bot written in Go. It relays messages between services and IRC. A Tenyks service Go library Quasar is the Go library for writting services for Tenyks. A Tenyks service Python library Tenyks Service is the Python library for writting services for Tenyks. Most services are currently written in Python. Self-hosted bookmarking SUFR is a self-hosted bookmarking program written in Go. It's simple to install and run because it's a single binary with no external requirements. It uses BoltDB under the hood for storage. Minimalistic static site generator Solarwind is a static site generator written in Go. It keeps things simple by compliling .md (markdown) to html and just copying html files into a public directory. The ugly duckling dat...

Projects · Climbing Data · Resume · Github · 0x3BA4034B I'm a rock climber, Go programmer, snowboarder and mountain man. You can find me on IRC. I frequent freenode and will always be in #infoforcefeed. I work for https://reflect.io and will be posting a bunch of my data as visualizations using our service. GPG fingerprint: 6E74 0249 A688 F563 509F AEF1 4856 403F 3BA4 034B Fingerprints can be found at the following locations: Github - website tls both sha1 and md5 Twitter - website tls sha1 Twitter - website tls md5 Twitter - gpg fingerprint Sun Mar 5 11:45:00 2017 - Tenyks update (0.10.0). Connection issues. Sat Mar 7 18:25:00 2015 - Solarwind: The bullshit-free static site generator © Kyle Terry · Everything is Creative Commons Attribution 3.0 ...

...

...

...

<header> <a href="/"><small class="fingerprint">DAAE E6B5 D729 10B7 4A6F 01F9 52A4 B5B2 F318 8BF2</small></a> &middot; <a href="/resume.html">Resume</a> &middot; <a href="/projects.html">Projects</a> &middot; <a href="https://github.com/kyleterry">Github</a> &middot; <a href="/kyle@kyleterry.com.0xF3188BF2-pub.asc">0xF3188BF2</a> </header> Systems Engineer Portland, OR kyle@kyleterry.com 971-275-5328 I am a system and software engineer in Portland, OR. I work on backend APIs and distributed systems mostly written in Go. Senior Software Engineer Portland, OR · Sep 2016 - Present Designing and building backend systems and APIs in Go for a data visualization SaaS platform. Software Engineer Remote Position · Dec 2014 - Sep 2016 Programming and engineering a customer facing web application for managing AWS secur...

DAAE E6B5 D729 10B7 4A6F 01F9 52A4 B5B2 F318 8BF2 · Resume · Projects · Github · 0xF3188BF2 You can find me on IRC. I frequent freenode and will always be in #infoforcefeed. Now Ebola free. BTC: 1KBNXvahSQHskxy8RmFtggc4VippXtoAZL Https fingerprints can be found at the following locations: Github - both SHA1 and MD5 Twitter - SHA1 Twitter - MD5 These are my words… Solarwind: The bullshit-free static site generator Tue Mar 3 17:25:00 2015 © Kyle Terry · The skies are finally black. ...

¶ ¶ The natas11 problem contains a OTP (one-time-pad) vulnerability called a "many-time-pad". Likewise, the attach is called a "many-time-pad" attack. Below is some code that led to the solution and progression to the next level. We know our data structure is a jsob blob stored in a cookie value as cipher text because the lab has the PHP source that runs on the server-side with some data censored. And since we have access to the cookies in our browser, we can start there: In [7]: cookie_data = 'ClVLIh4ASCsCBE8lAxMacFMZV2hdVVotEhhUJQNVAmhSEV4sFxFeaAw==' This is totally base64 encoding. So we can import our base64 package: In [5]: import base64 Now lets see what happens if we try to base64 decode our cookie_data In [9]: base64 . decodestring ( cookie_data ) Out[9]: &apos;\nUK"\x1e\x00H+\x02\x04O%\x03\x13\x1ap...

~?~

"You're asking me? The one who velcroed the shit out of the server closet?" DAAE E6B5 D729 10B7 4A6F 01F9 52A4 B5B2 F318 8BF2 Github | Resume | Blog | Projects | 0xF3188BF2 You can find me on IRC. I frequent freenode and will always be in #infoforcefeed. Now Ebola free. BTC: 1KBNXvahSQHskxy8RmFtggc4VippXtoAZL Https fingerprints can be found at the following locations: Github - both SHA1 and MD5 Twitter - SHA1 Twitter - MD5 The skies are finally black. ...

Shitbucket Add url Found 1 URLs Redis Tue, 06 Jan 2015 18:32:03 PST - http://redis.io Delete Permalink © Kyle Terry Code: Github ...

"You're asking me? The one who velcroed the shit out of the server closet?" DAAE E6B5 D729 10B7 4A6F 01F9 52A4 B5B2 F318 8BF2 Github | Resume | Blog | 0xF3188BF2 You can find me on IRC. I frequent freenode and will always be in #infoforcefeed. How many wars are we fighting now? 4, maybe 5? BTC: 1KBNXvahSQHskxy8RmFtggc4VippXtoAZL Aaron Swartz has died. May he rest in peace. ...

~?~

# ├── ††† │   └── EP † ├── 100 Demons │   └── 100 Demons ├── 108 │   ├── 18.61 │   └── A New Beat From a Dead Heart ├── 2Pac │   ├── 2Pacalypse Now │   ├── All Eyez on Me │   ├── Better Dayz │   ├── Greatest Hits │   ├── Loyal to the Game │   ├── Me Against the World │   ├── Pac's Life │   ├── R U Still Down_ (Remember Me) │   ├── Strictly 4 My N.I.G.G.A.Z.._ │   └── Until the End of Time ├── 2Pac & Outlawz │   └── Still I Rise ├── 7 Generations │   └── To See the End ├── A$AP Rocky │   └── Long.Live.A$AP ├── Aborted │   └── Slaughter & Apparatus_ A Methodical Overture ├── Across Five Aprils │   └── Collapse ├── AFI │   ├── decemberunderground │   ├── Shut Your Mouth and Open Your Eyes │   ├── Sing the Sorrow │   └── The Weight of Words ├── Akron_Family │   └── Set 'Em Wild, Set 'Em Free ├── Alexisonfire │   ├── Crisis │   └── Old Crows _ Young Cardinals ├── Alkaline Trio │   ├── Ag...

RIP Aaron Swartz "You're asking me? The one who velcroed the shit out of the server closet?" Mystery. \m/(-.-)\m/ Github Resume 0xF3188BF2 _________________ < cows don't talk > ----------------- \ ^__^ \ (oo)\_______ (__)\ )\/\ ||----w | || || ...

RIP Aaron Swartz "You're asking me? The one who velcroed the shit out of the server closet?" Mystery. \m/(-.-)\m/ Github Resume -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2.0.19 (GNU/Linux) mQINBFBt+0kBEADGhDP1ueWZjAQ/auyd5eZavrcet6o3/x5hhnhBV7PhLlthw4pA /CL9X8ebwwbEsxHC2U0i+feYDWRicx3rlDnL6ferK4qIMXF5SDabGxeZAPBtif4Y Ev1h6w89jnIOLAFnq6GF5FZWqN0zv/LMSjjrhH2LvwOU/Ms9+/vV/g+DZHRF1N6p sUV9ao3nw55/h6w2F21rrv4zvuilWGL8IPXgui6mftPKSMgUPSFUsdh35tLmE2oi 4qQka2Om3QVqfXWt5Roq9eQWxZhhsVHle+XI4VUwnNWwh9k+UMDNjAAqvl3Eartd AZzklHinGDbG+F8zSoseL7UAv7Ku2vxfjiwq/Ubzv4ox4t4iOiegPz4xfCfRSXOZ l8XWkzATLfWUrY0KkxqPuWE9MVJgRvrzN4PeTXYUPvTjLGw8oP9Cn6clqBR7CL9q 4jmGgKgia3D6g2J4fXQheZye7EDDt4hswbfAvl8JSmmj+5j4MVkl5OAQcnBrz1RI YsA15El9TBd+D8bnfQowZGlF6L2yZC+InjOSW9rBghgjST3sAwR2wSF+FyNuCEhm aoBQ26YOJ8iic76JpywO1A0g7GtYYcpv8jDOJ4XCjyL69OL3S++MdECmAgVZHety ZZLSR3yb2rgTMIMlcXswHGhEunofCPbvAykznV...

RIP Aaron Swartz "You're asking me? The one who velcroed the shit out of the server closet?" Mystery. \m/(-.-)\m/ Github Resume -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2.0.19 (GNU/Linux) mQINBFBt+0kBEADGhDP1ueWZjAQ/auyd5eZavrcet6o3/x5hhnhBV7PhLlthw4pA /CL9X8ebwwbEsxHC2U0i+feYDWRicx3rlDnL6ferK4qIMXF5SDabGxeZAPBtif4Y Ev1h6w89jnIOLAFnq6GF5FZWqN0zv/LMSjjrhH2LvwOU/Ms9+/vV/g+DZHRF1N6p sUV9ao3nw55/h6w2F21rrv4zvuilWGL8IPXgui6mftPKSMgUPSFUsdh35tLmE2oi 4qQka2Om3QVqfXWt5Roq9eQWxZhhsVHle+XI4VUwnNWwh9k+UMDNjAAqvl3Eartd AZzklHinGDbG+F8zSoseL7UAv7Ku2vxfjiwq/Ubzv4ox4t4iOiegPz4xfCfRSXOZ l8XWkzATLfWUrY0KkxqPuWE9MVJgRvrzN4PeTXYUPvTjLGw8oP9Cn6clqBR7CL9q 4jmGgKgia3D6g2J4fXQheZye7EDDt4hswbfAvl8JSmmj+5j4MVkl5OAQcnBrz1RI YsA15El9TBd+D8bnfQowZGlF6L2yZC+InjOSW9rBghgjST3sAwR2wSF+FyNuCEhm aoBQ26YOJ8iic76JpywO1A0g7GtYYcpv8jDOJ4XCjyL69OL3S++MdECmAgVZHety ZZLSR3yb2rgTMIMlcXswHGhEunofCPbvAykznV...

~?~