Skip to content

Matrix.org is Introducing Premium Accounts

Technology
110 56 94
  • 1 Stimmen
    1 Beiträge
    2 Aufrufe
    Niemand hat geantwortet
  • Anthem Demo - Napster plus Distributed Machine Learning

    Technology technology
    1
    1
    7 Stimmen
    1 Beiträge
    8 Aufrufe
    Niemand hat geantwortet
  • Musk's X sues New York state over social media hate speech law

    Technology technology
    1
    1
    1 Stimmen
    1 Beiträge
    9 Aufrufe
    Niemand hat geantwortet
  • 325 Stimmen
    40 Beiträge
    109 Aufrufe
    P
    Jimmy Carter gave up his tiny peanut farm. Yet people nowadays are just incapable of understanding the concept of conflict of interest?
  • The Quantum Tech Renaissance: Are We Ready?

    Technology technology
    1
    2
    0 Stimmen
    1 Beiträge
    11 Aufrufe
    Niemand hat geantwortet
  • Forced E-Waste PCs And The Case Of Windows 11’s Trusted Platform

    Technology technology
    116
    1
    317 Stimmen
    116 Beiträge
    194 Aufrufe
    K
    I was pretty lucky in university as most of my profs were either using cross platform stuff or Linux exclusive software. I had a single class that wanted me using windows stuff and I just dropped that one. Awesome that you're getting back into it, it's definitely the best it's ever been (and you're right that Steam cracked the code). It sounds like you probably know what you're doing if you're running Linux VMs and stuff, but feel free to shoot me a PM if you run into any questions or issues I might be able to point you in the right direction for.
  • 1 Stimmen
    8 Beiträge
    28 Aufrufe
    L
    I think the principle could be applied to scan outside of the machine. It is making requests to 127.0.0.1:{port} - effectively using your computer as a "server" in a sort of reverse-SSRF attack. There's no reason it can't make requests to 10.10.10.1:{port} as well. Of course you'd need to guess the netmask of the network address range first, but this isn't that hard. In fact, if you consider that at least as far as the desktop site goes, most people will be browsing the web behind a standard consumer router left on defaults where it will be the first device in the DHCP range (e.g. 192.168.0.1 or 10.10.10.1), which tends to have a web UI on the LAN interface (port 8080, 80 or 443), then you'd only realistically need to scan a few addresses to determine the network address range. If you want to keep noise even lower, using just 192.168.0.1:80 and 192.168.1.1:80 I'd wager would cover 99% of consumer routers. From there you could assume that it's a /24 netmask and scan IPs to your heart's content. You could do top 10 most common ports type scans and go in-depth on anything you get a result on. I haven't tested this, but I don't see why it wouldn't work, when I was testing 13ft.io - a self-hosted 12ft.io paywall remover, an SSRF flaw like this absolutely let you perform any network request to any LAN address in range.
  • 2 Stimmen
    8 Beiträge
    34 Aufrufe
    F
    IMO stuff like that is why a good trainer is important. IMO it's stronger evidence that proper user-centered design should be done and a usable and intuitive UX and set of APIs developed. But because the buyer of this heap of shit is some C-level, there is no incentive to actually make it usable for the unfortunate peons who are forced to interact with it. See also SFDC and every ERP solution in existence.