Skip to content

lemm.ee is shutting down at the end of this month

Technology
130 75 31
  • 71 Stimmen
    11 Beiträge
    0 Aufrufe
    P
    Very nice and very impressive
  • One-Click RCE in ASUS's Preinstalled Driver Software

    Technology technology
    9
    29 Stimmen
    9 Beiträge
    3 Aufrufe
    M
    Yeah, Lemmy has a VERY large Linux user base, which means Windows discussions tend to get mocked or dismissed. But the reality is that Windows is still the dominant OS for the vast majority of users, by leaps and bounds. Linux runs the world’s infrastructure, but Windows is what the average user boots up every day. “This exploit only works on the average user’s OS. And it only works if the user clicks the “yes” button to escalate permissions, which they have been conditioned to always do without question. Obviously this isn’t an exploit to worry about.”
  • Hiring Developers in Eastern Europe

    Technology technology
    1
    0 Stimmen
    1 Beiträge
    3 Aufrufe
    Niemand hat geantwortet
  • 4 Stimmen
    12 Beiträge
    3 Aufrufe
    guydudeman@lemmy.worldG
    Yeah, I don’t know how they’re doing it. They’re using some “zero trust” system. It’s beyond me.
  • Microsoft pulls MS365 Business Premium from nonprofits

    Technology technology
    37
    1
    48 Stimmen
    37 Beiträge
    11 Aufrufe
    S
    That's the thing, I wish we could just switch all enterprises to Linux, but Microsoft developed a huge ecosystem that really does have good features. Unless something comparable comes up in the Linux world, I don't see Europe becoming independent of Microsoft any time soon
  • 1 Stimmen
    8 Beiträge
    5 Aufrufe
    L
    I think the principle could be applied to scan outside of the machine. It is making requests to 127.0.0.1:{port} - effectively using your computer as a "server" in a sort of reverse-SSRF attack. There's no reason it can't make requests to 10.10.10.1:{port} as well. Of course you'd need to guess the netmask of the network address range first, but this isn't that hard. In fact, if you consider that at least as far as the desktop site goes, most people will be browsing the web behind a standard consumer router left on defaults where it will be the first device in the DHCP range (e.g. 192.168.0.1 or 10.10.10.1), which tends to have a web UI on the LAN interface (port 8080, 80 or 443), then you'd only realistically need to scan a few addresses to determine the network address range. If you want to keep noise even lower, using just 192.168.0.1:80 and 192.168.1.1:80 I'd wager would cover 99% of consumer routers. From there you could assume that it's a /24 netmask and scan IPs to your heart's content. You could do top 10 most common ports type scans and go in-depth on anything you get a result on. I haven't tested this, but I don't see why it wouldn't work, when I was testing 13ft.io - a self-hosted 12ft.io paywall remover, an SSRF flaw like this absolutely let you perform any network request to any LAN address in range.
  • 56 Stimmen
    4 Beiträge
    4 Aufrufe
    cupcakezealot@lemmy.blahaj.zoneC
    !upliftingnews@lemmy.world
  • *deleted by creator*

    Technology technology
    4
    1
    0 Stimmen
    4 Beiträge
    9 Aufrufe
    O
    I feel like I'm in those years of You really want a 3d TV, right? Right? 3D is what you've been waiting for, right? all over again, but with a different technology. It will be VR's turn again next. I admit I'm really rooting for affordable, real-world, daily-use AR though.