web application security lab

fthe net - The name says it all.


oh hai pls to hack?

August 21st, 2008 by RSnake

This email needs no introduction:

hai i want to give a presentation on hacking i know some want about hacking but i need the breif informaion on hacking please send me the some of the sites of the hacking or give me the papers of the hacking thanking you………………

This super hacker found me by searching for “paper on hacking.” Ph33r the skillz!

-RSnake

F* Full Tilt Poker

August 12th, 2008 by thrill

Last year I read an article that detailed the events of a particular tournament. In this tournament, it was extremely obvious, once you read what each player started out with and what came on the board after, that there was some serious cheating going on. And while I understand that on-line poker sites are filled with extremely lucky idiots, the logs clearly showed insider knowledge, for example, why would a player go all in with 7-2 off suit, pre-flop, yet fold ak suited?

The method behind it is actually very simple.

On-line poker sites use pre-dealt hands. The computer generated hands are first created, then they have to be verified that the winning hand is actually correct (it’s a bit tough for the computer to understand the concept of face cards). Then, these pre-dealt hands are entered into a database which then in turn deals to real players.

Now, FTP operators need to have access to these databases and each individual hand for the purposes of having a record in case a dispute comes in. Of course, these disputes could be in the case where 4 10’s beat a straight flush (the verification process could have missed the real winning hand).

So let’s say my good friend Bob is now a part of the operators at full tilt, I’m sitting on the button with 7-2 off suit, I tell him the hand number, he looks it up on the database, he sees that the big blind has A K off suit, but knows that two 7’s and a 2 will make their way on the board. He tells me that I have the winning hand and to bet big because the fool on the big blind is likely going to not only call, but go all-in.

Unfortunately for me, I was the fool with AK on the big blind, and the player on the button with his 7 2 was the one with the friend at FTP.

How can FTP prevent this type of abuse? Easy, deny access to hands that have not been played and put a 5 minute delay before the hands can be looked up through the database.

Of course, it is quite plausible that FTP has a room full of ‘players’ that pick up hands from bots to give it the realism of having someone actually type into the chat window, and as far as they’re concerned, they want the cheating to go on because they’re making more money by cheating anyway..

So in short, F* Full Tilt Poker.

-thrill

F* Wind chimes

February 20th, 2008 by id

You take something mildly annoying and make it extremely annoying, what good could that possibly be? If you’re alone in the middle of nowhere, go chime all you fucking want, but if you’re in earshot of me, SHUT THE FUCK UP. Do you really need something to alert you the fucking wind is blowing? The howling just isn’t enough and you need to hear some clattering and banging as well? How fucking deranged are you to think to yourself “my, that blowing sound isn’t any good, I’ll add the sound of metal randomly hitting metal to spice it up”???

Yahoo returns 3,590,000 hits for “wind chimes”, that’s over 3,590,000 sites trying to make the world a more annoying place, and 3,590,000 webmasters that need to die by having metal and glass shoved through their eardrums.

F* you Mr make noise noisier man.

-id

Retarded MMS

April 21st, 2007 by RSnake

So I get an MMS on my phone. Although my phone is running the Windows operating system, apparently it is incapable of getting MMSs. Here’s where my troubles begin. So I get a username and password and a website to log into. The website address does not contain a www (although that is necessary for it to function). Easily figured out. Next is the username and password.

So I look at the username, and I swear to you, it is something like “a1j4ufi3j2″ and the password is something super easy like “stats8bang”. So it takes me half a dozen times typing in the username to get it right, but the password is plaintext anyway (doesn’t even use the password type on the input box). Don’t ask me why they have utterly useless security. So I finally manage to log in and it just sits there. Oh, apparently this requires JavaScript. So I turn that on, hit refresh - sorry, no worky, gotta log in again… it continues to sit there. Uhh… switch browsers… log in half a dozen times… still sitting there… uhh… oh, I guess it’s loading something. Here I sit waiting, like a frozen idiot waiting for some stupid application to start loading…

Five fucking minutes later it loads a Flash movie for a stupid 30k image my girlfriend took of a funny sign. Ugh! So I try to download the picture embedded in the Flash movie using the hand dandy little download image button they have there. No, I’m sorry, that throws a JS error. Why? Why must you do this to me? I’m going to go punch my neighbor now - just cuz.

-RSnake

Best Advice Ever

March 16th, 2007 by RSnake

So there I am on a conference call with one of the world’s leading experts in UI design. Oh he just fucking rocks. He is so bad ass no one can hold a candle to him in his respective microscopic part of UI that he works on. So I am there, prepared to be stunned and amazed by his utter brilliance and then he hits me with the best advice ever:

“I think you should create a UI that is the best possible UI you can build.”

God, I’m glad there are people out there to do this big thinking for me. Where would we be without such brilliant scholars? Wait, how much are we paying this guy?

-RSnake

The wing man

January 20th, 2007 by id

Women don’t get it, men suffer through it, you know when you’ve lost and all you have left is to make sure your buddy comes through with the win.

It’s not fun, but it’s your duty, you’re the wingman. The one half to one hour it costs you is irrelevant. SUCK IT UP NANCY BOY!

So what does it mean to be the wing man? If you’re a guy with any sense of decency, and of course don’t give a fuck what women think (you are a guy right???), you know you’re not getting laid tonight, but your buddy just might…IF not for her cockblocking, jaba the hut, satanic guardian angel. You see her walking for the door, motioning her drunk and horny friend to follow her into the pit of self denial of her longings. She knows the only guy that will pay attention to her is the 52 year old drunk guy at the end of the bar; drinking southern comfort to the point of bobbing his head off the edge of the bar. So to “make things fair for herself” she tries to deny her friend the fruits of a drunken encounter with the man of her sloshed dreams, YOUR buddy.
Your duty, your honor as a man, your cruel punishment for not picking up the other hot chick is to play interference. You know what you have to do, though despising it, you must deflect, mesmerize and possibly sleep with the “Friend”.
You fucked up, but now you have to do the right, but oh so wrong thing.

So….
She’s fat:

Think of the HUGE tits, close your eyes and play with em.

She’s dumb:

You suck at being a wingman, if you can’t just put a sock in her mouth and fuck her to help out a friend…man.

She’s the ugliest women you’ve ever laid eyes on:

Close you’re eyes and pretend it’s not your freshmen year of college in the dorm hall on the 5th floor of Corbet hall at CSU, but it’s your birthday man, and she doesn’t give such bad head as you pretend she’s the sorority chick you saw earlier at the party and DON’T JUDGE ME MAN. Deny ever meeting her the next night, it’s going to take a while to come to terms with shit, but forget, just forget.

-id

F* Contracts

November 9th, 2006 by RSnake

I could barely believe this section of a contract I was asked to sign with a straight face:

Contractor agrees to perform, during and after the term of this Agreement, all acts that Company deems necessary or desirable to permit and assist Company, at its expense, in obtaining, perfecting and enforcing the full benefits, enjoyment, rights and title throughout the world in the Company Innovations as provided to Company under this Agreement. If Company is unable for any reason to secure Contractor’s signature to any document required to file, prosecute, register or memorialize the assignment of any rights under any Company Innovations as provided under this Agreement, Contractor hereby irrevocably designates and appoints Company and Company’s duly authorized officers and agents as Contractor’s agents and attorneys-in-fact to act for and on Contractor’s behalf and instead of Contractor to take all lawfully permitted acts to further the filing, prosecution, registration, memorialization of assignment, issuance and enforcement of rights under such Company Innovations, all with the same legal force and effect as if executed by Contractor. The foregoing is deemed a power coupled with an interest and is irrevocable.

In case you can’t read legal-eze this is sorta the legal equivalent of being sodomized with a telephone pole. No, I’m not signing it - not without the KY.

-RSnake

Next Steps

November 5th, 2006 by RSnake

I was seriously in the worst meeting a few months back. Not only was it poorly organized but then at the end the agreed upon next steps really just took the cake. This ridiculousness just never made sense. It was so bad I actually wrote them down to eventually put somewhere. I guess fthe.net is as good a place as any:

Next Steps

  • Roll out beta
  • Study what users want
  • Develop roadmap
  • Hire specialists
  • Develop unified backend
  • Build phenomenal products
  • What are success criteria?
    • Return users
    • Visits
    • Become competitive

My personal favorite was “build phenomenal products.” Uhm. Okay. That’s like saying “Step 1) get some paper. Step 2) Use some magic. Step 3) Fly to Mars” What exactly are the phenomenal products exactly? I guess they are pretty awesome with all those specialists we’ve hired after we’ve built out roadmap. There’s no way I could have come up with those next steps! Good thing we have such smart people working for us.

-RSnake

Re: Your Resume

September 13th, 2006 by id

Apparently my boss thought it would be a good idea for me to hire a new security guy for some upcoming work, so he posted on a few job sites and the results are sent to me. Turns out I hate everyone.

Dear person who has no chance of getting hired,

  • I don’t give a fuck what your middle name is.
  • I’m not reading 6 pages, you’re not that important.
  • Try to spell the name of the employer you “worked” at for 4 years correctly.
  • Your “Objective” seems to be rather broad for a job listed as “Sr Security Engineer”.

Objective: To contribute as VPE, CTO, principal architect, chief scientist, staff mentor, or hired gun consultant.

  • Once again the title is “Sr Security Engineer”, that means don’t email me from your AOL account.
  • “System Administration and Network Security” is not a “Professional Association”, it’s a fucking sentence fragment.
  • You listed “INTERNATIONAL HACKERS CONFERENCE LAS VEGAS” under “Education”, you mean defcon or blackhat was your professional edumafukincation???
  • I understand you may not want to email your resume from your current employer, that’s fine, but if you don’t have at least one external email address you can get securly to, you’re not a “security guy” in the first place, go away.
  • We don’t hire one handed engineers, they type half as fast.

SUMMARY OF EXPERIENCE: Over 10 years of Hand - On IT Network Administrator experience

  • A Windows 2003 Server logo in your resume is sad, pathetic and worthy of a cock punch.
  • Yeah I get it, you’re Chinese and don’t like plural words, but when the proper name of a product contains an “s” at the end, try and fuckin use it.

Network Management Tool: Ciscowork LAN Management Solution, CiscoWork 2000, Cisco Call Manager

  • Once afuckinggain how fucking half ass are you to not bother to change your objective to something that kind of sorta just maybe fits the position, this time the job title was “Senior Network Engineer”. LIE TO ME AND PRETEND THAT IS WHAT YOU ACTUALLY WANT TO DO.

Career Objective: To broaden expertise and apply my Electrical Engineering skill set in a creative manner to motivate present and future technologies.

  • You sent your resume today at 8:38AM, 11:13AM and 5:15PM, I deleted all 3 at 9:22PM.
  • If this appears in your resume, you’re not getting hired.

Member of International High IQ Society, USA

  • Almost more than anything else, I don’t fucking care what frat house you were in.
  • Gee, thanks for telling me about the position your applying for.

The Solution Architect is a sales focused technology specialist who creates great client intimacy by their technical expertise. As well as being viewed as a trusted technical advisor to the client, as a Solution Architect I’m also involved in developing new products and services, by working as the technical arm of the Practice.

  • Yes, it’s a technical resume, but this is just dumb

LANGUAGES: Spanish = Fluent

  • Is English that hard of a language? “and Linux in LAN”? wtf?

Have worked extensively for Troubleshooting and Designing networks comprising of Windows 2000/NT, Novell NetWare, and Linux in LAN as well as WAN.

  • Use words that are words please.

Troubleshooting, upgradation of system hardware as and when required.
Upgradation of System BIOS and firmware with latest available version.

  • It’s 2006, don’t put “proficient with a hammer” on your resume

DOS 5.x 6.x.

  • No, the word “Senior” implies that it didn’t start there, you’ve just had an inflated sense of importance from the start

My technical career started in 1985 as a Senior Field Engineer

  • You worked for a company called “GetRelevant” during dot com, you obviously have bad judgment…maybe that’s why your job title goes from VP to manager?
  • Well I have Remarkable knowledge on breathing

Remarkable knowledge on FTP

  • In professional communications do not email me using IRC slang

Pls find the profile of our consultant Jane Doe for QA positions

I’ll keep adding the foolishness as it comes in…

-id

Use Management Speak please, I don’t understand you!

July 7th, 2006 by id

Yes, I got this email today…

Hi team,

In a few cases recently, the management team in XXXXX has had difficulty understanding the meaning of some of your written communications. After considering this for a few days, I think I now understand what is happening. So please consider the following suggestions:

When you are writing to another engineer, you may continue use “engineer speak”
- abbreviations
- acronyms
- mis-spellings
- incomplete sentences.

When you are writing to anyone in management, you must always use “management speak”
- be sure to communicate the complete thought; write so that anyone could understand the subject, action, and status.
- avoid abbreviations, spell each word fully
- define all acronyms before using them
- spell each word correctly (always use the spell checker)
- use complete, properly-formed sentences.

-id