darkport

I wanted to figure out just how exploitable php2shell and http2shell were in practice, so I've created two purposely vulnerable web apps: https://brotli2bitcoin.com & https://php2bitcoin.com with a standard production config -- pop an RCE and find the flag to claim the $1K BTC

And to make it interesting, I setup a live stream showing every single attack attempt happening live https://www.youtube.com/watch?v=w7_EJWqRzvw

Have fun!

FYI you can spin up 4xH200s at ~$9/hr on spot. Just ask Codex and it'll do it end to end.

Thanks for the suggestion, will look into it.

We’re pretty new! :) They didn’t want to provide comment on our post but they did offer comment via The Register.

Founder of CodeWall here. It's quite funny because whilst an LLM did write the bulk of the posts factual content (based on the agents findings), I wrote the intro and summary at the end. That's just my writing style. Feel free to read my personal blog to compare: https://darkport.co.uk

Is there any evidence of CSAM being generated by Grok? Because I’ve never seen any and I use X every day.

Sure, I saw the bikini pics which I agree is weird and shouldn’t be allowed but it’s not CSAM under a legal definition.

I think this is true for deeply complex problems, but For everyday tasks an LLM is infinitely “better”.

And by better, I don’t mean in terms of code quality because ultimately that doesn’t matter for shipping code/products, as long as it works.

What does matter is speed. And an LLM speeds me up at least 10x.

I've always wanted to do something similar at scale. Generate all possible random mobile numbers 11^10, check if they have a WhatsApp profile pic and run it through AWS' rekognition celebrity model (https://docs.aws.amazon.com/rekognition/latest/dg/celebritie...). You could identify the personal numbers for a _lot_ of VIPs, politicians, etc.

I created a tool awhile back that pretty much does this https://github.com/eth0izzle/Needl - it’s gone stale so looking for new contributors

What year is it?

Eh, BlockCypher are based in CA. Court order could force them to sinkhole any API requests to that wallet.

Completey agree. I thought AirBnB was great back in the day but these days I only find it 'useful' (read: cheaper) when sharing a large property with friends. 99% of the time a 4*+ hotel cost is similar if not £20 - £40 more overall which I would be willing to pay because of your list above.

I made the mistake of buying an HP printer years ago. But I found a 'neat trick'. You can subscribe to the free Instant Ink program using a test credit card, i.e. a number from https://developer.paypal.com/docs/payflow/payflow-pro/payflo.... And ~2 days later you have ink sent to your door. Fuck you HP.

This is great. One of my side project ideas is to build an ANPR based app and 'social network' starting with basic tracking, I.e. you've passed this car 4 times before. I'm new to the ML world so still learning vut Do you think this is feasible to run in real time using CoreML on iOS?

I developed a tool called shhgit.com that watches code commits across GitHub, Gitlab and Bitbucket in real time. In a ~24 hour period you will find 100s of valid SendGrid credentials/API keys so this does not surprise me. They really need to enforce 2FA and IP whitelisting for API key use.

How are you installing Firefox extensions in mobile? Is it Android only?

Docker. Which hasn’t really helped me get _better_ at writing code. But my God it’s helped my productivity and I’m finishing more and more side projects because of it.

This is great. I'd love to see automated recurring scheduled scans and it e-mails me the results if anything changes.

Author here. I released the tool a few weeks back and since downsized the EC2 instance. So this post pretty much killed the box. I've just up-sized it again but it's still running fairly slowly due to high load. It typically finds around 5 secrets/a second. Corresponding blog post here: https://darkport.co.uk/blog/ahh-shhgit!/ and you can run your own instance here: https://github.com/eth0izzle/shhgit

Would people here use a similar service, but the ingredients are automatically sourced from your local supermarket and delivered to your door? Almost supermarket prices with still the convenience of not deciding what to eat and buying the separately.

It’s by design. The default for all F9 rockets is to land off-shore in the water. Once all the checks are complete and the rocket is “happy” and all systems are performing nominally, it redirects to the landing zone (either a barge or on land).

It’s quite hard to do this randomly. You need a substantial data set to train the machine to recognise your targets face. You can’t just upload 5 or 6 blurry social media photos.

How do you know they use TeamSite? A similar hack occurred against TicketMaster. I wonder if they use TeamSite as well. Maybe a 0day?