Hacker News Reader

But he has a history of intentionally withholding instructions on how to run it just to avoid script kiddies from using this not for research.

View on HN

> But he has a history of intentionally withholding instructions on how to run it just to avoid script kiddies from using this not for research.

Interesting approach. Although looking at the Github it seems pretty straight forward (not being a script kiddie I can't speak for if it would be straight forward to them).

It's a vintage approach. I don't see much of this anymore, but before responsible disclosure was widely used, many exploit authors would intentionally insert small bugs (usually in the assembly payloads such as an interruption in the NOP slide) to prevent neophytes from abusing them.

Another vintage approach I see right off the bat are a few references in his code that is pointing toward Samy's own servers.... interesting he didn't obfuscate it or use a MITM server.

At the minimum, the host(victim) is establishing a websocket with Samy, so his server is aware who is being compromised or researched on.

Reply on news.ycombinator.com