Hacker News Reader

Comment by xyst | Hacker News Reader

People like that is the reason why this list was created

https://github.com/minimaxir/big-list-of-naughty-strings/blo...

My personal favorite is this one though

  "If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you.",

View on HN

what a great github repo.

I enjoyed:

    #   Strings that may occur on IRC clients that make security products freak out
    DCC SEND STARTKEYLOGGER 0 0 0

and everything under:

    # Innocuous strings which may be blocked by profanity filters (https://en.wikipedia.org/wiki/Scunthorpe_problem)

I'm surprised about Scunthorpe, if any name with a profanity substring would trigger the filter I'd have thought this issue would be more common than Scunthorpe.

Yeah, such a filter would be a mbuttive problem due to all the mimanures.

This could exists a fun puzzle genre, replacing substforbidds of words with synonyms. Perhaps with muloanle dened itefractionns. Could even have replacementb agrosb lade boundaries.

Found some GitHub issues [1] with something similar: an enterprise firewall blocking a repo because it contained the string "arglebargleglopglyf" [2] in some tests.

The text was flagged as malicious because of its presence in the repo github.com/wireghoul/htshells [3]. However, the whole point of the word in the htshells repo is that it's an invalid command that breaks Apache, so it could have been almost any random string.

[1] https://github.com/search?q=arglebargleglopglyf&type=issues

[2] https://mume.org/help/arglebargle

[3] https://github.com/wireghoul/htshells/blob/master/dos/apache...

This one from link 3 caught my eye:

    "".__class__.__mro__[2].__subclasses__()[40]("/etc/passwd").read()

Looks to be a Python 2 specific way of trying to read a file in a sneaky way. I say Python 2 specific because Python 3 strings only have 2 supertypes now, so __mro__[2] is out of range, but __mro__[1] is 'object', and I'm guessing they were going for a file like class, but right now object.__subclasses__()[40] points at "mappingproxy".

And the only subclasses of object I can find with a read classmethod are these:

    109 <class 'codecs.StreamReaderWriter'>
    110 <class 'codecs.StreamRecoder'>

Found with:

    for i, x in enumerate("".__class__.__mro__[1].__subclasses__()):
        if "read" in dir(x):
            print(str(i) + " " + str(x))

    $ python2
    >>> "".__class__.__mro__[2].__subclasses__()[40]("/etc/passwd").read()
    'root:x:0:0:root:/root:/bin/bash\n ...

yep, there it is.

FWIW it’s looking for the `file` class which does not exist anymore an was a direct subclass of object: `open` now creates a TextIOWrapper<BufferedReader<TextIO>>.

You can still reach TextIO though _IOBase, in python 3.9 it’s object’s 101st subclass, then 0, then 0.

In 3.8 it’s 99, 0, 0.

This is pretty fascinating!

It's a shame subclass numbers do change from version to version, so there is no "one-size-catch-all" injection string.

Someone in this thread posted a solution with next() that iterates over subclasses to find the correct one. But an injection with spaces won't work as well when injected in jinja2 (something that original injection accomplishes in python2).

> It's a shame subclass numbers do change from version to version, so there is no "one-size-catch-all" injection string.

Yeah going through subclasses is not trivial, but that's the way exploits work really. And usually once you find a target the version is going to be reliable.

An other big injection sources in Python is when modules are available in the evaluation context, that's way more risky than exposing classes, functions, and objects due to Python's transitive import nature: anything you import becomes an attribute of your module, meaning if your module is visible so are its module. And very often there's a point at which `sys` is imported somewhere within transitive reach. Once `sys` is available they're out of the interpreter.

Python 3 `system` example

  next(sub for c in "".__class__.__mro__ for sub in c.__subclasses__() if '__init__' in dir(sub) and '__globals__' in dir(sub.__init__) and 'system' in sub.__init__.__globals__).__init__.__globals__['system']('cat /etc/passwd')

My favorite of these was the discussion section of a popular lefty blog where any mention of "socialism" or "socialist" was routed to moderation and had to be unblocked manually. Not because of profanity, but a particularly pernicious spam problem at the time.

I am surprised that the EICAR test string is not here:

    X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

https://en.wikipedia.org/wiki/EICAR_test_file

From README —

Likewise, please do not send pull requests which compromise manual usability of the file. This includes the [EICAR test string](https://en.wikipedia.org/wiki/EICAR_test_file), which can cause the file to be flagged by antivirus scanners, and files which alter the encoding of `blns.txt`. Also, do not send a null character (U+0000) string, as it [changes the file format on GitHub to binary](http://stackoverflow.com/a/19723302) and renders it unreadable in pull requests. Finally, when adding or removing a string please update all files when you perform a pull request.

+++ATH0

That one normally only worked reliably if you could figure out some way of introducing a short delay between the +++ and the ATH. There may have been some crap modems that didn't require the delay, but that wasn't the spec.

(the 0 was not necessary, btw, as 0 is the default for the ATH command)

Why is "nop" your personal favorite? I don't get it.

I have to confess this freaked me out well played!

I can get why testing for "Jimmy Clitheroe" and "Horniman Museum", but can't make a reason for "Linda Callahan".

Perhaps it's 'allah'?

In February 2006, Linda Callahan was initially prevented from registering her name with Yahoo! as an e-mail address as it contained the substring Allah. Yahoo! later reversed the ban.

https://en.wikipedia.org/wiki/Scunthorpe_problem

that was unexpected. but I guess I should have expected it given how much islam is iconoclastic. it's probably muslims protesting the use of the name of allah in email addresses that caused it (alternate explanation: the word was raising too much false positives in Xkeyscore)

1. That’s not what iconoclastic means. If you actually care about iconoclasm in Islam, the Saudi government has unfortunately destroyed almost 90% of Muslim holy sites without a word from other countries.

2. The Second Commandment Christians follow is “Thou shalt not take the name of the Lord thy God in vain” and I can tell you a lot of Christians follow that.

3. You have it backwards. It’s not Muslims’ fear of the name of God, it’s Yahoo’s fear of literally just the Arabic word for “God.”

It's their fear of people constructing offensive names (<deity>-sucks, etc.) that will spark another Charlie Hebdo incident.

Any idea why "Lightwater Country Park" is on the list?

Twat, maybe?

"twat" substring probably.

Most of the things in this list I can see what they're testing for but your favorite stumps me. Can you give me a hint? Thanks.

I assume it's a joke to test if reality is a simulation or a dream.

That makes complete sense and it went right over my head. Thanks

When Elon Musk was talking about reality vs simulation, I couldn't help but think he's onto something

If you were going to play a simulation game, you would not be a normal participant. You would not play a normal person, you would play the successful guy at the top launching spaceships and making money.

So - the chances of Elon Musk being in a simulation are very high compared to normal people.

I would assume most simulations would be more academic/business related, like how we have tools that simulate a wind tunnel, rather than for entertainment purposes

The entities running the simulation knew you would think like that, which is why they put Elon Musk there so the simulated you thinks "nah, if I were simulated my life would be awesome".

I had the exact opposite take, that him talking about that is (further) evidence he's a bit off his rocker. Not that being off his rocker is necessarily a problem. In fact, it might be the only reason he's doing interesting stuff with his wealth instead of just trying to turn it into more wealth for the sake of a high score.

But I'm not Elon Musk, and I'm not super rich and successful, so therefore I am real and he is as well and not a simulation. I don't know what things are like your simulation, however.

His mistake in his assumption is all games are the same. Sometimes I play a game that is kind of 'boring' and relaxing like a bit of solitaire. Other times I play a fragfest with 15 other people looking to take my head off. Sometimes I intend to play something exciting and end up playing max/min stats. Sometimes I just suck at the game...

Reply on news.ycombinator.com