jwcrux

I've been taking this course recently. Due to time constraints, I haven't kept up with the rest of the course, but the content is phenomenal.

If you want to learn machine learning, check out the course.

Basically, it looks like this affects servers that still support SSLv2. From the mitigation notes:

> To protect against DROWN, server operators need to ensure that their private keys are not used anywhere with server software that allows SSLv2 connections.

Also, I like this snippet:

> Disabling SSLv2 can be complicated and depends on the specific server software.

Great feedback, thanks! We're working on a new landing page that hopefully shows this in action a bit more, as well as provides a bit more information on why you might want to use gophish and when.

I'll keep this feedback in mind. Very helpful!

Sadly these spoofed emails from high ups are becoming all too common.

Shameless plug - if anyone is in need of an open source phishing training solution, I recently launched gophish to great feedback so far, and have a new version being dropped early next week: https://getgophish.com.

Everyone should have access to training to prevent this as much as possible.

If only there were a way to bypass that paywall.

I've had nothing but great experiences with gorm.

Previous discussion: https://news.ycombinator.com/item?id=11093779

Previous discussion before that: https://news.ycombinator.com/item?id=11074638

And the one before that: https://news.ycombinator.com/item?id=11070192

How do you feel this will compete with the growing popularity of bug bounties that are a crowdsourced pay-per-bug model?

Well the fact that gmail launched the same month this journal was published would have made that difficult for the author..

Assuming the source of the credentials (malware, other breaches, etc) is correct, 320k isn't outlandish by any means.

My Twitter bot, @dumpmon, comes across thousands of leaked creds per day, and that's only on pastebin.

This, combined with "checker" services that can verify credentials to services like TWC make things like leaked credentials be correlated into "from these x unique dumps, we have a group of creds that all work with TWC as well".

My guess is that TWC was alerted to a file someone was trying to sell that took leaks from other public/private dumps or malware infections, checked them against TWC, and verified that they all happened to work. This would be why TWC wouldn't be able to pin down an exact source - there absolutely doesn't have to be just one source.

It happens more than you think.

I'd be interested in hearing more about it and how it compares to other established honeypots (e.g. Kippo).

Is there a place I can go now to learn more?

Seeing the "_id" : ObjectId() fields indicates to me that this is likely a mongodb instance that was available to everyone.

There's been a lot of talk about these recently[1] that I'm surprised this didn't come up sooner.

[1] https://blog.shodan.io/its-still-the-data-stupid/

Oh, hi there! Author here. Glad y'all like the post! I've been on a break recently working on other projects, but I'm finishing up a post for this series soon, so stay tuned!

I'll be hanging around off and on, and am happy to answer any questions!

The "-g GOOGLEDORK" and the "--tor" flags are key to any script kiddies arsenal. That's why you see so many low-level db breaches posted on things like Pastebin. Set those two flags and you have automated sql injection for easy targets.

Any good resources where CS folks typically upload their papers? I've used the Google/Twitter/etc. "published research" pages, but those are obviously company-specific.

There was an interesting talk [0] and paper [1] presented at some security conferences about crawling the DHT for different purposes. It's been a while, but I remember these to be a great read.

[0] https://www.defcon.org/images/defcon-18/dc-18-presentations/...

[1] https://jhalderm.com/pub/papers/dht-woot10.pdf

Or the cyber security company LookingGlass[1]

[1] https://lgscout.com/

Currently working on an open-source phishing framework called gophish [1]. It will let businesses and pen testers conduct phishing simulations/engagements easily. And it's a full web app sitting on a go backend.

[1] http://github.com/jordan-wright/gophish

Anyone interested in this would also like Corakmi's excellent ELF101 diagram: https://code.google.com/p/corkami/wiki/ELF101

Neat! I really like the easy pricing model.

Quick question - are you concerned about trademarks (Amazon and such) being included as the phishing templates? Reason I ask is that I'm working on a hosted project [1] similar to this and have considered including default templates. I've held off for this exact reason.

Edit - another question, your screenshot in the intro page shows an email (in the Gmail client) coming from "support@github.com". Github has spf records setup so I would be interested to know how you manage to spoof the actual email address itself without getting flagged as spam.

[1] http://github.com/jordan-wright/gophish

It is... just not on Twitter anymore. The account was suspended about a week or two ago and I haven't heard anything back on my appeal from Twitter.

I created a Twitter bot called @dumpmon (recently suspended for no apparent reason) that scraped paste sites looking for password dumps and tweeting if one was found.

You can find the code here: http://github.com/jordan-wright/dumpmon.

Here are some stats if anyone is interested in what it collected over approx. 2 years: http://jordan-wright.com/blog/2015/05/26/two-years-of-at-dum...

> Fluency on the command line is a skill that is in some ways archaic...

I don't see this to be the case at all. Plus, having this be the opening line may cause people to equate archaic=I don't need this.

I'd suggest (would pull request but afk) that you remove "is a skill that is in some ways archaic".

This is a protocol (or specification)... do you think this might conflict with the naming of Python's pep8?

I like goquery[1] for doing this type of thing.

[1] https://github.com/PuerkitoBio/goquery

Hey there! Author here - thanks for posting this!

In response to this, I made an open-source honeypot (in Go!) called Elastichoney. I recently released every single log I collected in nice JSON form:

http://jordan-wright.github.io/blog/2015/05/11/60-days-of-wa...

Let me know if you have any questions!

Neat! Possible typo:

> After two weeks, if actions have been made on the deck then we throw it away.

Might be "if no actions"?

This is both a blessing and a curse for Go. The language touts itself as being easy to pick up, and has a batteries included stdlib.

This allows developers to quickly say "I know Go. Here's what's wrong with Go." since they believe they have learned all there is to know about it. This is good, since that's part of why Go is approachable.

However, this has downsides. As you showed, there are succinct features that can make the difference between "this is a bad thing" and elegant code.

Lizardsquad had thousands of exit nodes spun up all running the exact same config. It doesn't take state actor effort to do this.

Interesting analysis. And that's absolutely correct, the exit probability is what makes the difference.

It could be that they were all popped boxes running the same config, or it could be basic devops making sure all boxes setup have the same config. Both seem equally plausible, IMO.