jwcrux

It looks like only the front end has changed. I have a Python library (github.com/jordan-wright/rapportive) that directly calls the backend API, and it still works fine.

I'm finishing up an open source phishing framework called gophish (http://github.com/jordan-wright/gophish). It's written in golang and angular, and has a full REST api and web frontend.

I'm personally excited about the possibility of creating an "Emergency Card" (http://www.apple.com/ios/ios8/health/) that's accessible from the lock screen.

Currently, I use a screen-shotted contact screen as my wallpaper for my ICE contact - just in case the worst were to happen. This will let me put more information, and might even let me have a wallpaper again!

The sql package in the standard library has support for parameterized queries, so you should use those instead of some random function to check for injections.

As a somewhat unrelated side note, I'm actually working on providing a free API written in Golang for CVE and CVSS entries. You can find it here: https://github.com/jordan-wright/cve-api

I don't think it measures the inbound/outbound bandwidth - especially over UDP. It's more of an SSH emulator (so to speak) with everything being logged (commands, files, etc.).

In addition, there are quite a few good visualization tools to show the logs made by kippo. You can save them to a db, plot them nicely, etc.

Great question. I had this exact same problem before I came across/contributed to a fork of kippo by micheloosterhof that implemented SCP (and more).

Check it out here: https://github.com/micheloosterhof/kippo

OP may also benefit from the use of an SSH honeypot. I use kippo (https://code.google.com/p/kippo/) with great success. It tracks all commands run, as well as keeps copies of all downloaded files.

In addition, it limits available commands to a certain predefined subset, allowing the host to prevent damage caused (e.g. a DoS attack in this case) by the system being compromised.

This is fantastic news!

> As Emacs and Vim have demonstrated over the past three decades, if you want to build a thriving, long-lasting community around a text editor, it has to be open source.

I agree whole-heartedly. In fact, I don't believe that editors like Sublime Text would have such a large following if not for the extended "free-trial" functionality.

It will be exciting to see where this project goes, and I think open-sourcing the rest of the editor was a great move.

This is garbage. Probably the same guys behind this other one recently (http://pastebin.com/qPxR9BRv).

One of the members of the full disclosure mailing list outed these guys here: http://seclists.org/fulldisclosure/2014/Apr/292

Only this time - they got smart:

> Please note that we are busy and we will NOT answer to questions, social engineering tentatives or dumb comments.

AKA

> Please note that we will not in any way prove this is legit (not falling for that again!)

Don't the stack exchange sites already serve for something like this?

I appreciate you giving it a shot. If the issue is with my package, please don't hesitate to let me know and I'll jump on it ASAP. Happy to help any way I can!

Neat! Shamelessly, I'd like to mention that you may also consider using the email (https://github.com/jordan-wright/email) package I wrote to serve your backend. I've worked to make it as simple and robust as possible. However, if you're happy with gophermail, by all means use it! Both are great packages, imo.

Same here- I wonder what functionality this has over easybib.

Out of curiosity - how did you come across that FB account? I'm showing a different account registered to that email address.

Somewhat off-topic, but I notice they are using xorm as their golang ORM. Anyone have experience with this? I use gorm, and I wonder how xorm compares.

This is absolutely the case. I think the original comment missed the assumption that the spammer already has the email addresses they spammed.

I'd also like to shamelessly plug my list of boilerplate templates (https://github.com/jordan-wright/boilerplate/blob/master/boi...) for as many languages I could find. Feel free to send a pull request if you know of one I didn't include!

Just curious - what does this have that Gist doesn't, with the exception of creating an account?

Ah, gotcha. You're saying that you sent an email with a valid envelope sender from your domain, with only a spoofed From: address, and gmail sent it back. If so, nice!

Sure - SPF may very well only check the envelope sender, but isn't that usually plenty? If you can't spoof the Linkedin envelope sender, and the mail goes to SPAM, who cares if the From: address is spoofed? The user likely won't see it anyway.

I believe you are correct: http://blog.sellhack.com/post/75825344472/why-we-built-sellh...

Anyone have the full text of the paper?

That's great to hear - thanks for doing so.

> as there were a number of "following nobody, and nobody follows" accounts

This is actually very common. Twitter recently took down a large number of bots and published a paper about their classification. One of the attributes of a Twitter bot account is it's reputation. By remaining idle, it can establish a reputation within Twitter's spam detection system, becoming more valuable when sold.

Edit: HUZZAH! After Googling like crazy, I found the paper: http://www.imchris.org/research/thomas_sec13.pdf

Many of the movies people torrent are new releases so that they don't have to pay the high price of going to the cinema to see it.

That's what I was thinking.. Found the JS file, Googled for AddTerminalShell to no avail. Didn't know if anyone else could recognize it or if it was custom.

Thanks for the help, though!

Does anyone know what terminal emulator they're using for vagrantcloud.com? It looks slick, I just can't identify it.

I'm currently working on an open-source phishing toolkit written in Go and AngularJS called gophish (http://github.com/jordan-wright/gophish).

Any idea what the bounty was for this finding?