SkullSecurity
skullsecurity.org · Personal blog · on HN since 2010
SkullSecurity is a security blog covering CTF writeups, password leaks, hash length extension attacks, and DNS tricks.
What HN saysHN links it for its password lists, the Facebook data torrent, and security writeups, often in discussions about password handling and DNS traffic.
19HN people shared it
6linked it in comments
14stories submitted
189story points
13 years agolast shared
2010people per year2026
Most-shared posts
- 1Everything you need to know about hash length extension attacks (2012)2 people · 63 points · first shared 2012 · 17 comments on HN
- 2Battle.net authentication misconceptions2 people · 60 points · first shared 2012 · 36 comments on HN
- 3Return of the Facebook Snatchers2 people · 3 points · first shared 2010 · discussion on HN
- 4Listing of public password leaks2 people · 2 points · first shared 2010 · discussion on HN
- 5Stuffing Javascript into DNS names1 people · 35 points · first shared 2010 · 7 comments on HN
- 6Stuffing Javascript into DNS names1 people · 13 points · first shared 2012 · 1 comments on HN
- 7Locks that can re-key themselves?1 people · 5 points · first shared 2011 · discussion on HN
- 8Epic "cnot" Writeup (highest value level from PlaidCTF)1 people · 2 points · first shared 2013 · discussion on HN
- 9Weaponizing dnscat with shellcode and Metasploit1 people · 2 points · first shared 2010 · discussion on HN
- 10Hacking crappy password resets (part 1)1 people · 1 points · first shared 2013 · discussion on HN
- 11Return of the Facebook Snatchers1 people · 1 points · first shared 2010 · discussion on HN
- 12Followup to my Facebook research1 people · 1 points · first shared 2010 · discussion on HN
- 13Padding oracle attacks: in depth1 people · 1 points · first shared 2013 · discussion on HN
- 14The ultimate faceoff between password lists1 people · first shared 2011
- 15Fbdata.torrent1 people · first shared 2010
What HN people wrote when they linked it
repsilat · 2012-06-07
It's not great, though - it means that someone who hacks your server can get users' passwords a lot easier. I read a couple of weeks ago that Blizzard's games don't send the passwords to the server, they send a hash. Things are necessarily crappier on the web, of course.
Edit: there's more detail at the link below. It looks clear that in at least some of their schemes they deliberately do not send the client password to the server, which sounds like a decent idea.
http://www.skullsecurity.org/blog/2012/battle-net-authentication-misco…
jcromartie · 2012-06-08
You can integrate common passwords into your password choice UI.
These guys did a nice example: http://howsecureismypassword.net/
Lists are available from various sources. Here's a good page http://www.skullsecurity.org/wiki/index.php/Passwords
avar · 2010-07-28
A link to the actual torrent file: http://www.skullsecurity.org/blogdata/fbdata.torrent
quellhorst · 2010-07-28
The guy who did it, and a link to the actual torrent file: http://www.skullsecurity.org/blog/?p=887
gwu78 · 2013-08-29
8 bytes at a time.
Wouldn't that mean 100's, 1000's or 10's of thousands of requests for nonsensical subdomains of the same domain name (and that domain name is probably a silly one if you got it recently for 10 bucks).
This is not anomalous DNS traffic? My imagination just does not stretch this far. If the title was just "Transfer a file via DNS", maybe I could play along.
I think nstx preceded iodine.
Here's another one no one has mentioned yet:
http://www.skullsecurity.org/wiki/index.php/Dnscat
What I'd really like to see is an implementation of lcamtuf's old, pre-cloud/dropbox idea: daemon caches, specifically recursive DNS caches, as free, (temporary) distributed storage. Anyone can store data for free on 100's of 1000's of networked computers worldwide, otherwise known as recursive DNS caches. Currently we only store "domain names" on these servers, but as the OP shows, it's possible to encode more information into requests than just domain names.
Imagine if the encoded data was an image. With most recursive DNS servers, the data expires upon the TTL expiry. Snapchat via DNS.
tripzilch · 2011-04-15
> You can choose to l33tify different combinations of letters in the password. passw0rd may be in the dictionary, but is p4ssword, or pa$$word?
yes they are. well, actually, password cracking software (most used is Jack the Ripper) comes with a bunch of commandline tools that allow you to do substitutions and common variations to your password lists.
generally, when trying to crack a specific target, you start with a few "seed" password lists (common passwords, but also lists of target-specific jargon), and then apply the transformation tools on those to expand your lists.
say you'd want to crack accounts at an aviator forum, you'd include a list of airplane types and aviation jargon. then you'd apply the transformation tools, and you'll end up with boeing Boeing b0eing Bo3!ng, etc.
check this guy's blog, he writes about how it's (usually) done:
http://www.skullsecurity.org/blog/2010/the-ultimate-faceoff-between-pa… (analysis of leaked password lists)
http://www.skullsecurity.org/blog/?s=ripper (describes Jack the Ripper in these articles)