[00:01:54] *** Quits: vishwin60 (~psu-clc@wikimedia/O) (Quit: Later.) [01:14:29] Is this place still active [01:20:53] yessir [01:52:37] lol [01:57:38] heh [03:19:55] *** Quits: wolfcore (~wolfcore@unaffiliated/wolfcore) (Ping timeout: 250 seconds) [03:38:36] *** Joins: wolfcore (~wolfcore@unaffiliated/wolfcore) [04:53:25] *** Quits: wolfcore (~wolfcore@unaffiliated/wolfcore) (Ping timeout: 265 seconds) [05:19:02] *** Joins: wolfcore (~wolfcore@unaffiliated/wolfcore) [09:43:35] *** Quits: vishwin_ (~alliek@wikimedia/O) (Ping timeout: 240 seconds) [09:50:50] *** Joins: vishwin_ (~alliek@wikimedia/O) [11:26:07] no [12:06:07] damn google. After one day of scraping, they banned my ip [12:06:16] or at least made it so that I have to type a captcha [12:14:37] lol [12:14:42] are you trying to scrape google? [12:44:56] why not just google google; after breaking the internet, everything should become trivial [12:46:18] indeed [13:08:32] what are you trying to scrape from google? [13:10:13] the internet, duh [13:29:46] *** Quits: vishwin_ (~alliek@wikimedia/O) (Ping timeout: 240 seconds) [13:36:09] *** Joins: vishwin_ (~alliek@wikimedia/O) [13:40:08] naturally [15:16:06] *** Quits: vishwin_ (~alliek@wikimedia/O) (Ping timeout: 240 seconds) [15:22:50] *** Joins: vishwin_ (~alliek@wikimedia/O) [15:43:27] hm, http://www-01.ibm.com/support/docview.wss?uid=swg21084174 should be in the sidebar for HH C [15:43:27] Title: IBM Test Case Reduction Techniques - United States [15:44:01] because nobody wants to sift through six hundred damn lines for something that can be easily reduced to 50 and perhaps 20 [15:56:35] *** Quits: vishwin_ (~alliek@wikimedia/O) (Ping timeout: 264 seconds) [16:01:34] *** Joins: vishwin_ (~alliek@wikimedia/O) [16:56:54] I've decided 500 is enough since Google banned 7 of my ips [17:01:08] cold_sauce: run it through tor and rotate IP addresses? [17:04:59] !admin quit [17:04:59] yossarian: You do not have permission to do that. [17:05:03] uh.... [17:05:19] okay, we'll do this the hard way [17:05:27] *** Quits: yossarian-bot (~yossarian@104.131.177.124) (Remote host closed the connection) [17:05:39] *** Joins: yossarian-bot (~yossarian@104.131.177.124) [17:05:42] *** ChanServ sets mode: +v yossarian-bot [17:11:12] *** Quits: yossarian-bot (~yossarian@104.131.177.124) (Remote host closed the connection) [17:11:24] *** Joins: yossarian-bot (~yossarian@104.131.177.124) [17:11:27] *** ChanServ sets mode: +v yossarian-bot [17:36:03] yeah I guess I can do that but then I need to figure out how to use TOR on a remote server [17:36:25] *** Quits: yossarian-bot (~yossarian@104.131.177.124) (Remote host closed the connection) [17:36:36] *** Joins: yossarian-bot (~yossarian@104.131.177.124) [17:36:39] *** ChanServ sets mode: +v yossarian-bot [18:12:00] *** Quits: yossarian (~yossarian@user-12hdv2g.cable.mindspring.com) (Quit: And then he took off.) [18:20:36] *** Joins: woodruffw (~yossarian@unaffiliated/cpt-yossarian/x-8375832) [18:20:36] *** Quits: woodruffw (~yossarian@unaffiliated/cpt-yossarian/x-8375832) (Excess Flood) [18:21:36] *** Joins: woodruffw (~yossarian@unaffiliated/cpt-yossarian/x-8375832) [19:01:51] at your schools, do you guys do any sort of community events with your hacker clubs? [19:02:01] like going to local high schools and talking about CS [19:02:05] or going to a homeless shelter [19:02:08] etc [19:07:03] I think I one-upped myself in readings done out of boredom at work [19:07:16] NHTSA book on rubber tire engineering [19:15:30] we don't even have one hacker community here yet :-\ [19:32:15] I tried to start a hacker group but time flew and now I'm graduating [19:32:38] In one more semester, that is. [20:24:59] has anyone here used logstash, ossec, or splunk? [20:25:02] cc: iangcarroll [20:25:25] no, no, and no [20:25:42] loggly and papertrail are the log storage services I use [20:26:19] i used to use trend micro's IDS but I don't think it ever did anything [20:26:23] that's good and bad, I suppose [20:27:00] i'm looking through the apache logs of a comprimised host [20:27:11] is it your wordpress blog? lmao [20:27:11] and just grepping around isn't very efficient [20:27:18] i don't have a wordpress blog [20:27:24] what kept getting pwned? [20:27:25] my blog is octopress [20:27:36] someone else's site that I setup [20:27:40] ah [20:27:46] like [20:27:54] wordpress is great for setting up sites for other people [20:28:17] but i set it up when i was in high school [20:28:26] and i didn't know much about wordpress security at that point [20:28:34] so "let's install all the plugins!" [20:28:49] assuming you were in high school >4 years ago, I don't think anyone did :p [20:28:53] it's also on a shared php host [20:29:03] because back then DO didn't exist [20:29:16] so someone might have gotten in through someone else [20:29:31] is this apache server high-traffic? [20:30:06] lol, no, but the logs are still a mess because of all the bots, and wordpress logs are generally a mess because of all the GET requests they make in a single GET request [20:32:06] hm, I'm not too sure how to go about it [20:32:24] some coworkers recommended those tools i mentioned above [20:32:34] ah [20:32:46] one nice thing about working at facebook is i can shut the attackers other sites down [20:32:56] i found a useful domain in a referrer [20:33:02] definitely related to the attack [20:33:07] this guy has 20 other domains [20:33:09] no whois guard [20:33:17] and i have all the resources to take them down :P [20:33:24] lol, are you flagging domains by WHOIS data? [20:33:33] flagging his domains [20:33:47] well, i found where he registered this one domain [20:33:55] and then he had 20 others on the same account [20:34:04] i'm going to put them in threatexchange [20:34:10] and then send takedown requests [20:34:10] ah i c [20:34:58] are any AVs using threatexchange data for URL flagging? [20:35:08] i guess I could look myself... [20:35:34] on topic though, splunk looks too heavy duty for that [20:36:05] if you have filesystem access to the web root you could look for the most recent changes and narrow the log down based on those times [20:36:24] presuming files were written [20:36:42] yup, i've fixed most of the backdoors [20:36:43] s/presuming/assuming [20:36:43] iangcarroll probably meant: assuming files were written [20:36:57] but there's some other strange stuff going on [20:37:11] let's say foo.com is a wordpress site [20:37:32] when you access foo.com/bar/ it goes through index.php to rewrite.php to do the routing [20:37:48] doesn't seem normal [20:37:48] everything should go through foo.com/index.php [20:37:56] that's how it works [20:38:07] ...wordpress does that? [20:38:10] yea [20:38:18] it's all query strings on index.php, no? [20:38:25] are you sure rewrite.php is a legit file? [20:38:32] yes, this is called pretty urls i think [20:38:46] index.php is an alternative [20:38:59] lol, we haven't gotten to the strange stuff yet [20:39:12] the strange stuff is that there are webpages on the site like foo.com/spam [20:39:21] that still uses index.php tho [20:39:21] https://codex.wordpress.org/Using_Permalinks#Using_.22Pretty.22_permalinks [20:39:22] Title: Using Permalinks « WordPress Codex [20:39:35] there's htaccess magic going on [20:39:38] 99% of the time [20:39:44] right, htaccess is supposed to use index.php :p [20:40:07] unless there is a plugin installed for this, though I don't see why there would be [20:40:55] anyway, if you wanna find bad scripts clamav usually fares pretty well [20:41:48] wait, what are we disagreeing about? [20:42:08] if things are going through rewrite.php, that doesn't seem like vanilla wordpress [20:42:19] no, i'm saying that rewrite.php does the routing [20:42:20] wordpress routes things via index.php [20:42:32] index.php is literally two lines long [20:42:40] index.php includes rewrite.php [20:42:48] after like 5 includes [20:42:50] deep [20:43:31] it's like index.php -> wp-load -> wp-config -> wp-settings -> wp-rewrite [20:43:35] ah [20:43:42] anyways [20:43:46] the issue is [20:43:46] that makes more sense, I think [20:43:52] there exist pages like foo.com/spam [20:44:05] if i put logging in index.php [20:44:15] it's clear that these pages do not go through index.php [20:44:22] apache config? [20:44:36] all the config i can do is through cpanel and .htaccess [20:44:49] and i've verified the .htaccess files [20:45:11] most shitty webhosts install clamav with cpanel [20:45:17] see if that's in there and try running it [20:45:30] i'll check it [20:45:31] out [20:45:45] i mean, i know clamav, we use it at facebook [20:45:49] i just don't think the host has it [20:46:24] ah, kk [20:46:35] hm [20:46:54] two ideas come to mind, then [20:47:03] zip up the web root and run clamav locally from that [20:47:14] yea, i'll probably do that [20:47:17] or diff the files and file hashes from a clean wordpress install [20:47:32] so, i've already verified the wordpress install [20:47:38] sucuri scanner is a great wordpress plugin [20:47:42] that verifies this [20:47:48] it's the plugins and themes that are the issue [20:48:16] hm [20:48:57] well, if the wordpress install is clean, the worst this can do is inject itself into other plugins and themes [20:49:11] which is pretty bad [20:49:22] the first backdoor i found was in a theme [20:49:33] the second was in the wordpress folder itself [20:49:40] did you save the backdoor you found in the theme? [20:50:01] it was the standard execute this GET param if it exists [20:50:30] if you remember the code/file paths roughly, you might be able to find a writeup online [20:50:40] i searched for it [20:50:56] like if you have a hacked site and you just search for the URLs [20:51:04] you find thousands and thousands of similarly hacked sites [20:51:06] lol [20:51:09] did you grep for the same lines elsewhere? [20:51:19] those same lines didn't exist anywhere else [20:51:28] but my grep could have missed it [20:51:31] sigh, you're killing all my ideas here [20:51:36] i'll copy everything locally tonight [20:51:38] lol [20:51:45] i'm asking you after having spent a few hours on this myself [20:52:00] lol, I see [20:52:07] maybe just grep for exec/file_get_contents/file_put_contents [20:52:13] will do [20:58:38] lmk when you list the domains on TX btw [21:06:44] (y) [22:09:02] *** Joins: vishwin60 (~chatzilla@wikimedia/O) [22:16:44] do you guys know of any way to change the sampling rate of a file such that it would play the same on a player that is playing at like 16K as when playing on 44.1K? [22:18:39] use an audio file converter? [22:19:36] right now what you're hearing is slow-mo because the 44.1K file is playing at 16K? [22:20:06] hmm I'm not sure, actually. I'm using a speech to text library that listens at 16K and it's shitty speech to text [22:20:08] haha [22:20:12] you could use ffmpeg/avconv to change the sample rate probably [22:20:15] let me try it out with 16K and see what I hear [22:20:35] WOAH [22:20:37] IT'S SLOW MO [22:20:40] OMG THIS IS THE COOLEST THING EVER [22:20:43] I was gonna say audacity but you're dealing with a stream haha [22:21:35] ok now it makes sense why the speech to text was so bad [22:21:50] ffmpeg command line arguments too OP [22:22:44] ffmpeg is pretty amazing [22:22:58] it's like the imagemagik of audio [22:23:04] you can convert anything to anything [22:28:39] and it's mostly what makes VLC tick [22:30:02] ffmpeg is baller [22:30:11] although i think VLC uses a fork, avconv [22:33:28] VLC using libav may only be for certain linux distros that package a "virtual" ffmpeg that uses libav instead [22:51:31] hmm, it seems as though ffmpeg doesn't actually "anti-alias" the audio when it changes sample rates [22:51:39] guess i'll have to do it myself [22:54:14] Whoever made CMUSphinx is a sadist [22:54:16] my god [22:54:57] does it sound like microsoft sam? [22:56:48] hmm i haven't done text to speech w/ it, not sure if you can. [22:56:53] i'm doing speech to text [22:57:14] oh right [22:59:55] lmao [22:59:58] I just got a segfault [23:00:02] IN PYTHON [23:00:13] :o cython :( [23:16:03] lol nice [23:16:11] got a backtrace? [23:16:18] s/back/stack/ [23:16:19] m0shbear probably meant: got a stacktrace? [23:17:32] cold_sauce: haha i know what you mean [23:23:25] CMUSphinx [23:23:28] is awful [23:56:21] * vishwin60 has gotten segfaults in python before…