u/Skoobool

Those are the organisations bug hunters can earn lots of money from. Though if an org runs a bug bounty program they clearly have some kind of interest in fixing things.

Sounds good :)

Bypassing sanitisation is possible, but it depends on many factors.

Have a google for an XSS cheat sheet. It's worth learning some asp too, you might find a certain... Percentage... Of characters are not sanitised. Depending on implementation and code, of course!

Alright, I can respect that. See you around :D

Keep me in the loop if you like, I'm interested to hear about what else you get up to.

Have you considered starting a blog to document these things (anonymously, and only after a fix has been released of course!)

It will look good on a CV too.

Awesome stuff, congrats!!!

It is an XSS but as it's a product from oracle you would probably need to contact them instead of your school's IT. Oracle do have a bug bounty, though I've not read the terms so cannot say if they would pay out for it. There can be exceptions (recently acquired software, unsupported software, some don't pay out for XSS, etc)

It's safe, though they have got a cert on there for another domain. They should fix that.

If you prefer, here's a GitHub link: https://github.com/ethicalhack3r/DVWA

Not a bad idea, thanks for the suggestions!

Ah I see, just recognition. Could work... I didn't consider not having a reward.

A pi for Christmas, perfect. Don't be afraid to break it. the best way to learn is to break it then figure out how to fix it! Pi's are pretty durable machines and can handle a bit of abuse!

I am UK based.

This is a fairly short comment as it's quite late, so I'll try and reply further tomorrow.

With regards to your comment about a bug bounty program in schools, I've thought of this before and keep coming back to the idea. I'd love to do one here, but I'm not sure what the bounties or rewards would be. I'd like to reward the discovery of a bug but budgets are nonexistent and my pay isn't that great either so I couldn't fund much at all, though I don't mind spending some of my own money on it.

As a student, do you have any ideas for bug bounty rewards? What would you want? Remember that it can be tricky to give stuff to kids lol. Vouchers are money, so that is a no go.

Don't reward these comments of mine! Put the money you would spend towards buying a raspberry pi or something similar, load it up with Linux and mess around. Learn something! If you already know Linux, stick DVWA on it to really learn some web application hacking stuff. https://dvwa.co.uk

I look forward to hearing how it goes for you tomorrow if you do talk to the teacher.

So I just wanted to follow up with you as I credit you with the inspiration for the positive change that I needed.

I still think I should figure out a way to get a new job, but for now I'm actually fairly happy with my workplace so there's not such a rush to get there.

I went on that holiday. It was to Greece, and we all had an amazing time. As soon as I got back, I re-read your (bookmarked) comment here and booked another two weeks off of work (not a holiday, just a break) in October. My operating theory was that I could look forward to another break whilst at work which would make the current job seem less important. As soon as I remembered I had another two weeks off soon, I wouldn't take anything quite as seriously.

It worked!

It was a slow change as I fought old habits, but within a few weeks of returning to work after the holiday I was taking all my lunches, after another few weeks, I was much more relaxed during work hours and, most importantly of all, I was more relaxed at home in the evenings and weekends. I've since begun delegating much more work even though it takes them longer (they'll speed up) and even have periods of time blocked off in the calendar for "reflection". Which is something my boss fully supports and encourages!

I've started a blog, I've begun reading more (both fiction to relax and technical stuff to learn) and am looking into starting up more old hobbies again (home lab! Coding! Writing fiction! Gaming!) Starting with the non technical of course, I don't want to burn out for a different reason.

The change that has had the biggest positive impact, aside from the holiday, is the delegation. I've delegated some basic management tasks and have found much of my stress came from some of those. A disproportionate amount. I've gotta be careful to not move the problem onto this other guy but so far we've been working it all out quite well. I think we've got a balance. He can dedicate more time to it which results in a better experience for the others on the team. A win.

I still find myself feeling the pressure, but nine times out of ten it's entirely self inflicted. I still have to remind myself to take it easy, but I don't remind myself nearly as much as I did back in the summer.

Most importantly of all, the family. They've noticed a positive change and are very happy about it. We are having so much fun now, I can't believe I ever let myself get dragged down. I didn't see the signs, but now I know what they look like, I think I'll be able to prevent it in the future. Or at least identify an issue sooner.

If you hadn't written that original comment, which inspired me to take that holiday with the family, this Christmas period would be filled with anxiety and worry. Now I know that I'll be relaxing and having a great time.

Still got work to do, but... Well, I owe you one.

I say this as a school sysadmin with an interest in netsec - I would love it if a student came forward with some kind of vulnerability they had discovered (either legitimately or through being a script kiddie - either way there's clearly an interest there). It would make my entire year and I would go to such a great length to provide them with resources that I never had access to when I was doing the same shit as a kid.

From experience, however, most others in edu IT immediately go on the offensive or just don't give a shit. This is a real shame, there's some really interesting security opportunities (issues?) in schools. Huge software diversity and low budget = opportunities to learn everywhere.

One thing to remember is if they do react negatively if you report this, don't pursue anything else on their turf. That's asking for trouble.

It might be worth looking into the vulnerable system - is it built in house or a paid for solution? Most schools won't have the time (or skills) to build anything in house. If it's a paid for product, I would contact the company or individual that made it rather than the school's IT. They may be more receptive and likely to fix the issue.

Edit: and I want to make a point of congratulating you. You sound like you've got the right kind of head on your shoulders to get into the field. XSS is a simple issue and one that is very accessible, but it is often the issue that inspires many to get into security in the first place. You may have gone a bit over board with the precautions in this case (btw: the use of tor in itself is a form of identifier if no other students use it - have you ever logged in to this site using tor before? Or tried your own username? If so, and the school's IT have decent chops, they could make a guess it was you. Though of course, you can deny as you using it before isn't proof, but it's a decent indicator in this specific case) but there's no such thing as being too careful.

Keep at it. And remember, get permission. With permission, you can do anything.

Edit edit: might be worth talking to the school's IT and saying you're interested in IT security but do not mention any existing vulnerabilities you have found. You're just interested, nothing more, or they might start keeping a closer eye on you and think of you whenever something goes wrong. If they respond positively and encourage you, you have a strong indicator as to how they would respond to a vulnerability report.

It actually went really smoothly for me. Built in upgrade tool did the job, nothing broken. Though the site is fairly simple to be honest.

Pasted in from word or a website that used emdash perhaps?

Interesting. Might not be entirely malicious then, at least on its own. I'll take a copy of it when I'm back on a desktop and take a look through it. I'm not too good with JS but I'll see if anything odd sticks out.

What does this do? I have it on a router here (2925n)

I can't find much about it on Google (though I am currently limited to mobile so it's not too easy to research...)

The homelab is never complete.

Looks good though. Tell us about it!

On the flip side of this question, what are the best?

In our org we have first name initial, period, surname. When two people have similar names we use the first two letter of the first name instead of just one. This gets difficult when you have a few thousand users. Is there a better way? Unique IDs? John Smith becomes js487741?

Sounds good. As someone who wants to learn how to create a great team from a poor team, I'm interested to see what appears on there. Subbed.

Does it have a physical network port?

If so, plug it in. If you don't know the manufacturer, check your router for the device Mac address (if it can show this) then take the first six characters and search for them here. Might give you a bit of a lead.

You can also scan the IP range with a ping scan with nmap (make sure you're on the same subnet) and it should report on the manufacturer. Once you have identified and verified the device IP address, scan it more fully with nmap to see a list of open ports, then explore them either manually or Google them to see what they do.

I can't not see that fucked up right eye of hers. Maybe it's just an odd angle but it looks really off

I'll second the VPN suggestion, but I had a similar situation once before (it was a very short term thing, and kind of a joke, not a serious issue) and to make the sniffers life frustrating I downloaded popular torrents (seed a few Linux distributions or something to get many hits from many different addresses)

With adequate filters in wireshark or whatever this ain't gonna help much, but if they don't know too much about that you might make their lives more difficult as they have to pour through hundreds of thousands of torrent packets a second to get to what you're actually doing... Which will just be an encrypted VPN connection anyway. You'll be adding noise and pissing them off. You may not want to do this, of course, depending on the individual in question.

I did it, I got two weeks off work (somehow?! Not gonna question it) and booked a week long holiday with the family on a hot sunny island thanks to your comment. We leave in a few weeks.

I've had a few days to think on it and you're 100% right about work life balance. Just gotta take it slow. Might mean a new job, might mean just taking my current job a little less seriously. Either way, what happens in life is more important than work.

I feel you with the team size, we're on a similar scale across or locations. I hadn't considered assigning an engineer to a location, but you and another commenter mentioned it so I think we'll give it a go. Thanks for the insight!