unforum

[judderman]

Not exactly what I was getting at Al - more a targetted brute force. I see people posting lists of things they have tried, and there tend to be recurring themes (eg hesh, heshrecords, hesh_records, viard, viard_cd etc).

If a list had been compiled, it would be a potentially trivial matter to chuck this at any new password - and probably discount them as being useless. Could save a lot of headbanging & frustration.

However, after a night's sleep, I may have a mechanism that would stop this approach working. I'm not familiar with PHP tech, but if I get a spare hour or so I'll have a little play.

Regards, Stew

[noodrez]

A look at the source code shows that the password form isn't php, its Flash, so not sure how much a php attack/workaround will work. Your welcome to try anything though

[judderman]

Ah, but the Flash sends the text entered in the box to the aforementioned PHPs & deals with the reply to decide whether you get access/see the file or show the failure message.

[Al Green]

New article on the path of least time. There's not really anything we haven't already figured out, but the following statement is in the text.

[Guin]

Have posted to Kevin under Sanjay and in Daemons memorabilia for sale thread asking if he has a fave player.

[Al Green]

Thinking outside the box, I've noticed that the senitel 'views from earth' articles often get replies in the letters page. Maybe if we wrote an article about sports teams we may get some info that way.

What do people think about this?

[maevey]

More updates:

On Viard CD:

[GasparLewis]

Charlie in "Daemons Swag" would be me; sadly, the second half of the plan didn't quite work its way through, so now I'm left with Charlie just getting defensive.

But, yay, I gots a post on the interweb!

Otherwise, I guess we still have some social engineering to do, no?

[Juxta]

[GuyP]

Yes, but in fairness, that's not really what judderman was suggesting - more that you could push a *select* set of words at the PHP script to try out a bunch of combinations relatively quickly.

Real brute force, such as a dictionary attack, is inelegant and takes the fun out of things, but also puts a massive strain on the server. Trying out a selection of likely keywords isn't quite so heinous.

That said, I'd agree Kurt's post indicates this isn't going to work. Also, if you can get so far as compiling a list of possible passwords, why not just enter them directly into the password box and save yourself the trouble of messing with PHP?

[travelling performer?]

I've got an idea, but i haven't tried it yet....

[Juxta]

Sorry, again, META...(if the discussion continues from here on out, can we just lift the relevant posts and plonk them over in the Meta forum?)

[noodrez]

hmm... thats an idea... the next question is how can we get violet into the building? its meant to be a staff poker night and violet isnt staff

[travelling performer?]

[Guin]

Well what ever we are going to do we need to do it by tomorrow as Kevin and Brigdit are having a meeting