@valorin@phpc.social
@valorin@phpc.social avatar

valorin

@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️
I hack stuff on stage for fun. 😈
I used to be found at: https://infosec.exchange/@valorin
#searchable

This profile is from a federated server and may be incomplete. Browse more on the original instance.

andrewfeeney, to Laravel
@andrewfeeney@phpc.social avatar

I don't miss Twitter but I do miss the community I used to interact with there. I don't really see any evidence that those folks are likely to give up on it soon, but I do wish they would. I expect the hard-liners wouldn't end up on Mastodon anyway.

Welp, will just have to do my best to build and contribute what I'm missing to this community.

valorin,
@valorin@phpc.social avatar

@outofcontrol @andrewfeeney @freekmurze @nunomaduro I stick around Twitter because I need to market my stuff. But some days I wonder if it's worth it.

I refuse to pay for blue/premium/whatever-its-called-now though.

valorin,
@valorin@phpc.social avatar

@andrewfeeney @ramsey @tappenden This is the reason I'm still on Twitter, as much as I hate it. I need to be an active and relevant member of the community to sell my stuff, and unfortunately that community is still on Twitter.

Plus, all the announcements go out there, official stuff links there, and I would miss too much if I left.

valorin, to php
@valorin@phpc.social avatar

Just how secure is PHP's strip_tags()? 🤔
Is it safe to use everywhere, or only in some situations, or should you avoid using it completely? 😕

Let's answer that question: https://securinglaravel.com/p/security-tip-is-strip_tags-secure

valorin, to php
@valorin@phpc.social avatar

I've had this question many times, so let me take you through the steps I follow when provisioning and securing apps on Forge...
https://securinglaravel.com/p/in-depth-securing-apps-on-forge [$]

valorin, to random
@valorin@phpc.social avatar

Day two @ !

It's gonna be another fun one, and don't forget to stick around to the very end! I'm last up, teaching you how to Th1nk Lik3 a H4acker. 🥷

This one's fully interactive, so bring your phones and get hacking. 😈

valorin, to php
@valorin@phpc.social avatar

You need to protect your .env file, and search engines like to snoop on all of your files, so be careful what you leave lying around! 😈

Or, in other words... Install your apps properly!

https://securinglaravel.com/p/security-tip-protect-your-env-file

valorin,
@valorin@phpc.social avatar

Just a reminder that Securing Laravel subs are currently on sale for and !
(You don't need to attend to get the discount 🤫 )

Sign up for weekly security tips and monthly In Depth security articles about and !
👉 https://securinglaravel.com/3f37d076 👈

valorin, to php
@valorin@phpc.social avatar

Since I'm in Austin for , and is in two weeks, my traditional Securing Laravel discount is up: https://securinglaravel.com/3f37d076

Sign up to learn all about and security!

valorin, to random
@valorin@phpc.social avatar

I was procrastinating yesterday and noticed an app I use has a security bounty, so I went digging...

20 minutes later, I popped a top-tier vuln! 😈 🎉
Reported it via email, it was acknowledged in 12 mins, fixed in 17 mins. 🥰

That's how you do security properly.

valorin, to random
@valorin@phpc.social avatar

Anyone switched from Notion to https://obsidian.md?

I really like the idea of having everything local, but I use databases, templates, and properties A LOT. So I'm curious how you went replicating the experience of some of the advanced features.

valorin, to php
@valorin@phpc.social avatar

This week's "I can't believe I haven't already written about this" Security Tip: Disable Debug Mode on World-accessible Apps!

It may seem obvious, but you'd be surprised just how often I come across websites where it's left enabled! 😲
https://securinglaravel.com/p/security-tip-disable-debug-mode-on

valorin, to php
@valorin@phpc.social avatar

I've just had some availability open up in December for my Laravel Security Audits & Penetration Tests! 🕵️

It's my only slot until March, so reach out if you need an audit before the end of the year, or you want me to test your app!
https://valorinsecurity.com/

valorin, to random
@valorin@phpc.social avatar

Any crypto/password entropy nerds able to help me out calculating possible combinations/entropy?

If an 8 character password with 88 possible characters to choose from has 3,596,345,248,055,296 possible combinations, how many would a password of the same length where one character MUST be a letter [a-zA-Z], one MUST be a number [0-9], and one MUST be a special char (with 26 options) be?

Is it just: 52 * 10 * 26 * (88^5), totalling 71,349,355,151,360?

I feel like that's missing something?

valorin,
@valorin@phpc.social avatar

Ah, I just found https://www.omnicalculator.com/statistics/password-combination, which I believe does the calculations for me.

So for the 8 char password without restrictions, it says 3,378,005,142,470,400 total passwords.

Requiring a letter, number, and symbol gives me: 1,739,426,494,740,480

Putting them side by side:
3,378,005,142,470,400
1,739,426,494,740,480

That seems like what I'm looking for. 🙂

valorin,
@valorin@phpc.social avatar

And I guess the follow up question - is this sort of comparison actually useful?

Does enforcing special characters being included in generated password actually lower their security, or does it not really matter?

valorin,
@valorin@phpc.social avatar

@oliver Awesome, thanks for the practical explination. That basically fits with what I'm thinking too. 🙂

valorin, to Tolkien
@valorin@phpc.social avatar

For the Tolkien fans here: https://www.kickstarter.com/projects/expectedsoundscape/an-unexpected-soundscape-and-a-soundscape-of-ea
I have the LOTR soundscape, and it's a pretty great way to read the books or listen to the audiobook.

valorin, to php
@valorin@phpc.social avatar

One of my favourite (and oh so simple) hacker tricks is to abuse JSON support in APIs and pass TRUE instead of the actual API key. If the code does loose comparison, you don't need the key! 😎 😈 🍿
https://securinglaravel.com/p/security-tip-type-juggling

valorin, to php
@valorin@phpc.social avatar

Ok Laravel folks, it's time to increase your bcrypt rounds because 10 is no longer considered secure enough.
https://securinglaravel.com/p/security-tip-increase-your-bcrypt

valorin,
@valorin@phpc.social avatar

@derickr It was the PHP RFC that triggered the upgrade in Laravel. 🙂

I'm not sure where I stand on the question of hardcoding defaults in wrappers in general, but in this specific instance, we're going straight for 12 - rather than the conservative 11 that PHP may end up with, and we don't need to wait a year or more for it to be released into the wild.

valorin, to Tolkien
@valorin@phpc.social avatar

My Tolkien reread continues...

image/jpeg
image/jpeg

jerry, to random

Well, I was just contemplating downsizing a bit on infosec.exchange when I saw this scroll by: https://variety.com/2023/digital/news/elon-musk-charge-all-x-twitter-users-fee-1235726693/

Maybe I'll wait a while...

valorin, (edited )
@valorin@phpc.social avatar

@jerry I was going to say that a lot of folks are sticking around there because of communities, but won't/can't pay. But those folks are probably the ones already using multiple social networks already.

I wonder if it'll be paid for anyone in the world, or he'll be effectively limiting Twitter to specific countries? Isn't Blue limited to countries?

valorin, to php
@valorin@phpc.social avatar

It may be tempting to compare keys/sensitive strings using === (or even == 😱) but that opens you up to timing attacks! You should be using a timing attack safe string comparison function like hash_equals()...
https://securinglaravel.com/p/security-tip-compare-keys-with-hash_equals

valorin, to php
@valorin@phpc.social avatar

In the last 12 months on Securing Laravel, I have published:

  • The OWASP Top 10 Series
  • Security Audits Top 10 Series
  • 33 Security Tips
  • 11 In Depth Articles
  • “Th1nk Lik3 a H4cker” walkthrough

Wow, it's been a busy year! 😲
https://securinglaravel.com/p/2-years-of-securing-laravel-laravel

valorin, to random
@valorin@phpc.social avatar

A friend received these emails recently, and asked me for help...
On face value they sound worrying, but this is what's known as a Beg Bounty! The sender runs an basic scanner, finds minor 'issues', and asks for money to disclose "serious vulns".

In the vast majority of cases, these are simply identifying things like missing security headers, which enhance your security but don't mean an actual vuln exists. You can usually identify them with the lack of details and a veiled request for money.

image/png

valorin,
@valorin@phpc.social avatar

@avuko That is a very good point, thanks for the reminder. 🙂

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • megavids
  • thenastyranch
  • rosin
  • GTA5RPClips
  • osvaldo12
  • love
  • Youngstown
  • slotface
  • khanakhh
  • everett
  • kavyap
  • mdbf
  • DreamBathrooms
  • ngwrru68w68
  • provamag3
  • magazineikmin
  • InstantRegret
  • normalnudes
  • tacticalgear
  • cubers
  • ethstaker
  • modclub
  • cisconetworking
  • Durango
  • anitta
  • Leos
  • tester
  • JUstTest
  • All magazines
    •