Win Web Hosting

NameError: global name ‘reduce’ is not defined

I have the following error when write this function in pyton

can any one please let me know t site for poet.py … i tried jar file for the same but its not working. want to give a try for python. an immediate help will be great.

@MrPrahalath See section D. of RFP policy and compare to MSRC: weird response, followed by months of no fix. Guess why people arent complying? See statements from veracode researchers etc as well

@MrPrahalath papers published since 2002 define class of vulnerabilities. 8 years would satisfy “due time” for crypto vendors to remedy Padding Oracle attack?

And the CBC-R works cause ASP.NET does Encypt-Without-MAC, which you have to go back to medieval times for people not to know it is a vulnerability.

Microsoft failed in many ways here.

I don’t know when or if MSRC was notified, it is interesting that ASP.NET was omitted in the first papers by these guys. Was this really “0-day”?

@wydok ASP.NET Form Authentication works that way. Regardless of what we might think about it, it is a design decision of Microsoft, DotNetNuke is just following “the standard way to do it”.

Okay, so this Poet tool using a bug in ASP.NET in how it handles padding, and uses a brute force method to send multiple requiests to an ASP.NET website until it gets a correct response and is able to use that to find the encryption key.

But how does POET then use that key to determine the proper cookie to set to give a user admin privledges? Is it based on the concept that .dotNetNuke uses a specific username as the superuser?

@coreyogburn Nothing in this world is perfect. This is something we all know. You can buy the most expensive car in the world and it *will* come with some imperfection. This is a fact. Timing and the order in which one does something is also an important factor in getting things right.

@MrPrahalath If this guy doesn’t find the problem and work towards fixing it, then somebody else will find the problem and work towards exploiting it. I hate to put words in your mouth, but it sounds like you’re saying “don’t look for a problem, focus on more important things.” With a foundation as widely accepted as ASP.Net, the problem is the important thing and it does need to be fixed.

OMG guys, this is absolutely perfect, I can’t say anything else, but congratulations!

uggghh

cryptbe, you and the hoax artists that presented this at ekoparty and made this video are clowns. Anyone who knows ASP.NET and DNN knows you rigged this for breakage. Your video shows plainly that the setup not only doesn’t follow best practices, but doesn’t even have the default DNN install protections in place. Quit claiming the MS work-around won’t work, and PROVE it.