full-disclosure - Re: What's going on about Pangolin

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 28 Mar 2008 11:20:11 -0600
From: Tremaine Lea <tremaine@...il.com>
To: mastahflank@...il.com
Cc: full-disclosure@...ts.grok.org.uk,
	full-disclosure-bounces@...ts.grok.org.uk
Subject: Re: What's going on about Pangolin

Why should he show the source to his work?

To allay valid concerns of the intended users.

With some of the discussion at this point, it would certainly benefit  
the author if he wants to gain wider usage and discourage uninformed  
opinion.

---
Tremaine Lea
Network Security Consultant
Intrepid ACL
"Paranoia for hire"


On 28-Mar-08, at 10:38 AM, josh wrote:
> Why should he show the source to his work. I don't see him selling  
> it, he isn't twisting your arm to use it. He released it for free.  
> Either use it or don't.
> Sent from my BlackBerry® smartphone with SprintSpeed
>
> -----Original Message-----
> From: "Andreas Selvicki" <drsynack@...il.com>
>
> Date: Fri, 28 Mar 2008 10:25:25
> To:full-disclosure@...ts.grok.org.uk
> Subject: Re: [Full-disclosure] What's going on about Pangolin
>
>
> Let's see the source please.
>
>
> On 3/26/08, zwell@...u.com <mailto:zwell@...u.com>  <zwell@...u.com <mailto:zwell@...u.com 
> > > wrote:
> I've just read the discussion from here, seriously, I don't know  
> what's going on.
> I've coded it since 2005 and never release it until this year. And I  
> really do not know why it be treated as a backdoor.
>
> If you think it is a backdoor, so please do a reverse engineering on  
> it. You can capture the network packet, you can list all the strings  
> in it, even you can hook APIs in it. Do anything you like to make  
> sure whether it's backdoor or not.
>
> BTW, I packeted it through UPX to reduce the size. And some people  
> focused on "http://www.nosec.org/web/index.txt <http://www.nosec.org/web/index.txt 
> > ", which is used in ORACLE injection mode when the target database  
> is in intranet so we can use some store-procs to make the target to  
> visit our website then we can receive the internet address that is  
> mapped to outside. Anybody who is good at oracle injection should  
> know this.
>
> Really, I wanna know why!!!
>
>
>
> < div class="w134">
>
>
>
>
>
>
>
>
>
> ----------------
>
> 2008年薪水翻倍技巧 <http://doc.go.sohu.com/200802/5e1b674ab8183f3db8baba 
> 8ee4c6dd53.php>
> *用搜狗拼音写邮件，体验更流畅的中文输入&gt;&gt; <http://goto.m 
> ail.sohu.com/goto.php3?code=mailadt-ta>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html <http://lists.grok.org.uk/full-disclosure-charter.html 
> >
> Hosted and sponsored by Secunia - http://secunia.com/ <http://secunia.com/ 
> >
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/


Download attachment "PGP.sig" of type "application/pgp-signature" (487 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/