| abstract
| - To see PORT number just enter nonexisten link after valid onion url Maybe the same Server? Would make sense from cicadas view Onion 5: We dont have port number. More about why we dont have it in this log: Collapsed log More about why we dont have it in this log: [02:31] also nobod y checked the port number [02:31] it wasn't availalbe [02:31] [02:31] To see PORT number just enter nonexisten link after valid onion url [02:31] yea that part was missing from onion5 [02:32] but i guess we can assume it was Port 5244 [02:32] lol [02:32] <-- Anoniem4l (c7feeeae@gateway/web/freenode/ip.199.254.238.174) has quit (Ping timeout: 245 seconds) [02:32] can we [02:33] --> ksihkehe_ (48bdf90d@gateway/web/freenode/ip.72.189.249.13) has joined #cicadasolvers [02:33] or if error mesage was different, it menas that cicada saw that we are noting those ports and manually chanhged error mesages in apache [02:33] while it was up [02:33] we tried to hit port 9133/3319 etc.. [02:33] yeah it works only while it was up [02:33] nothing [02:33] note that these are just arbitrary address tag texts in a static error page or header [02:33] yeah [02:33] not clear any actual port is involved [02:33] it doesnt mean it is really this port [02:33] NiceLurk: since all urls was serving the string the port number could not be observed [02:34] but apparently its another "signture" of cicada, for every onion that port should be higher by one [02:34] ext: of it was lobal redirect? [02:34] was that true for previous years? [02:34] <-- ksihkehe (48bdf90d@gateway/web/freenode/ip.72.189.249.13) has quit (Ping timeout: 245 seconds) [02:34] r2dliu: idk [02:34] but this is all just a playful ordering technique [02:35] --> Slipknot- (~flashdr@c-24-6-178-40.hsd1.ca.comcast.net) has joined #cicadasolvers [02:35] NiceLurk: no redirect, it served the string directly [02:35] or what do you mean "local redirect"? url rewriting? [02:36] that is not possible to find out [02:36] --> logikal (~logikal@30.sub-70-208-71.myvzw.com) has joined #cicadasolvers [02:36] ext xeah but if you entered then you aso got string? [02:36] what we should have tried was passing an invalid method or something [02:36] NiceLurk: yes [02:36] <-- gigart (46b9d742@gateway/web/freenode/ip.70.185.215.66) has quit (Quit: Page closed) [02:36] y i think i tried index or smth [02:37] yeah isnt that coalled global redirect? idk, our guys call it like this [02:37] it was not a HTTP redirect [02:37] <-- D_Synapse (~flashdr@c-24-6-178-40.hsd1.ca.comcast.net) has quit (Ping timeout: 272 seconds) [02:38] --> OzWiSkeptic (cb278aaa@gateway/web/freenode/ip.203.39.138.170) has joined #cicadasolvers [02:39] a possible way to get the port would be to use a bad method (e.g. not GET or POST), but I don't think to try that at the time [02:39] I am off see you tomorow> good night and good luck.. [02:39] Good aftermorn everyone, how are we travelling today? [02:39] --> grazzaB (~grazzab@wcnat-108-170.wheaton.edu) has joined #cicadasolvers [02:39] *** Mode #cicadasolvers +o grazzaB by ChanServ [02:39] didn*t [02:39] shadowfix: nighty [02:40] ext: we will se on next onion, if it will be up long enough [02:40] i serioulsy thing cicada is removing onions so fact to prevent us disecting them [02:40] I will be back tomorrow and be able to be on all weekend, goodnight and thanks.. [02:41] NiceLurk: yes, I agree [02:41] bye [02:41] one thing: why cicada pic on jpg4 is different from all cicadas seen till now? [02:42] if using curl to fetch the page, use "-X foo" to pass an invalid method which will result in HTTP 405 Method Not Allowed [02:42] <-- ShadowFix (56b2e2dc@gateway/web/freenode/ip.86.178.226.220) has quit (Quit: Page closed) [02:42] and the port will be in the description [02:42] unless they disabled error pages ofcourse [02:43] <-- Surtri (~surtri@gateway/tor-sasl/surtri) has quit (Remote host closed the connection) [02:43] --> Anoniem4l (bc7e4bfa@gateway/web/freenode/ip.188.126.75.250) has joined #cicadasolvers [02:44] --> Discordia_ (4b900d1e@gateway/web/freenode/ip.75.144.13.30) has joined #cicadasolvers [02:45] <-- neziru (41621811@gateway/web/freenode/ip.65.98.24.17) has quit (Ping timeout: 245 seconds) [02:46] what i miss, anything [02:47] <-- Slipknot- (~flashdr@c-24-6-178-40.hsd1.ca.comcast.net) has quit (Ping timeout: 245 seconds) [02:48] --> gig_ (46b9d742@gateway/web/freenode/ip.70.185.215.66) has joined #cicadasolvers [02:50] ext: curl -w %{remote_port} ?? [02:51] <-- brotherBox (~brotherBo@ip-178-203-85-56.unitymediagroup.de) has quit (Ping timeout: 240 seconds) [02:52] erfwerf: it is not actually [02:52] i f you are talking about jpg4 from onion 4 [02:52] i've missed something i suppose then [02:52] NiceLurk, anything from like 4:30 ish? [02:53] erfwerf: [02:53] same cicada was twice on warning page (not sure itf that is page 2 or 3 though) [02:53] cool thanks :) [02:54] i was wrong, happens [02:54] it just wanst place in the middle so it was much harder to spot [02:54] and well, it happens a lot of times if cicada is around lol [02:54] sometime best place to hid things is in plain sight [02:54] anyone got a link of all five onion addresses? [02:54] i also tought i saw that new cicada first time whne i looked at jpg4 from onion 4 [02:54] <-- nbka (~nbk@2.82.17.108) has quit (Ping timeout: 240 seconds) [02:55] akame: 4 are there [02:55] [02:55] <-- OzWiSkeptic (cb278aaa@gateway/web/freenode/ip.203.39.138.170) has quit (Quit: Page closed) [02:55] - 9133 [02:55] <-- logikal (~logikal@30.sub-70-208-71.myvzw.com) has quit (Ping timeout: 245 seconds) [02:56] thats fifth one [02:56] akame: "-x foo" changes the http method to an invalid which will cause an error no matter what, the only question is if an error page is rendered or not [02:56] <-- Discordia_ (4b900d1e@gateway/web/freenode/ip.75.144.13.30) has quit (Ping timeout: 245 seconds) [02:57] <-- nopd (~nopd@gateway/tor-sasl/nopd) has quit (Ping timeout: 240 seconds) [02:57] ext: was that redirect from all pages to index html done by htaccess? [02:58] like this: [02:58] either using .htaccess or using the host configuration [02:58] but no, not as SO [02:58] they cause a HTTP redirect [02:59] <-- more like that [03:01] the major difference is that a http redirect sends a reply to you "hey, the new url is over here: ..." and your client automatically fetch the new [03:01] while an alias is transparent to you [03:02] cool thx
|
![[RDF Data]](/fct/images/sw-rdf-blue.png)