{"action":"created","issue":{"url":"https://api.github.com/repos/Sk1er/Resource-Exploit-Fix/issues/2","repository_url":"https://api.github.com/repos/Sk1er/Resource-Exploit-Fix","labels_url":"https://api.github.com/repos/Sk1er/Resource-Exploit-Fix/issues/2/labels{/name}","comments_url":"https://api.github.com/repos/Sk1er/Resource-Exploit-Fix/issues/2/comments","events_url":"https://api.github.com/repos/Sk1er/Resource-Exploit-Fix/issues/2/events","html_url":"https://github.com/Sk1er/Resource-Exploit-Fix/issues/2","id":360072222,"node_id":"MDU6SXNzdWUzNjAwNzIyMjI=","number":2,"title":"Please Clarify Exploit","user":{"login":"JRoy","id":10731363,"node_id":"MDQ6VXNlcjEwNzMxMzYz","avatar_url":"https://avatars1.githubusercontent.com/u/10731363?v=4","gravatar_id":"","url":"https://api.github.com/users/JRoy","html_url":"https://github.com/JRoy","followers_url":"https://api.github.com/users/JRoy/followers","following_url":"https://api.github.com/users/JRoy/following{/other_user}","gists_url":"https://api.github.com/users/JRoy/gists{/gist_id}","starred_url":"https://api.github.com/users/JRoy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JRoy/subscriptions","organizations_url":"https://api.github.com/users/JRoy/orgs","repos_url":"https://api.github.com/users/JRoy/repos","events_url":"https://api.github.com/users/JRoy/events{/privacy}","received_events_url":"https://api.github.com/users/JRoy/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-09-13T21:24:58Z","updated_at":"2018-09-14T12:28:28Z","closed_at":"2018-09-13T21:36:40Z","author_association":"NONE","body":"# Summary\r\nIn Tenebrous's video, he really didn't seem to understand what the hell this exploit is (along with many other technical videos he does mind you...). Therefore, I am asking you to please clarify, in your README and the release, this exploit **cannot** send the server the contents of a file and **only** sends if the file exists and the SHA1 hashes for those files (to which there is no *real* threat as the time it would take to reverse those).\r\n# Proofs\r\nIn [Tenebrous's Video](https://www.youtube.com/watch?v=B-XGalEw1Fw) at 3:58 he says a server can \"get any file on your computer\" which is misleading.\r\n\r\nHe continues in the comments by saying as long as you didn't keep passwords in files, which is **misleading** again. This exploit cannot be practically used to get passwords, let alone any data in a file.\r\n![image](https://user-images.githubusercontent.com/10731363/45516161-436d5f80-b778-11e8-8081-99903a313cb5.png)\r\n\r\n# Conclusion\r\nWhile yes this exploit is a medium is a severity as servers could brute-force or check predetermined file names, this exploit has **no real world** possibility of viewing the contents of files. And no, I'm not saying this mod isn't good to use or doesn't serve a porpose. @Sk1er don't get me wrong this is a well-made mod and I do still recommend using it for people who have a concern that somebody will *illegally* use this. I just think this needs to be more clear, in this repository, what the exploit can or cannot do as much of the traffic has been through Tene's misleading video.\r\n\r\nTene if you are reading this, I suggest having someone like Sk1er proof-read these videos before you publish them as he could have probably caught this mistake and helped you not miss-direct users.\r\n\r\nRegards,\r\nJosh"},"comment":{"url":"https://api.github.com/repos/Sk1er/Resource-Exploit-Fix/issues/comments/421343272","html_url":"https://github.com/Sk1er/Resource-Exploit-Fix/issues/2#issuecomment-421343272","issue_url":"https://api.github.com/repos/Sk1er/Resource-Exploit-Fix/issues/2","id":421343272,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMTM0MzI3Mg==","user":{"login":"includereserved","id":40807582,"node_id":"MDQ6VXNlcjQwODA3NTgy","avatar_url":"https://avatars0.githubusercontent.com/u/40807582?v=4","gravatar_id":"","url":"https://api.github.com/users/includereserved","html_url":"https://github.com/includereserved","followers_url":"https://api.github.com/users/includereserved/followers","following_url":"https://api.github.com/users/includereserved/following{/other_user}","gists_url":"https://api.github.com/users/includereserved/gists{/gist_id}","starred_url":"https://api.github.com/users/includereserved/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/includereserved/subscriptions","organizations_url":"https://api.github.com/users/includereserved/orgs","repos_url":"https://api.github.com/users/includereserved/repos","events_url":"https://api.github.com/users/includereserved/events{/privacy}","received_events_url":"https://api.github.com/users/includereserved/received_events","type":"User","site_admin":false},"created_at":"2018-09-14T12:28:28Z","updated_at":"2018-09-14T12:28:28Z","author_association":"NONE","body":"@RDIL In my hypothetical situation it'd say it doesn't exist either way because I don't use Windows... I'm not saying the bug isn't real I'm saying that it's useless. You'd have to send thousands of packets to put together a single filename and even after you find out, who cares?"}}
{"actor":{"display_login":"includereserved"}}