22,740 reputation
648107
bio website infosecstudent.com
location Singapore
age 19
visits member for 1 year, 11 months
seen 48 mins ago

Currently a student studying IT security.


Dec
16
comment Getting rid of trojans on Windows XP - the basic toolkit
download.fedoraproject.org/pub/fedora/linux/releases/19/Live/…
Dec
14
comment Does an email signature increase security?
I assumed you meant "PGP" instead of "PHP" so I went ahead and edited it. :)
Dec
12
comment what is mXSS? anyone knows?
@cengizUzun I can't recall, but I think yes, if the textarea in question is being used by code calling .innerHTML
Dec
12
comment what is mXSS? anyone knows?
@Rook Heh, the "m" actually stands for mutation. :P
Dec
10
comment Questions on IDS, IPS, VLANs and VPN
Way too many completely unrelated questions here. Voting to close this as "Too broad".
Dec
2
comment Why is always possible to discover and exploit new zero-day vulnerabilities?
@Matrix Sandbox escapes and priv escalation vulns are available for almost every platform out there given enough cash. Sure, you can lock down a single server very tightly but then in most cases you limit the usefulness of said server. This answer is correct, it's a risk management thing.
Nov
29
comment Force a specific SSL cipher
Yes, this tool is called Python (or scripting language of choice.)
Nov
27
comment What to do when I found a spyware that my spouse has installed?
Talk to her...?
Nov
25
comment Pentesting Cleanup
What tool? What file?
Nov
22
comment Is HMAC-SHA256 and HMAC-SHA512 able to act as drop in replacement for HMAC-SHA1 in HOTP/TOTP?
Yes, not questioning the point about improving security. My question is more about finding out if the algorithms are officially supported by the RFC. Given that TOTP is essentially the same algorithm as HOTP, won't the two algorithms work for HOTP as well?
Nov
22
comment Is HMAC-SHA256 and HMAC-SHA512 able to act as drop in replacement for HMAC-SHA1 in HOTP/TOTP?
"Obviously, these two hash algorithm aren't supported by the standard." So why is HMAC-SHA256 and HMAC-SHA512 described in RFC 6238? Test vectors are even provided.
Nov
21
comment Is “Why Should You Avoid AES In MySQL?” true?
possible duplicate of Is it preferable to perform encryption using database functions or code?
Nov
19
comment How secure is NOPASSWD in passwordless sudo mode?
@JurianSluiman It's good that you know that, wasn't very clear coming from the question. NOPASSWD is really more of a convenience option and doesn't really affect security that much imo. It's more important to ensure that users are given only as much sudo privileges as required to get the job done.
Nov
13
comment How does nmap do a zombie and decoy scan?
Or just run nmap with the --packet-trace flag... No need for wireshark.
Nov
7
comment Can Your ISP use a Packet Sniffer?
Read the Terms of Service and other documents you agreed to when signing up with the ISP in question.
Nov
7
comment Why does Google cripple the 2FA Google Authenticator PAM module?
Great question! I opened an issue on the google-authenticator project page about this. code.google.com/p/google-authenticator/issues/…
Nov
6
comment Encrypted chat using any smartphone. Is it legal?
This question appears to be off-topic because it is about getting legal advice. Consult a lawyer instead.
Nov
6
comment Encrypted chat using any smartphone. Is it legal?
Not a good idea to get legal advice from a bunch of guys on the internet. Consult a lawyer.
Nov
5
comment Difference between IDS and IPS and Firewall
@yzT It's just semantics really. For all intents and purposes, they are the same thing.
Nov
1
comment How does nmap determine if it's running HTTP service on a port? Fails here
@warl0ck In addition, a custom nmap-services file can be passed as an option using the --servicedb flag.