25,088 reputation
761121
bio website ayrx.me
location Singapore
age 19
visits member for 2 years, 6 months
seen 7 hours ago

This is not the profile you are looking for.


Dec
19
comment Bypass Nmap Scans Being Blocked
This question is very difficult to answer without more information about the actual setup. The "hidden" machine could be on a subnet that's only accessible from one of the machines which will require you to root it and tunnel traffic through it.
Dec
17
comment Challenges in authentications
@user2315 Thomas Pornin says otherwise. security.stackexchange.com/a/3213/10211
Dec
17
comment Does Google/Dropbox/Github Two-Step Verification count as Two-Factor?
"Devices and tokens that implement TOTP (Yubikey, Google Authenticator app) are designed to protect the secret key against extraction." - Not true. The Google Authenticator app merely stores the key in an sqlite database.
Dec
16
comment Getting rid of trojans on Windows XP - the basic toolkit
download.fedoraproject.org/pub/fedora/linux/releases/19/Live/…
Dec
12
comment What is mutation XSS (mXSS)?
@cengizUzun I can't recall, but I think yes, if the textarea in question is being used by code calling .innerHTML
Dec
12
comment What is mutation XSS (mXSS)?
@Rook Heh, the "m" actually stands for mutation. :P
Dec
2
comment Why is always possible to discover and exploit new zero-day vulnerabilities?
@Matrix Sandbox escapes and priv escalation vulns are available for almost every platform out there given enough cash. Sure, you can lock down a single server very tightly but then in most cases you limit the usefulness of said server. This answer is correct, it's a risk management thing.
Nov
29
comment Force a specific SSL cipher
Yes, this tool is called Python (or scripting language of choice.)
Nov
27
comment What to do when I found a spyware that my spouse has installed?
Talk to her...?
Nov
25
comment Pentesting Cleanup
What tool? What file?
Nov
22
comment Is HMAC-SHA256 and HMAC-SHA512 able to act as drop in replacement for HMAC-SHA1 in HOTP/TOTP?
Yes, not questioning the point about improving security. My question is more about finding out if the algorithms are officially supported by the RFC. Given that TOTP is essentially the same algorithm as HOTP, won't the two algorithms work for HOTP as well?
Nov
22
comment Is HMAC-SHA256 and HMAC-SHA512 able to act as drop in replacement for HMAC-SHA1 in HOTP/TOTP?
"Obviously, these two hash algorithm aren't supported by the standard." So why is HMAC-SHA256 and HMAC-SHA512 described in RFC 6238? Test vectors are even provided.
Nov
21
comment Is “Why Should You Avoid AES In MySQL?” true?
possible duplicate of Is it preferable to perform encryption using database functions or code?
Nov
19
comment How secure is NOPASSWD in passwordless sudo mode?
@JurianSluiman It's good that you know that, wasn't very clear coming from the question. NOPASSWD is really more of a convenience option and doesn't really affect security that much imo. It's more important to ensure that users are given only as much sudo privileges as required to get the job done.
Nov
13
comment How does nmap do a zombie and decoy scan?
Or just run nmap with the --packet-trace flag... No need for wireshark.
Nov
7
comment Can Your ISP use a Packet Sniffer?
Read the Terms of Service and other documents you agreed to when signing up with the ISP in question.
Nov
7
comment Why does Google cripple the 2FA Google Authenticator PAM module?
Great question! I opened an issue on the google-authenticator project page about this. code.google.com/p/google-authenticator/issues/…
Nov
6
comment Encrypted chat using any smartphone. Is it legal?
This question appears to be off-topic because it is about getting legal advice. Consult a lawyer instead.
Nov
6
comment Encrypted chat using any smartphone. Is it legal?
Not a good idea to get legal advice from a bunch of guys on the internet. Consult a lawyer.
Nov
5
comment Difference between IDS and IPS and Firewall
@yzT It's just semantics really. For all intents and purposes, they are the same thing.