24,492 reputation
759119
bio website ayrx.me
location Singapore
age 19
visits member for 2 years, 6 months
seen 21 hours ago

Currently a student studying IT security.


Dec
10
comment Questions on IDS, IPS, VLANs and VPN
Way too many completely unrelated questions here. Voting to close this as "Too broad".
Dec
2
comment Why is always possible to discover and exploit new zero-day vulnerabilities?
@Matrix Sandbox escapes and priv escalation vulns are available for almost every platform out there given enough cash. Sure, you can lock down a single server very tightly but then in most cases you limit the usefulness of said server. This answer is correct, it's a risk management thing.
Nov
29
comment Force a specific SSL cipher
Yes, this tool is called Python (or scripting language of choice.)
Nov
27
comment What to do when I found a spyware that my spouse has installed?
Talk to her...?
Nov
25
comment Pentesting Cleanup
What tool? What file?
Nov
22
comment Is HMAC-SHA256 and HMAC-SHA512 able to act as drop in replacement for HMAC-SHA1 in HOTP/TOTP?
Yes, not questioning the point about improving security. My question is more about finding out if the algorithms are officially supported by the RFC. Given that TOTP is essentially the same algorithm as HOTP, won't the two algorithms work for HOTP as well?
Nov
22
comment Is HMAC-SHA256 and HMAC-SHA512 able to act as drop in replacement for HMAC-SHA1 in HOTP/TOTP?
"Obviously, these two hash algorithm aren't supported by the standard." So why is HMAC-SHA256 and HMAC-SHA512 described in RFC 6238? Test vectors are even provided.
Nov
21
comment Is “Why Should You Avoid AES In MySQL?” true?
possible duplicate of Is it preferable to perform encryption using database functions or code?
Nov
19
comment How secure is NOPASSWD in passwordless sudo mode?
@JurianSluiman It's good that you know that, wasn't very clear coming from the question. NOPASSWD is really more of a convenience option and doesn't really affect security that much imo. It's more important to ensure that users are given only as much sudo privileges as required to get the job done.
Nov
13
comment How does nmap do a zombie and decoy scan?
Or just run nmap with the --packet-trace flag... No need for wireshark.
Nov
7
comment Can Your ISP use a Packet Sniffer?
Read the Terms of Service and other documents you agreed to when signing up with the ISP in question.
Nov
7
comment Why does Google cripple the 2FA Google Authenticator PAM module?
Great question! I opened an issue on the google-authenticator project page about this. code.google.com/p/google-authenticator/issues/…
Nov
6
comment Encrypted chat using any smartphone. Is it legal?
This question appears to be off-topic because it is about getting legal advice. Consult a lawyer instead.
Nov
6
comment Encrypted chat using any smartphone. Is it legal?
Not a good idea to get legal advice from a bunch of guys on the internet. Consult a lawyer.
Nov
5
comment Difference between IDS and IPS and Firewall
@yzT It's just semantics really. For all intents and purposes, they are the same thing.
Nov
1
comment How does nmap determine if it's running HTTP service on a port? Fails here
@warl0ck In addition, a custom nmap-services file can be passed as an option using the --servicedb flag.
Nov
1
comment How does nmap determine if it's running HTTP service on a port? Fails here
@warl0ck No. nmap does not use the /etc/services file for port specifications. Instead, nmap maintains a nmap-services file. In my Fedora 19 machine, the file is located at /usr/share/nmap/nmap-services. The file format is the same as the /etc/services file though, so customizing it is very possible.
Oct
20
comment May I `store` the password, by making it the key in AES-256?
@LuciferOrichalcum I dump your database. I have the username, R and E. I randomly try deriving P and K through a bruteforce or dictionary attack by guessing the password until I find a value where E = encrypt(k,P). Your scheme does not protect against this at all.
Oct
20
comment May I `store` the password, by making it the key in AES-256?
@LuciferOrichalcum You derive the key for AES encryption by hashing the password ONCE. This is trivial to bruteforce and has no bearing on the strength of AES as an encryption algorithm. It's fine for most things to want to try something new, but cryptography is not one of them. Stick with well tested schemes instead....
Oct
20
comment Protecting personal documents in cloud
Hello, welcome to Information Security Stackexchange. Could you provide more information, perhaps even a summary of the article? Link-only answers are discouraged because they usually lead to link-rot.