7,606 reputation
21250
bio website lucb1e.com
location The Netherlands
age
visits member for 2 years, 6 months
seen 1 hour ago

Software Engineering student. Also interested in computer networking and security. For contact info, see lucb1e.com/!about


Apr
15
reviewed Leave Closed How non-executable are implemented?
Apr
15
comment What are the parameters to be logged in a web application?
I would not include the POST-data. This can include sensitive data, and logging is usually not encrypted while the normal processing of POST-data might encrypt it before saving it to the database. Also note that in some countries there are laws about what you are allowed to store and for which time period. Strictly seen, in the Netherlands you must tell the "College Bescherming Persoonsgegevens" (semi-govt organisation) about storing source IP addresses for anything but security purposes or longer than ~3-6 months.
Apr
15
answered Redirect attack
Apr
15
revised What are the ways to implement two factor authentication?
Replaced (imho unclear) 2fa tag with the already existing multi-factor tag
Apr
15
comment Exploited by newbie3viLc063s
@user2279808 He was able to compile some binary on your server? Interesting php settings you have. What user does it even run as... Anyway, yeah perhaps I would actually just reinstall the whole thing then and check all files manually before putting them back.
Apr
14
comment Exploited by newbie3viLc063s
@user2279808 Technically no, any files could be in there. Perhaps if you verify the files' age to be well before any signs of the breach. I would personally not reinstall the entire server, but from a security standpoint, it is the right thing to be advised.
Apr
14
comment Vulnerable code suggested on OWASP?
@minitech It's the first one that came to mind as exploitable vulnerability. Of course IP spoofing is also a problem.
Apr
14
reviewed No Action Needed How is “hacking” even possible if I “defend” properly?
Apr
14
comment how can you inject malicious code into an innocent-looking URL?
Not all URLs look innocent without XSS attacks. They'd be easy to exploit. Google is most guilty of this: https://www.google.nl/#output=search&sclient=psy-ab&q=test+search&oq=test+searc‌​h&gs_l=hp.3..0b3.128.1072.0.1196.11.8.0.2.2.0.141.764.5z3.8.0...0.0...1c.1.9.psy-‌​ab.nJres6sEYEk&pbx=1&bav=on.3,or.r_qf.&bvm=bv.43175339,e.e2k&fp=289e1bfce01f7e5&b‌​iw=1920&bih=913
Apr
14
comment Vulnerable code suggested on OWASP?
"the attacker can put the victim's IP address in his header and the code will use that value as his legitimate IP address." Hadn't thought of that yet. Good one.
Apr
14
revised Vulnerable code suggested on OWASP?
added 7 characters in body
Apr
14
comment Vulnerable code suggested on OWASP?
@RoryMcCune He means that getenv(forwarded-for) can contain anything a user wants.
Apr
14
answered Vulnerable code suggested on OWASP?
Apr
14
comment Vulnerable code suggested on OWASP?
From what I read in your quote, I'd think the same. Going to look at the context now...
Apr
13
revised DoSing my Home Network with only a Public IP address
deleted 93 characters in body
Apr
13
comment ISO27000 implementation - Where do you get the standardization material?
@ChrisAndrèDale In The Netherlands it'd be nen.nl that's recommended by a semi-government organisation. Don't seem to have an English website, but this preview of ISO27000 is in English: nen.nl/pdfpreview/preview_178921.pdf -- Edit: Oh other answers already posted better resources :)
Apr
11
reviewed Leave Open Is there a way to encrypt an existing ext4 filesystem with already data on it?
Apr
10
comment Picking exponents for Diffie-Hellman
That actually sounds like good motivation ;). +1 your post.
Apr
10
comment Picking exponents for Diffie-Hellman
"I'm taking a class on Cryptography and the professor mentioned [...]. I wasn't completely sure of what he said and cant seem to find much info on it." So why don't you ask him? He's supposed to teach you.
Apr
8
comment Can I determine if my computer has a key logger installed?
If his contract didn't state that his contract was secret in itself, what are the relevant clauses? What does it say about company-issued hardware?