9,004 reputation
21558
bio website
location The Netherlands
age
visits member for 3 years, 1 month
seen 5 hours ago

Student; manufactured 2 decades ago; interested in computer security and software engineering.


Oct
1
comment How to tell if someone else's site is vulnerable to Shellshock without hacking them?
I suspect the downvote is because, though that site may stink of security vulns, this question (title at least) stinks of black hat ;). Reading the question more thoroughly it's probably not the case, but you might want to try to formulate it a bit less like "I see this really old website and want to exploit it" and more like "Someone claims their site to be certified secure, can I prove that it's not (e.g. shellshock?) without really hacking them?"
Sep
30
awarded  Explainer
Sep
30
reviewed Approve MySQL Authentication Hash Cracking
Sep
30
reviewed Approve Brute-force an SSH-login that has only a 4-letter password
Sep
30
reviewed Approve Does client certificate do any encryption in https connection?
Sep
30
reviewed Approve My IP address (with a NAS) is targeted by a hacker. What to do? Should I be worried?
Sep
29
reviewed Approve Is server exploitable by Shellshock with cgi-enabled only?
Sep
27
reviewed Approve shellshock tag wiki
Sep
25
reviewed Approve Kerberos v4 replay attack vs. sliding time window
Sep
25
reviewed Approve Are ordinary OS X desktops at risk from bash “shellshock” bug (CVE-2014-6271)?
Sep
23
reviewed Reject Why does malware periodically check google.com
Sep
23
reviewed Reject AES Key Management / How To Swap Encryption Key
Sep
21
comment A future heartbleed bug?
I've been noticing a bunch of certificate updates on Google, Twitter and other websites too. In all cases it changed, if I remember correctly, the MD5 fingerprint to undefined or something. Seems to be related to the recent discussion about accepted hashing methods for certificates in 2015.
Sep
21
answered entropy of two factor authentication
Sep
21
reviewed Approve Can anti-CSRF token prevent bruteforce attack?
Sep
20
answered Search on hashed data
Sep
20
reviewed Approve Why is it a security problem not to update one's browser?
Sep
13
comment Is my custom password hashing algorithm insecure?
It's better than nothing (kudos for at least thinking about the problem), but in general pbkdf2/bcrypt/scrypt with decent settings is always better than something you came up with yourself.
Sep
11
reviewed Approve Is there any good reason to choose IDS over IPS?
Sep
10
reviewed Approve How to keep someone from analyzing our site?