Reputation
1,462
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
4 13
Impact
~66k people reached

  • 0 posts edited
  • 1 helpful flag
  • 109 votes cast
Apr
21
answered Strange behavior of Nmap
Apr
21
comment Google Drive photo security and publicly visible lh*.googleusercontent.com
I get a 403 accessing that resource; so it must be protected by something. Furthermore, @ThisClark secure documents that fetch more resources should be safe, unless your client/browser allows mixed content.
Apr
8
comment Is it a good practice to forbid ip access to port 80?
+1. The only "security risk" that may be there is that your default page exposes data such as "You're running Nginx [VERSION] on CentOS [VERSION]".
Apr
5
comment Monitoring HTTP traffic on openvpn server
I updated my answer with how to intercept it.
Apr
5
revised Monitoring HTTP traffic on openvpn server
elaborated on how-to
Apr
4
answered Monitoring HTTP traffic on openvpn server
Apr
4
comment Monitoring HTTP traffic on openvpn server
Do you control the clients as well?
Mar
29
comment Is there any benefit to encrypting messages with PGP that will be trasmitted over SSL to a REST server?
Oh no, not at all. It's possible to perform a man-in-the-middle, just like Burp suite does it, by trusting a arbitrary CA certificate. This allows that party to issue certificates, and decrypt (and re-encrypt) all SSL traffic. This doesn't mean that the same person/organization (think agency, proxy admin, wifi, ...) has access to your environment. If you do ever send any secrets (i.e symmetric keys, secret keys, pw's) over SSL, then they will see it.
Mar
29
awarded  Citizen Patrol
Mar
29
answered Is there any benefit to encrypting messages with PGP that will be trasmitted over SSL to a REST server?
Mar
29
comment Is there any benefit to encrypting messages with PGP that will be trasmitted over SSL to a REST server?
Why assuming SSL is setup poorly, you're not in control of that? Also, is the message supposed to be for a (human) recipient, or the web app?
Mar
29
comment Best practice of Secret Question/Answer
..Or let machines auto-lock when not in use? If it's a back office app, I assume you're running on some sort of directory anyway.
Mar
11
answered How does Nessus know which services are running in a host?
Aug
11
answered How to really treat security between peers in WebRTC
Jul
26
awarded  Caucus
Jul
26
awarded  Constituent
Jul
13
comment Apache Server Maintains HTTPS Connection To Mysterious Server (Hijacking?)
Do you have XMLRPC enabled?
Jul
13
answered Session hijacking
Jul
9
comment XSS only works when GET request is submitted with form
It seems your form's response is a JSON object which is rendered in your page. I'm afraid the page isn't even reloading. Do you have a code snippet when the form is submitted? It's probably an XHR function, or JQuery's $.getJSON() ...
Jul
9
comment XSS only works when GET request is submitted with form
Is the form being submitted using POST / XHR? - When you copy/paste a URL, the request should be in the query string (ie: GET request).