1,373 reputation
412
bio website michaelhendrickx.com
location Dubai, United Arab Emirates
age 34
visits member for 3 years, 1 month
seen 6 hours ago

Entropy isn't what it used to be.


1d
awarded  Caucus
1d
awarded  Constituent
Jul
13
comment Apache Server Maintains HTTPS Connection To Mysterious Server (Hijacking?)
Do you have XMLRPC enabled?
Jul
13
answered Session hijacking
Jul
9
comment XSS only works when GET request is submitted with form
It seems your form's response is a JSON object which is rendered in your page. I'm afraid the page isn't even reloading. Do you have a code snippet when the form is submitted? It's probably an XHR function, or JQuery's $.getJSON() ...
Jul
9
comment XSS only works when GET request is submitted with form
Is the form being submitted using POST / XHR? - When you copy/paste a URL, the request should be in the query string (ie: GET request).
Jul
5
answered What countries have strong data protection laws?
Jun
28
comment Enumerate the subdomains of a given domain - what's the point?
Wouldn't that just resolve non-existing names to an IP address? Thereby making it more difficult to differentiate existing and non-existing ones.
Jun
28
comment Enumerate the subdomains of a given domain - what's the point?
For 3, sure it's security by obscurity, but one could set up a wildcard domain record, so that every subdomain responds to an IP address.
Jun
26
awarded  Yearling
Jun
24
answered Using VPN in the UAE - safe or trackable?
Jun
22
answered What are hashes that begin with $1$…?
Jun
22
comment Dom based Xss Query - location.hash
Currently no, but it depends on what happens to myhash. If you run it through an eval() or so it might be.
Jun
21
awarded  Editor
Jun
21
revised Multiple logins on the same website
fixed typo, SSL -> Transport layer security
Jun
21
answered Multiple logins on the same website
Jun
21
answered How secure are “pattern” passwords?
Jun
20
awarded  Revival
Jan
15
comment Http redirect using Location, but using falsely supplied data from host header
I think your last paragraph nails it; it just redirects everything everything to SSL first, and will then handle the hostname afterwards. (Which may be rendering the default vhost, or nothing at all)
Jan
14
comment Bruteforce with Hydra
Can you see if there's a string in the HTTP response when you request it with curl? Some pages do a 302, but also have HTTP content.