346 reputation
212
bio website
location Switzerland
age
visits member for 2 years, 4 months
seen Oct 7 at 13:57

Sep
11
comment Are social security numbers useless by themselves?
There is a really good podcast show about that: social-engineer.org/podcast/…
Jun
26
comment In what way is a partially encrypted webpage insecure?
It strongly depends on what you encrypt. Is there a good reason to only encrypt some parts? Is there so much traffic?
May
15
comment Fastest way to “lockdown” CentOS and have network intrusion detection, firewall, etc up and running?
Bastille looks awesome, but hasn't been in active development since about 7 years if I gather the information from their site correctly.
Nov
29
comment What approaches are to detect DoS attack in IDS/Firewall?
Is your question about DoS or also about DDoS?
Nov
28
comment Two-Factor Authentication: When is it worth it?
Sorry, my answer wasn't very clear in the beginning. I hope it's better understandable now.
Nov
19
comment What XSS attacks doesn't “Reflective XSS Protection” defeat?
"So what I guess what I'm really interested to know is are there any evasion techniques that mean that by design reflective XSS protection won't work?" AndySmith - maybe you should phrase your question that way then.
Nov
16
comment What XSS attacks doesn't “Reflective XSS Protection” defeat?
There is a finite anount of characters, so if one considers all possibilities, you could escape all. That is not design but implementation though. But there is ongoing research in this field. If therr would've been an easy design change or possibility we wouldn't be facing this amount of xss on the net. For right now it depends on the quality of the implementation.
Sep
28
comment Changing IP ID generation of a server
"you could set it to 0" - that's what I'd like to do, but I don't know how.
Aug
22
comment Why should every file have a user and a group?
but how does that affect security? From your answer it looks like the only downside is, that a user gets the files of another user (which is bad, but still, I was wondering if there are bigger implications)
Aug
20
comment Why should every file have a user and a group?
thanks, enforcing file premissions was what I was looking for.
Aug
9
comment unix config scanner / compliance checks
@RoryAlsop, thanks! compliance checks is the right choice of words. I'm not a native speaker.
Aug
9
comment unix config scanner / compliance checks
I edited the question, I hope the motivation for the question is better explained.
Aug
9
comment unix config scanner / compliance checks
@TerryChia This script is supposed to look for configuration issueS. There are quite a lot of configuration files too look at (Network, Kernel, Applications, ...). Depending on which distribution the files change already. I don't mind writing such a script, but it's a lot of work, and if such a script already exists, it'd be to reinvent the wheel. That's why I first want to see if it already exists :) Polynomial, it's only an example. Look at the comment to TerryChia please.
Aug
7
comment tcp seq number prediction
great! Thank you! Burp's sequencer should be able to handle those numbers and check the degree of randomness.
Aug
4
comment How Is It Possible For Hackers To “Dig Up The Dirt” On People?
There is quite a good podcast by social-engineer.org with background information on all those topics asked. Elaborating a bit on the post of Terry Chia. social-engineer.org/…