284 reputation
29
bio website
location
age
visits member for 2 years, 2 months
seen Nov 19 at 14:02

Nov
17
comment Tell people that I can encrypt emails
Just to be curios, shouldn't it be possible to add the PGP version as alternative, instead of multipart? (Or cann't outlook handle this correctly?)
Nov
9
comment Is this somebody trying to exploit a vulnerability?
maybe someone implemented the cookie jar in a wrong way?
Nov
9
awarded  Informed
Nov
9
awarded  Citizen Patrol
Nov
9
comment Is this XSS filter i.e <[space][0-9a-z]/> can be bypassed?
=. is not allowed according to your regexp, but it is used in your example.
Oct
2
comment Even with the Shellshock patch, isn't Bash vulnerable to command redefinition?
I didn't even know about schroot, so I probably wouldn't have found that.
Oct
1
comment Even with the Shellshock patch, isn't Bash vulnerable to command redefinition?
@ninjalj Interesting. I currently don't have the time or environment to create a test for this, so I wonder if system from an SUID binary can result in this bug.
Sep
30
awarded  Enlightened
Sep
30
awarded  Nice Answer
Sep
29
comment Even with the Shellshock patch, isn't Bash vulnerable to command redefinition?
the ability to hide full paths is afaik considered a bug and removed with some patches.
Sep
27
awarded  Yearling
Sep
26
revised Even with the Shellshock patch, isn't Bash vulnerable to command redefinition?
added 335 characters in body
Sep
25
revised Even with the Shellshock patch, isn't Bash vulnerable to command redefinition?
added 159 characters in body
Sep
25
answered Even with the Shellshock patch, isn't Bash vulnerable to command redefinition?
Sep
24
awarded  Autobiographer
Jan
3
comment iptables: plaintext password protection
Bad idea. A script can try to send all possible combinations of your password to a server. The missing password is yours.
Dec
30
comment Can malicious code be contained outside the filesystem on a USB drive?
Yes
Nov
27
awarded  Commentator
Nov
27
comment Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *)
The preflight request is only send for request that you could not send otherwise, e.g. you can always add a form with hidden elements and submit it via JS.
Nov
27
comment Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *)
Wrong. If the script requests that cookies are send, they are send, but if the Access-Control-Allow-Credentials response header is false or missing, the script would not get the response.