147 reputation
8
bio website droope.wordpress.com
location Wellington, New Zealand
age 23
visits member for 2 years, 2 months
seen Nov 3 at 19:41

Programmer, mostly ^^


Oct
5
comment Passwords in plaintext?
"I think that the App never check the Server's certificate" Yeah, that's a pretty serious vulnerability, then.
Oct
3
awarded  Teacher
Oct
2
answered Passwords in plaintext?
Jun
12
comment SSH connection attempts from China show different key; is China doing a MITM attack on SSH traffic?
This same thing happened to me, too.
Nov
14
awarded  Critic
Nov
4
awarded  Scholar
Nov
4
accepted What output can a program, when executed from a command line, output to generate behavior that is a vulnerability on the terminal emulator?
Nov
1
comment What output can a program, when executed from a command line, output to generate behavior that is a vulnerability on the terminal emulator?
Yeahhhhh! that's awesome too. =)
Nov
1
revised What output can a program, when executed from a command line, output to generate behavior that is a vulnerability on the terminal emulator?
edited tags
Nov
1
awarded  Student
Nov
1
comment How can I protect myself from this kind of clipboard abuse?
This is crazy! :P Imagine having a random process altering the clipboard!
Nov
1
asked What output can a program, when executed from a command line, output to generate behavior that is a vulnerability on the terminal emulator?
Oct
10
comment Is it possible to do SQL injection (HIGH Level) on Damn Vulnerable Web App?
You have to be careful with intval and how it treats non numeric values. From the PHP documentation on intval: "Strings will most likely return 0 although this depends on the leftmost characters of the string". I don't see it causing an issue in this case, but it could though.
Apr
15
comment Firewall philosophy
Sorry, I am quite dense, but: Does it work for browsers like firefox, which maintain it's own database of certs? I do see how it's harmful for OP, if his app doesn't check certificates.
Apr
11
comment Firewall philosophy
@k1DBLITZ cool to know! doesn't this display huge warnings in the browser, though? I mean, that's what SSL's for, to prevent the content being looked at by anyone other than the receiver (among other thins ofc)
Jan
30
awarded  Commentator
Jan
30
comment Why does HTTP Basic authentication encode the username and password with base64?
This makes sense, it would be a shame if a user would have two new lines in his password.
Dec
13
comment How to know which database is behind a web application?
Also, check out the SQL Injection pocket reference docs.google.com/…
Dec
13
comment Firewall philosophy
-1 score, truth hurts.
Dec
13
comment Firewall philosophy
SSL decryption and application layer inspection? So you are going to SSLStrip the whole of your company's traffic? I'm not an expert on "SSL Decryption" myself, but I'd be very interested in knowing how you plan to achieve that. It's not that I doubt your skill, but the only point of having SSL is not having people intercepting and decrypting our communications, and if the sysadmin can do it, frankly, so can do everyone else on the internet between us and our destination.