137 reputation
7
bio website droope.wordpress.com
location Wellington, New Zealand
age 23
visits member for 1 year, 11 months
seen Jun 24 at 23:47

Programmer, mostly ^^


Jun
12
comment SSH connection attempts from China show different key; is China doing a MITM attack on SSH traffic?
This same thing happened to me, too.
Nov
1
comment What output can a program, when executed from a command line, output to generate behavior that is a vulnerability on the terminal emulator?
Yeahhhhh! that's awesome too. =)
Nov
1
comment How can I protect myself from this kind of clipboard abuse?
This is crazy! :P Imagine having a random process altering the clipboard!
Oct
10
comment Is it possible to do SQL injection (HIGH Level) on Damn Vulnerable Web App?
You have to be careful with intval and how it treats non numeric values. From the PHP documentation on intval: "Strings will most likely return 0 although this depends on the leftmost characters of the string". I don't see it causing an issue in this case, but it could though.
Apr
15
comment Firewall philosophy
Sorry, I am quite dense, but: Does it work for browsers like firefox, which maintain it's own database of certs? I do see how it's harmful for OP, if his app doesn't check certificates.
Apr
11
comment Firewall philosophy
@k1DBLITZ cool to know! doesn't this display huge warnings in the browser, though? I mean, that's what SSL's for, to prevent the content being looked at by anyone other than the receiver (among other thins ofc)
Jan
30
comment Why does HTTP Basic authentication encode the username and password with base64?
This makes sense, it would be a shame if a user would have two new lines in his password.
Dec
13
comment How to know which database is behind a web application?
Also, check out the SQL Injection pocket reference docs.google.com/…
Dec
13
comment Firewall philosophy
-1 score, truth hurts.
Dec
13
comment Firewall philosophy
SSL decryption and application layer inspection? So you are going to SSLStrip the whole of your company's traffic? I'm not an expert on "SSL Decryption" myself, but I'd be very interested in knowing how you plan to achieve that. It's not that I doubt your skill, but the only point of having SSL is not having people intercepting and decrypting our communications, and if the sysadmin can do it, frankly, so can do everyone else on the internet between us and our destination.
Dec
12
comment Firewall philosophy
Might as well not allow employees access to the internet :P That'd be safer.
Dec
12
comment Firewall philosophy
Yeah, I don't know. I think there are too many websites out there that require https to go one by one, whitelisting. Again, could I connect to my SSH over port 80? Not quite sure what the difference would be between those two ports. The main advantage for the sysadmin would be the possibility of actually detecting rogue encrypted traffic, but then again, you need to enable HTTPs.
Nov
15
comment Is a simple, but very long password a good password?
plus if someone sees you type that, it's going to look weird.
Sep
17
comment How to refuse delivering emails that are not signed by trusted PGP keys?
@TobiasKienzler agreed!
Sep
13
comment How to refuse delivering emails that are not signed by trusted PGP keys?
@TobiasKienzler No, it won´t. Will convice them of not writing any email to you though.
Sep
13
comment Global Blackout is a myth?
Wonder how much of it is hosted at amazon.