Reputation
10,603
Top tag
Next privilege 15,000 Rep.
Protect questions
Badges
1 33 55
Newest
 Announcer
Impact
~667k people reached

22h
comment Hacking/Sniffing/recording GSM like Karsten Nohl
Related answer using pytacle and Kraken here -- security.stackexchange.com/a/94901/140
Jan
30
comment How often do high-end attackers actually use zero-day exploits?
Yeah the use of the term `zero-day exploit' is sort of a misnomer. I find it interesting when there is no public code available but an adversarial team like a nation state or criminal org all of a sudden uses an exploit for a patched vuln where the patch is 0-3 months old. This happened twice in the Stuxnet codebase, as an example (patches were available but no known exploit code was). What's scary about very-recent patches with no public exploit code is that many IDS/IPS/UTM devices do not have signatures yet. Red-team engagements can't use them yet for adversarial simulation.
Jan
22
comment How Should WiFi Passwords be securely stored on IOT (embedded) devices?
BitLocker will stop those attacks
Jan
20
comment What is real-world impact of CVE-2016-0728 (Linux Kernel Vulnerability)
@leoluk: yes, but even ARM processors (and most server-based Intel ones) include this sort of support.
Jan
12
comment Difference between antivirus and sandbox?
Detecting malware, a form of computer-based deception performed by a human or humans, can only be detected by a human or a team of humans that have analytical knowledge of counterdeception and domain knowledge of malware and anti-malware practices
Jan
12
comment Should the risk of antivirus products be reconsidered in light of the TrendMicro critical bug report
If you read The AntiVirus Hacker's Handbook, you'll realize that it's not jus TrendMicro, but all AV vendors -- even FOSS projects such as ClamAV. AV agents always increase the attack surface and lower the security posture -- and yes, many still have millions of vulns left to uncover. They make systems more vulnerable and more easily exploitable in nearly all situations.
Dec
30
comment Using VPN on Android, Necessity of Rooting
Just use OpenVPN app, I had found it as a useful non-root required app in the past
Dec
18
comment Nmap NSE Password Brute Force is Stopping on First Positive Instance
i think it's because any instance of firstonly causes the condition to be true. just leave it out. the default is to keep bruting
Dec
4
comment Open-source penetration-test automation
For those who like masscan, it now has a web interface -- offensive-security.com/offsec/masscan-web-interface
Dec
1
comment apple.com exploit attempt?
Is there an exploit or POC for ms15-065?
Nov
29
comment Metasploit Meterpreter alternatives
This answer is exactly right! Using payload/windows/dllinject with Empire is the best way to get an implant on a Windows machine, but with which exploits? Can it work with SMBRelayX, LNK, and USB Rubber Ducky -- or only browser/Java/Flash exploits? Doesn't Empire ship with a weak network-based C2? What about PowerShell defenses such as -- hackerhurricane.blogspot.com/2015/05/… -- leeholmes.com/blog/2015/11/13/detecting-obfuscated-powershell -- and dfirblog.wordpress.com/2015/09/27/dissecting-powershell-attacks ?
Nov
29
comment OSX Yosemite and Security/Privacy
github.com/drduh/OS-X-Security-and-Privacy-Guide
Nov
23
comment Message signing disabled (dangerous, but default)
Exploit engine here -- nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2015/…
Nov
13
comment Do actual penetration testers actually use tools like metasploit?
I may contend that, as of late, Empire's Process Injection -- powershellempire.com/?page_id=273 -- especially when combined with PowerSploit's Invoke-ReflectivePEInjection and Out-MiniDump provide a lot of advantage (as an implant) over anything in meterpreter, unicorn, or even spraywmi
Nov
12
comment Should veil framework produce packed and obfuscated binaries which bypass virustotal?
veil-framework.com/…
Nov
11
comment How do you capture ALL the traffic from an Android app?
@DylanPierce You can change DNS settings however you like. See -- developer.android.com/tools/devices/emulator.html#dns -- and -- stackoverflow.com/q/2676073
Oct
15
comment How can I objectively evaluate trust in a person? (Systems Admin, or other)
It's easier to trust teams than people -- trusted-introducer.org -- the best way to establish any semblance of team-based trust is to enforce the two-person-integrity rule -- en.wikipedia.org/wiki/Two-man_rule -- see more in the book, Managing the Insider Threat: No Dark Corners
Oct
15
comment Is Bluetooth Low Energy Injection possible?
Repeat question? -- security.stackexchange.com/q/100443/140
Oct
10
comment How do I continue pentesting with access to local station?
Subverting the supply chain can be a very-believable and nearly-unstoppable vector. For a few hundred dollars you can convince someone that they have won an iPad. You can even reshinkwrap the box.
Oct
2
comment Automatically enumerate missing patches on penetration test
@ SilverlightFox: In terms of your second comment above on running Nessus through a session, please check out this reddit /r/AskNetsec thread -- reddit.com/r/AskNetsec/comments/32b9sj/… -- but if you have access to this commercial tool (Cobalt Strike) and use the Beacon implant instead of the meatsploit-framework meterpreter one, this method can passthrough non-TCP IPv4 packets -- cobaltstrike.com/help-covert-vpn -- ask me about IPv6 if you want to know more about that, too