9,009 reputation
12843
bio website
location
age
visits member for 4 years, 6 months
seen 1 hour ago

May
22
comment Any way to circumvent a 'filtered' response on NMap?
Repeat question -- security.stackexchange.com/questions/53104/…
May
20
comment Resources on security risks of NFC
Also see this question -- security.stackexchange.com/q/66590/140
May
20
comment How secure is NFC on mobile devices?
Also see -- security.stackexchange.com/q/66590/140
May
17
comment How to detect Meterpreter and similar malware?
Actually it appears that Avast, BitDefender, and BullGuard are the only three that can reliably detect Meterpreter. In particular, McAfee and TrendMicro will not even catch a Meterpreter which has not been obfuscated at all! What the heck!
May
13
comment What techniques and tools do you use to relate security events?
It's Q2-2015 and most of these answers are still relevant, seeing shops running RSA Security Analytics, Splunk, and OSSIM, as well as QRadar and certainly ArcSight and Trustwave. What I don't see are modernized additions such as Cybersponse, Squrrl, etc. Please speak up!
May
13
comment What is the proper priority/mix of (people, tools and technology, processes) to optimize defense?
Is this a goal of the NIST CSF? Does it try to answer this qustion? If so, how effectively? What is missing?
May
13
comment Should veil framework produce packed and obfuscated binaries which bypass virustotal?
@ Steve : Unsure, but you are saying too much and I am purposefully implying too little. Concentrate on the best approach, which is what I gave
May
13
comment Should veil framework produce packed and obfuscated binaries which bypass virustotal?
@ Steve: Great question. So the basic answer is that you're fighting yourself: by submitting it, you're telling the AV companies that it's malware too simply since many factors will catch it. Check out the Malware Analyst's Cookbook or its tools here -- code.google.com/p/malwarecookbook -- there are many other resources but this is an ok starter
May
12
comment Can I use Metasploit to demo penetration testong on Zigbee or Smart meter?
You must be thinking of Killerbee -- code.google.com/p/killerbee/wiki/GettingStarted
May
12
comment NFC contactless payment security
More links to read -- inforisktoday.com/blogs/… -- hackfu.mwrinfosecurity.com/hackfu-blog/params/post/465447/…
May
8
comment Is it safe to trust a Docker container?
infoq.com/news/2015/05/Docker-Security-Benchmark
May
6
comment Why do so many embedded devices use shared keys?
Be sure to also check out the amazing work at -- factorable.net
May
5
comment Is it good idea to rely on Mifare UID for security/authorization reasons?
firefart.at/how-to-crack-mifare-classic-cards
May
4
comment Dynamic application security testing tools
DOMinator Pro is the best for this purpose
Apr
24
comment Do actual penetration testers actually use tools like metasploit?
Powershell is now on Crowdstrike's radar. Won't be long until ClickOnce and newer payload concepts will have their heyday
Apr
21
comment Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?
I really don't think that any of the people who commented in response to my post or downvoted me understand the issues here at all. They don't have the experience. Testing must happen. Testing moves things forward. Testing some things in prod and some things in dev or test is the way to go. Understanding what bad can wrong in either is the zen of security testing and pen testing alike.
Apr
20
comment Is a web application firewall necessary if the application is secure?
Completely agree except with the last part. It's always possible to get the source code. It's always possible to get physical access to the systems running the app.
Apr
20
comment Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?
The difference between some people on this forum who follow the letter of the law, and me, who follows the spirit of the law -- is that I can reinterpret meaning from questions and "question the question". It's ok to debate. It's ok to have different perspectives. This is the world I want to live in. All of my pen tests are full knowledge. I always get the source code first.
Apr
19
comment Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?
I can; maybe you can't
Apr
16
comment Web Crawler for ASP.NET site
Have found that Netsparker Community or Pro editions work on ASP.NET apps especially well