8,660 reputation
2442
bio website
location
age
visits member for 4 years, 4 months
seen 29 mins ago

Mar
24
comment How to pen-test RAP applications
retire.js and Burp Suite Professional may be your best bets then
Mar
18
comment Firewalk through a Firewall on our subnet
Try using `strace -fx firewalk <flags> <ip> <ip>' and see what's stopping it. Or use tcpdump (or Wireshark) and compare the firewalkk traffic from the original tool to the nmap NSE scripts.
Mar
18
comment What can I do with a SSH certificate?
You can use a tool such as this one -- leidecker.info/projects/phrasendrescher.shtml -- to "password brute-force" an SSH RSA or DSA private key file. The tool is included with Kali Linux
Mar
17
comment Firewalk through a Firewall on our subnet
Try the -t, -T, and -x flags with values that make sense to your environment as well
Mar
17
comment Firewalk through a Firewall on our subnet
@ Shrout1: Did you try putting them both together like the above?
Mar
17
comment Firewalk through a Firewall on our subnet
Perhaps it would be `firewalk -d 80 -n -pTCP 192.168.1.2 192.168.3.11''? See the man page -- freebsd.org/cgi/…
Mar
17
comment Firewalk through a Firewall on our subnet
Can you try specifying more flags for firewalk(1)? e.g., `firewalk -n -pTCP -S25,53,80,443,465,587,5353 192.168.1.2 192.168.3.11'. Maybe it's a name resolution or ICMP/UDP issue?
Mar
10
comment proxychains-ng with nmap issues
I had almost exactly this -- github.com/rofl0r/proxychains-ng/blob/master/src/… -- except the last line. I had "http proxyservername 8080 username passwordsecret" instead of "socks4 127.0.0.1 9050"
Mar
10
comment How to bypass Nmap blockage?
This might work! I'd also try port 88 or ports 9100-9107 since Kerberos and printer traffic are likely to be hole-punched through any interfering proxy or fireall.
Mar
10
comment How do I report a vulnerability to a large organization that doesn't believe it has a problem?
The HD Moore method is to notify the company, wait 15 days, notify CERT, wait 45 days, if CERT releases anything then call the press, even if CERT doesn't release anything (and even if they do) then start building a module for Metasploit, commit it to unstable, and make sure it gets committed to master within 30 days
Mar
10
comment Transparent way to send logs from honeypot to logging server
LibVMI -- libvmi.com -- gets inside the guest VM from the host hypervisor.
Mar
10
comment Similar products to MS EMET
Invincea has a comparison to EMET -- invincea.com/why-invincea/microsoft-emet-comparison
Mar
10
comment Manipulating data during a MiTM
I prefer Kali Linux, a few Alfa WiFi external-USB radios, and to `apt-get install mana-toolkit mitmf'. These last two tools provide a lot more than the MITM-focused tools I've seen in 2014 or earlier
Mar
10
comment Open-source penetration-test automation
@ schroeder : Yes, I came across AutoPwn -- github.com/nccgroup/autopwn -- while writing this post. It supports serial and parallel, multi-tool operation. For me, personally, I'd just rather run screen(1) in one or more X11 terminals (e.g., rxvt). I like to decide when I want to make something run in parallel, and I like to watch the output. Storing data in Dradis or LAIR allows me to organization my information rather well. Thoughts?
Mar
10
comment proxychains-ng with nmap issues
I have used nmap in privileged mode with -- github.com/rofl0r/proxychains-ng -- and had zero issues, including with version detection. If I were to take a guess, it sounds like a bad proxychains.conf file
Feb
28
comment Looking for credit card data and other PII in files
Similar to this question -- security.stackexchange.com/questions/34902/… ?
Feb
26
comment Open-source penetration-test automation
Need to work on my set_config skills! Any updates on using SET or similar tools? What is new and innovative in this space?
Feb
24
comment Does an alternative approach to PKI technology exist?
This is such a relevant question given SuperFish, PrivDog, et al -- the current state of TLS affairs in early 2015!!! A+++++
Feb
24
comment Code Review Strategies
@ paj28: for which parts of the app stack in Python? in webapps, there's -- github.com/sdelements/django-security -- from the people who make this product -- sdelements.com/features -- not static analysis, but clearly all huge wins for appsec that go beyond the norm
Feb
24
comment How did Snowden do it?
Facts from Citizenfour and Frontline United States of Secrets: Snowden had TS SCI PRIVA, which means he had a special kind of privileged access to top-secret information because of the fact the he was a sysadmin. Another fact from those sources is that Snowden infiltrated computers owned by GCHQ, not the NSA directly. If the GCHQ had an equivalent of Intellipedia, Snowden used `wget -m' (similar to Zuckerberg at Harvard gathering pictures, portrayed rather cleanly in The Social Network)