1,308 reputation
1418
bio website
location
age
visits member for 1 year, 6 months
seen 11 hours ago

Apr
10
comment Best secure way to update back-end servers?
@DKNUCKLES done. Linux servers, mostly they are RedHat v5 and v6.
Apr
10
revised Best secure way to update back-end servers?
added 20 characters in body
Apr
10
asked Best secure way to update back-end servers?
Apr
6
accepted Why do we trust organizations that certificate ISO 27001?
Apr
6
asked Why do we trust organizations that certificate ISO 27001?
Apr
4
awarded  Famous Question
Mar
24
awarded  Popular Question
Mar
18
comment SqlMap bypasses OWASP ModSecurity Core Rule Set for SQL Injection
;) Have you thought that maybe sqlmap bypasses the WAF because it's obfuscating the payload? Can you bypass it manual encoding the URL as well?
Mar
18
comment How safe is SSL?
have you ever heard about sslstrip or BREACH?
Mar
18
answered Embedding hidden data inside files
Mar
18
comment SqlMap bypasses OWASP ModSecurity Core Rule Set for SQL Injection
What's the point of hiding a private IP and a private session ID?
Mar
17
awarded  Notable Question
Mar
17
accepted Isn't a HIDS, NIDS and WAF complementary?
Mar
17
asked Isn't a HIDS, NIDS and WAF complementary?
Mar
7
asked Given a hash, salt, charset and password length, how do you get the password without brute-forcing it?
Feb
26
comment Why does host's antivirus detect guest's malware?
I'm using VirtualBox
Feb
26
comment Why does host's antivirus detect guest's malware?
No shared files, guest's network adapter is configured as NAT.
Feb
26
asked Why does host's antivirus detect guest's malware?
Feb
20
comment Trying to reproduce a file upload compromise on Joomla
I don't have direct access to that machine. I got the logs from the days that the network guys detected the web shell working, but maybe it was there for long time. And one of the guys which access to that machine deleted the all the files that seemed to belong to the shell. Today I noticed that the administrator page doesn't have bruteforcing protection, so another entry point.
Feb
20
comment Trying to reproduce a file upload compromise on Joomla
which version are you using? Joomscan says it's the 1.5.12 but I just confirmed the running version is 1.5.20. Checking out the changelog, the file upload vulnerability was fixed on 1.5.13,so maybe that's why I don't see the obfuscation code? Also, when I go to the url provided on #1 I get a HTTP/1.1 200 OK Date: Thu, 20 Feb 2014 15:06:48 GMT Server: nginx/0.8.50 Content-Type: text/html X-Powered-By: PHP/5.3.2 Content-Length: 17 Keep-Alive: timeout=5, max=500 Connection: Keep-Alive Restricted access