2,578 reputation
315
bio website
location Tulsa, OK
age
visits member for 2 years, 9 months
seen 2 days ago

15 years enterprise IT / Infosec experience and counting...


2d
answered Identify Malicious/Suscipicous Processes from Process List
Jul
27
comment Force a specific SSL cipher
I just used the method in the answer and it worked great. Often times the ciphers reported by the scanning tool don't align with the cipher name that must be specified in OpenSSL. There is a handy list located at: openssl.org/docs/apps/ciphers.html
Jul
23
comment Is it possible to exploit an image field in which I can upload any file?
You might give this a watch: youtube.com/watch?v=NPqVVhxhqmY "The Little JPEG That Could (Hack Your Organization)" Even it's not susceptible you'll learn something really cool. :)
Jul
10
revised indicators of compromise via email servers
grammar, punctuation.
Jul
8
comment Implications of IP Address as Subject Alt Name in certificates
Heads up, if this is going to be used on an internal server - the use of IP's is going to be deprecated. symantec.com/connect/blogs/transition-non-fqdn-server-names
Jun
30
comment Fiddler show external requests but not initiated by any legitimate process
For the time being, you could add an entry in your hosts file to route www.google.pl to 0.0.0.0 until you can track this thing down.
Jun
26
revised Fiddler show external requests but not initiated by any legitimate process
grammar
Jun
26
answered Fiddler show external requests but not initiated by any legitimate process
Jun
22
comment Is there a way my organization can collect clients' sensitive documents without being liable for them?
You're already liable to be GLBA compliant for handling sensitive customer/financial data. (if you're in the US or doing business with a US company) Please review: ftc.gov/tips-advice/business-center/privacy-and-security/…
Jun
10
comment Is it secure not to have csrf protection in login forms?
@Aatif Please provide an example of how the Worpress Admin panel is susceptible.
Jun
10
revised Is it secure not to have csrf protection in login forms?
clarify in reference to wordpress
Jun
10
answered Is it secure not to have csrf protection in login forms?
Jun
8
revised What do I do if I find XSS on my website?
clarifying that this is in reference to reflected XSS as Stored XSS is indeed server side.
Jun
5
comment Can a wifi provider decrypt HTTPS usind MITM without users noticing?
Or use SSLstrip, though sites are starting to protect against this.
Jun
5
comment How to figure out that someone is ARP spoofing me and what to do against it?
Is this a wireless network?
May
29
comment Penetration testing approach - Is there a better method?
@Atsby It depends on the scope. I've see some network pentesting companies who ran the equivalent of an nmap scan against our external network and collected a fat check. However, I've seen web application pen testing companies that were worth their fee and then some. These tests involved highly skilled and specialized pen testers utilizing human logic and intuition in combination with tools and were highly effective. I actually look forward to reading those reports because the things these people find are amazing. Long story short, you have to shop around till you find the right fit.
May
27
comment Are there any two way + two factor authentication systems in use?
@RoryAlsop I modified my out of band statement to be more accurate. However, if the premise is that it's not out of band because it can be compromised, then nothing can be truly out of band.
May
27
revised Are there any two way + two factor authentication systems in use?
modified out of band statement
May
27
revised Are there any two way + two factor authentication systems in use?
added image for clarity.
May
27
answered Are there any two way + two factor authentication systems in use?