1,664 reputation
212
bio website
location Tulsa, OK
age
visits member for 2 years, 6 months
seen 1 hour ago

15 years enterprise IT / Infosec experience and counting...


2d
answered Is testing for SQL injection vulnerabilities still relevant in modern web applications?
Apr
30
comment Someone Copied Our Site Code (Including Analytics) and Put Adult Content on It
Will this filter prevent the OP from being alerted someone has copy/pasted his site?
Apr
23
comment Understanding Certificate Pinning
Kudos for the SSH comparison.
Apr
22
comment How to find out if somebody is spying on my private browsing data in the same WiFi network?
There is no way for you or anyone else to know for sure. We can only make assumptions.
Apr
21
answered Minimize risk with Windows 2003 end of life
Apr
21
comment How to keep logs safe from attackers?
Sounds like you need a SIEM.
Apr
17
comment Does http.sys vulnerability affect Windows not running any webservers?
Please review: news.ycombinator.com/item?id=9378449
Apr
16
answered Malware analysis - Traffic Inspection
Apr
13
revised Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
deleted 1 character in body
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
One thing to note, if the users have a propensity to click past certificate warnings then the attacker doesn't have to take the DNS down, or force a connection by IP. The attacker can spoof any secured site with a MitM and the user would click passed the warning prompts.
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
In that very specific scenario, yes. But I would hope if the user is savvy enough to access the site by IP, I would hope they would be savvy enough to read the warning for the reason "why" the certificate was untrusted when accessing the site by IP. Was it because there was a name mismatch? Was it because the certificate chain was broken? Was it because the CA was untrusted? The latter two would indicate a possible MitM attempt.
Apr
13
revised Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
added 489 characters in body
Apr
13
answered Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
Mar
30
comment Kerberos Authentication
I found RogueLynn's explanation to be very helpful. roguelynn.com/words/explain-like-im-5-kerberos
Mar
30
comment Suspicious GET request parameter list?
Any GET request that isn't part of your expected GET request in accordance with the web application design flow is suspicious. Like Question Overflow said, there are too many to list.
Mar
24
answered Could an attacker prevent IIS from logging requests
Mar
23
comment Is Clickjacking a real security vulnerability?
One can also log keystrokes via an iframe if framebusting techniques are used.
Mar
22
comment Which is first job or certificates
Just an FYI, you're not qualified to take the CISSP exam. You must have a minimum of five years of direct full-time security work experience in two or more of the 10 domains. For all requirements, please review: isc2.org/cissp-professional-experience.aspx
Mar
19
answered Is there any way to check the certificates in a client's root CA store?
Mar
19
awarded  Citizen Patrol