Reputation
3,135
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
6 18
Newest
 Enlightened
Impact
~151k people reached

Nov
1
awarded  Yearling
Oct
20
revised A couple of questions about port scanning
added links for reference
Oct
20
answered A couple of questions about port scanning
Oct
20
comment Web site vulnerability discovery by scanner
@PangSerLark Yes, it will. Today's web application scanners (I have 10+ years of experience with HP Webinspect) are quite sophisticated. If there are URL's in the javascript, it will find them. If you have comments in the code, it will find them. Any and all data in the cookie(s) will be parsed and attacked. All headers will parsed and attacked. All parameters found will be manipulated and attacked. All directories will be probed. There will literally be thousands of requests sent to the web server in an effort to sniff out any and all vulnerabilities.
Oct
19
revised Web site vulnerability discovery by scanner
grammar
Oct
19
revised Web site vulnerability discovery by scanner
grammar
Oct
19
answered Web site vulnerability discovery by scanner
Oct
16
comment What is a typical response from webserver for POST request?
@DoodleKana Correct, the HTTP status code is irrelevant. There is a distinction between Post data and form field data. Post payload is not cached but form field data can be cached. To prevent form field data from being cached, please refer to stackoverflow.com/questions/2699284/…
Oct
14
comment Pros and cons of security images
Actually, many institutions have removed site images due to pending litigation by patent trolls.
Oct
13
comment Can a WiFi access point operator tell that I'm streaming video to my phone?
@drxzcl "Netflix is on the harmless end of the scale" This is not entirely true. There are other factors to consider. We don't know if any business critical processes are using the Wi-Fi. We don't know how much bandwidth is available via the Wi-Fi link. A situation could occur where the link is saturated with streaming Netflix traffic if other employees adopted this same approach to combat boredom, creating a DOS scenario.
Oct
6
revised How to block or detect user setting up their own personal wifi AP in our LAN?
deleted 22 characters in body
Oct
6
revised Bring your own phone to a (new) job: Consequences?
removed silicon valley reference.
Oct
6
accepted Can I force unique passwords for domain admin accounts?
Oct
6
awarded  Scholar
Oct
6
comment Is it possible to change code of website through an embedded image
In addition to what Dr Mattle said, "The little jpeg that could hack your organization" youtube.com/watch?v=BIwe571zcWY A real world example of why it's important to get this right.
Oct
5
comment Non-Sensitive/Non-Critical Database and Web server protections?
"People confirmers" are commonly referred to as Captchas. :) As for the webserver, ideally there would be a WAF (web application firewall) or HIDS (host based IDS) in place to help prevent and detect attacks. In this case though, it seems the cost to implement would be higher than the data worth protecting. It would serve the security posture well if the developers are following OWASP and SANS SWAT guidelines for secure coding.
Oct
2
answered How to find a process that is sending HTTP HEAD requests
Oct
1
answered Non-Sensitive/Non-Critical Database and Web server protections?
Oct
1
comment Non-Sensitive/Non-Critical Database and Web server protections?
Can you define/elaborate on "gets interfaces from two critical systems"?
Sep
24
comment How do banking software systems securely store account information in database?
Also, companies like Imperva and McAfee have products designed to detect as well as prevent this type of scenario from occurring. These products are dubbed "Database Activity Monitoring" - aka: DAM.