Reputation
3,075
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
5 17
Newest
 Nice Answer
Impact
~132k people reached

Oct
19
revised Web site vulnerability discovery by scanner
grammar
Oct
19
revised Web site vulnerability discovery by scanner
grammar
Oct
19
answered Web site vulnerability discovery by scanner
Oct
16
comment What is a typical response from webserver for POST request?
@DoodleKana Correct, the HTTP status code is irrelevant. There is a distinction between Post data and form field data. Post payload is not cached but form field data can be cached. To prevent form field data from being cached, please refer to stackoverflow.com/questions/2699284/…
Oct
14
comment Pros and cons of security images
Actually, many institutions have removed site images due to pending litigation by patent trolls.
Oct
13
comment Can my employer see that I am using Netflix on my phone using their wifi?
@drxzcl "Netflix is on the harmless end of the scale" This is not entirely true. There are other factors to consider. We don't know if any business critical processes are using the Wi-Fi. We don't know how much bandwidth is available via the Wi-Fi link. A situation could occur where the link is saturated with streaming Netflix traffic if other employees adopted this same approach to combat boredom, creating a DOS scenario.
Oct
6
revised How to block or detect user setting up their own personal wifi AP in our LAN?
deleted 22 characters in body
Oct
6
revised Bring your own phone to a (new) job: Consequences?
removed silicon valley reference.
Oct
6
accepted Can I force unique passwords for domain admin accounts?
Oct
6
awarded  Scholar
Oct
6
comment Is it possible to change code of website through an embedded image
In addition to what Dr Mattle said, "The little jpeg that could hack your organization" youtube.com/watch?v=BIwe571zcWY A real world example of why it's important to get this right.
Oct
5
comment Non-Sensitive/Non-Critical Database and Web server protections?
"People confirmers" are commonly referred to as Captchas. :) As for the webserver, ideally there would be a WAF (web application firewall) or HIDS (host based IDS) in place to help prevent and detect attacks. In this case though, it seems the cost to implement would be higher than the data worth protecting. It would serve the security posture well if the developers are following OWASP and SANS SWAT guidelines for secure coding.
Oct
2
answered How to find a process that is sending HTTP HEAD requests
Oct
1
answered Non-Sensitive/Non-Critical Database and Web server protections?
Oct
1
comment Non-Sensitive/Non-Critical Database and Web server protections?
Can you define/elaborate on "gets interfaces from two critical systems"?
Sep
24
comment How do banking software systems securely store account information in database?
Also, companies like Imperva and McAfee have products designed to detect as well as prevent this type of scenario from occurring. These products are dubbed "Database Activity Monitoring" - aka: DAM.
Sep
23
comment Implications of the security model of HTTP cookies on HTTPS connections
The HttpOnly flag is designed to help prevent scripts from interacting with a cookie.
Sep
10
comment Many suspicious requests are going from my browser whenever open any site
In the meantime, you can redirect those sites to 0.0.0.0 via your hosts files until you can get things under control.
Sep
8
comment Browsing file/directory structure of a website
In IIS, it's a server side configuration. Directory Browsing can be enabled or disabled.
Sep
4
answered Amazon cert SHA-1 signed?