meta user
network profile
| bio | website | |
|---|---|---|
| location | Washington, DC | |
| age | 30 | |
| visits | member for | 2 years, 2 months |
| seen | May 20 at 21:20 | |
| stats | profile views | 26 |
|
Apr 22 |
accepted | What applicability does the Halting Problem have to infosec? |
|
Apr 21 |
comment |
Secure yet reversible encryption for local data store I agree with Kitsune.. Don't implement your own crypto. It's too easy to make mistakes, you're a novice, and there are too many high-quality and free implementations out there to justify DIY crypto. Your best bet is whole disk encryption. If you need free, look at True Crypt. |
|
Mar 15 |
awarded | Organizer |
|
Mar 15 |
revised |
What is the next step of this file upload attack? edited tags |
|
Mar 14 |
comment |
What is the next step of this file upload attack? "PHP is run with permissions that can't be obtained by a hacker via normal HTTP." I'm not sure if this is true for IIS in particular, but it's definitely not true in general. E.g. when running mod-php with apache, mod-php runs inside the daemon processes, and therefore executes as the same user, same umask, etc. |
|
Mar 14 |
comment |
What is the next step of this file upload attack? "As long as you have control over the file name and where it's stored1, it's not an issue." Wrong. See AJ Henderson's post, and also consider what happens if mod-php is a registered handler for .jpg files. |
|
Mar 14 |
answered | What is the next step of this file upload attack? |
|
Mar 14 |
comment |
What is the next step of this file upload attack? What's a nonexecute directory?? |
|
Feb 27 |
awarded | Yearling |
|
Feb 13 |
asked | What applicability does the Halting Problem have to infosec? |
|
Feb 9 |
comment |
Protecting against SSL Strip "Use SSL sitewide." If you do this, then users who enter yoursite.com will get a connection refused error, unless you have a non-SSL server listening on port 80 that redirects to port 443. But if you do that, then your users are susceptible to sslstrip, which is the whole point of sslstrip. |
|
Feb 9 |
answered | Protecting against SSL Strip |
|
Dec 3 |
comment |
Checklist for securing MacOSX They provide some in PDF format and some are in XML format. The ones I linked to were in PDF, so I'd be surprised if you couldn't open them. The XML ones are admittedly hard to work with; there is no stylesheet that I know of that will pretty print a STIG. |
|
Dec 3 |
answered | Checklist for securing MacOSX |
|
Dec 1 |
revised |
How to properly validate HTTP redirects? fix typo |
|
Dec 1 |
revised |
Should an app remove or encrypt locally stored user data after a user logs out? fix typo |
|
Nov 29 |
comment |
Is there formal guidance that requires all sessions to be logged off when a user changes their password? @ixe013 You're assuming a lot about the OP's environment that isn't necessarily true. He might not be using cookie's to store session state. He might not even be talking about HTTP at all. |
|
Nov 2 |
comment |
Is it necessary to scan users' file uploads by antivirus? Nobody mentioned an important detail: threat model. In your threat model, are the people uploading these files considered to be potential attackers? If so, then #1 is a must. |
|
Nov 2 |
comment |
Is it necessary to scan users' file uploads by antivirus? What parsers are written in memory-safe languages? Most HTML, XML, and JSON is parsed in C or C++ code. |
|
Nov 1 |
asked | Compatibility between OpenSSL 0.9.8r and OpenSSL FIPS Object Module v1.2? |
