278 reputation
14
bio website
location
age
visits member for 3 years, 9 months
seen Oct 2 '13 at 5:49

Jan
5
comment Building a Security Training Simulation environment
A hosted service like Amazon would likely not serve your needs. When we looked into setting this same type of environment with them for use by our students, they informed us that the type of activities students would have to perform against the amazon network (portscans, network exploits, etc.) would violate their terms of service and they would probably have to shut us down. Keep that in mind as you make a selection. You may have to build something in house.
Aug
9
comment Are SQL injection scans considered illegal?
Geez. Don't listen to Matrix. One of the hallmarks of a real security professional is a high ethical and moral standard. You must consider if you "should" more than you consider if you "can."
Aug
9
comment Why does the password field not show the entered text?
Lotus Notes (don't laugh) is an example of an app that displays a random number of X's when you type your password to, as Matrix says, obfuscate its true length.
Jun
27
comment How can I detect and block bots?
Agree with John C. There is nothing simple about truly effective bot-blocking, hence my complicated answer. Plus, OP explicitly stated the word "build" so I didn't mention pre-built stuff like Roboo, etc.
Jun
27
comment How can I detect and block bots?
IP address is low hanging fruit, but in practice is ineffective for this. Most large networks use NAT so multiple hosts share few externally facing IP addresses. My university proxied all connections from their internal net through just 2 external IP addresses. In OP's example, Stackoverflow could see hundreds of requests per second from those 2 IP addresses, but it is all valid traffic from dozens of real humans whose access is legit. That's why I discussed in my answer about user agent string, cookie, etc. as other uniquely identifying characteristics.