2,300 reputation
726
bio website N/A
location Canberra, Australia
age 31
visits member for 2 years, 3 months
seen Nov 1 '13 at 5:02

.


Feb
6
awarded  Yearling
Sep
30
awarded  Explainer
Jun
19
awarded  Nice Answer
Feb
6
awarded  Yearling
Mar
26
awarded  Revival
Mar
7
awarded  Enthusiast
Feb
24
awarded  Enlightened
Feb
22
awarded  Enlightened
Feb
22
awarded  Nice Answer
Feb
21
comment How can I tunnel through an SSH server for HTTP(s) requests?
Have a look at wiki.vpslink.com/Instant_SOCKS_Proxy_over_SSH - what you're after is achievable with a SOCKS proxy, the only caveat being that client software (IE/Firefox/Chrome in the case of HTTP/HTTPS) needs to support it and be configured to use it.
Feb
20
reviewed No Action Needed What is the correct way to implement anti-CSRF form tokens?
Feb
20
reviewed No Action Needed What is the correct way to implement anti-CSRF form tokens?
Feb
20
comment Cracking MS-CACHE v2 hashes using GPU
Have a look at my update above - it contains the link for MSCash2 - openwall.info/wiki/john/MSCash2 and a couple of other things I found out.
Feb
20
awarded  Nice Answer
Feb
19
awarded  Good Answer
Feb
17
comment Is this SSO design secure?
We're getting way off topic; maybe worth a second question if you want detailed answers. The quick answer is: 'DNS Poisononing is easier than you think, public wifi plus a cheap device - and cache entries can outlive your connection to a compromised network.'
Feb
17
comment Cracking MS-CACHE v2 hashes using GPU
I've added a section detailing what I found of MSCache2 - as compared to openwall.info/wiki/john/MSCash I don't think it's anywhere near as attackable. You'd have to go in with some prior knowledge of some description.
Feb
17
revised Cracking MS-CACHE v2 hashes using GPU
added 925 characters in body
Feb
17
comment Is this SSO design secure?
A simple method is to find a site that has an open redirect (or set one up yourself; somesite.com/?redirectto=auth.com) and run a DNS poisoning attack of some sort to make somesite look like your site.
Feb
16
comment Is this SSO design secure?
That's really not true - forging the referer is easy, so is forging the query string, but neither matter; because it's not that big a risk to authenticate a user against a service they have access to - just make the token site specific.