ephrack

369 reputation

bio	website
	location	Norway
	age
visits	member for	2 years, 1 month
	seen	Apr 21 at 18:35
stats	profile views	38

whitehat

	369 reputation	bio	website		visits	member for	2 years, 1 month
19 badges		location	Norway		seen	Apr 21 at 18:35

summary answers questions tags badges favorites bounties reputation activity

49 Actions

suggestions reviews revisions comments badges posts accepts all

Feb 20	asked	How to use Maltego in a team?
Jan 22	comment	Swap file may contain sensitive data Lets say I set up Debian with encrypted LVMs (standard setup) would that mean this is set up?
Jan 19	awarded	Citizen Patrol
Jan 19	comment	Swap file may contain sensitive data Nice one. Is there a similar easy fix for Linux without using protected memory?
Jan 13	comment	UNION SQL Injection you need to close the query before the comment
Nov 24	comment	What are the main weaknesses of mobile software based OTP generators? Agreed. It would be easy to reverse engineer the OTP-generation algorithm and learn future passwords.
Aug 14	awarded	Caucus
Aug 14	comment	Is this a ViewState attack? Is this the only occurrence from this IP? For me the suspicious part is the " ' " character, which is often used for probing SQL injection vulnerabilities.
Jun 25	asked	Good Android tablet for pentesting apps?
Apr 17	awarded	Yearling
Mar 8	comment	How to perform security exploits/penetration on devices like iPhone's, PSP's, and Android to run your owncode? No need to apologize :) I like the question, but maybe it should be broken into multiple more specific ones. And I too am very interested in this topic. For reference I've been testing Android apps and this might point you in the right direction for that: intrepidusgroup.com/insight/2011/05/androidaudittools and wsec.be/blog/2011/10/05/adventures-in-pentesting-android-apps
Mar 7	comment	How to perform security exploits/penetration on devices like iPhone's, PSP's, and Android to run your owncode? I think you should be more specific - as each device is different, how you exploit or pentest each device is inherently different. At least technically. Many of the principles are of course the same as with all clients, be it a Windows computer or an Android device.
Feb 22	comment	Is accessing bank account on the internet really secure? @AviD just a typo, I meant authentication of course. But in Norway where I'm from I have not heard of any bank that don't use two-factor authentication. I actually thought that was a requirement for PCI compliance, but of course it might just be an "extra service" our banks provide.
Feb 19	comment	Does strong naming remove the need for packing/obfuscation? I agree you are right. However everywhere I read about them they're presented as a security feature.
Feb 19	revised	Does strong naming remove the need for packing/obfuscation? added 7 characters in body
Feb 19	revised	Does strong naming remove the need for packing/obfuscation? Edited to add answer
Feb 16	accepted	Does strong naming remove the need for packing/obfuscation?
Feb 16	comment	Does strong naming remove the need for packing/obfuscation? Okay, so long as the attacker has control over its GAC they will be able to do this. I'm accepting this answer.
Feb 16	comment	Does strong naming remove the need for packing/obfuscation? How would you hack the verification code? It's signed using a 1024 bit RSA key. As to updating the references I see this is a possible way, however with a large application this becomes a very daunting task. Say if you have an application with at least a 100 assemblies and a 100k lines of code, would it even be plausible?
Feb 16	comment	Does strong naming remove the need for packing/obfuscation? I've tried changing the assemblies of an application using Graywolf (digitalbodyguard.com/GrayWolf.html). However, when I try to run the application afterwards it fails because the classes are looking for assemblies signed by the original author. My modified assemblies have strong name with PublicKeyToken=null. How would an attacker overcome this?