374 reputation
110
bio website
location Norway
age
visits member for 3 years, 3 months
seen Dec 3 '13 at 13:04

whitehat


Feb
16
asked Does strong naming remove the need for packing/obfuscation?
Dec
23
comment iOS/Android Pen-Test
Maybe this question should be broken into multiple questions? There is too much to answer - general methodology, android app testing, ios app testing, man-in-the-middle testing using SSL with or without client certificates... Then there's the whole OS/system itself which are probably full of vulns
Dec
20
comment Is accessing bank account on the internet really secure?
Question, are there actually any online banking out there that haven't started using two-factor authorization with one-time-passwords yet? I imagined that would be one of the assumptions here.
Dec
7
awarded  Commentator
Dec
7
comment Where can I find exploit code?
I don't argue that you are wrong. What I'm saying is that it is irrelevant to the question which is where do you find exploit code.
Dec
6
comment Where can I find exploit code?
Although true, this answer has nothing to do with the question asked.
Dec
5
comment How to force ALL programs to use my Proxy?
@pootzko default port for Fiddler so that would be my guess
Oct
28
answered How should a web page respond to a CSRF attack?
Oct
27
awarded  Critic
Oct
27
comment Is there a reason to disable root login, if SSH connections are restricted to a single IPv4 address?
-1 IP Spoofing over an SSL channel would be extremely difficult to acheive and does not strike me as feasible.
Oct
26
comment Expired SSL Certificate Implications
Are you talking about a certificate for a server you own, or for other servers in general? The expiration does not necessarily mean the certificate is not secure anymore, but you should not trust it to be secure.
Oct
25
answered Is hacking legal when a friend allows you to attempt to hack their system?
Oct
25
comment Does an exposed XMLRPC API in a web application pose a threat?
I'm thinking the API is there for the developer, as the application in the background already "knows" the protocol. By that reasoning I would think it should be safe to remove? Or have I totally misunderstood the concept?
Oct
24
asked Does an exposed XMLRPC API in a web application pose a threat?
Oct
19
comment What is a good enough salt for a SaltedHash?
+1 Haven't though about that last part. Good idea.
Oct
19
answered What is a good enough salt for a SaltedHash?
Oct
7
comment The aescrypt implementation hashes a password 8192 times to generate the key. Is this necessary?
Shouldn't this be in crypto.stackexchange.com ??
Sep
15
comment Penetration testing by ethical Hackers/Crackers should be trusted?
There are always alternatives. Pentesting firms hire really good hackers, but not (usually at least) convicted criminal hackers.
Sep
5
awarded  Editor
Sep
5
revised How are possible uses for X.509 (SSL) certificates denoted?
fixed grammar