504 reputation
18
bio website github.com/Anorov
location
age
visits member for 1 year, 1 month
seen 4 hours ago

Apr
3
answered SQL Injection via Unicode
Feb
24
awarded  Yearling
Dec
21
comment Can the xor of two RNG outputs ever be less secure than one of them?
@Matt Thanks! That does make sense.
Dec
21
comment Do generic custom scripts avoid detection more than common security applications?
Do you mean like using a custom script using C and sockets vs. using nmap, to avoid detection? I would say that for network scanning and reconnaissance: no, generally the behavior will be similar enough to flag both. However, when it comes to exploitation, usually rewriting or obfuscating exploit payloads is a good way to bypass IDSs and AVs.
Dec
21
comment Is my service provider hacked and what can I do to protect myself?
Carefully scan your computer for malware. Also, inspect your router to see if there are any peculiar DNS server entries.
Dec
21
comment Can the xor of two RNG outputs ever be less secure than one of them?
I am not a cryptography expert, but I want to say "no". XOR'ing two different same-length RNG outputs in the way you describe should be an effective way to hedge against one of the RNGs being biased or backdoored.
Dec
17
awarded  Popular Question
Nov
30
answered What methods are there of protecting a VPS from DDOS attacks?
Nov
1
comment Uploading Shell Using SQLI
AppArmor has made many a pentest quite a bit more difficult for me. I'm glad it's shipped by default for Ubuntu nowadays.
Nov
1
comment Can I limit PHP include() to specific directory trees?
In addition, be 100% sure the PHP installation on every server you're using is fully up to date. Any version 5.3.4 and above makes it impossible to truncate a filename with a null byte.
Nov
1
comment How does nmap determine if it's running HTTP service on a port? Fails here
nmap only does service detection if you pass the -sV flag.
Sep
28
comment Is it illegal to use Fake User-agents?
When weev was recently prosecuted and convicted of "hacking" AT&T's website, the prosecutors kept repeating over and over that his "spoofing" of an iPad (via a forged User-Agent header) was an indication of malicious/devious intent. I'm not sure if those same prosecutors would say such spoofing is outright illegal just on its own, but it was part of what got him convicted, so that should definitely be taken into consideration.
Sep
19
awarded  Critic
Sep
19
comment Popular Security “Cargo Cults”
And that's why strlcpy should be preferred over strncpy when copying whole strings.
Sep
19
comment Popular Security “Cargo Cults”
"effectively halving the security of a symmetric key". Not quite. It is an exponential decrease. A 64-bit key is much more than just "half as secure" as a 128-bit key. A 2048-bit key is also much less secure than a 4096-bit one, but that is still nearly impossible to bruteforce.
Sep
14
comment Are self-signed certificates actually more secure than CA signed certificates now?
If you assume that the server operator also has some secure way of communicating revocations (as CAs all, theoretically, do), and that all clients check this source before each new connection, then it actually would be pretty secure.
Sep
14
answered Are self-signed certificates actually more secure than CA signed certificates now?
Aug
31
comment Why is password hashing considered so important?
One thing to add is that a "partial, read-only" break can turn into a "full" break or even a "root access" break if the attacker is able to obtain the password of a user with administrator privileges. If the admin re-uses that password anywhere, they could potentially gain SSH or FTP access, and even if they don't, there's a decent chance that somewhere in the web application's interface is a way for them to augment their foothold (shell upload, LFI, etc.). Making it difficult for them to determine admin passwords mitigates this greatly.
Aug
29
answered DirBuster request found in my log files
Aug
21
comment CSRF possible if params are not passed through query string?
@Patrick Yep, excuse me, I was quite wrong. I've revised my answer.