2,773 reputation
1714
bio website
location
age
visits member for 2 years, 2 months
seen 1 hour ago

1d
comment Linux Kernel module signing
If you don't have battery then all certificate validation will fail and not just kernel modules. Every HTTPS site you visit will display the non-validation warning. I suppose at this stage your problem is not that of kernel module warning but fixing the motherboard.
1d
comment How to get into penetration testing profession?
Usually you can be hired as an intern to write reports for the penetration testing exercise. However, no one will be willing to send you on the client site to perform penetration testing when you don't have any experience.
2d
comment What causes a powershell payload to run the first time but not the second?
Much has changed in the world of Metasploit payloads. Can you generate the payload through msfvenom and then run it on the target machine through powersploit or any other means?
May
22
reviewed Approve When using LUKS, which parts of the hard disk are not encrypted?
May
22
reviewed Approve If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
May
21
comment Which book is best for ethical hacking?
@SteveDL Can't imagine making fun of anyone ever. It was more of a few fun comments directed towards Kay as I knew this question is going to be closed soon. Still if it sounds in a bad taste, I deleted all the comments.
May
19
comment What is the difference between generic decryption vs sandbox techniques?
From what I understand, generic decryption means the operations through which the infected file could be trivially decrypted (decoded) and then its run time behavior analyzed. For example a lot of times the decryption or decoding stub is attached with the file which decrypts the payload at runtime. A case in point is shikata_ga_nai. When the file is executed, it jumps to the decryption routine, decrypts the payload and execute it. Such techniques can't be detected by the signature engine since the payload is encrypted. However, CPU emulation will easily detect it.
May
18
comment How does an attacker know when he has the password?
if hash(pAssword) == obtained_hash, then pAssword is the password. Else if hash(passwoRd) == obtained_hash, then passwoRd is the password and so on unless you get hash(x) == obtained_hash or you run out of choices.
May
18
comment Where should a Vulnerability Disclosure Policy be published?
"the managing director doesn't want to publish this on the website for fear of frighting customers off our website". Depending on the customers, it might earn you more trust if you are open to the vulnerability disclosures. For a long period of time, all the big vendors were afraid for the exact same reason. But at the end they have to embrace this.
May
15
reviewed Reject Prevention measures against laptop seizure at US borders
May
14
comment NMap to scan a private subnetwork
If you can access the web server from a network, so can the nmap. If you are asking about the specific switches for Nmap, you can start at nmap.org/book/man.html
May
13
comment Should veil framework produce packed and obfuscated binaries which bypass virustotal?
@SteveDL What atdre said is quite common in pentesting not to upload something to an online service. The reason is the moment you upload an executable to VirusTotal, if it is not detected by the AV, the antimalware analysts manually check the file and make signatures for it in the next AV update. Even discussing the technique used for AV bypass in a public forum usually make it blacklisted soon. That is why the idea is to setup a VM, install only the AV you are targeting, make sure the VM is disconnected from the Internet after update and then perform all the testing on this isolated VM.
May
13
comment Metasploit timeout behind nat
What is the IP address of the Win7 machine? The line "Sending stage (882688 bytes) to 192.168.1.100" is sending it to this specific IP. Also, are you using the post module or the local exploit?
May
13
comment Should veil framework produce packed and obfuscated binaries which bypass virustotal?
The gold advice is "test them against HIPS and AV system you are specifically targeting". The goal shouldn't be to bypass all AVs rather just the AV you are up against.
May
12
comment Can I use Metasploit to demo penetration testong on Zigbee or Smart meter?
Also majority of embedded device vulnerabilities include backdoor/service accounts, hard coded passwords for root, unauthenticated access to supposedly restricted and admin areas etc. Don't assume exploitation only means traditional memory corruptions as reverse engineering the firmware will almost always give juicy information.
May
12
comment Can I use Metasploit to demo penetration testong on Zigbee or Smart meter?
Metasploit modules exploits services rather than products. Smart meter is an embedded device while Zigbee is a protocol suite. A lot of embedded devices can be exploited e.g. home routers by exploiting the services running in them such as HTTP, SNMP etc.
May
12
comment How does SSL/TLS PKI work?
Was looking for an answer for the bear. +1 given. Now I am going to read the answer
May
9
comment Two user accounts, or UAC?
@MattLubbers Metasploit UAC bypass don't work in "Always Notify". Take a look at github.com/rapid7/metasploit-framework/blob/master/modules/…. If you examine the code, you will see the bypass only work when you have Administrator privileges, the process from which the UAC bypass is initiated is not low integrity, and the setting is not "Always Notify". I am not saying UAC is all-in-one solution but disregarding it as having "no security implications" is incorrect.
May
8
revised In what cases can overly strict security policies be detrimental to organisations?
edited title
May
8
comment Two user accounts, or UAC?
@MattLubbers "UAC does not provide any security implications". I disagree. UAC is not a stand alone feature. It works with the integrity levels of each process where all the user processes run in the medium integrity level by default and request elevated privileges on demand. My earlier comment was that if the same user has both accounts AND that user can't differentiate between a legitimate elevation request and a malicious one, then UAC won't provide too much of security. However, UAC itself provide great benefit and if it is set to "Always notify", the bypass is impossible without prompt.