2,498 reputation
1513
bio website
location
age
visits member for 1 year, 8 months
seen 10 hours ago

10h
reviewed Approve suggested edit on should I encrypt a certificate used only for automation?
Nov
18
comment Best practice in web application security authentication to avoid bruteforce attack
OWASP brute forcing protection owasp.org/index.php/Blocking_Brute_Force_Attacks
Nov
17
reviewed Approve suggested edit on Can GPG be a full replacement for PGP?
Nov
5
reviewed Approve suggested edit on Intercepting SSL traffic on Android app
Oct
30
comment How to make a decent Certificate Signing Request (CSR)?
Take a look at the excellent blogpost at timtaubert.de/blog/2014/10/deploying-tls-the-hard-way
Oct
29
comment bot detection via browser fingerprinting
Instead of looking for malicious UAs, baseline all the UAs in your environment and then look for deviation. But this process is not robust as well. Signatures are not robust. Nothing stops the malicious users from changing the parameters. A case in point is meterpreter HTTP(S) where you can configure any UA you want.
Oct
28
reviewed Approve suggested edit on What are the insecure Protocols in terms of PCI DSS
Oct
26
reviewed Approve suggested edit on Need Help with decrypting the “client key exchange” captured in wireshark
Oct
25
reviewed Approve suggested edit on What can the school do with my MAC address?
Oct
23
comment how to embed exe file to pdf?
Embedding the executable code after the PDF EOF can only hide the code in the PDF file and it won't be executed. I am not sure how it will benefit the OP since he is asking about it for attacking (assuming because of Metasploit).
Oct
23
comment how to embed exe file to pdf?
Embed exe can only work with Adobe Reader 9.x and 8.x (noted in the module source as well). If you bind the executable with the PDF, the resultant file will be an executable.
Oct
23
reviewed Approve suggested edit on One liner to create passwords in linux?
Oct
23
reviewed Approve suggested edit on nginx poodle fix configuration
Oct
20
comment Why do exploit kits use droppers?
Droppers are generic and hence can be used to download any other payload to the target system depending upon the campaign for which the botnet is in use at a given time (spam, DDoS etc). Also, droppers are small in size and can be easily adjusted within a small space therefore can be part of a large set of exploits.
Oct
17
reviewed Approve suggested edit on Why do browsers probe and fallback (or, why SSL_MODE_SEND_FALLBACK_SCSV)?
Oct
17
reviewed Approve suggested edit on SSL3 “POODLE” Vulnerability
Oct
17
reviewed Approve suggested edit on How secure is online banking with smart card? How could it be hacked?
Oct
14
reviewed Approve suggested edit on What is public key pinning
Oct
13
reviewed Approve suggested edit on Putting my PGP ID/link on printed business cards
Oct
13
reviewed Approve suggested edit on Is it dangerous for apache error_log to be writable?