Reputation
3,551
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
1 9 18
Newest
 Good Answer
Impact
~148k people reached

Feb
4
answered How can I add modules to a Payload on Metasploit
Feb
4
comment How can one securely hash passwords server side while avoiding DoS?
security.stackexchange.com/questions/12101/…
Feb
3
comment ms08_067_netapi not performing expectedly on Windows XP Sp1/Sp3
Run nmap -p 445 --script smb-check-vulns <IP> and look at the results. The machine should be vulnerable only then the exploit will work.
Jan
31
comment Is there any downside to always declaring some default bad chars when generating exploits?
+1. Null bytes are not bad in every situation. It is only bad in overflowing a string input where it is treated as a terminator.
Jan
28
answered metasploit exploits and payloads documentation
Jan
28
comment metasploit exploits and payloads documentation
When you select a module (exploit, payload etc), type info. OR rapid7.com/db/modules
Jan
28
comment Why number of connection does not migrate after process migration in Meterpreter
The total number of connections should remain the same because after migration to the new process, the old thread is terminated. However, if you can't see the network bytes from the new process, perhaps there is something wrong with the logging utility you are using. Use process monitor and see if you can view the network activity?
Jan
22
comment Preventing LSASS from storing clear-text passwords in Kerberos environment
Securing credentials in pre Windows 10 environment is a nightmare. However, Windows 10 introduced Credential Guard which is the only true method of securing against these credential thefts AFAIK. technet.microsoft.com/en-us/library/mt483740(v=vs.85).aspx. Unfortunately, when it comes to Enterprise we are still stuck with Windows 7.
Jan
19
comment Privilege Escalation Mitigation
owasp.org/index.php/Session_Management_Cheat_Sheet
Jan
18
comment Any idea to prevent on this case of security breach on Windows 7
Remove all the removable media drives i.e. CD/DVD drives, USBs etc. Keep the primary hard drive as the first boot device, put a password on the BIOS setup and lock down the system so that no one with a screw driver can open it and change the jumper settings. Windows doesn't suck. It won't make any difference what OS you use on it with the current setup and it will be equally easy to put a live CD in it and bypass the login screen.
Jan
13
revised Reading physical memory frame previously owned by another process to read contents of its memory page
deleted 2 characters in body
Jan
13
reviewed Approve Is it possible for a virus to be redistributed through RAM?
Jan
13
comment Some specific website not loading when proxy through Burp
Are these websites HTTP or HTTPS? If it is HTTPS, HSTS and certificate pinning might prevent you from MiTM-ing the connection.
Jan
12
comment Should the risk of antivirus products be reconsidered in light of the TrendMicro critical bug report
Without system level access they won't be able to provide protections against root kits and other low level hooks in kernel. Your concern is completely valid though. AVs and sandbox solutions today tend to show a lot of complacency in security of their own software.
Jan
8
comment Removing remnants of a Metasploit exploit
That's right. The register_file_for_cleanup method deletes the uploaded file once it is loaded in memory. However, in some cases it remains on the disk. In such cases it is always ensured to tell the user that he needs to manually cleanup. However, I believe we should pass an additional argument to the register_file_for_cleanup method to make sure the file is securely wiped rather than just deleting it. Thanks for your input.
Jan
8
reviewed Approve Is it possible to write an SEAndroid permission that enables only one app (subject) to access a device (object)?
Jan
8
comment Removing remnants of a Metasploit exploit
@Morgoroth Can you clarify more what you mean? Only a single payload is injected in the exploited process through reflective DLL injection and at no point does it touches the disk.
Jan
7
answered Removing remnants of a Metasploit exploit
Jan
7
comment Web application security vulnerability managment
Acunetix is not open source. acunetix.com/vulnerability-scanner
Jan
6
reviewed Approve Stealing Facebook HTTPS cookies with captive portal