2,598 reputation
1714
bio website
location
age
visits member for 2 years
seen 3 hours ago

Mar
25
comment what is the best keylogger for security uses?
I don't think the Metasploit keyloggers will come in handy in the OP's situation since that would mean a continuous meterpreter session from the laptop to the handler. Also OP can persist the session but still managing it would be a lot harder compared to legitimate app which starts normally like prey. Didn't mean to negate your suggestion as all your comments are excellent. Just that IMHO meterpreter would be a lot harder in this condition.
Mar
25
comment What kinds of PE file infection can AV software detect?
+1. Some of the thoughts can be found at security.stackexchange.com/questions/44345/… as well.
Mar
24
comment Meterpreter and staged payloads
Yes. LoadLibrary API is the preferred means through which DLLs are loaded into a process at run time.
Mar
24
comment Meterpreter and staged payloads
The loading of DLL is the same as in normal operations i.e. create a process and then load the DLL. The difference here is that LoadLibrary API load DLL from the disk while reflective DLL injection load it from within the memory. Disk touching is avoided for security reasons e.g. AV bypass.
Mar
24
answered Meterpreter and staged payloads
Mar
20
comment Do I have to harden IE if I'm only using Firefox?
By default Firefox don't use proxy. It CAN use system proxy settings but the user need to specifically choose that. By default it is no proxy.
Mar
19
comment Will having 2FA protect me on a potentially insecure network?
While generally your answer is true and should be practiced always, if the attacker gets access to the user password and the also the 2FA code, then he can just turn off 2FA for future to gain unlimited access as turning it off only require password.
Mar
18
comment How does the NOP sled work with MSFVenom?
Also people usually assume nops can only be implemented as \x90. Any x86 assembly op-codes can be used as nops. For example, push eax, xor eax,eax, mov eax, 123h, sub eax, 1, pop eax is a nop operation since the effective instructions are only push eax and pop eax.
Mar
13
comment What is a current best practice example of basic encryption and decryption in PHP?
Asking the user for pass phrase and then using that pass phrase directly as encryption key is completely wrong. There are key derivation functions that can take a user input and derive the key of the desired length. This is a consistent problem with PHP as a whole that a lot of bad code is given as example and people assume that is the best (or the only) way to do things.
Mar
9
comment Why do device vendors build-in backdoors when it can destroy the companys reputation?
Good points. One other scenario is the company didn't put the backdoor there but a third party compromised the supply chain and changed the hardware/software before the shipment. I still blame the company if they haven't provided an interface through which the customer can check integrity of the product but still this is a case we have seen exploited in the real world as well.
Mar
7
comment Are there / have there ever been viruses that completely evade virus scanners for very long?
Thanks for clarification.
Mar
7
comment Are there / have there ever been viruses that completely evade virus scanners for very long?
is there any documented evidence that Heartbleed and/or shellshock was exploited before the vulnerability was made public? Since my understanding was that Heartbleed was detected by the Google engineer and once it was made public only then people tried to exploit it over the Internet.
Mar
3
awarded  Yearling
Feb
16
comment Metasploit Framework console misencodes text
Metasploit had a bug where the color codes were not getting displayed properly. The bug was patched in the PR github.com/rapid7/metasploit-framework/pull/4337. Update the framework to the latest version through msfupdate and then check. If you still get an error, please open a new issue at github.com/rapid7/metasploit-framework/issues
Feb
16
reviewed Approve How to fuzz service with sending bad data?
Feb
11
comment Architecture dependency issue associated with malicious payloads
I think he is talking specifically about Metasploit encoders when he mentioned x86 encoders. This is the same problem the attacker encounters when exploiting a vulnerability in a browser plugin (Java, flash etc) where he won't know the underlying OS to select a proper shellcode. That is why things such as User Agent strings or SMB remote fingerprint etc are used to detect the architecture and select appropriate shellcode.
Feb
11
reviewed Approve Verify CDN javascript's integrity
Feb
6
revised msfvenom -b flag not working?
Update notice for issue resolution.
Jan
30
comment Is it possible to “fingerprint” the “patches” applied to a Windows system?
You can use the WMI query SELECT HotFixID FROM win32_QuickFixEngineering which will list the installed patches on the remote machine. Metasploit has a post module post/windows/gather/enum_patches which can be used when you have meterpreter session.
Jan
30
comment Should anti-virus detect metasploit payloads?
Have you tried to run the payload? Sometimes AV signature might fail (due to all the randomness in the payload) but once it is run the AV run time behavior analysis detect it.