1,212 reputation
1931
bio website
location
age
visits member for 3 years, 4 months
seen Sep 11 at 8:05

I work as a security analyst. I'm from Australia, although I've recently immigrated to the US and hope to start a small business offering security services.

I have a strong interest and knowledge in different access control models, reading about new exploits and vulnerabilities and digital forensics.


Sep
24
awarded  Autobiographer
Sep
15
awarded  Famous Question
Aug
26
comment Testing XSS - how to validate manually?
It's not a moot point, and the banner on this question is misleading. I am not asking in this question for a browser I can test XSS with, as I already found that with the arguments to chrome, however the XSS was seemingly not working and I wanted to verify it was a false positive, now that I had a browser I can test it. Get it?
Aug
25
comment Testing XSS - how to validate manually?
@SilverlightFox Answer wouldn't be the same, any a same answer is not what determines if a question is a duplicate or not. I've been away for a while and that might have changed, do you have a reference for that policy?
Aug
25
comment What is a good browser for web application pen testing?
That's exactly what I was trying, and what was failing.
Aug
25
accepted What is a good browser for web application pen testing?
Aug
25
comment Testing XSS - how to validate manually?
@SilverlightFox Wow. Not duplicates at all. Again, one is a general question, one is a specific code example. But, OK.
Aug
25
comment Testing XSS - how to validate manually?
@SilverlightFox How in the world is a question with specific code examples a duplicate of a question asking about a browser to test with in general?
Aug
25
asked Testing XSS - how to validate manually?
Aug
25
asked What is a good browser for web application pen testing?
Aug
21
comment Is denying login after incorrect attempts ineffective?
@Jeff-InventorChromeOS the capctha is the difference I think. Care to expand that into an answer?
Jul
31
comment Minimum access required to access LSA Secrets
@raz, gsecdump, procdump of lsass.exe, pwdumpx etc...
Jul
31
asked Minimum access required to access LSA Secrets
Jul
29
comment Find the location of a hidden host
@Gilles I have write access to the users home directory and /tmp via sftp. I can't execute anything or set anything to execute. I can't get a shell of any sort except via a specific host, that I can't find via DNS or hosts files.
Jul
28
asked Find the location of a hidden host
Jul
24
comment SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection- medium or low risk?
I'm thinking of moving it to low risk because practically, I don't see how it can be leveraged. While it seems possible to MITM, it seems very unlikely to get it to succeed. I don't see why this shouldn't be the same level as RC4 ciphers being considered insecure, which is low by default.
Jul
24
asked SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection- medium or low risk?
Jul
24
comment Inconsistant browser warnings for SSL
I figured, but wanted to make sure. Just an odd policy of what gets passed through or not I guess. Thanks.
Jul
24
asked Inconsistant browser warnings for SSL
Jul
24
comment Bypassing Trustwave NAC
@danielAzuelos Not sure what you mean when you say evaluation or weak points. With the restrictions of my engagement I cannot leave the room I'm in as an attacker would not be able to due to physically controls. Social engineering is not part of the engagement. As such, I unfortunately have to state the trustwave nac simply cannot be bypassed at this point in time without using getting physical access to a whitelisted or previously authenticated device.