1,207 reputation
930
bio website
location
age
visits member for 3 years, 3 months
seen Aug 26 at 1:49

I work as a security analyst. I'm from Australia, although I've recently immigrated to the US and hope to start a small business offering security services.

I have a strong interest and knowledge in different access control models, reading about new exploits and vulnerabilities and digital forensics.


Aug
26
comment Testing XSS - how to validate manually?
It's not a moot point, and the banner on this question is misleading. I am not asking in this question for a browser I can test XSS with, as I already found that with the arguments to chrome, however the XSS was seemingly not working and I wanted to verify it was a false positive, now that I had a browser I can test it. Get it?
Aug
25
comment Testing XSS - how to validate manually?
@SilverlightFox Answer wouldn't be the same, any a same answer is not what determines if a question is a duplicate or not. I've been away for a while and that might have changed, do you have a reference for that policy?
Aug
25
comment What is a good browser for web application pen testing?
That's exactly what I was trying, and what was failing.
Aug
25
accepted What is a good browser for web application pen testing?
Aug
25
comment Testing XSS - how to validate manually?
@SilverlightFox Wow. Not duplicates at all. Again, one is a general question, one is a specific code example. But, OK.
Aug
25
comment Testing XSS - how to validate manually?
@SilverlightFox How in the world is a question with specific code examples a duplicate of a question asking about a browser to test with in general?
Aug
25
asked Testing XSS - how to validate manually?
Aug
25
asked What is a good browser for web application pen testing?
Aug
21
comment Is denying login after incorrect attempts ineffective?
@Jeff-InventorChromeOS the capctha is the difference I think. Care to expand that into an answer?
Jul
31
comment Minimum access required to access LSA Secrets
@raz, gsecdump, procdump of lsass.exe, pwdumpx etc...
Jul
31
asked Minimum access required to access LSA Secrets
Jul
29
comment Find the location of a hidden host
@Gilles I have write access to the users home directory and /tmp via sftp. I can't execute anything or set anything to execute. I can't get a shell of any sort except via a specific host, that I can't find via DNS or hosts files.
Jul
28
asked Find the location of a hidden host
Jul
24
comment SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection- medium or low risk?
I'm thinking of moving it to low risk because practically, I don't see how it can be leveraged. While it seems possible to MITM, it seems very unlikely to get it to succeed. I don't see why this shouldn't be the same level as RC4 ciphers being considered insecure, which is low by default.
Jul
24
asked SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection- medium or low risk?
Jul
24
comment Inconsistant browser warnings for SSL
I figured, but wanted to make sure. Just an odd policy of what gets passed through or not I guess. Thanks.
Jul
24
asked Inconsistant browser warnings for SSL
Jul
24
comment Bypassing Trustwave NAC
@danielAzuelos Not sure what you mean when you say evaluation or weak points. With the restrictions of my engagement I cannot leave the room I'm in as an attacker would not be able to due to physically controls. Social engineering is not part of the engagement. As such, I unfortunately have to state the trustwave nac simply cannot be bypassed at this point in time without using getting physical access to a whitelisted or previously authenticated device.
Jul
21
comment Bypassing Trustwave NAC
@danielAzuelos they are white listed in. less than .005 of devices are non windows.
Jul
16
revised Bypassing Trustwave NAC
added 74 characters in body