30,413 reputation
1173148
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 4 years
seen 2 hours ago

Security expert and experienced Windows programmer


Mar
31
comment Privacy issues with email providers
Asking for "a list of products/services to do XXX" is offtopic, and would be closed as "too localized", please see the FAQ. However the second part of the question, how to approach this (together with the focus of some of the answers: other aspects) is a much better question. Please edit accordingly, and refocus the question.
Mar
30
comment What tools are available to assess the security of a web application?
you're saying NTOSpider is not worth the price? I've used it only briefly, but it didnt knock my socks off... regardless, the point I was taking was with use of "undisputed".
Mar
30
comment Are there ways to protect the guest kernels at the hypervisor level?
I don't have a proper answer for this, but She Who Is The Expert on this (Joanna Rutkowska) can be found at theinvisiblethings.blogspot.com. She was the original author of the Blue Pill exploit, and numerous other attacks on virtualization.
Mar
30
comment Starting with sandbox development
@gkt.pro, you're wrong about that - it's a lot easier for a beginner to get into the basics of web attacks, its (usually) based on a very simple, transparent protocol which is easy to play with. Getting into current windows vulns will often force you to go down to reverse engineering and kernel debugging. Not very beginner-friendly. Definitely +1 for WebGoat, I use it for beginner training all the time.
Mar
30
revised How can an IPS be fingerprinted?
edited tags
Mar
30
revised Are there ways to protect the guest kernels at the hypervisor level?
edited tags
Mar
30
awarded  Nice Answer
Mar
29
comment Are there any serious problems with this technique for generating symmetric keys?
@Rook, the point of adding the known value isnt to create entropy, it is to make the first part different from the second part. That way the keys are different, even though they're done together.
Mar
29
comment What tools are available to assess the security of a web application?
I beg to differ - while NTOSpider is indeed a solid tool, it is far from "undisputed". I know of quite a few vendors that would "dispute" that claim, correctly or not.
Mar
29
comment Web server file sniffing
That's not really so common...
Mar
29
revised Web server file sniffing
edited tags
Mar
29
answered Web server file sniffing
Mar
29
answered Is Content Security Policy an approach that is worth to support?
Mar
29
comment Are there any serious problems with this technique for generating symmetric keys?
+1 for simplicity, +100 for reusing existing channel.
Mar
29
revised Are there any serious problems with this technique for generating symmetric keys?
edited tags
Mar
29
comment What tools are available to assess the security of a web application?
Specifically, according to PCI you would need to check for the current OWASP Top 10.
Mar
28
revised Wireless auto-join on laptops
edited tags
Mar
28
revised Is Content Security Policy an approach that is worth to support?
edited tags
Mar
28
awarded  Nice Answer
Mar
26
revised How do I configure nmap to verify my firewall is performing stateful packet inspection?
edited tags