12,643 reputation
12745
bio website
location
age
visits member for 3 years, 2 months
seen 19 mins ago

Security, Unix, and Networking jack-of-all-trades, master-of-some.


19h
revised Feedback Form Exploitation possible or not?
Forgot comments= tag for correct HTTP POST
20h
answered Feedback Form Exploitation possible or not?
1d
comment Can I sign a new certificate with a previously paid for certificate
The genie's wish cannot be used to get more wishes.
1d
answered Can I sign a new certificate with a previously paid for certificate
Sep
24
awarded  Autobiographer
Sep
24
awarded  Enlightened
Sep
24
awarded  Nice Answer
Sep
23
reviewed Edit suggested edit on Why do testers often use the single quote ( ' ) to test for SQL injection?
Sep
23
revised Why do testers often use the single quote ( ' ) to test for SQL injection?
Improve title
Sep
23
answered Course Material for GPEN Certification?
Sep
23
answered Question regarding browser windows when integrating with 3rd party payment software
Sep
22
comment Question regarding browser windows when integrating with 3rd party payment software
Have you asked for the person who told you that for documentation? Sounds like implementation guidance from the 3rd party. The rule is probably to allow the 3rd party control over the transaction flow and relatively seamless integration. These aren't PCI requirements.
Sep
16
comment PCI compliance if not storing or transmitting credit card data
Can you explain more about what your device does? Is it a switch or other device which network traffic transits? If all it's doing is sitting on the same network but not storing, processing, or transmitting card data, then at most your device needs to be scanned regularly and any issues resolved appropriately (which does not mean you need PCI compliance, it means your customers need to perform standard diligence in configuring and maintaining it). But, again, better if we knew what your device is.
Sep
9
revised Handling unencrypted HTTP data for a PCI compliant system - in scope for PCI DSS v3 but not v2?
Rewrote to reflect edit to question
Sep
9
answered Handling unencrypted HTTP data for a PCI compliant system - in scope for PCI DSS v3 but not v2?
Sep
9
comment Handling unencrypted HTTP data for a PCI compliant system - in scope for PCI DSS v3 but not v2?
Who advised you of this, and were they unable or unwilling to cite their source?
Sep
8
answered Is distinguished subject name at normal SSL Certificate issuance must same as generated Certificate Signing Request (CSR)?
Sep
8
comment mac adress encryption
Because the MAC address is the sole, fundamental piece of information that's required in order for a packet to be received by the station it's being sent to. It must be seen because the reason it is seen is to allow receiving stations to determine if the packet is intended to be read by them or not. It is the first and only piece of information read by a station and used to determine whether to receive or ignore a packet. Note also that even IPSec tunnel mode, which hides the IP address, works by wrapping the packet in another address. Addresses must always be visible, MAC or IP.
Sep
6
comment How to check whether firewall allows traffic on specific port but not listening on the port
This question is basically "how do I port scan" - see this question for some simple basics, and maybe google 'nmap tutorial'
Sep
6
comment How to check whether firewall allows traffic on specific port but not listening on the port
possible duplicate of Use nmap correctly