25,759 reputation
34297
bio website raesene.github.io
location Scotland, United Kingdom
age 40
visits member for 3 years, 9 months
seen 11 hours ago

I'm an IT Security professional based in Scotland. I've been in IT Security for over x years now, with the last x-5 focusing on penetration testing/ethical hacking.

Currently a managing consultant with a large provider of security testing services.

Any opinions expressed here are purely my own and not necessarily those of my employer.


Aug
22
comment How to disable x-oracle-dms-ecid cookie
I'm afraid I don't know how you'd change it. As to whether it's a security issue, I'd say that depends. the name provides a bit of information about the tech. the site is based on to an attacker (clearly identifies that it's an Oracle product probably their dynamic monitoring service), so I'd generally rate this as a "low" or "informational" finding. If your site is super-high security it might be worth addressing but in most cases I wouldn't do it unless it was an easy/low risk change.
Aug
22
answered Location Obfusication and Email/remote login
Aug
22
answered How trustable is third party root certificates?
Aug
18
comment How sqlmap tests/injections are seen by the victim?
Sure, so to track someone back by their IP you'd need either to be law enforcement (you'd provide an IP to the ISP and ask which of their subscribers had that address at a given point in time, which could correlate to a specific person or at least customer account of the ISP) or alternatively you might be able to correlate it yourself with an online identity but that would be tricky and require you to have some idea of who you were looking for...
Aug
15
answered How sqlmap tests/injections are seen by the victim?
Aug
14
answered What is a visible example for a mandatory access control (MAC)
Aug
12
comment How do location-based apps avoid getting cheated by emulated GPS?
From what I've seen from gaming, it's generally used to avoid really egregious cheating (so for example moving from New York to San Francisco in 5 minutes), not by any means a perfect control and you'd need to watch for false positives but worth doing all the same....
Aug
12
answered How do location-based apps avoid getting cheated by emulated GPS?
Aug
11
answered REST API: does securing the first call with a CAPTCHA make sense?
Aug
11
answered Identifying attacks by network activity
Aug
7
awarded  Pundit
Aug
4
comment Is it safe to send clear usernames/passwords on a https connection to authenticate users?
Just to add to the answers you've received already, in this kind of set-up I'd recommend looking at Certificate Pinning which helps mitigate MITM attacks...
Aug
4
comment Is there a Linux tool for extracting embedded resources from EXEs?
you may have more luck with this on softwarerecs.stackexchange.com
Aug
4
answered Can a static (HTML only) site be vulnerable to XXE?
Jul
20
answered WPA/WPA2 vulnerabilities
Jul
20
answered Online Shopping password keylogger risk
Jul
20
comment Is there a repository of credentials used in training materials/samples and SDKs?
I'm not aware of a specific repo. for this, but to be honest googling <product or SDK name> default credentials generally does the job just fine...
Jul
20
answered How can I identify this hash?
Jul
20
answered Can JS templates for admin-only pages be public
Jul
11
answered Should remote access (RDP/SSH) only be allowed for VPN clients? Or should RDP and SSH be opened the public?