26,885 reputation
546103
bio website raesene.github.io
location Scotland, United Kingdom
age 40
visits member for 4 years, 1 month
seen 1 hour ago

I'm an IT Security professional based in Scotland. I've been in IT Security for over x years now, with the last x-5 focusing on penetration testing/ethical hacking.

Currently a managing consultant with a large provider of security testing services.

Any opinions expressed here are purely my own and not necessarily those of my employer.


Dec
17
comment Password Encoding/Encryption on ODC connection Strings
based on blogs.msdn.com/b/emeadaxsupport/archive/2010/02/17/… I don't think so. If it was kerberos I think it would state it in the connection string..
Dec
17
asked Password Encoding/Encryption on ODC connection Strings
Dec
17
awarded  tls
Dec
15
awarded  Vox Populi
Dec
15
awarded  Suffrage
Dec
15
awarded  Good Answer
Dec
15
answered CSRF in ASP.NET
Dec
8
comment List of security products for my network
so the tools you've suggested appear to be OSINT (and yes I read the plugin bit too) where for me it sounded like OP was looking for network analysis to ascertain actions by installed software (e.g. is this software communicating with the Internet when installed). Whilst I'm not one of your -1's I'd agree that your answer could stand a little exposition to tie it better to the question.. (that said interesting products I'd not come across before)
Dec
2
answered The effect of hidden or spoofed service banners on vulnerability scanners
Nov
27
answered Can you still be tracked when using a VPN?
Nov
25
revised Are there any disadvantages to encrypting the password hash?
he->be
Nov
24
comment Security of mainframes?
if you're interested in more on this topic, I'd recommend the soldier of Fortran blog mainframed767.tumblr.com . it has a lot of inforamtion on mainframe security and links to talks.
Nov
20
comment Penetration Testing on Thick Client Application
Do you know what protocol the application is meant to be running? I'm assuming here that it's HTTP(s) if you're trying burp. When you say burp invisible proxying isn't working, what exactly about it isn't working? If the app uses HTTP(s) the only thing off the top of my head that would stop Burp in its tracks would be certificate pinning or hard-coded server IP addresses.
Nov
18
revised Best practice in securing a web server and an offsite worker
added 4 characters in body
Nov
18
comment Best practice in securing a web server and an offsite worker
Not knowing everything about your company and set-up it's impossible to provide definitive advice I'm afraid, what's easier for one company is harder for another.
Nov
18
comment Best practice in securing a web server and an offsite worker
HTTPS implemented correctly should serve the same goals, in that it encrypts data transferred between the two systems and should provide authentication of the endpoints, unless an attacker can get a fake certificate issued, which is unlikely unless you're worried about government level attackers.
Nov
18
answered Best practice in securing a web server and an offsite worker
Nov
16
comment Telnet Open, is this an exploit?
First rule of testing, don't connect to systems without authorisation from the system owner. Also if I was you I'm not sure you should put the IP address in the open like that you might want to delete/amend that comment :)
Nov
16
comment Telnet Open, is this an exploit?
fair enough, if you try just running telnet without opening a connection, I think what you'll see is that typing help returns the same commands, which is why I reckon it's the telnet help you're seeing rather than something on the server... not to say that there aren't other commands you could run which would do something on the server of course
Nov
16
comment Telnet Open, is this an exploit?
That's the telnet help information, it looks somewhat like you've not connected to the server as yet (or it didn't accept your connection)