26,530 reputation
545101
bio website raesene.github.io
location Scotland, United Kingdom
age 40
visits member for 4 years
seen 7 hours ago

I'm an IT Security professional based in Scotland. I've been in IT Security for over x years now, with the last x-5 focusing on penetration testing/ethical hacking.

Currently a managing consultant with a large provider of security testing services.

Any opinions expressed here are purely my own and not necessarily those of my employer.


1d
comment bank of england cbest
most of the time I just keep an eye on their twitter twitter.com/dc4420 they usually anounce there.
1d
comment bank of england cbest
unfortunately I doubt you'll get much info here, as it's probably not fully on topic, and people from the industry may not want to comment publicly. My recommendation would be to go to the next DD4420 meeting and buy some people a beer :)
2d
comment Penetration Testing on Thick Client Application
Do you know what protocol the application is meant to be running? I'm assuming here that it's HTTP(s) if you're trying burp. When you say burp invisible proxying isn't working, what exactly about it isn't working? If the app uses HTTP(s) the only thing off the top of my head that would stop Burp in its tracks would be certificate pinning or hard-coded server IP addresses.
Nov
18
revised Best practice in securing a web server and an offsite worker
added 4 characters in body
Nov
18
comment Best practice in securing a web server and an offsite worker
Not knowing everything about your company and set-up it's impossible to provide definitive advice I'm afraid, what's easier for one company is harder for another.
Nov
18
comment Best practice in securing a web server and an offsite worker
HTTPS implemented correctly should serve the same goals, in that it encrypts data transferred between the two systems and should provide authentication of the endpoints, unless an attacker can get a fake certificate issued, which is unlikely unless you're worried about government level attackers.
Nov
18
answered Best practice in securing a web server and an offsite worker
Nov
16
comment Telnet Open, is this an exploit?
First rule of testing, don't connect to systems without authorisation from the system owner. Also if I was you I'm not sure you should put the IP address in the open like that you might want to delete/amend that comment :)
Nov
16
comment Telnet Open, is this an exploit?
fair enough, if you try just running telnet without opening a connection, I think what you'll see is that typing help returns the same commands, which is why I reckon it's the telnet help you're seeing rather than something on the server... not to say that there aren't other commands you could run which would do something on the server of course
Nov
16
comment Telnet Open, is this an exploit?
That's the telnet help information, it looks somewhat like you've not connected to the server as yet (or it didn't accept your connection)
Nov
11
awarded  Yearling
Nov
6
reviewed Leave Open How to prevent users from booting at safe mode
Nov
6
reviewed Leave Open Do I need antivirus for this unusual installation - or just firewall?
Nov
6
reviewed Leave Open Wifi - Can you be traced?
Nov
6
reviewed Close Site allows both Partial and Complete password authentication; do they have my password in plain text?
Nov
6
reviewed Close How Secure are Virtual Networks
Nov
6
reviewed Leave Open Recovering From Suspected MPEG Malware Attack
Nov
6
comment Wifi - Can you be traced?
FWIW it' also worth noting that many corporate level Wi-Fi solutions include facilities to physically locate wireless signals via triangulation based on proximity to multiple APs. Whilst this isn't perfect, depending on how sparsely the office is populated it may be possible for them to use this information to precisely locate a given device.
Nov
3
awarded  Enlightened
Nov
2
comment Microsoft OneNote being detected as Malware
virustotal.com/en/url/… virustotal has this down as 0/60 detection rate...