Reputation
36,353
Next tag badge:
145/100 score
17/20 answers
Badges
7 66 139
Impact
~2.1m people reached

21h
comment Some specific website not loading when proxy through Burp
You could try settings your browser to use the SOCKS proxy without burp to see if there are any helpful errors generated, which might give you some more info. Also if you put a note of the SSH command your using to do the SOCKS proxying (I'm assuming here that's what you're doing..) that could be useful
1d
comment Can a root user inside a Docker/LXC break the security of the whole system?
Worth noting that with Docker 1.10+ and User namespacing, the root user inside a container is no longer the root user outside of the container. whilst that reduces the risk of breakout, it also prevents this scenario of loading a kernel module as the root user inside the container wouldn't have the appropriate rights outside the container.
1d
comment Would CVE-2016-0728 affect Docker?
FWIW I think that Docker 1.10 with seccomp filters may not fall to this as it restricts access to the syscalls used by the exploit.
1d
answered Is running wp-cli as root in docker container dangerous?
Feb
10
answered Not Asking Email Verification on Account Creation
Feb
9
revised What kind of information does a penetration tester require?
added a bit about more reasons you might be having a test
Feb
9
revised What kind of information does a penetration tester require?
added 17 characters in body
Feb
9
answered What kind of information does a penetration tester require?
Feb
8
awarded  Popular Question
Feb
7
comment Unknown ports shown on Nmap scan…and other strange behavior
with the nmap scan was your intention to scan your localhost? as that's what scanning 0.0.0.0 will do (although it's more usual to do 127.0.0.1 for that)
Feb
7
awarded  Good Answer
Jan
30
answered XSS Vector without < or > symbols or equal sign?
Jan
28
comment What to do if meterpreter get Caught?
Possible duplicate of Metasploit Meterpreter alternatives That Question and answer have some good information about alternatives to meterpreter to handle A-V evasion...
Jan
23
comment Can I get SSL certificates for my OpenPGP key?
the closest you're likely to find to this is either keybase.io (key tied to social media identities and/or ownership of a website) or S/MIME certificates which are issued by a CA
Jan
21
comment Is the BBC’s advice on choosing a password sensible?
I'm going to go against the consensus and disagree that it makes cracking passwords easier. "easier" is a relative term that implies that currently users are choosing good passwords and if they follow this scheme they'll be worse. That's objcectively not true, most users choose passwords which are much more predictable than the ones generated by this scheme. This scheme doesn't provide "good" passwords, but it may provide "better" passwords than the majority of users currently choose...
Jan
19
comment Why is it harder to brute force an iphone than a zip-file?
The answer to your question is here blog.cryptographyengineering.com/2014/10/…
Jan
14
answered Ethics & releasing research with no viable solution
Jan
10
comment Why java.sql.ResultSet.getString is an Information Leakage vulnerability
FWIW it's important to note that I would be very careful before using LAPSE+ for anything, the last release I can see is 2.8.1 from 2011 and the mailing list shows no activity since 2013
Dec
17
comment Are there any statistics about packet filtering to prevent IP spoofing on the internet?
bcp38.info/index.php/Main_Page would likely be a good place to get info about this kind of thing..
Dec
15
answered IBM AppScan false positive