26,885 reputation
546103
bio website raesene.github.io
location Scotland, United Kingdom
age 40
visits member for 4 years, 1 month
seen 19 mins ago

I'm an IT Security professional based in Scotland. I've been in IT Security for over x years now, with the last x-5 focusing on penetration testing/ethical hacking.

Currently a managing consultant with a large provider of security testing services.

Any opinions expressed here are purely my own and not necessarily those of my employer.


2d
comment Password Encoding/Encryption on ODC connection Strings
based on blogs.msdn.com/b/emeadaxsupport/archive/2010/02/17/… I don't think so. If it was kerberos I think it would state it in the connection string..
Dec
8
comment List of security products for my network
so the tools you've suggested appear to be OSINT (and yes I read the plugin bit too) where for me it sounded like OP was looking for network analysis to ascertain actions by installed software (e.g. is this software communicating with the Internet when installed). Whilst I'm not one of your -1's I'd agree that your answer could stand a little exposition to tie it better to the question.. (that said interesting products I'd not come across before)
Nov
24
comment Security of mainframes?
if you're interested in more on this topic, I'd recommend the soldier of Fortran blog mainframed767.tumblr.com . it has a lot of inforamtion on mainframe security and links to talks.
Nov
20
comment Penetration Testing on Thick Client Application
Do you know what protocol the application is meant to be running? I'm assuming here that it's HTTP(s) if you're trying burp. When you say burp invisible proxying isn't working, what exactly about it isn't working? If the app uses HTTP(s) the only thing off the top of my head that would stop Burp in its tracks would be certificate pinning or hard-coded server IP addresses.
Nov
18
comment Best practice in securing a web server and an offsite worker
Not knowing everything about your company and set-up it's impossible to provide definitive advice I'm afraid, what's easier for one company is harder for another.
Nov
18
comment Best practice in securing a web server and an offsite worker
HTTPS implemented correctly should serve the same goals, in that it encrypts data transferred between the two systems and should provide authentication of the endpoints, unless an attacker can get a fake certificate issued, which is unlikely unless you're worried about government level attackers.
Nov
16
comment Telnet Open, is this an exploit?
First rule of testing, don't connect to systems without authorisation from the system owner. Also if I was you I'm not sure you should put the IP address in the open like that you might want to delete/amend that comment :)
Nov
16
comment Telnet Open, is this an exploit?
fair enough, if you try just running telnet without opening a connection, I think what you'll see is that typing help returns the same commands, which is why I reckon it's the telnet help you're seeing rather than something on the server... not to say that there aren't other commands you could run which would do something on the server of course
Nov
16
comment Telnet Open, is this an exploit?
That's the telnet help information, it looks somewhat like you've not connected to the server as yet (or it didn't accept your connection)
Nov
6
comment Wifi - Can you be traced?
FWIW it' also worth noting that many corporate level Wi-Fi solutions include facilities to physically locate wireless signals via triangulation based on proximity to multiple APs. Whilst this isn't perfect, depending on how sparsely the office is populated it may be possible for them to use this information to precisely locate a given device.
Nov
2
comment Microsoft OneNote being detected as Malware
virustotal.com/en/url/… virustotal has this down as 0/60 detection rate...
Oct
29
comment ISPs are now adding unique header identifiers to web traffic. Can this be avoided? If so, how?
The question relates to the ISP modifying web traffic as it goes from the user to the site. A VPN helps by encrypting the traffic at the point it passes over the ISPs network to prevent that modification.
Aug
22
comment How to disable x-oracle-dms-ecid cookie
I'm afraid I don't know how you'd change it. As to whether it's a security issue, I'd say that depends. the name provides a bit of information about the tech. the site is based on to an attacker (clearly identifies that it's an Oracle product probably their dynamic monitoring service), so I'd generally rate this as a "low" or "informational" finding. If your site is super-high security it might be worth addressing but in most cases I wouldn't do it unless it was an easy/low risk change.
Aug
18
comment How sqlmap tests/injections are seen by the victim?
Sure, so to track someone back by their IP you'd need either to be law enforcement (you'd provide an IP to the ISP and ask which of their subscribers had that address at a given point in time, which could correlate to a specific person or at least customer account of the ISP) or alternatively you might be able to correlate it yourself with an online identity but that would be tricky and require you to have some idea of who you were looking for...
Aug
12
comment How do location-based apps avoid getting cheated by emulated GPS?
From what I've seen from gaming, it's generally used to avoid really egregious cheating (so for example moving from New York to San Francisco in 5 minutes), not by any means a perfect control and you'd need to watch for false positives but worth doing all the same....
Aug
4
comment Is it safe to send clear usernames/passwords on a https connection to authenticate users?
Just to add to the answers you've received already, in this kind of set-up I'd recommend looking at Certificate Pinning which helps mitigate MITM attacks...
Jul
20
comment Is there a repository of credentials used in training materials/samples and SDKs?
I'm not aware of a specific repo. for this, but to be honest googling <product or SDK name> default credentials generally does the job just fine...
Jul
6
comment Cannot get access into a vulnerable Windows 2000 (MS03_026)
@yzT Assuming that you've got access to the machine at an OS level, if you haven't already, I'd try rebooting it before retrying the exploit. In some cases I've seen exploits that will only work once as they leave the vulnerable service in a hung/crashed state.
Jun
19
comment Are there any exploits in Movable Type that allow the attacker to delete the movable type files?
you might want to have a look at this movabletype.org/news/2014/05/securing_movable_type.html recent blog post from movable type about securing an installation...
Jun
17
comment Should websites be allowed to disable autocomplete on forms or fields?
@Manishearth sure in an ideal world but the reality is that sites do this for all sorts, I had one today do it for Debit card expiry dates and CVV numbers..