527 reputation
37
bio website
location Manchester, United Kingdom
age 39
visits member for 2 years, 6 months
seen Feb 3 at 16:45

Security analyst, penetration tester and web developer based in the UK.


Sep
22
awarded  Yearling
May
3
awarded  Citizen Patrol
Jan
4
revised What is SQL injection?
deleted 1 characters in body
Jan
2
awarded  Good Answer
Sep
22
awarded  Yearling
Jun
27
comment Am I a Hosting service provider in a sense of PCI-DSS SAQ D Appendix A?
You may be best off asking a registered QSA pcisecuritystandards.org/approved_companies_providers/…
Jun
27
comment Am I a Hosting service provider in a sense of PCI-DSS SAQ D Appendix A?
Where does credit card data fit into this service? Is your service a payment platform?
Jun
22
comment Looking for information about CVE-2006-6876 vulnerability
very old reference, but seminal and relevant insecure.org/stf/smashstack.html
Jun
22
comment Looking for information about CVE-2006-6876 vulnerability
Memory corruption. The overlong user-data will overwrite existingly used memory, corrupting the values stored there. With an invalid state, the program cannot continue to execute as normal, resulting in undefined behaviour.
Jun
22
comment Looking for information about CVE-2006-6876 vulnerability
It is most likely to be exploitable by hand-crafting a malicous SMS binary with an overlong field (read into the pdu argument) and placing that SMS in the queue to be processed by the server. The overlong data will be written into memory that may already be in use by something else. The server can be crashed (or perhaps worse) if a user sends a text message like this.
Jun
19
comment Why doesn't the same origin policy block get requests what contain arguments?
+1 for a very key point: "there is nothing special about the query string"
May
24
comment How do I get started with security? (beginner)
19 deadly sins [2005] (the first link) has been updated to 24 deadly sins [2009] amazon.co.uk/Deadly-Sins-Software-Security-Programming/dp/…
May
15
answered Is scanning a site directory considered illegal penetration testing?
May
4
comment Keeping valuable algorithms secret
I have asked a moderator to move it over for you.
May
4
comment Keeping valuable algorithms secret
Candidate for s.tk/security ?
Apr
19
answered how can you view an HTTP request in transit?
Mar
13
comment Unauthorised Perl Scripts
See also atomicorp.com/forums/…
Mar
13
comment Unauthorised Perl Scripts
There's a notable chance this is something to do with the recentish vulnerability that allows unauthenticated remote users to call agent.php and achieve anything plesk can do cvedetails.com/cve/CVE-2012-1557 reddit.com/r/netsec/comments/qhb6y/…
Feb
22
comment Database Security Best Practices for E-Commerce Site
Unless it really is your only option, please try to avoid processing card data yourself. Use the online solution provided by your merchant bank. Nobody will enjoy the process and continual expense of being validated for PCI compliance every quarter (minimum). If you really to need to handle cards yourself, seriously consider hiring a financial applications/processes expert. There's a lot to get wrong and high penalty to pay, if you do.
Feb
7
comment Best way to alert a website owner of a vulnerability?
+1 to anonymity. To be frank, unless they've hired you to look for vuls, i really wouldn't contact them at all. There are some well known cases where people have been prosecuted for exactly this.