53,862 reputation
17130222
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 6 months
seen 40 mins ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


6h
awarded  Popular Question
15h
answered Are there any known breaches of the .NET AppDomain isolation?
17h
comment XSS with a torrent
@Aatif Also, come to think of it, many torrent clients have a web-based interface. Transmission and Hadouken are headless, so a web interface is a common front-end. uTorrent and Deluge also have optional web interfaces. So it is possible for an XSS condition to arise.
17h
comment XSS with a torrent
@Aatif Some clients use a web renderer such as Microsoft's WebBrowser control. I've come across binary apps which are vulnerable to XSS. Since the code executes in the local security domain it is possible to do stuff like load ActiveX components or VBScript if the local security policy has not been hardened. These can be used to run arbitrary code in the same context as the application process (e.g. create an FSO object, drop data into file, ShellExecute it).
17h
revised No internet access using Airbase
Formatting
Apr
24
awarded  Enlightened
Apr
24
awarded  Nice Answer
Apr
24
accepted Maltego transform samples
Apr
24
accepted Internal code-signing certificate on Windows
Apr
24
accepted Alternative to security questions for account recovery when email isn't an option
Apr
24
accepted Potential issues with Kim Dotcom's new proposed “encrypted webmail service”
Apr
24
accepted Is there a public database of mutex names that are associated with malware?
Apr
24
accepted What statistics can be used to identify pseudorandom data?
Apr
24
accepted What's an easy way to perform a man-in-the-middle attack on SSL?
Apr
20
awarded  Notable Question
Apr
17
comment Why do some bank websites use passwords that are not case sensitive?
You're more likely to find that the hardware is new (e.g. IBM Power Systems kit), but the OS is a Unix-like distro such as AS/400 which is technically ancient, but still maintained.
Apr
17
comment Why do some bank websites use passwords that are not case sensitive?
Yup, my money is on it being a frontend for an AS/400 or similar.
Apr
16
awarded  Nice Answer
Apr
15
awarded  Famous Question
Apr
15
comment What does this malicious PHP script do?
Right, that's the encoding mechanism. But what's the payload?