57,470 reputation
17139235
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 9 months
seen Jul 15 at 23:36

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


May
20
answered What is Logjam and how do I prevent it?
May
19
answered Cryptowall encryption files
May
19
comment How to escape a cookie to cause split response?
You can only exploit it as a splitting attack if you can cause encoded values to be decoded into the cookie value, e.g. passing %0D%0A into the URL producing a raw CR+LF in the cookie.
May
19
comment Virus attached or included in VST(i) Plugin
Why are people flagging this as "Primarily opinion based"? It's a good, objective question, asking whether VSTs are somehow prevented from acting maliciously, and whether there's a risk. Please read things fully and properly before you issue a flag.
May
19
answered Virus attached or included in VST(i) Plugin
May
19
awarded  Enlightened
May
19
awarded  Nice Answer
May
19
awarded  Enlightened
May
19
awarded  Nice Answer
May
19
revised How can the Android GraphicBuffer::unflatten() vulnerability (CVE-2015-1474) be exploited remotely?
additional clarifications
May
19
comment How can the Android GraphicBuffer::unflatten() vulnerability (CVE-2015-1474) be exploited remotely?
@SureCoat I added some clarifications which should help.
May
19
revised How can the Android GraphicBuffer::unflatten() vulnerability (CVE-2015-1474) be exploited remotely?
additional clarifications
May
18
comment How does an attacker know when he has the password?
@SnakesandCoffee It's Python in the sense that I wrote it to look a bit like Python, because it's easy to understand. Stuff like "for each" and "file.readlines" is totally bogus though.
May
18
answered How can the Android GraphicBuffer::unflatten() vulnerability (CVE-2015-1474) be exploited remotely?
May
18
comment How does an attacker know when he has the password?
@mucaho Added additional pseudocode as requested.
May
18
revised How does an attacker know when he has the password?
added new code for how it works with salts
May
18
answered How to manage a custom session in a webapp?
May
18
comment How does an attacker know when he has the password?
@NeilSmithline Yes, that is true, but for simplicity's sake and to answer the specific question of how the attacker would know the right password for the hash, I didn't go into that.
May
18
comment ASP.NET Machinekey encryption
@Jake Yes. The IV is embedded within the output data.
May
18
revised Signing (HMAC) cookie identifier
deleted 11 characters in body