43,447 reputation
1294172
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 6 months
seen 14 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Dec
10
comment How to know which database is behind a web application?
Haha, cheers. It's from Metal Gear Awesome (warning: nsfw)
Dec
10
comment I'm leaving my job and want to erase as many personal details etc. as possible; any tips?
There's a lot of bad advice here. Manual cleaning of %temp% is bad, you should use Disk Cleanup for that. The advice about the registry doesn't even make any sense; the registry doesn't contain files at all. Even if you meant keys, what do you "clean up" in there? On top of all that, your steps here still don't actually have much benefit, and may actually make the system unstable. Furthermore, it's mostly security theatre - no real security benefit outside misplaced perception. Bad, bad, bad.
Dec
10
revised I'm leaving my job and want to erase as many personal details etc. as possible; any tips?
command
Dec
10
comment Excel 2007 Encryption Strength
@zm15 Yes, it'd still be strong. The iteration count is stored as part of the hash.
Dec
10
revised How to know which database is behind a web application?
added 267 characters in body
Dec
10
answered are there any services to test nmap
Dec
10
reviewed Edit suggested edit on How to increase Windows PowerShell WebAccess security?
Dec
10
revised How to increase Windows PowerShell WebAccess security?
I couldn't understand what the OP wanted; I tried to clean it up so that the question was clearer.
Dec
10
comment How are CVE identifiers assigned and managed?
I'm aware of it. I'm actually reasonably familiar with CVEs, but I figured it'd be nice to have a question on here that'd cover it.
Dec
10
asked How are CVE identifiers assigned and managed?
Dec
10
comment What should I do if I type my password in the address bar, or type password in google search?
You shouldn't be re-using (or even remembering) passwords for most things anyway. That's what we have password managers like KeePass for. In reality you should never really need to remember more than 4 passwords - your system encryption password, your OS login password, your password manager password, and your email account password (allows recovery of most passwords in the case of losing your password database). Everything else goes in your password manager, and is unique + properly random.
Dec
10
answered How to know which database is behind a web application?
Dec
10
comment How to know which database is behind a web application?
Not very concrete, and if you've already got an SQL injection there are much easier and more reliable methods.
Dec
10
revised How to know which database is behind a web application?
added 2 characters in body
Dec
10
comment Encrypting data for Android mobile app
If a user changes their password, require them to re-enter their old password. This allows you to decrypt their data, then re-encrypt it with a new password, and doubles up as a protection against an attacker changing the password on an unlocked device. You should also generate a new random salt whenever they change their password.
Dec
8
comment My website keeps getting infected
They're not interested in your posts. BHEK is used to steal bank account details.
Dec
8
comment How do the authorities know who's downloading protected software?
If the VPN is to a box with hundreds of users, how do you identify the infringing user? You can't, not easily, and especially not if the person running the VPN service is trying to make it anonymous.
Dec
8
revised how to trace the IP address of gmail account sender via browser
added 182 characters in body
Dec
7
awarded  Popular Question
Dec
7
comment How did the Tumblr worm spread?
Yup, sounds like XSS. At that point you don't even need the CSRF, because in-page tokens can be stolen by the injected script.