48,523 reputation
12118208
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 3 years
seen 19 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Dec
19
comment Secure query string parameters
Is this Eval a method of an object? I'm not familiar with ASP.NET (I'm a WinForms guy) - it may be ok if you're using it to bind to a data controller, but not if you accept user supplied values into your eval parameter.
Dec
19
comment Secure query string parameters
Never. Avoid it like the plague. It's the security equivalent of goto.
Dec
19
answered Secure query string parameters
Dec
19
comment Secure query string parameters
That's a pretty bad idea.
Dec
19
comment Secure query string parameters
No, you have an Eval() call in there. What's that for? Are you putting user parameters into an eval?
Dec
19
comment Secure query string parameters
What's that eval in there for? It worries me.
Dec
19
revised Secure query string parameters
formatting / spelling / title
Dec
19
comment Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?
Not sure I understand. Once you're doing MAC at the system level there's no difference between a native executable and a bash script. You just have to launch the script interpreter executable with a particular set of MAC rules (a context) that applies to the script.
Dec
19
comment Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?
Again, there's no real way to automatically identify the purpose of some code, so you can't categorise it. The best you can do is have the script writer request certain permissions, and then have a human review and grant / reject them. This is exactly how Android apps work - the app is sandboxed and all code runs through the JVM, which has access controls built into its framework.
Dec
19
reviewed Approve suggested edit on Security of Openflow/SDN network
Dec
19
comment Crack plain RSA given p, q and e
@Josso Yeah, that's probably the best way to calculate d, when you consider the 1/e step is really e^-1.
Dec
19
revised Crack plain RSA given p, q and e
added 98 characters in body
Dec
19
revised Crack plain RSA given p, q and e
added 69 characters in body
Dec
19
comment Nessus does not detect sql injection with “Web App Tests”
Ok then. What's your question?
Dec
19
answered Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?
Dec
19
comment Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?
Yeah, there's no way to do that. It's a Turing-complete language, so you can't detect what it's going to want to access ahead of time. You need to configure it or have the script writer provide some metadata.
Dec
19
answered Crack plain RSA given p, q and e
Dec
19
comment Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?
I understand that, but what are you trying to do? I can't work out whether you're looking for a way to implement these MAC rules in a particular tool, or if you're looking for some platform-specific mechanisms / APIs to do this, or what.
Dec
19
comment Is there any way to differentiate between a normal web request and a web service request?
Define "normal".
Dec
19
comment Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?
I'm struggling to work out what you're looking for. Are you trying to implement some sort of protection mechanism to prevent scripts from accessing various stuff?