49,258 reputation
14120210
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 3 years, 1 month
seen Nov 12 at 0:16

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Dec
19
comment Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?
Not sure I understand. Once you're doing MAC at the system level there's no difference between a native executable and a bash script. You just have to launch the script interpreter executable with a particular set of MAC rules (a context) that applies to the script.
Dec
19
comment Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?
Again, there's no real way to automatically identify the purpose of some code, so you can't categorise it. The best you can do is have the script writer request certain permissions, and then have a human review and grant / reject them. This is exactly how Android apps work - the app is sandboxed and all code runs through the JVM, which has access controls built into its framework.
Dec
19
reviewed Approve suggested edit on Security of Openflow/SDN network
Dec
19
comment Crack plain RSA given p, q and e
@Josso Yeah, that's probably the best way to calculate d, when you consider the 1/e step is really e^-1.
Dec
19
revised Crack plain RSA given p, q and e
added 98 characters in body
Dec
19
revised Crack plain RSA given p, q and e
added 69 characters in body
Dec
19
comment Nessus does not detect sql injection with “Web App Tests”
Ok then. What's your question?
Dec
19
answered Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?
Dec
19
comment Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?
Yeah, there's no way to do that. It's a Turing-complete language, so you can't detect what it's going to want to access ahead of time. You need to configure it or have the script writer provide some metadata.
Dec
19
answered Crack plain RSA given p, q and e
Dec
19
comment Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?
I understand that, but what are you trying to do? I can't work out whether you're looking for a way to implement these MAC rules in a particular tool, or if you're looking for some platform-specific mechanisms / APIs to do this, or what.
Dec
19
comment Is there any way to differentiate between a normal web request and a web service request?
Define "normal".
Dec
19
comment Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?
I'm struggling to work out what you're looking for. Are you trying to implement some sort of protection mechanism to prevent scripts from accessing various stuff?
Dec
19
reviewed Approve suggested edit on
Dec
19
comment Changing user account passwords from PHP script - vulnerabilities?
@RyanGriggs Ordinarily I'd have given an answer, but between symcbean's answer and Rook's comment it's pretty much covered. I'll also let Rook do the honours of dissecting your code, since he's our resident "bastard appsec tester from hell".
Dec
19
awarded  Enlightened
Dec
19
awarded  Guru
Dec
18
comment Changing user account passwords from PHP script - vulnerabilities?
@Rook Glad to see I'm not the only one that cringed.
Dec
18
revised Is my developer's home-brew password security right or wrong, and why?
expanded answer
Dec
18
awarded  Good Answer