55,613 reputation
17133229
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 7 months
seen 1 hour ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Jan
22
answered Is this code harmful? Why?
Jan
22
comment Is this code harmful? Why?
My biggest concern would be why on earth it is being loaded into every HTTP page... who's injecting this content?
Jan
21
awarded  Proofreader
Jan
21
reviewed Approve Swap file may contain sensitive data
Jan
21
comment Msf and exploitdb on Backtrack 5
Wouldn't it make more sense to be using msfupdate?
Jan
21
comment Law & Ethics - I'm not be breaking the law its the computer
Most legal frameworks cover this by criminalising cases where a person has rigged an automated or mechanical system to "commit" a crime by proxy. Even worse, your planning shows premeditation and intent, which puts you firmly in the firing line of any competent prosecution lawyer.
Jan
21
awarded  Popular Question
Jan
19
comment HTTP Response Splitting
True - you'd have to send a second content length header.
Jan
18
reviewed Approve SSL Certificate Signing by a CA
Jan
18
reviewed Approve What is the difference between an x.509 “client certificate” and a normal SSL certificate?
Jan
18
comment HTTP Response Splitting
It would be considered very serious if you were able to attack the response, but if you can only attack the request it's much more of an "it depends", in that it requires a second vulnerability in order to exploit anything properly. Either way, you should fix splitting bugs if you find them.
Jan
18
answered HTTP Response Splitting
Jan
18
comment HTTP Response Splitting
Firefox fixes it by disabling the javascript: handler entirely for the address bar. Anyway, this doesn't answer the question.
Jan
17
comment How about preventing CSRF this way?
@George Of course they can. Httponly just stops the cookies being accessed by JavaScript - any cookie editing addon for a browser will let the user change the cookie.
Jan
15
awarded  Enlightened
Jan
15
awarded  Nice Answer
Jan
15
reviewed Approve Are passwords stored in memory safe?
Jan
14
comment Reporting a GMail hacker attack
It's the only way to be sure.
Jan
14
comment Any recipient can modify an order confirmation mail, right? Does this ever matter ?
@DanNeely But in that event you have recourse to demonstrate good faith on your behalf, in case the customer comes crying to you.
Jan
14
comment Pseudo-Unique PICC Identifier in Passports/ID Cards
I would imagine that "a diversified fixed number" could mean a counter. As long as there are <2^32 cards, it's feasible that there are no duplicates.