48,638 reputation
13118208
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 3 years
seen 17 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Dec
19
comment Nessus does not detect sql injection with “Web App Tests”
Ok then. What's your question?
Dec
19
answered Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?
Dec
19
comment Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?
Yeah, there's no way to do that. It's a Turing-complete language, so you can't detect what it's going to want to access ahead of time. You need to configure it or have the script writer provide some metadata.
Dec
19
answered Crack plain RSA given p, q and e
Dec
19
comment Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?
I understand that, but what are you trying to do? I can't work out whether you're looking for a way to implement these MAC rules in a particular tool, or if you're looking for some platform-specific mechanisms / APIs to do this, or what.
Dec
19
comment Is there any way to differentiate between a normal web request and a web service request?
Define "normal".
Dec
19
comment Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?
I'm struggling to work out what you're looking for. Are you trying to implement some sort of protection mechanism to prevent scripts from accessing various stuff?
Dec
19
reviewed Approve suggested edit on openflow tag wiki excerpt
Dec
19
comment Changing user account passwords from PHP script - vulnerabilities?
@RyanGriggs Ordinarily I'd have given an answer, but between symcbean's answer and Rook's comment it's pretty much covered. I'll also let Rook do the honours of dissecting your code, since he's our resident "bastard appsec tester from hell".
Dec
19
awarded  Enlightened
Dec
19
awarded  Guru
Dec
18
comment Changing user account passwords from PHP script - vulnerabilities?
@Rook Glad to see I'm not the only one that cringed.
Dec
18
revised Is my developer's home-brew password security right or wrong, and why?
expanded answer
Dec
18
awarded  Good Answer
Dec
18
accepted OWASP Top 10 style security guide for implementation in hardware devices
Dec
18
accepted Is behavioural analysis (e.g. keystroke dynamics) a reliable security mechanism for MFA?
Dec
18
accepted How are CVE identifiers assigned and managed?
Dec
18
accepted Disclosure in potential loss-of-life situations, with an uncooperative vendor
Dec
18
revised Is my developer's home-brew password security right or wrong, and why?
deleted 1 characters in body
Dec
18
revised Is my developer's home-brew password security right or wrong, and why?
added link to k's principle