43,437 reputation
1294172
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 6 months
seen Apr 11 at 12:45

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Oct
22
comment How “leaking pointers” to bypass DEP/ASLR works
Care to expand this to include a quick explanation of how it's possible to leverage such a dangling pointer when you can't build reliable ROP chains due to ASLR?
Oct
22
awarded  Good Answer
Oct
22
comment SHA1 hash encoded with base64 results not consistent?
Yep. The "garbage" you see is the ASCII representation of the raw bytes produced by the hash.
Oct
22
comment SHA1 hash encoded with base64 results not consistent?
Yes, that's the case.
Oct
22
answered 172.16.33.197, 127.0.0.1 IP addresses in visitor logs
Oct
22
answered SHA1 hash encoded with base64 results not consistent?
Oct
22
comment Why do we lock our computers?
I guess my experience has been tainted by always having a biometric device available, which takes less than a second to use.
Oct
22
comment If I find or create a 0day exploit, can I be held liable for releasing out to the public?
@AviD Possibly, depending on how the ToS complies with local law. EULA is a case where you've accepted a contractual agreement, so you can be held liable for in a civil sense at least. Interesting cases start to occur when a minor is involved though - anyone under 16 in the UK cannot enter into a legally binding contract, and many are found to be completely unenforceable under penalty of perjury unless all parties are 18 or over.
Oct
22
comment Experience with a recent DDoS attack on Apache
In the meantime, take a look at CloudFlare, which has a free service that can mitigate most small DDoS attacks.
Oct
22
comment Experience with a recent DDoS attack on Apache
Your second question is a good one... stay tuned.
Oct
22
answered If I find or create a 0day exploit, can I be held liable for releasing out to the public?
Oct
22
reviewed Approve suggested edit on Why do we lock our computers?
Oct
22
asked What is the potential impact of these SSL certificate validation vulnerabilities?
Oct
22
awarded  Nice Answer
Oct
22
comment What is the state of the Windows Update certificate after Flame?
@Ramhound Sadly there are still corporate environments that require XP SP0. Often they're not directly on the internet, but most airgaps are deeply flawed.
Oct
22
comment How does CAPTCHA mitigate DDoS attacks?
+1 for unicorns, which (rather amusingly) seem to be on the other side of the fence.
Oct
22
comment Is ProxyPass more secure than directly hosting PHP site?
I don't have an objective answer, but it would increase your attack footprint.
Oct
22
comment How does the Copyright Alert System work? Who has implemented it?
@ewanm89 Whilst I agree with the sentiment and understand your frustration, it'd probably be better if you didn't make off-the-cuff remarks like that on a public site.
Oct
22
answered Why do we lock our computers?
Oct
22
revised Why refresh CSRF token per form request?
added 397 characters in body