1,686 reputation
1520
bio website
location
age
visits member for 3 years, 1 month
seen 15 hours ago

16h
asked How does this wordpress XSS work?
Nov
18
comment Best practice in web application security authentication to avoid bruteforce attack
@dgn It is quite common having multiple users using the same IP. Companies, Proxy, people sharing internet, ... IPv4 is just not enough.
Nov
11
revised JavaScript Injection using Man in the Middle Attack
added 331 characters in body
Nov
10
comment JavaScript Injection using Man in the Middle Attack
@Curious First have a look how http works‌​. I linked to the server response. This is what the server tmail.com sends back to you. Here the script is injected. Now you need to know how TCP/IP works. The data (server response) is send as a TCP/IP packet from the server to you passing several router. Run traceroute tmail.com to see them. Every router can modify the data in the packet. See Man-in-the-middle.
Nov
10
comment JavaScript Injection using Man in the Middle Attack
@Curious Not sure what you like to know here. You read until you hit a </html> tag and insert you <script> infront of it.
Nov
10
comment JavaScript Injection using Man in the Middle Attack
If you connected to a wifi everything you download is "downloaded" by the wifi router and forwarded to you. The WiFi access point can modify this data on the fly as it pass through.
Nov
10
answered JavaScript Injection using Man in the Middle Attack
Nov
5
awarded  Explainer
Nov
5
revised Security through obscurity - “https requests” are safe?
fixed spelling
Nov
5
answered Security through obscurity - “https requests” are safe?
Nov
5
suggested suggested edit on Security through obscurity - “https requests” are safe?
Oct
21
answered Use cookies once stolen
Oct
19
awarded  Yearling
Oct
15
comment Lock a website login to a certain computer
No, but it would stop anyone else to access this page. Now you only need to tell the account owner not use this account from anywhere else. You could also check client IP during login.
Oct
15
revised Lock a website login to a certain computer
added 316 characters in body
Oct
15
answered Lock a website login to a certain computer
Oct
9
comment Where should a team store server credentials
For sure you should never send any password in an email or via skype.
Oct
9
awarded  Citizen Patrol
Oct
6
answered Unexpected emails have been sent - do I need to wipe my Android?
Sep
26
answered Is limiting access to a web script with .htaccess secure enough when that script can run arbitrary commands?