552 reputation
28
bio website dshaw.net
location California
age 26
visits member for 2 years, 11 months
seen Aug 18 at 18:06

David has extensive experience in many aspects of information security.

Beginning his career as a Network Security Analyst, David monitored perimeter firewalls and intrusion detection systems in order to identify and neutralize threats in real time.

After working in the trenches of perimeter analysis, David joined an External Threat Assessment Team as a Security Researcher, working closely with large financial institutions to mitigate external risk and combat phishing attacks.

David is currently the Senior Director of Engineering at Redspin, specializing in External and Application security assessments and managing a team of highly skilled engineers.

David has particular interests in exploit development and unconventional attack vectors, and was a speaker at ToorCon 12 in San Diego, CA.


Nov
22
awarded  Yearling
Jul
8
answered Is there a Security/Privacy risk in storing computers' hardware thumbprint?
May
10
comment Is it possible for a hacker to download a php file without executing it first?
@Rook - LFI of the nature include($_GET['var']) would execute the code. However, you can also have something along the lines of echo file_get_contents($_GET['var']), which would echo back arbitrary files.
May
7
answered Is it possible for a hacker to download a php file without executing it first?
Mar
7
comment Is GPG suitable as part of a password manager and generator?
AES-256-CBC should be strong enough for any feasible purpose. The real risk would lie in brute-forcing the password, rather than breaking the crypto itself. Using a long, complicated passphrase is the way to go on this one.
Mar
5
answered Is GPG suitable as part of a password manager and generator?
Feb
20
revised How to not reveal that you are using PHP?
spelling error fixed, slightly reworded for clarity
Feb
19
suggested suggested edit on How to not reveal that you are using PHP?
Feb
7
answered Options for simple phone verification with pin delivery
Jan
22
answered Good tools for reverse engineering colaboratively?
Nov
22
awarded  Yearling
Dec
2
comment Are address bars unphishable?
D.W., perhaps we can agree to disagree--in my experience testing, there have been many instances of finding XSS on pages that don't hold things like password fields. The ability to send a user to a URL (or even more serious for persistent XSS) and change something like victim.com/storage-search-results to something like victim.com/login.aspx--combined with rewriting the page to appear like a login screen--seems like an excellent way to steal credentials. I do not mean to mislead anyone with my answer.
Dec
1
comment Are address bars unphishable?
D.W., I agree - it doesn't seem possible to change the domain. However, as I mentioned in my answer, if you find XSS on some page (say, searchresults.aspx), you could make that URL appear to be login.aspx to steal credentials.
Nov
30
awarded  Editor
Nov
30
revised Are address bars unphishable?
added in example on dshaw.net
Nov
30
answered Are address bars unphishable?
Nov
30
comment Bypassing a captive portal with tor
Again, this is certainly a misconfiguration on the captive portal. It could be that on portals like those that DNS is correctly filtered, but Skype and Gmail apps use hard-coded IP addresses. Or maybe they are just connecting over 3G/data!
Nov
29
answered Sudo password when authenticating via passwordless SSH
Nov
29
comment What is the security implications of enabling SSH onward connections
D.W., I am talking about using the middle server as a bounce point for encrypted communication. For example, scp Middle.Host:~/remote.file Third.Host:~/. In this case, the communication is entirely encrypted, but a MitM attack could occur from Middle.Host to Third.Host. If the data is already in plaintext, that is even easier!
Nov
29
awarded  Revival