14,877 reputation
12866
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 3 years
seen Dec 17 at 23:50

Security Architect

Owner of: SelfPhish.com


Dec
5
reviewed Reviewed Weird characters at the end of openssl dhparam output file
Dec
5
comment Some very (very) strange issues in wpa handshake
using aircrack on the 'monitor'?
Dec
5
comment Is there scan-me-for-vulnerabilities services?
Is your host publicly available (a web server), or a machine in your home? what do you want to test for?
Dec
5
reviewed Close What is a Sonic Wall?
Dec
5
comment What is a Sonic Wall?
Is there a model number?
Dec
5
reviewed Close InfoSec professionals - Is math/programming a requirement?
Dec
5
reviewed Reviewed InfoSec professionals - Is math/programming a requirement?
Dec
5
reviewed Close What kind of SSL certificate do I need?
Dec
5
reviewed Leave Open Am I allowed to DDOS my own server?
Dec
5
answered database of URLs used by penetration tools
Dec
5
comment Protecting a statistics endpoint
Correct. But what benefit would there be for someone to do that? The person doing that would have to understand the correct data format and value ranges, then craft and send fake data. Why would someone go through the effort?
Dec
4
comment Screen capture through silent install routed back out port 80
@JoeSwindell Then here is a great answer. Clicking links IS enough to be pwned.
Dec
4
revised Screen capture through silent install routed back out port 80
deleted 1 character in body
Dec
4
comment Screen capture through silent install routed back out port 80
But the OP said "0 interaction", which would seem to mean that the user did not click the link (therefore no browser vuln).
Dec
4
revised google recaptcha V2 on apache shared server: How to get it to work with SSL
formatting
Dec
4
comment google recaptcha V2 on apache shared server: How to get it to work with SSL
This is more of an Apache config question.
Dec
4
comment Screen capture through silent install routed back out port 80
Through what route was the link sent? That's the important info. Email readers can process links, and that requires no interaction. Or, the tester had control over the endpoint and activated the link. We need more info.
Dec
4
reviewed Leave Open Which forward secrecy cipher suites are supported for TLS1.0 protocols?
Dec
4
reviewed Leave Open Automated tools to manage or monitor authorized_keys?
Dec
4
comment Protecting a statistics endpoint
I'm not sure why the devs would care. The data would have to be properly formed to be relevant. Unless there was an identified risk that manufactured data was going to taint their debug data, there might not be any authentication at all.