10,003 reputation
11547
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 2 years, 4 months
seen 4 mins ago

Canadian insurance company Security Manager.


Jul
30
comment “Username and/or Password Invalid” - Why do websites show this kind of message instead of informing the user which one was wrong?
@JoãoPortela I did not say that it is a valid assumption for all cases, I said that it is not a bad assumption. Of course some sites have very public usernames, and in that case, if you know a valid username, all you need to do is to guess the password, but as a general case for a designer, it is better to assume that the username is not known.
Jul
30
comment “Username and/or Password Invalid” - Why do websites show this kind of message instead of informing the user which one was wrong?
@kojiro Yes, it does assume that. But, that is not a bad assumption.
Jul
30
comment “Username and/or Password Invalid” - Why do websites show this kind of message instead of informing the user which one was wrong?
@MarkBeadles ... the logon entity won't know if the username is valid? You might have to explain that one more...
Jul
30
comment How do I hide files inside an image without using any steganography tools?
This works if the OP also doesn't require steganography ... if he still needs the file to be a picture or sound file, then your method doesn't apply.
Jul
24
comment Conky for PenTesters
I am finding it useful as a constant monitor on the desktop. I can run several things at once, and the monitor can keep track of what's going on. Including, as my script now allows, checking to see if reverse shells have connected, and if I have remembered to set up listeners or servers, and which ones are active. I also have the normal dynamic monitors of CPU and RAM, as well as interface traffic and settings. It makes it easier to multitask in an engagement.
Jul
24
comment Conky for PenTesters
I am still stumped why there are not more conky scripts for pen testers. The quick and dirty one I have has been so helpful!
Jul
23
comment Microsoft SQL server 2000 sp3a - isn't it oudated?
Coding might take a month but testing is a much longer process. If you have an app written in 1999 that has been running for this long, the SQL bugs are well-known and the app has reached a certain level of stability. Upgrading is not a trivial task in this instance, especially if it is a business-critical application. Things can break that can be nearly impossible to properly trace and the costs of errors are huge.
Jul
19
comment Conky for PenTesters
@Rook Your idea has potential. Would filtering on outgoing ACKs reduce the noise? It would save me from being in promisc mode, and I am more interested on established connections than other traffic.
Jul
19
comment How to filter POST requests before they reach PHP on Apache?
Then sanitize the POST input on the scripts that need it? If your other PHP files don't process POSTS, then you're covered there. I'm still unsure what needs to be done.
Jul
19
comment How to filter POST requests before they reach PHP on Apache?
Do you want to filter POSTs or file uploads?
Jul
12
comment nmap showing unknown IPs on private network
Depending on where you live, an nmap -O or -A scan is illegal if you know they are hosts that you do not own. I'd put up a firewall to prevent all those hosts flooding your home network with traffic .... or attacks ....
Jul
12
comment Coverage of OSCP training
They have a separate wifi certification OSWP. There are many Windows and Linux targets in the class. There is only a little web testing, but they have announced a OSWE certification coming soon.
Jul
8
comment What preparation do I need to fullfil for OSCP?
If you are new consider 60 days the minimum. Be prepared to go for 90 days, and prepare to take the exam more than twice.
Jul
8
comment What preparation do I need to fullfil for OSCP?
The exam does not let you use Metasploit - so you need to learn how to exploit without it in class. Learning Meatasploit before PWB is a big help to understand concepts, though. The Meterpreter is allowed as a payload, but not the scanners or exploits.
Jul
1
comment Looking for something like a QR code that cannot be copied/reproduced
He meant that it's not impossible to copy
Jun
30
comment Block the HTTPS version of a website
@momo1729 Squid does not get installed on the clients but on the perimeter. You have a lot of reading to do about proxies and firewalls ...
Jun
30
comment Looking for something like a QR code that cannot be copied/reproduced
Anything visual that has to be interpreted by a camera can be copied.
Jun
29
comment Block the HTTPS version of a website
He's using K9, which is client-side, and has a limitation with its ability to enforce SafeSearch features on SSL sites.
Jun
29
comment Block the HTTPS version of a website
Please do not cross post, and if you do, make sure you include the same information on both sites.
Jun
29
comment Block the HTTPS version of a website
I think the filtering is being forced on the client-side, not the proxy, in the OP's case.