freddyb

345 reputation

bio	website
	location
	age
visits	member for	2 years, 5 months
	seen	Apr 12 at 13:31
stats	profile views	45

python, ruby, web-security, etc.

	345 reputation	bio	website		visits	member for	2 years, 5 months
26 badges		location			seen	Apr 12 at 13:31

summary answers questions tags badges favorites bounties reputation activity

40 Actions

suggestions reviews revisions comments badges posts accepts all

Nov 27	awarded	Good Answer
Oct 5	comment	Are there valid reasons for spoofing an address? If I'm not mistaken, listening for and responding to Anycast addresses might be considered spoofing as it appears that an otherwise unique address is present on two sides of a router
Sep 20	revised	What “hacking” competitions/challenges exist? this makes more sense, I suppose :)
Jul 6	comment	ASLR in Ubuntu 11.10 You are completely correct. I should have mentioned the most common forms of ASLR bypasses. Your remark about 64 bit is also important. +1.
Jun 26	answered	ASLR in Ubuntu 11.10
Mar 20	comment	What “hacking” competitions/challenges exist? I have added a list of lists. If you find more, don't hesitate to edit my post :)
Mar 20	revised	What “hacking” competitions/challenges exist? added list of lists :)
Mar 20	comment	Can fuzzing be considered a software testing technique for any vulnerability type The term fuzzing is not precisely defined. Considering that you're doing this for a some kind of research I would suggest that you find a good computer security book and quote the author's definition of fuzzing :) In my opinion fuzzing is less sophisticated than vulnerability scanning. Fuzzing especially requires you to run the application on your own, whereas vulnerability scanning may happen with remote machines.
Mar 20	awarded	Yearling
Mar 13	awarded	Critic
Mar 13	comment	Powerful security tools to use in penetration testing This is a smart 'out of the box thinking' answer and all that. But clearly he asked for TOOLS. Suggesting him to use a brain is like pointing out that a keyboard might be helpful. -1, Sorry.
Mar 13	comment	Can fuzzing be considered a software testing technique for any vulnerability type My main point was, that sqlmap does something sophisticated. Using SQL Syntax and checking the output variation. But there are fuzzers which stick to specific languages (i.e. JavaScript) as well. My reasoning is slightly flawed, I'm afraid ;) -- But! Sqlmap is doing black-box analysis and not hoping for application crashes. That's imho a notable criterion to distinguish vulnerability scanners from fuzzers.
Feb 18	comment	Does prepending a salt to the password instead of inserting it in the middle decrease security? Sometimes I think this site needs more people with crypto knowledge. Thank you for bringing up hash extension attacks. People, don't just hash passwords. PLEASE! Please use bcrypt2, scrypt or the like.
Feb 18	answered	Can fuzzing be considered a software testing technique for any vulnerability type
Feb 18	comment	Does this assembly packer is familiar, is used in wget? unpack with upx -d ;)
Jan 16	awarded	Nice Answer
Dec 1	comment	Designing a Capture The Flag target and game management system The term CTF is kinda ambigous. See security.stackexchange.com/questions/3592/…
Nov 22	awarded	Commentator
Nov 22	comment	Is it correct to use form field(hidden) for storing Session Token You did not cover the inherent security risks of session tokens in HTML content. That is a serious problem. Session tokens can be protected from XSS attacks by being placed in HttpOnly Cookies. See Krzysztofs answer.
Nov 20	comment	Is opening both TCP/UDP less secured than just TCP or UDP when needed and why? You don't have to have the software running to find its port. The very most ports are listed in /etc/services.