meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 2 years, 5 months |
| seen | yesterday | |
| stats | profile views | 7 |
|
Jan 9 |
answered | Why do some antivirus programs find infections that others miss? |
|
Sep 10 |
awarded | Yearling |
|
Aug 28 |
revised |
Are there any tools that focus on shellcode analysis? Added miasm |
|
Aug 21 |
comment |
Are there any tools that focus on shellcode analysis? Cannot say, I used it for shellcode analysis but never try to modify one with libemu. |
|
Aug 21 |
answered | Are there any tools that focus on shellcode analysis? |
|
Aug 20 |
awarded | Caucus |
|
Aug 20 |
awarded | Constituent |
|
Aug 19 |
answered | Finding Win32.Sality sample for malware analysis purposes |
|
Nov 1 |
answered | Securely building a local pentest lab in a VM |
|
Sep 26 |
revised |
Where can I find good resources on reversing web malware? added 4 characters in body |
|
Sep 26 |
answered | Where can I find good resources on reversing web malware? |
|
Sep 23 |
comment |
Is security increased by using a subdomain per customer in a web-app? You must set cookie domain attribute exactly with the correct subdomain, if not other subdomain could handled other subdomain cookie. From OWASP: For example if the application resides on server app.mysite.com, then it should be set to "; domain=app.mysite.com" and NOT "; domain=.mysite.com" as this would allow other potentially vulnerable servers to receive the cookie |
|
Sep 23 |
comment |
How do you know your server has been compromised? @BozKay Check logs, most of the time are bots exploiting known vulnerabilities massively and they simply append malicious content on your index or similar front file. In fact if you inspect 404 codes you should see interesting things |
|
Sep 23 |
comment |
How do you know your server has been compromised? @Piskvor you're right. EOF |
|
Sep 23 |
comment |
How do you know your server has been compromised? @Piskvor Thanks, I already knew what a rootkit is. You are assuming all hacked server are rooted and all rooted server has a undetectable rookit installed. Of course it can happens and when it happens you're screw. But seriously, do you think it happens all the time in all the hacked servers? There is not the ultimate method to know when a server is hacked but a least take some measures. If we thought your way then unplug the server, burn it and throw it to the sea. Poster was asking 'How to' not if is ALWAYS possible to know and be sure about then. |
|
Sep 23 |
comment |
How do you know your server has been compromised? @Piskvor in any case you can check the responses too. This is: You know what a right response looks like. Check the response with yours and examine diff. Otherwise, if you access the code and download the pages you can check the hash locally on your machine. |
|
Sep 23 |
answered | How do you know your server has been compromised? |
|
Sep 22 |
awarded | Supporter |
|
Sep 21 |
awarded | Analytical |
|
Sep 20 |
awarded | Editor |
