461 reputation
36
bio website
location
age
visits member for 2 years, 7 months
seen Jan 21 '13 at 14:13

Jun
8
comment Class.forName injection and constructor invocation
In this case, I'm the auditor/attacker, and totally agree about stacktraces being a bad idea. I am interested in concrete examples and didn't know that FileOutputStream actually created/emptied files just by being constructed, so +1 for that! Any more examples? Being able to overwrite files is pretty nasty, depending on configuration. Overwriting configuration files could e.g. enable server-side scripts to be served as plain text, and overwriting .htaccess files could also bypass restrictions.
Jun
6
comment Class.forName injection and constructor invocation
Ok, some more possibilities: parameter: java.io.FileInputStream This will throw an exception if the init-string does not exist on the filesystem, which will make it possible to determine the location of arbitrary files.
Mar
24
comment What's the practical limit for rainbow-table based bruteforce?
@SteveS Agree. I'd even wager that plain text password storage is more common than any hashing more complex than MD5.
Mar
24
comment What's the practical limit for rainbow-table based bruteforce?
Yes, naturally, that's why I specifically pointed out that the passwords were considered random in the context of the question.
Mar
23
comment What's the practical limit for rainbow-table based bruteforce?
What I'm interested in, basically, is what the upper bound on M+N is that can be bruteforced in practice, today, by a dedicated attacker (as per the scenarios). Perhaps the focus that I put on rainbow table was wrong.
Mar
23
comment What's the practical limit for rainbow-table based bruteforce?
Strange choice? It is one that I've seen in use pretty often, that's the only reason. And what does the size of 64bit+ come from? What's behind that figure?
Mar
23
comment What's the practical limit for rainbow-table based bruteforce?
I agree. The distinction in my question between password and salt is rather pointless - but I left it there in order to prevent comments like "hey, you should use a salt also". However, the complexity should be reduced if the attacker knows the exact length of the total password (M+N). I have updated the question to be more precise about this.