bonsaiviking

625 reputation

bio	website	bonsaiviking.com
	location
	age
visits	member for	1 year, 2 months
	seen	yesterday
stats	profile views	16

	625 reputation	bio	website	bonsaiviking.com	visits	member for	1 year, 2 months
16 badges		location			seen	yesterday

summary answers questions tags badges favorites bounties reputation activity

57 Actions

suggestions reviews revisions comments badges posts accepts all

Jun 4	comment	Is it worth padding passwords? @RayBritton In general, the crypto you choose should be good enough that you can trust it. If you have to bolt on your own stuff, then you should instead choose better crypto. One other thing you could do is to seed the database with "bogus" accounts (hashes based on 32 bytes of random garbage) to slow down an offline attack. Just don't make them obviously bogus (same creation date, same name, sequential usernames, etc).
Jun 4	comment	Is it worth padding passwords? In general, you shouldn't mess with security functions on your own because 1) you may introduce bugs, 2) you break modularity (e.g. I can't change that, it'll break my padding scheme), 3) you make code maintainers go WTF. For more discussion, see this question, where something like your scheme (but even more "unbreakable") is discussed.
Jun 3	answered	Is it worth padding passwords?
May 21	comment	How to find live hosts on my network? @TheRookierLearner This sort of confusion is why `-P0` was deprecated for `-Pn` to mean the same thing.
May 20	comment	How to find live hosts on my network? Nmap already uses this method for "ping" sweeps of broadcast-local network segment. Run with root privilege and use `-v` for verbose output, and you will see "Initiating ARP Ping Scan". nmap.org/book/man-host-discovery.html
May 20	comment	How to find live hosts on my network? `-P0` does not "try to scan all the ports of a system to check if it is up." Instead, it skips host discovery, reporting everything as up, and performing whatever port scans you have requested on every IP. Also, as @RoryMcCune notes, Nmap should send ARP requests for this type of scan. Use `nmap --iflist` to check what Nmap thinks about your routing table; it's possible that it is confused and not sending the right probes. If you can't get an ARP reply from an IP, you can't send a TCP or UDP packet, either.
May 20	comment	How to find live hosts on my network? @HamZaDzCyberDeV Yes, `-sn` is the new standard argument, but it used to be `-sP`, so @TheRookierLearner's command should still work.
Apr 18	awarded	Yearling
Apr 18	answered	How was this token decoded?
Apr 17	comment	Vulnerable code suggested on OWASP? The page on OWASP says you should invalidate the session if there is a mismatch in previously observed parameters. It does not say you should use these parameters to identify a session. That's what Cookies are for.
Apr 16	answered	How do random attackers discover websites to target?
Apr 16	answered	Sharing Nmap scan results in a web page
Apr 15	comment	Vulnerable code suggested on OWASP? @HM You're missing the point. By doing the check, the bar has already been raised. If your attacker has to spoof anything, you're imposing extra costs. User-Agent is also easily-spoofed, but should remain constant in a session and require reauth if it changes. You're just trying every possible way to invalidate a stolen session ID.
Apr 14	answered	Vulnerable code suggested on OWASP?
Apr 9	answered	What are the TCP/UDP ports used by torrent applications?
Apr 4	comment	What are the security threats of zip file uploads and what preventive actions should be taken? How is the security team "not allowing" zip uploads? Is it a policy issue, or are the uploads crossing a network boundary with a IPS or application firewall that is blocking it?
Mar 25	comment	How to bypass Nmap blockage? That is the expected behavior. Your provider is not blocking anything.
Mar 25	comment	How to bypass Nmap blockage? Please describe the "blocking" behavior. What Nmap command did you run, what was the result, and what did you expect? Most likely they are not "blocking nmap" explicitly, but doing something else that is affecting your scan.
Mar 21	answered	nmap.online inconsistent results
Mar 3	comment	What does -Pn option mean in nmap? When most people see "ping," they think of ICMP Echo Request, but Nmap uses many other probes for host discovery, too. The default set of 4 probes (or ARP request on LAN) is overwhelmingly likely to find a host that is up, so you should very rarely ever need to use the `-Pn` option.