305 reputation
17
bio website pastebin.com/u/dc5553
location DE
age 94
visits member for 1 year, 11 months
seen yesterday

Intrusion/Security Analyst with experience in PowerShell, Python, and Scapy.

Former Sys Admin for Windows/Cisco Domain.

Security junkie that loves to help and learn..

Stacktrolls move along!

profile for dc5553 on Stack Exchange, a network of free, community-driven Q&A sites


Apr
11
comment EICAR alternative for IDS/IPS
absolutely on board with very broad rules, something like that could overwhelm your logging servers quickly. This solution is of course a simple example, the real version would be much more specific and tested at the appropriate time or on a a test network.
Mar
18
answered EICAR alternative for IDS/IPS
Feb
23
comment Snort not showing dropped/blocked packets
When you run a packet capture where you have the snort box I assume you see these icmp packets?
Feb
23
answered How does an IDS identify a computer ?
May
12
comment What defines a programming language as useful for hacking?
Canvas is also written in Python :)
May
12
awarded  Commentator
May
12
comment What defines a programming language as useful for hacking?
One huge reason I would choose Python is Scapy. Sure Metasploit runs on Ruby but thats no reason to make it the "hackers" scripting language of choice.
May
12
comment What defines a programming language as useful for hacking?
All of the examples are OO languages, however, Perl is more bolted on that integrated IMHO. If you are going to include JS in the list I think a more fitting option would have been PHP as well. Lastly as much as I hate to say it Perl still has the largest amount of libraries out there. This will change but CPAN has been around a long time so its the nature of the beast.
May
12
comment Security Onion:snorby alerts shows all local nerwork source IP(public and private)
I can probably answer this for you if you provide a small diagram and your IP scheme. Do you NAT both ways? Where is the sensor located in your architecture?
Apr
19
awarded  Yearling
Apr
29
comment HTTPS Everywhere vs. NoScript
No script's is manual not automatic like https everywhere
Apr
28
answered HTTPS Everywhere vs. NoScript
Apr
28
comment Is your PGP passphrase used to decrypt an encrypted private key, or needed in conjunction with the private key to decrypt the message?
If you fix the question i believe i know what you are asking and I will answer it. You want to know if you need the your pgp(or rather gpg) private key and passphrase to decrypt a message correct?
Apr
27
comment Network Concerns Over a MITM Attack
hypothetically you want him to run a continuous arp table check to see if it changed? Don't see it happening sorry.
Apr
27
revised Network Concerns Over a MITM Attack
added 1 characters in body
Apr
27
answered Network Concerns Over a MITM Attack
Apr
27
comment Network Concerns Over a MITM Attack
logging alerts using what? MAC addresses are at layer 2 this guy is talking about a host server on the internet. Mac address change at every hop of a router.
Apr
27
awarded  Critic
Apr
27
answered Theft of data via live boot disk
Apr
26
awarded  Autobiographer