Reputation
325
Top tag
Next privilege 500 Rep.
Access review queues
Badges
1 8
Newest
 Nice Answer
Impact
~35k people reached

  • 0 posts edited
  • 2 helpful flags
  • 30 votes cast
Jun
12
comment How do I ensure that my Ubuntu download has not been tampered with?
MD5 is not "broken" true there are more collisions that ideal, however, for this purpose as well as even for use in a court of law MD5 is absolutely fine.
Jun
12
comment Monitoring Active Directory Domain Administrator Activities
I think a good or better question is ask is there a tool that can better correlate mountains of windows logs. A network of that size should have something like ArcSight logger or Splunk and to do this with those tools (especially Splunk) is somewhat trivial. just my 2 cents and I hope that helps.
Oct
24
comment What file formats are known to be unsafe?
@user606723 Flash supports multiple versions of ActionScript which can be used for a number a malicious reason. Including nearly all of the JS vectors plus it is usually harder to locate because within 1 flash file you may have multiple versions of ActionScript running 1/2 and 3.
Jul
7
awarded  Nice Answer
May
14
comment Is my ISP doing a port scan on my computer?
did you try to connect to those IP addresses on 443 and see what happens?
May
14
comment Is my ISP doing a port scan on my computer?
Could this be replies to your internal host with misconfigured stateful rules by chance? It certainly looks that way. 192.168.1.1 connecting to your ISP and the return packets are being filtered maybe?
Apr
27
revised EICAR alternative for IDS/IPS
typo
Apr
27
revised Network Concerns Over a MITM Attack
added 17 characters in body
Apr
11
comment EICAR alternative for IDS/IPS
absolutely on board with very broad rules, something like that could overwhelm your logging servers quickly. This solution is of course a simple example, the real version would be much more specific and tested at the appropriate time or on a a test network.
Mar
18
answered EICAR alternative for IDS/IPS
Feb
23
comment Snort not showing dropped/blocked packets
When you run a packet capture where you have the snort box I assume you see these icmp packets?
Feb
23
answered How does an IDS identify a computer ?
May
12
comment What defines a programming language as useful for hacking?
Canvas is also written in Python :)
May
12
awarded  Commentator
May
12
comment What defines a programming language as useful for hacking?
One huge reason I would choose Python is Scapy. Sure Metasploit runs on Ruby but thats no reason to make it the "hackers" scripting language of choice.
May
12
comment What defines a programming language as useful for hacking?
All of the examples are OO languages, however, Perl is more bolted on that integrated IMHO. If you are going to include JS in the list I think a more fitting option would have been PHP as well. Lastly as much as I hate to say it Perl still has the largest amount of libraries out there. This will change but CPAN has been around a long time so its the nature of the beast.
May
12
comment Security Onion:snorby alerts shows all local nerwork source IP(public and private)
I can probably answer this for you if you provide a small diagram and your IP scheme. Do you NAT both ways? Where is the sensor located in your architecture?
Apr
19
awarded  Yearling
Apr
29
comment HTTPS Everywhere vs. NoScript
No script's is manual not automatic like https everywhere
Apr
28
answered HTTPS Everywhere vs. NoScript