6,471 reputation
41345
bio website adranos.com
location
age
visits member for 3 years, 2 months
seen Feb 13 '14 at 14:40

@TildalWave said having a sig would encourage more people to view my profile. Also beer.


Sep
18
reviewed Approve Does a DDoS attack have other purposes beyond a lack of availability?
Sep
18
reviewed Close What are the reasons this SQL injection code wouldn't work?
Sep
18
reviewed Leave Open What are covert channel algorithms?
Sep
18
reviewed Close Edit virtual host file using php
Sep
18
comment Create netcat listener and execute reverse shell in the same script
@Nucklear I have added to my answer to address how to do this in python alone.
Sep
18
revised Create netcat listener and execute reverse shell in the same script
added 731 characters in body
Sep
18
answered Create netcat listener and execute reverse shell in the same script
Sep
17
answered Reverse shell in gzip
Aug
27
comment Does validating a mime-type reduce or stop the need for virus scanning?
'Validation Filters' are often quite thin. Making stuff look like other stuff is often possible; A B C
Aug
23
answered IP address of an iPhone
Aug
14
comment Site Executing control characters in title tag
I'm not suggesting this is done clientside, it seems likely that the content is simply POSTed to the results page, where it is filtered and used (The definition of used will lead to whether or not this is exploitable). The regex I posted was to explain your very last point about needing 'normal' chars surrounding the control chars.
Aug
14
answered A scammer placed a remote file on a Wordpress website?
Aug
14
comment Site Executing control characters in title tag
Sounds like maybe they are doing search.matches("[\w]+") rather than search.matches("^[\w]+$"). As to whether this is exploitable, I'm unsure - it would depend on what other functions the search term is passed through.
Aug
13
comment Does a network behind a NAT\modem firewall need a firewall?
@sectek Remote-execution exploits exist for some older incarnations of the Linksys software stack, the firewall configuration is largely irrelevant in such cases.
Aug
13
comment Is it possible to respect a user's privacy while collecting phone MAC addresses?
My phone keeps track of where your chosen WiFi networks are using GPS, then only turns on the WiFi when the GPS indicates that you are nearing a saved network. This I think is a great feature.
Aug
13
comment Is it possible to respect a user's privacy while collecting phone MAC addresses?
@CodesInChaos gotcha, somehow I got lost in the double/triple negatives and thought you were arguing the opposite.
Aug
13
comment Is it possible to respect a user's privacy while collecting phone MAC addresses?
@CodesInChaos not sure what point you're making. Longer identifiers are worse for privacy. Saying MAC addresses are short implies they cannot be used to ID people uniquely - imagine a 2 bit MAC. Also 48 bits is a long ID when you're talking about things like human beings.
Aug
13
comment Cross site scripting prevention removing &lt and &gt
@Nucklear if you have thrown everything from that OWASP page at your filter, then you're probably pretty good. Whitelisting is still the preferred approach however. eg msg.matches("[\w\s]*")
Aug
13
answered Cross site scripting prevention removing &lt and &gt
Aug
7
answered Recommended options for LUKS (cryptsetup)