399 reputation
315
bio website
location
age
visits member for 2 years, 6 months
seen Nov 11 at 16:48

ca51ce1fb15acc6d69b8a5700256172fcc507e02073e6f19592e341bd6508ab8


Jul
3
comment mprotect at kernel level
So, imagine I have a program running with kernel privileges. Could other program, with the same privileges, use for instance ptrace() to see the memory of the first program, even the PROT_NONE protected pages?
Jul
1
comment Allow or Deny Access to a Network Based on Client Hardware
@TerryChia how do they know that it was not created by a keygen? Or that I am not the rightful owner of that key but an impostor?
Apr
9
comment How does SSL/TLS work?
I'm printing this answear for my Security Management exam.
Sep
19
comment From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work?
Seems like a buffer overflow.
Aug
31
comment Is not checking the src url a vulnerability?
And, apart from CSRF, are there other ways to exploit it?
Aug
30
comment Is not checking the src url a vulnerability?
It sanitizes, I updated the question to show how. BTW I made a little mistake, img tag does not have the href attribute, it is src ;)
Aug
30
comment Is not checking the src url a vulnerability?
I edited the question, now you can see how it is done. BTW I made a little mistake, img tag does not have the href attribute, it is src ;)
Aug
30
comment Is not checking the src url a vulnerability?
@adric I mean, if you let the user to introduce any valid url in the href, could it be exploited?
Aug
23
comment Is asymmetric encryption ever recommended for long-term storage?
I find your system pretty secure, although let ear some expert's advices...
Aug
23
comment I'm currently receiving a targeted attack
And, could it be a faked sender, using some tools like FakeMailer, so his friend email account has not been compromised, but the attackers knows it, and is trying to phish him?
Aug
22
comment How to determine if a browser is using an SSL or TLS connection?
please, specify what browser you are using
Aug
22
comment how to identify whether my page is phished or normal page?
@Polynomial do you mean something like, when the user clicks the submit button, the script changes the action attribute?
Aug
22
comment how to identify whether my page is phished or normal page?
@dippu the action attribute could be legitimate, but the phising website could have a script that sends all the information you wrote to other place...
Aug
22
comment how to identify whether my page is phished or normal page?
@vignesh I think that the advice, checking the https, is a good advice, websites with fake https are exceptions, but we could not ignore that possibility. But appart from that, I would concentrate my efforts in making them aware of the risks of internet and, since most of phising cases are perpetrated via email, let them know that they should never open, or click links of, emails from unknown sources, banks (they never send emails), and in general any email that they have not requested. In a nutsell, do not trust your emails. And with chatrooms etc. it is exactly the same.
Aug
22
comment Where and How is data stored in a session?
I added other question: "If I store an object of a class, in wich way is it stored? Like $_SESSION['kart'] = new Kart(10). Could someone get the information stored in that class? How?" Could you explain how the data is stored in these documents?
Aug
22
comment Instant access to application using token in url
@jcubic it is not secure, but forgot brute force, if the url has a long-live token, it could be sniffed or if someone looks the history of the browser, the account would be compromised. Also, have you consider race conditions? if two users gets/requests the url at the same second... time() works with seconds, so you could end up with two users with the same token, and then what?
Aug
21
comment What can a hacker do with an IP address?
+1 good metaphor
Aug
17
comment How to convince your boss about importance of IT security
(I am from Spain) I found an article of a law which says (Translation from Spanish): "[...] while it(password) is still being valid, it must be stored unintelligible"
Aug
17
comment How to convince your boss about importance of IT security
I found an article of a law which says (Translation from Spanish): "[...] while it(password) is still being valid, it must be stored unintelligible" Do you think is a good aporach telling this to my boss by email?
Aug
8
comment Is sha-1 hash always the same?
I was not sure if the hash is different for the same string if you hash it using linux and then with windows