meta user
network profile
| bio | website | stachliu.com |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 2 years, 4 months |
| seen | 17 hours ago | |
| stats | profile views | 1,120 |
Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen. Test everything, trust no one.
I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.
|
May 2 |
revised |
Lessen impact of DoS attack on cpu-expensive login? added 258 characters in body |
|
May 2 |
comment |
Are these two ways safe? @Strernd edit your post, this is the most important piece if information you could have included. Now the real question is, how are you keeping this hash a secret if you don't have a session id? And if you have a session id, why not just use that to enforce access control? |
|
May 2 |
revised |
Lessen impact of DoS attack on cpu-expensive login? added 248 characters in body |
|
May 2 |
comment |
Are these two ways safe? @Strernd Why would the attacker not know this value? How is this value generated? |
|
May 1 |
answered | Are these two ways safe? |
|
May 1 |
comment |
Lessen impact of DoS attack on cpu-expensive login? @Nuoji SSL supports the resuming of connections so why not this protocol? Disconnecting a large number of clients would be a venerability. Sending TCP-FIN packets would require the attacker to intercept a client's traffic... Also, who says you can't have a CAPTCHA over a non-http protocol? |
|
May 1 |
comment |
Allow embedded videos while keeping youtube blocked The irony is that its easy for employees to bypass this but difficult for the company to display its own videos on youtube. |
|
May 1 |
answered | Do email clients reduce security? |
|
Apr 30 |
revised |
Lessen impact of DoS attack on cpu-expensive login? added 63 characters in body |
|
Apr 30 |
answered | Lessen impact of DoS attack on cpu-expensive login? |
|
Apr 30 |
comment |
Lessen impact of DoS attack on cpu-expensive login? So if you block the login with an IPS, then no one can login. This causes a much more serious problem than it attempts to solve. |
|
Apr 30 |
revised |
Webmail host knows my password added 14 characters in body |
|
Apr 27 |
answered | Will “upgrading” www-data user open up known security issues? |
|
Apr 26 |
answered | How can I find the source of traffic allegedly originating from my IP address? |
|
Apr 25 |
answered | Security Scanning for Desktop Applications |
|
Apr 25 |
comment |
SQL Injection - Extracting database data from the page content @perl-user If its non-blind injection you should be able to pull out the value of an arbitrary column. One option is to use the concat() function to surround the data that you are pulling out with a unique value. Then just use a regex to pull out the data between the two unique values. Damn simple son, maybe you should actually try solving problems, then you'll be a better problem solver ;) |
|
Apr 25 |
comment |
SQL Injection - Extracting database data from the page content @perl-user Well finding the content on the page is a technically difficult approach. However, you can use a union select with blind sql injection. Here is an exploit that i wrote which uses a a binary search with blind SQL Injection to pull out bytes using O(log(n)) requests. I use a union select with blind sql injection to find messages in the bin_ask subroutine. Its also multithreaded, which makes it very fast. |
|
Apr 25 |
awarded | sql-injection |
|
Apr 24 |
revised |
SQL Injection - Extracting database data from the page content added 57 characters in body |
|
Apr 24 |
comment |
SQL injection to a mysql database doesnt work You are using a bracket to try and end the first query, and then you are trying to use a union select.... You should learning SQL before trying to exploit it. |
