239 reputation
210
bio website
location Manchester, United Kingdom
age 40
visits member for 5 years, 6 months
seen Apr 23 at 13:26

Security analyst, penetration tester and web developer based in the UK.


Feb
3
awarded  Popular Question
Jan
8
comment Create a Lockout policy for RDP
Agreed. Don't put it on the internet; just set up a VPN.
Jun
26
accepted Setting the secure flag on cookies from Outlook Web Access
Jun
26
revised Setting the secure flag on cookies from Outlook Web Access
added 12 characters in body
Jun
26
asked Setting the secure flag on cookies from Outlook Web Access
May
9
awarded  Commentator
May
9
comment Does PHP-CGI security issue (CVE-2012-1823) affect PHP running as regular users with mod_fcgid?
worked exploit here blog.spiderlabs.com/2012/05/… to test your own servers with
May
2
comment Reverse Proxy - should it be a different technology stack?
Arguably one aspect of security is decreased, as with two different stacks, HTTP Request Smuggling techniques may be employed to selectively target the front-proxy or the back-end server. owasp.org/index.php/HTTP_Request_Smuggling
Feb
8
revised openVAS scan against new instance fails test (possible false positive) How to debug plug-in
added 3 characters in body
Feb
8
answered openVAS scan against new instance fails test (possible false positive) How to debug plug-in
Dec
31
awarded  Editor
Dec
31
revised What is the best Web Application Firewall for IIS?
deleted 87 characters in body
Dec
20
comment multi-purpose server - security
Seems like a system-administration question, rather than a programming question
Oct
8
awarded  Yearling
Jan
30
awarded  Notable Question
Aug
27
awarded  Scholar
Aug
27
accepted Security Risk? Microsoft-HTTPAPI/2.0
Aug
27
answered is this a hack attempt?
May
11
awarded  Popular Question
Feb
2
comment What is the best Web Application Firewall for IIS?
Please note that in new regulations provided to ASVs from the PCI security council this month, detection of an IPS/IDS that affects the results of the scan is an instant PCI fail. So ensure that you choose one that allows you to whitelist your ASV's source addresses.