Reputation
1,584
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
1 11 29
Impact
~109k people reached

  • 0 posts edited
  • 1 helpful flag
  • 174 votes cast
Apr
26
comment Remove identifying information from SSH
I am not concerned with vulnerabilities in ssh per say. There aren't many vulnerabilities in ssh, so keeping it up to date won't be that difficult. I am more concerned with an attackers ability profile and then replicate my server and conduct simulated attacks such that a real attack will become more successful.
Apr
26
comment Remove identifying information from SSH
+1 Port knocking is very cool. Although i disagree with the security though obscurity comment. This information gives details that are only useful to attacker. By looking at this string an attacker knows I'm using a 64bit ubuntu system and they can make sure their exploit works against that system, this is especially important for buffer overflows where 1 wrong bit means a crash instead of a remote shell.
Apr
15
comment Necesity of ModSecurity if Apache is behind Nginx
mod_security does not stop csrf/xsrf, in fact no WAF can do this properly.
Apr
15
comment Free OCSP server for testing purposes?
@StackedCrooked Thats awesome! OpenCA rocks, i'm glad i could help.
Apr
8
comment Is iptables enough security, if port 80 is the only unblocked port and apache is setup correctly?
<joke> Oah so now we agree, I see how it is. </joke>
Apr
7
comment Is iptables enough security, if port 80 is the only unblocked port and apache is setup correctly?
Thanks, i'm happy to help. You should leave port 80 open purely to redirect people to https://, you can take care of this in your Apache virtual host config file.
Apr
7
comment Free OCSP server for testing purposes?
@Warren if you don't know what ocsp is, then you shouldn't answer the question.
Apr
3
comment E-mail sent with postfix are marked as spam
(+1) I'm sending mail from a dedicated host. I've added my root domain name to the mx records and I've created spf records for every mx record. Now, I'm waiting for dns to propagate.
Mar
11
comment How to renew dhcp ip address in ubuntu?
sudo dhclient always works, it doesn't need an argument but you can give it one.
Feb
22
comment Security VPN vs RDP
Yo Nigga! You be protectin' your protocols and shit.
Feb
22
comment How do I securely execute commands as root via a web control panel?
If you buy it then a browser will be able to tell you that you are in fact talking to your server. If you don't buy one, the browser will always throw an error when you visit your server and it will throw the same error when you give your root password to a hacker conducting a MITM attack. There isn't much point in self-singed certs.
Feb
19
comment How do I securely execute commands as root via a web control panel?
I almost gave you a -1 for suggesting hardened-php. That project is awesome, but its not designed for this. The whole point is that he wants to give PHP LOTS of privileges, not take it away.
Feb
19
comment How do I securely execute commands as root via a web control panel?
No go with a real one. Its only $30 and the whole point is that you want to make sure your typing your ROOT password into your server and not a "Man In the Middle" (MITM).
Feb
14
comment How to test passwords against a word list with fuzzing
You are talking about a dictionary attack with transformations. Any time you are relying on making a ton of guesses to break the secuirty system you are doing brute force, in this case it is intelligent brute force. I have written fuzzers and I can tell you they are completely unrelated.
Feb
13
comment How to test passwords against a word list with fuzzing
your using the word fuzz incorrectly. Fuzzing is a type of software testing. You mean to say Brute Force.
Jan
28
comment How can you obscure the fact that you are running Apache?
Who said I was defending against automated attacks? Giving any information to an attacker is a serious problem. I am a penetration tester and an exploit writer.
Jan
28
comment What is the best Web Application Firewall for IIS?
@Cheekysoft, your right, the pci-dss does however require an IPS or IDS and HTTP/HTTPS is the only thing open on the server.
Jan
28
comment What is the best Web Application Firewall for IIS?
@Cheekysoft, your right, it does however require an IPS or IDS and HTTP/HTTPS is the only thing open on the server.
Jan
28
comment What is the best Web Application Firewall for IIS?
Writing vulnerability free code is impossible. So then would it also be true that you should put up as many obstacles as possible.
Jan
5
comment How can I use mod_rewrite to remove everything after the ? (question mark) in a URL?
I want the rules to work for all files on the system, not just index.php