Viewing profile — amjo324

The truth is that when reputable information security specialists are engaged to perform a no holds barred internal network penetration test or red teaming exercise for a client, t…

Although not a good read (in terms of being engaging or interesting), you'll find that a lot of security professionals will use something like the Center for Internet Security (CIS…

Great idea for a project. Nice job. It says in the About section on the home page "Unless someone can intercept your local traffic and our traffic to a site, you'll be able to spot…

"NoSQL, or rather NoAuthentication, has been a huge gift to the hacker community. Just when I was worried that they'd finally patched all of the authentication bypass bugs in MySQL…

"We are currently utilizing advanced protocols including double salted hashes" Shudder. Whenever someone starts talking about double salting, triple salting or even just salting, i…

When an application residing at one.example.com sets a cookie, the browser by default resubmits the cookie in all subsequent requests to one.example.com and also to any subdomains,…

Sure. But it would be a stretch to find any financial institution with as many as 360 million customer records. Maybe one of the state-owned commercial banks in China being the exc…

"The passwords are stored as SHA1 hashes of the first 10 characters of the password converted to lowercase. That's right, truncated and case insensitive passwords stored without a …

This is one of those cases where it's the responsibility of the bug bounty platform operator (HackerOne) to ensure that its customer (PornHub) deals appropriately with bug bounty p…

A similar anti-CSRF measure is implemented in some application frameworks by default. For example, When performing XHR requests in AngularJS, "the $http service reads a token from …

I'm a few chapters into Silence on the Wire and enjoying it. Zalewski is brilliant. It's very theoretical however. I'd only recommend it if your motive for reading it is pure inter…

Agreed. However, in a formal penetration testing engagement, the tester will usually only record and document their exact steps because they have to provide a detailed report to th…

Bcrypt has built-in salts to prevent rainbow (i.e. lookup) table attacks. More to the point, modern password cracking doesn't usually involve the use of rainbow tables anyway. GPU …

"The rationale was that as technology progressed and password cracking became easier, users could be contacted to update their password." I would argue that this a misguided motiva…

I say use secure templating because you need highly contextual encoding. As this article points out, escapes for HTML will not work in Javascript I just wanted to reinforce this co…

I can't live without vimperator nowadays. It's the only thing stopping me from switching to Chrome from FF (and yes, i know there are other similar vi extensions for Chrome but non…

As per my other comment below, the intended use case for SQLmap is more around exploitation rather than identifying injection points. Penetration testers will usually identify the …

In my opinion, this is not really SQLMaps intended use case. It's essentially an exploitation tool for penetration testers and doesn't provide a proper mechanism to just scan your …

I've been doing penetration testing of web applications professionally for about 5 years now. The incidence of SQLi has definitely decreased over the years but I would estimate tha…

Yes, this class of web vulnerability is called Cross-Site Request Forgery or CSRF ( https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%... ). The Same Origin Policy (SOP) …