Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror

Comment: Re: Normal women... (Score 2) 765

Its not a workplace...its a guthub repo. Also you implied its not okay to have an unpopular opinion outside of the workplace...why wouldnt the "cant have an opinion brigade" jump on you?

What happens when you have a dissenting, unpopular opinion? In you're ideal world you wouldnt be able to express it. Wouldnt that bother you?

Comment: Re: Is he dangerous? (Score 1) 163

by Redmancometh (#49239437) Attached to: Man Claiming Half Ownership of Facebook Is Now a Fugitive

People shouldn't be punished for sleeping it off in their car. I was under the impression that it wasn't a DUI if the keys weren't in the ignition though.

The issue I was getting at in response to the person I responded to was pretty simple: alcohol destroys your judgement. So you may care about the license being lost when sober, but then your inhibitions are gone, and you don't.

Some of the folks responding got a little crazy with it o-o

Comment: Re: NMAP (Score 1) 205

by Redmancometh (#49239425) Attached to: Ask Slashdot - Breaking Into Penetration Testing At 30

I've actually gotten to the point where I think WAFs are absolutely useless. As far as WAFs go though I would recommend against mod_security, as fingerprinting it via it's helpful errors is a cakewalk.

The upside to WAFs is that they prevent automated attacks...buuut snort's dynamic preprocessors seem to do this FAR better.

Either way an IDS/IPS/WAF just isn't enough. In a non-automated attack bypassing them is trivial. Half the time I can simply use URL encoding for an attack string. Some poor WAFs don't even do recursive checking, so things like nested XSS code works.

On one pen-test a client had WAFwoof, and I was doing union injection, and iterating tables..like 20 requests a second. Not one. Single. Alert.

Rules-based filtering with regexes/etc just won't keep a determined attacker out. It's a good idea to have, but fixing the underlying applications is far more important. If I have PUT permissions on a directory it doesn't matter how good the ruleset is.

It just pisses me off the the PCI council, and similar rules for HIPPA, say "oh hey vulnerable apps? Don't worry about it you've got a WAF!"

Comment: Re:Get certified (Score 1) 205

by Redmancometh (#49239399) Attached to: Ask Slashdot - Breaking Into Penetration Testing At 30

It may not enable you to command respect from everyone, but GSE is an insanely difficult certification to get.

You have to have 5 provable years in IT security just to take the exam, the exam is extremely difficult, and the 48 hour lab is ridiculously hard. If you can't read packet dumps, you won't pass, if you can't write exploits yourself..you won't pass.

You get nmap, nessus, wireshark, metasploit, the SNORT source, and some low-level command-line tools. The boxes are pretty hardened so nessus and metasploit are basically a waste of time. Some of the nmap scripts were very useful, but alot of it involved very, very low level vulnerabilities.

No custom tools...that was a big problem for me.

Most pen testers wouldn't be able to identify OR exploit them. So having the certification means you are better than 90% (or more) of the pen testers you'd run into. On it's own it may not garner respect, but it should certainly hint that the GSE knows what he/she is doing.

Don't panic.

Working...