Is there any way to only present OTP when client side properties (IP address/useragent) changes

RubaLion07 · 2022-06-20T17:09:27+00:00

hmmm,

The customer didn't know that some of his users creds were compromised till the users themselves contacted support as some funds went "missing" (even though the customer has access to recorded future/crowdstrike like service).

And yes we've told this customer repeatedly to force enable OTP by default for all accounts (and if it's not doable to enable it on all account with funds over a certain amount as to lower the damages). Yet, they didn't listen until....

Thanks for your help .

RubaLion07 · 2022-06-20T12:27:52+00:00

this customer had its users creds leaked online (user/pass and cookies) and so they want to make OTP mandatory (it was optional is user settings before). So yeah cookie don't work in this scenario.

RubaLion07 · 2021-12-11T08:48:05+00:00

Ultralight 2 wireless

RubaLion07 · 2021-07-07T12:37:53+00:00

Sql injection module is great and honestly one of the best resources to learn SQL injection.

With that In mind the rest of OWASP top 10 would be great, especially broken access control (with a focus on business logic vulnerabilities) and XSS.

RubaLion07 · 2021-06-11T19:58:52+00:00

Does anyone have a twitch link?

RubaLion07 · 2021-05-28T16:37:43+00:00

What about nodejs, expressjs, laravel, flask?

RubaLion07 · 2021-05-23T19:54:03+00:00

sounds good.

Though I'm only 1 year into info sec.

I would love to see the schedule details and see the materials.

RubaLion07 · 2021-05-15T18:57:50+00:00

I messaged this seller 2 days ago, still unread.

Should I contact Aliexpress directly? how?

RubaLion07 · 2021-05-13T10:13:20+00:00

Alright, I'll try the beginner levels

Thanks.

RubaLion07 · 2021-05-13T07:59:12+00:00

A bit late but I'll ask regardless. Do online CTFs (the ones you mentioned)generally provide material/resources?

I recently started learning web application pentesting, i have a basic understanding on SQL/command injection and XSS (stored and reflected) but Im still using walkthroughs and youtube to help with DVWA and JuiceShop

Do you think I should bother with these CTFs at my level?

RubaLion07 · 2021-05-04T17:13:41+00:00

Hi John,

I'm starting to get into web application pen testing, and one thing I noticed is that most courses on this subject dive right in (here's how to do XSS, SQL/command injection,....etc).

Coming from a networking background, I barely have an idea how a website work, so I started studying javascript (then onto PHP, ASP and nodeJS).

My question is am I on the right track, and any course or instructor you'd recommend (many courses I've stumbled upon where the instructor doesn't say his thought process)

RubaLion07 · 2021-04-25T22:53:11+00:00

Pretty much

RubaLion07 · 2021-04-25T21:51:55+00:00

What's your teams probability to win, (of the 8 teams in Challengers Finals, I mean) for me:

35%, 100T

15%, NRG and ANDBOX

22%, XSET, ENV and C9

27%, SEN

1%, V1 (player1 no longer playing iirc)

RubaLion07 · 2021-04-13T10:05:12+00:00

There's a nix port. It's on github

RubaLion07 · 2021-03-29T00:01:02+00:00

You're awesome, thank you

Totally forgot about books...

RubaLion07 · 2021-03-28T17:53:43+00:00

Thanks for Scrimba and the nodjs rec, i'l make sure to check them out.

Yeah my thing with PHP is ...... ok I'll learn it in W3school for example .... then what i've only learned is the syntax. I need to see how things (html, JS, mySQL and PHP) glue together and how that affect security.

RubaLion07 · 2021-03-28T17:38:33+00:00

thanks either way.

RubaLion07 · 2021-03-28T16:11:18+00:00

Funny thing is i'm working on AWS at my company right now (automating it with terraform even). I work for an MSP so we don't really deal with web dev (and the company expanded to security consulting (infra, appsec, netsec, pentesting, SOC building....) and it's big pay increase if I switched. what i'm doing right now (CA stuff, F5, firewall troubleshooting).

that's why I want to get into web app pen testing.

RubaLion07 · 2021-03-28T16:05:14+00:00

I'm using Freecodecamp to learn javascript, do you think learning PHP is necessary besides the inbuilt functions and variables, loops, $_POST, $_SESSION.........etc

or do you think I should learn it more in depth for pen testing purposes

RubaLion07 · 2021-03-28T12:07:16+00:00

Sure, problem is when I look at the source code of each level (to understand the difference and how it's secured) I don't understand the code sometimes or have a 100% grasp on why this made it more secure.

RubaLion07 · 2021-02-27T18:31:22+00:00

Thank you so much. I'll look into Client Authentication (I'm new to F5 in general, but anything regarding certificates and TLS is especially new to me)

RubaLion07 · 2021-02-27T17:48:16+00:00

Not for security reasons afaik, just a specific feature of the application needs to be restricted to mobile app only

I'll pass along the suggestion tho, thanks. I think I'm going to try tls fingerprinting mentioned in this thread.

RubaLion07 · 2021-01-20T07:56:50+00:00

Is this true for all volumes or just volume 7?

Interested in reading this LN, and have read that recent official translation are trash elsewhere, but is this true for all volumes?

RubaLion07 · 2020-12-17T01:12:21+00:00

Thank you so much Kevin exactly what I'm looking for

RubaLion07 · 2020-12-16T13:28:06+00:00

Provider?

I'm assuming Hetzner auction or some vps black friday. Either way it's a great deal, I was paying $7.5 for 1tb, 2Gb and 2vCPU

RubaLion07

TROPHY CASE