Penetration Testing

Acquired a new skill today. I hope that i can put it to use soon.

Comments

Post a Comment

Popular posts from this blog

ElasticSearch - Sniff ! Sniff!

Note: Below is a brief discussion of the issues i have encountered using Elasticsearch's  Client  behind a VIP. As I had written previously, I had to setup an Elasticsearch cluster. In order to take advantage of balancing the load between the nodes of the cluster. I used a DNS pointed to VIP that does a round-robin load balancing among the nodes. The reason i choose this is because I can add servers to the VIP without changing the Transport Addresses in the Elasticsearch Client java code which uses a TransportClient. Without the VIP I need a coding change and deploy to add the new Transport Address. The cluster would not be really useful if I cannot take away nodes and add nodes to the cluster as I wish without any coding change. The drawback in hiding the cluster behind the VIP is that you don't know which node the java code client is going to get in order to process a search request.  This is causing an issue in the client code.  Since I only have one Tran...
Read more

OAuth 1.0a Request Signing and Verification - HMAC-SHA1 - HMAC-SHA256

Image
This is a security project that I did this Fall semester. I was interested in why the OAuth1.0a specification did not require you to sign a request using RSA-SHA1 or any RSA algorithm. The first issue that I found is where would you store your private keys in a javascript client? - as a javascript encrypted file ? from the browser ?  - that will be a security hole if you allow javascript to get private keys. These are some of the questions that got me asking and which I cannot find answers to for now. OAuth 1.0a Signature Signing and Verification using JavaScript Implementation Background The OAuth specification tries to define an API authentication method that allows consumer websites or applications to access protected API Resources from a Service provider. The advantage that OAuth provides is that the user of the website or application is not required to disclose their credentials to their service provider. Another advantage of using OAuth to authenticate is that it does...
Read more

The "Black Sheep" Way of Answering Inquiries from Managers

This is what i will be discussing in my Technical Communication class. We can pick a topic that is familiar to us. Since i have been teaching my daughter to read I became really familiar with nursery rhymes. I am going to take my classmates all the way back to nursery. Baa, baa, black sheep , Have you any wool ? Yes sir, yes sir, Three bags full. One for the master, One for the dame, And one for the little boy Who lives down the lane. Introduction Before we discuss the things that we can learn from the black sheep, we need background to relate this simple nursery rhyme to a management context. Who is asking the question “Have you any wool?” We know that it is not the “Master” because later on the sheep said “One for the master” which implies somebody other than the “Master” is asking the question. The sheep referred to the one asking the question “Sir” which is acknowledging the authority of the one asking to ask the question. We can deduct that the one asking the question is somebody ...
Read more