Cybersecurity professional with an interest/background in networking. Beginning to delve into binary exploitation and reverse engineering.

  • 0 Posts
  • 30 Comments
Joined 1 year ago
Cake day: March 27th, 2024
  • borari@lemmy.dbzer0.comtoProgrammer Humor@programming.dev•The government doesn't use SQL
    41·
    2 months ago

    No. You can have control over specific parameters of an SQL query though. Look up insecure direct object reference vulnerabilities.

    Consider a website that uses the following URL to access the customer account page, by retrieving information from the back-end database: https://insecure-website.com/customer_account?customer_number=132355 Here, the customer number is used directly as a record index in queries that are performed on the back-end database. If no other controls are in place, an attacker can simply modify the customer_number value, bypassing access controls to view the records of other customers.

  • borari@lemmy.dbzer0.comtocybersecurity@infosec.pub•What are You Working on Wednesday
    1·
    2 months ago

    My coworker was having difficulty starting and is trying to commit to finding at least one hour a day during the week, and that’s been pretty successful for them. My issue is that I get completely consumed by it. Like ignore my family, ignore food, ignore everything, get off work at 5pm and rip offsec until 1am, rinse, repeat, and I’m like enjoying life and other hobbies and stuff right now lol.

    Is there any specific offsec course/cert you’re trying to get going on? I’m super privileged in that my employer pays for the Learn Unlimited, so it’s easier to slack off on the training. When I was self-paying for individual courses it was much easier for me to hold myself accountable because I only had 90 days of lab access, and it was my money on the line.

  • borari@lemmy.dbzer0.comtocybersecurity@infosec.pub•What are You Working on Wednesday
    2·
    2 months ago

    I’m not currently working on anything projects or anything. I’m slowly getting back in to the OffSec training grind. I took a “short break” while working on my OSED over a year ago and am just now hopping back into it. I’ve already got my OSCP/OSEP/OSWE, so really gunning for this OSED for the OSCE^3. It has been extremely difficult to get back into a routine of doing training every day.

  • borari@lemmy.dbzer0.comtoSelfhosted@lemmy.world•What do you host for your finances and why!English
    10·
    4 months ago

    It is pretty easy. There’s tons of tutorials and walkthroughs for doing it, but anyone familiar with UIs will be able to work it out pretty quickly I think. Maybe a friction point in using the filter query, but again there’s tons of walkthroughs and guides for using it online.

    If you can’t conceptualize a packet, or sockets, or network flows, even with the help of online guides/manuals, I guess it wouldn’t be easy. In that case I’d be wondering why someone would want to use those tools in the first place though, as then they probably wouldn’t have the skills necessary to leverage the information gleaned from the tool in any useful way.

    Edit - As we’re in the self-hosted community, I’d argue that anyone who is self-hosting anything would probably be able to easily install wireshark and view http requests, both individual packets and the stream as a whole.

  • borari@lemmy.dbzer0.comtoSelfhosted@lemmy.world•Network SwitchEnglish
    71·
    6 months ago

    You presented one that doesn’t have security vulnerabilities? Here’s yet another CVE out for trendnet: https://nvd.nist.gov/vuln/detail/CVE-2018-19239

    Every. Single. Brand. Has. CVEs. I’ve used Mikrotik, I’ve used Cisco, I’ve used Juniper, I’ve used Ubiquiti. I have a trendnet Poe switch in my attic powering some cameras and an AP right now. I have no “problem” with any brand of anything.

    I do have a problem with you implying that a company doesn’t take security seriously when they do. I start to think you’re intentionally lying when you lift up trendnet as the model, because they have quite an especially atrocious history of it.