3,323 reputation
926
bio website blog.kotowicz.net
location Poland
age 34
visits member for 3 years, 4 months
seen Mar 22 at 17:07

Web security researcher specialized in discovery and exploitation of HTML5 vulnerabilities. Author of a few recognized HTML5/UI redressing attack vectors.

Solid web application development background in creating secure e-commerce systems, intranet and social networking applications.

Contributes to various open-source projects and also develops his own open-source solutions (just google "ohloh koto").

Speaker at IT security conferences, OWASP and Tech Krakspot meetings.


Jun
14
awarded  Nice Answer
Apr
5
awarded  Nice Answer
Apr
1
awarded  Yearling
Sep
11
awarded  Necromancer
Apr
1
awarded  Yearling
Oct
19
answered How to exploit DRUPAL-SA-CORE-2012-003
Sep
12
comment CRIME - How to beat the BEAST successor?
@CodesInChaos that's my guess too. The PoC was created in a few hours, just to check if the idea is sound.
Sep
12
awarded  Nice Answer
Sep
11
revised CRIME - How to beat the BEAST successor?
upgraded the algorithm
Sep
11
answered CRIME - How to beat the BEAST successor?
Aug
20
awarded  Caucus
Jun
25
awarded  Enlightened
Jun
25
awarded  Nice Answer
Jun
19
comment Is it safe to use leakedin.org?
@JeremyThompson the pass->hash calculation was done client side, in Javascript. Then the server checked the submitted hash.
Jun
19
comment Why doesn't the same origin policy block get requests what contain arguments?
Minor correction: SOP prevents scripts from reading content from a location that the script is running at (i.e. the address of the web page that loads the script).
Jun
8
awarded  Constituent
Jun
8
awarded  Caucus
May
4
answered HTML payload rewriting?
Apr
1
awarded  Yearling
Mar
22
awarded  Nice Answer