Reputation
268
Top tag
Next privilege 300 Rep.
Create new tags
Badges
2 13
Newest
 Curious
Impact
~7k people reached

Mar
30
accepted What is an example of arithmetic and buffer overflows in a php application?
Mar
22
awarded  Curious
Mar
21
comment What is an example of arithmetic and buffer overflows in a php application?
yep, fixed, thanks.
Mar
21
revised What is an example of arithmetic and buffer overflows in a php application?
typo
Mar
21
asked What is an example of arithmetic and buffer overflows in a php application?
Oct
11
awarded  Notable Question
Sep
2
awarded  Popular Question
Feb
4
answered Drupal SQLi only on login form?
Sep
24
awarded  Autobiographer
Sep
20
awarded  Popular Question
May
1
comment XSS via PDF when Content-Disposition: Inline?
Thanks for your answer. I'm hopeful to get a bit more details about the nature and exposure of the issue so I'm not going to accept this answer just yet.
Apr
30
asked XSS via PDF when Content-Disposition: Inline?
Feb
18
comment Is $_SERVER[ ] a safe source of data in PHP?
Or rather, what specific data types can it contain. AFAIU, they can be either strings or arrays, but not bools nor objects nor ints. This is important because 3v4l.org/vhNTG
Feb
17
comment Is $_SERVER[ ] a safe source of data in PHP?
This talks about controlling the variables, but there are two important and distinct elements of the variables: their content and their data type. Can you clarify if you believe it's possible for a client to set the data type of any of these to anything other than a string?
Feb
14
awarded  Popular Question
Jul
27
awarded  Nice Question
Jul
27
awarded  Yearling
Jul
24
awarded  Informed
Jul
24
accepted Sending HTTP 403 as. 200 - “Silent Identification of Admin”
Jul
23
comment Sending HTTP 403 as. 200 - “Silent Identification of Admin”
I just updated the question - cookies on the site are httponly and secure and the site uses ssl and hsts. I can't really say what the "right" behavior is, but I can say that in my testing that this attack (disclosing information) still works in Chrome and Firefox latest.