28,345 reputation
23299
bio website bishopfox.com
location
age
visits member for 3 years, 7 months
seen Aug 16 at 19:25

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Aug
25
awarded  Nice Answer
Aug
19
awarded  Enlightened
Aug
19
awarded  Nice Answer
Jul
30
comment Comparsion Between AppArmor and Selinux
@Steve DL SE Linux is so complex its impossible for even the developers to verify*
Jul
7
awarded  Nice Answer
Jul
2
awarded  Curious
Jul
1
awarded  Nice Answer
Jun
29
awarded  Nice Answer
Jun
9
comment Chrome vs Explorer - how to explain in plain words that open-source is better?
@Dan both Crome and IE have reflective XSS filters that must be bypassed in order for an reflective XSS vulnerability to be of any use to an attacker.
Jun
6
awarded  Generalist
Jun
5
awarded  Notable Question
Jun
1
awarded  Nice Answer
May
21
awarded  Notable Question
Mar
21
awarded  Good Question
Mar
12
revised Does truncating the cryptographic hash make it impossible to crack?
deleted 5 characters in body
Mar
3
awarded  Good Question
Feb
18
awarded  Good Answer
Feb
14
comment xp_cmdshell: should it ever be used?
@spaghettidba I am dead serious, as a pentester xp_cmdshell() is a god send. What makes it so bad is that no one at Microsoft even thinks to fix this issue. I'm very happy to encounter Microsoft products and applications built on the Microsoft platform because they are weak. Fun fact, my first 0-day was in a Microsoft security product when I was 16, which was more than a decade ago.
Jan
30
comment Session id on page html source code
+1 You cant use HTTPONly if you write the session id to the page. If the session id is in the URL you will print it out to paper if you print one of the pages!
Jan
30
comment Session id on page html source code
You can bind a cookie to a specific path /php, and /node_js. So you can still use the Secure and HTTPOnly cookie directives, and have a secure session handler.