32,802 reputation
449122
bio website bishopfox.com
location
age
visits member for 4 years, 6 months
seen 3 hours ago

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


17h
comment Can this text be figured out?
Asymmetric or symmetric?
17h
comment Brute force attack
Consider renaming your post to "Common Security Vulnerability"
2d
comment OAuth access token vs session key
CSRF is not a method of authentication, it is an attack. Consdier reading the OWASP top 10, espically the parts on session managment: (owasp.org/index.php/Session_Management_Cheat_Sheet).
Jul
28
comment How can I defend against malicious GET requests?
What attack are you worried about here? Could you provide more details, I just see a routing table. I think most attackers are more interested in code exec and info disclosure than DoS.
Jul
27
comment what reconnaissance or foot-printing tools for network or web, do you recommend?
subbrute: github.com/TheRook/subbrute
Jul
27
comment Can client-side hashing improve after-the-fact security in response to password leaks?
@Veedrac Google may not use this method for HTTP authentication because the security gain is only in edge cases, and it is fairly complex to do correctly. Zero password proofs are useful, but two-factor authentication protects against a much broader category of attacks. Google Authenticator is a cool service.
Jul
27
revised Can client-side hashing improve after-the-fact security in response to password leaks?
added 71 characters in body
Jul
26
revised Can client-side hashing improve after-the-fact security in response to password leaks?
added 286 characters in body
Jul
26
answered Can client-side hashing improve after-the-fact security in response to password leaks?
Jul
26
comment Is there a way to hack passwords in kali linux without wordlist
When I was 18 I was dropping RCE 0-days. Age Isn't an excuse for not understating web application security or how to write code.
Jul
24
comment Using .apk files to reverse_tcp and exploit on android?
I have no idea what you are asking. Consider reading about common mobile vulenrablites: owasp.org/index.php/Projects/…
Jul
22
awarded  Nice Answer
Jul
21
comment .JPEG File upload shell via EXIF comments
@lynks If the script is dropped into the webroot, then the attacker wouldn't need the include(), it can be executed directly. +1 sounds legit.
Jul
17
awarded  Nice Answer
Jul
8
comment Creating a P2P hosted website
@Jeremy French Yes, the website is free to run JavaScript and use localstorage. A server-side web application would require Tor.
Jul
6
answered Creating a P2P hosted website
Jul
4
revised Techniques for Anti Virus evasion
added 34 characters in body
Jul
2
comment Techniques for Anti Virus evasion
@SilverlightFox oah yeah this post was ooold. updated.
Jul
2
revised Techniques for Anti Virus evasion
deleted 204 characters in body
Jul
1
awarded  Popular Question