29,555 reputation
234105
bio website bishopfox.com
location
age
visits member for 3 years, 9 months
seen 1 hour ago

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


4h
revised How to exploit this include_once vulnerability in PHP?
added 491 characters in body
5h
comment How to exploit this include_once vulnerability in PHP?
@programings That is cool exploit technique for leveraging LFI, but it doesn't apply to this bug. Sad day.
5h
comment How to exploit this include_once vulnerability in PHP?
@jyzuz if one flaw doesn't give you everything, then you need to find another vulnerability that gives you what you need. We call these exploit chains.
5h
revised How to exploit this include_once vulnerability in PHP?
added 102 characters in body
5h
comment How to exploit this include_once vulnerability in PHP?
@jyzuz you will never be able to read PHP code with an LFI, the whole point of the include() function is to execute the PHP code. If your smart, you can get a shell.
6h
answered How to exploit this include_once vulnerability in PHP?
2d
answered Using OAuth 2.0 without token storage
2d
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
+1 this post is so good I deleted mine. Also your right, the ajax method does send cookies... but cookies are only sometimes displayed in the browser's network view. BURP saw the cookies, and BURP's XHR CSRF builder is a good method of delivering CSRF exploits. Thank you for clarifying this for me.
2d
comment Requirment for encryption algorithem to be secure/safe
Hacking is a lot of fun, but security classes tend to ask ridicules questions, and students dump these crap questions on security.se
2d
comment Requirment for encryption algorithem to be secure/safe
@Bob Brown looks like dry homework to me.
Oct
19
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
-1 I don't believe the OPs question anything to do with a strange, non-standards complaint browser, and as far as I can tell this answer nothing to do with exploitation of CSRF. I would take away the -1, but I can't.
Oct
19
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
@SilverlightFox I updated my post to contain more detailed information on why XHRs are simply not useful in exploiting CSRF.
Oct
19
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
@SilverlightFox, aah you are right I was partially mistaken. An XHR needs to have the withCredentials attribute, you need the cookie in order to ride on the session with CSRF. Which is why XHRs are never used in CSRF exploits.
Oct
19
answered Security concerns with iframes
Oct
19
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
@SilverlightFox I'm sorry, but it just doesn't work that way. Prove me wrong, show me a CSRF exploit that you have written that uses an XHR. (This is an impossible task for a modern browser.) If the target has CORS enabled, the the web app has bigger problems than CSRF.
Oct
19
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
@SilverlightFox I should reiterate, XHR can never be used in a CSRF attack because the CORS pre-flight request prevents this attack.
Oct
19
comment Socket.IO Client Security
@mtdevens I think that this: websocket.org/aboutwebsocket.html disagrees... I am pretty sure you need CORS to have a cross-origin WebSocket. Do you have any references?
Oct
18
comment Facebook full IP log
@ekaj Female computer? Now we are talking!
Oct
18
revised Socket.IO Client Security
added 397 characters in body
Oct
18
revised Socket.IO Client Security
added 20 characters in body