31,487 reputation
343114
bio website bishopfox.com
location
age
visits member for 4 years, 2 months
seen 2 hours ago

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Mar
19
awarded  Notable Question
Mar
15
comment Google Chrome “Your connection to website is encrypted with obsolete cryptography”
Consider: security.stackexchange.com/questions/76993/…
Mar
14
comment How to create a OSx pen testing environment
A mac? I would install a Linux distro with a good package manager.
Mar
13
awarded  Nice Question
Mar
13
revised OAuth2 Cross Site Request Forgery, and state parameter
deleted 5 characters in body
Mar
11
revised What is the most hardened set of options for GCC compiling C/C++?
deleted 13 characters in body
Mar
1
revised How to safely display html emails like gmail does it?
added 2 characters in body
Mar
1
revised How to safely display html emails like gmail does it?
added 34 characters in body
Mar
1
answered How to safely display html emails like gmail does it?
Feb
24
awarded  Popular Question
Feb
24
revised Cross site scripting and the use of http-only cookies?
added 1 character in body
Feb
23
awarded  Enlightened
Feb
23
awarded  Nice Answer
Feb
18
comment How can I set my server to only accept requests from my own client app? (similar to SSL Client Certificates)
@Daniel Magliola The only one you are fooling with cargo-cult security is yourself.
Feb
18
revised How can I set my server to only accept requests from my own client app? (similar to SSL Client Certificates)
added 147 characters in body
Feb
18
comment Session Authentication vs Token Authentication
@SilverlightFox Interesting, I was not aware of that weakness. Not surprising coming from Microsoft.
Feb
17
answered Using INTO OUTFILE with INSERT
Feb
17
comment Using INTO OUTFILE with INSERT
@Mints97 did you even try this? Sub-selct doesn't allow into outfile.
Feb
17
comment How can I set my server to only accept requests from my own client app? (similar to SSL Client Certificates)
SSL was deprecated over a decade ago, I sure hope you aren't using SSL. TLSv1 or later is the only acceptable secure transport layer.
Feb
17
answered How can I set my server to only accept requests from my own client app? (similar to SSL Client Certificates)