32,559 reputation
449120
bio website bishopfox.com
location
age
visits member for 4 years, 6 months
seen 2 hours ago

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


2h
comment Creating a P2P hosted website
@Jeremy French Yes, the website is free to run JavaScript and use localstorage. A server-side web application would require Tor.
1d
answered Creating a P2P hosted website
Jul
4
revised Techniques for Anti Virus evasion
added 34 characters in body
Jul
2
comment Techniques for Anti Virus evasion
@SilverlightFox oah yeah this post was ooold. updated.
Jul
2
revised Techniques for Anti Virus evasion
deleted 204 characters in body
Jul
1
awarded  Popular Question
Jun
24
comment My Virgin Media account password is visible in plaintext to call center staff. What do I do?
What a noob mistake, you should report them: plaintextoffenders.com
Jun
17
awarded  Good Question
Jun
14
awarded  Enlightened
Jun
14
awarded  Nice Answer
Jun
4
comment Is it possible to do HTTP header injection if CR/LF are stripped?
@immibis yeah \n works alone for all servers/clients in common use. More broadly every CRLF delimited protocol will usually just accept a LF as a delimiter. Don't take my word for it, load up netcat and try it for yourself.
May
28
awarded  Famous Question
May
18
awarded  Good Answer
May
15
awarded  Popular Question
May
8
comment Are phone calls on a GSM network encrypted?
@Andreas Florath Yes, and the A5/1 stream cipher and its key scheduling is a total joke. GSM is one of the most obvious backdoors (well lit frontdoor?) that anyone can access for under $1,000.
May
1
comment Why refresh CSRF token per form request?
@Domi It depends how they got the token in the first place. If it with XSS, or over an insecure channel, the a rolling token wouldn't matter.
Apr
30
comment How can two clicks lead to better security in the context of, e.g., Twitter and Facebook share buttons?
@Bleeding Fingers The NSA is also troubled by this side-effect, which is why they want to backdoor everything, and even collect stats from webbugs.
Apr
30
comment How can two clicks lead to better security in the context of, e.g., Twitter and Facebook share buttons?
Was this question answered?
Apr
29
revised How can two clicks lead to better security in the context of, e.g., Twitter and Facebook share buttons?
added 122 characters in body
Apr
28
awarded  Revival