28,589 reputation
232100
bio website bishopfox.com
location
age
visits member for 3 years, 8 months
seen 6 hours ago

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


2d
answered Extremely suspicious UDP network traffic when idle
Sep
16
comment Encrypting/decrypting our license key
consider reading: stackoverflow.com/questions/3002067/…
Sep
15
comment Imitation Gmail account created - what's the threat?
@Shaul oah ok, well then I'm not interested unless I can see the technical details.
Sep
15
revised How should I mitigate the XSS vulnerabilities in KnockoutJS described at mustache-security?
added 9 characters in body
Sep
15
answered How should I mitigate the XSS vulnerabilities in KnockoutJS described at mustache-security?
Sep
15
comment Imitation Gmail account created - what's the threat?
The OP should make the full SMTP headers available. Go into the email, and then "show original" from the message's drop-down.
Sep
15
revised How can document.referrer be used for XSS?
added 108 characters in body
Sep
15
answered How can document.referrer be used for XSS?
Sep
15
comment Implication in canaries that places a null
I think asking homework questions is against the rules.
Sep
14
revised Security concept for Android app with PHP based REST API
deleted 36 characters in body
Sep
14
revised Security concept for Android app with PHP based REST API
deleted 9 characters in body
Sep
14
answered Security concept for Android app with PHP based REST API
Sep
14
revised OAuth - Why exchange the authcode for a token
added 33 characters in body
Sep
14
comment How To Patch LFI Vulnerability
The code is difficult to read, consider using the code formatting tool.
Sep
14
answered OAuth - Why exchange the authcode for a token
Sep
13
comment Tiny USB sticks
The machine that has the bitcoin wallet needs to be connected to the intent. You can give someone a QR code and then expect payment without violating the air gap.
Sep
13
comment How to find Database attack in my site?
maybe this will help: owasp.org/index.php/SQL_Injection
Sep
13
comment drupal external authentication - how to handle password?
This design is insecure (CWE-257). We have already solved this problem and we call it OAuth.
Sep
13
revised Why should I use ROP for exploit dev?
added 51 characters in body
Sep
13
comment Why should I use ROP for exploit dev?
Based on technical mistakes in this post, I don't think you will be able to grasp this concept until you spend a few thousand hours using a debugger and writing C and ASM.