28,345 reputation
23299
bio website bishopfox.com
location
age
visits member for 3 years, 7 months
seen Aug 16 at 19:25

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Jan
30
comment Session id on page html source code
I guess you have never heard of "defense in depth."
Jan
27
revised Escaping rich text editor output
edited body
Jan
27
revised Escaping rich text editor output
added 5 characters in body
Jan
27
comment Building a web application security focused team
IMO, if a person can't write exploit code they have no business being in this team. Make sure they understand post-exploitation. When we are recruiting this is an area that we focus on, and most recruits fail in understanding why vulnerabilities are valuable to a hacker. Sure they can find some vulnerabilities, but that isn't enough to keep you from getting hacked.
Jan
27
answered Possible ways of exploiting PHP register_globals
Jan
26
revised Escaping rich text editor output
added 34 characters in body
Jan
25
answered Escaping rich text editor output
Jan
23
comment Can isolated forms be dangerous for my server security?
Read the OWASP top 10.
Jan
21
comment What kind of virus attack is this? And what do I do now?
You have provided no useful information, all anyone can tell you is that the "the attack" resulted in remote code execution. Probably started from timthumb or just neglecting basic security practices like UPDATES, and now your website is backdoored all to hell and re-sold on the blackmarket. Enjoy!
Jan
20
awarded  web-browser
Jan
16
revised Valid Characters For Magnetic stripe
deleted 16 characters in body
Jan
16
comment Valid Characters For Magnetic stripe
@PsychoData I stand by my answer, bits can be cast as any datatype. Without the OP providing his use, then the general case fits best.
Jan
16
answered Valid Characters For Magnetic stripe
Jan
7
awarded  Yearling
Jan
4
awarded  Notable Question
Dec
31
answered Missing Secure Attribute in Encrypted Session (SSL) Cookie Recheck
Dec
31
comment Identify users accessing hidden link in a website
@TestRunner i don't think you have provided enough information to assess that. But you are probably being attacked right now, like everyone else.
Dec
30
revised Cross site Scripting in HTTP Method?
added 3 characters in body
Dec
30
revised Cross site Scripting in HTTP Method?
added 10 characters in body
Dec
30
revised Identify users accessing hidden link in a website
added 1 characters in body