32,303 reputation
347118
bio website bishopfox.com
location
age
visits member for 4 years, 4 months
seen May 19 at 20:26

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Apr
1
awarded  Notable Question
Mar
29
comment Is it possible to emulate real network printer i.e. to run some actual firmware in VM?
@André Daniel Dang, I was going to mention QEMU. It is the dev tool of choice for embedded devices that are njon-x86.
Mar
29
comment Why do some people really hate security via client-side?
@Pacerier I'm in my twenties, and I first started releasing exploits when was in my teens.
Mar
19
awarded  Notable Question
Mar
15
comment Google Chrome “Your connection to website is encrypted with obsolete cryptography”
Consider: security.stackexchange.com/questions/76993/…
Mar
14
comment How to create a OSx pen testing environment
A mac? I would install a Linux distro with a good package manager.
Mar
13
awarded  Nice Question
Mar
13
revised OAuth2 Cross Site Request Forgery, and state parameter
deleted 5 characters in body
Mar
11
revised What is the most hardened set of options for GCC compiling C/C++?
deleted 13 characters in body
Mar
1
revised How to safely display html emails like gmail does it?
added 2 characters in body
Mar
1
revised How to safely display html emails like gmail does it?
added 34 characters in body
Mar
1
answered How to safely display html emails like gmail does it?
Feb
24
awarded  Popular Question
Feb
24
revised Cross site scripting and the use of http-only cookies?
added 1 character in body
Feb
23
awarded  Enlightened
Feb
23
awarded  Nice Answer
Feb
18
comment How can I set my server to only accept requests from my own client app? (similar to SSL Client Certificates)
@Daniel Magliola The only one you are fooling with cargo-cult security is yourself.
Feb
18
revised How can I set my server to only accept requests from my own client app? (similar to SSL Client Certificates)
added 147 characters in body
Feb
18
comment Session Authentication vs Token Authentication
@SilverlightFox Interesting, I was not aware of that weakness. Not surprising coming from Microsoft.
Feb
17
answered Using INTO OUTFILE with INSERT