32,554 reputation
449120
bio website bishopfox.com
location
age
visits member for 4 years, 6 months
seen 3 hours ago

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Apr
16
comment Why doesn't the same origin policy block get requests that contain arguments?
It depends on the XHR. But yes for the purposes of CSRF, you should assume that the client can send arbitrary requests, and that the response may be sent by the server, but not visible to the attacker.
Apr
14
awarded  Notable Question
Apr
12
revised (httpd log files) What kind of attack is? How can I prevent it?
deleted 1 character in body
Apr
12
answered (httpd log files) What kind of attack is? How can I prevent it?
Apr
7
awarded  Nice Answer
Apr
6
comment Why do some people really hate security via client-side?
@Pacerier I am a penetration tester, I study how software is built and how it fails.
Apr
5
comment Why do some people really hate security via client-side?
@Pacerier In my mind, hacker is just a title earned by a highly skilled engineer. No programmer wants to write insecure code, and in order to be a successful penetration tester you have to understand how the application works better than the engineers who wrote it. Studying compsci and understand the theories behind application design is just the first step.
Apr
3
awarded  Enlightened
Apr
2
awarded  Revival
Apr
1
awarded  Notable Question
Mar
29
comment Is it possible to emulate real network printer i.e. to run some actual firmware in VM?
@André Daniel Dang, I was going to mention QEMU. It is the dev tool of choice for embedded devices that are njon-x86.
Mar
29
comment Why do some people really hate security via client-side?
@Pacerier I'm in my twenties, and I first started releasing exploits when was in my teens.
Mar
19
awarded  Notable Question
Mar
15
comment Google Chrome “Your connection to website is encrypted with obsolete cryptography”
Consider: security.stackexchange.com/questions/76993/…
Mar
14
comment How to create a OSx pen testing environment
A mac? I would install a Linux distro with a good package manager.
Mar
13
awarded  Nice Question
Mar
13
revised OAuth2 Cross Site Request Forgery, and state parameter
deleted 5 characters in body
Mar
11
revised What is the most hardened set of options for GCC compiling C/C++?
deleted 13 characters in body
Mar
1
revised How to safely display html emails like gmail does it?
added 2 characters in body
Mar
1
revised How to safely display html emails like gmail does it?
added 34 characters in body