Reputation
33,250
Next tag badge:
94/100 score
25/20 answers
Badges
4 49 124
Newest
 Nice Answer
Impact
~1.7m people reached

Jul
22
awarded  Nice Answer
Jul
21
comment .JPEG File upload shell via EXIF comments
@lynks If the script is dropped into the webroot, then the attacker wouldn't need the include(), it can be executed directly. +1 sounds legit.
Jul
17
awarded  Nice Answer
Jul
8
comment Creating a P2P hosted website
@Jeremy French Yes, the website is free to run JavaScript and use localstorage. A server-side web application would require Tor.
Jul
6
answered Creating a P2P hosted website
Jul
4
revised Techniques for Anti Virus evasion
added 34 characters in body
Jul
2
comment Techniques for Anti Virus evasion
@SilverlightFox oah yeah this post was ooold. updated.
Jul
2
revised Techniques for Anti Virus evasion
deleted 204 characters in body
Jul
1
awarded  Popular Question
Jun
24
comment My Virgin Media account password is visible in plaintext to call center staff. What do I do?
What a noob mistake, you should report them: plaintextoffenders.com
Jun
17
awarded  Good Question
Jun
14
awarded  Enlightened
Jun
14
awarded  Nice Answer
Jun
4
comment Is it possible to do HTTP header injection if CR/LF are stripped?
@immibis yeah \n works alone for all servers/clients in common use. More broadly every CRLF delimited protocol will usually just accept a LF as a delimiter. Don't take my word for it, load up netcat and try it for yourself.
May
28
awarded  Famous Question
May
18
awarded  Good Answer
May
15
awarded  Popular Question
May
8
comment Are phone calls on a GSM network encrypted?
@Andreas Florath Yes, and the A5/1 stream cipher and its key scheduling is a total joke. GSM is one of the most obvious backdoors (well lit frontdoor?) that anyone can access for under $1,000.
May
1
comment Why refresh CSRF token per form request?
@Domi It depends how they got the token in the first place. If it with XSS, or over an insecure channel, the a rolling token wouldn't matter.
Apr
30
comment How can two clicks lead to better security in the context of, e.g., Twitter and Facebook share buttons?
@Bleeding Fingers The NSA is also troubled by this side-effect, which is why they want to backdoor everything, and even collect stats from webbugs.