30,074 reputation
336107
bio website bishopfox.com
location
age
visits member for 3 years, 10 months
seen 13 hours ago

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Nov
12
comment SQL Injection Modify / Insert Table Values
"MySQL Server doesn't support the SELECT ... INTO TABLE Sybase SQL extension. Instead, MySQL Server supports the INSERT INTO ... SELECT". The into table query operator cannot be in the OP's injection.
Nov
12
revised SQL Injection Modify / Insert Table Values
deleted 24 characters in body
Nov
11
revised SQL Injection Modify / Insert Table Values
added 132 characters in body
Nov
11
comment SQL Injection Modify / Insert Table Values
@Abe Miessler Good point, updated.
Nov
11
revised SQL Injection Modify / Insert Table Values
added 170 characters in body
Nov
11
answered SQL Injection Modify / Insert Table Values
Nov
8
comment Is this XSS filter i.e <[space][0-9a-z]/> can be bypassed?
Have you looked at the OWASP XSS filter evasion cheat sheet? I am 100% positive that this half-baked regex is trivial to bypass.
Nov
7
comment Is preventing XSS/HTML Injection really this simple?
What language or platform are you using? Usually the templating system you are using has an XSS filter.
Nov
5
revised defend against LOIC Hive Mind attack
added 49 characters in body
Nov
5
revised defend against LOIC Hive Mind attack
added 65 characters in body
Nov
5
revised defend against LOIC Hive Mind attack
added 17 characters in body
Nov
5
answered defend against LOIC Hive Mind attack
Nov
3
revised Intercepting SSL traffic on Android app
added 109 characters in body
Nov
3
comment Are GET parameters secure over https?
@threeFourOneSixOneThree OP never stated the webserver used, updated for the general case.
Nov
3
revised Are GET parameters secure over https?
added 201 characters in body
Nov
2
revised Intercepting SSL traffic on Android app
added 9 characters in body
Nov
2
answered Intercepting SSL traffic on Android app
Nov
1
revised CSP Reports: Ignoring Client Malware
deleted 6 characters in body
Nov
1
comment CSP Reports: Ignoring Client Malware
There are so many qeustions posted to Security.se "I'm having all these strage log entries", but then they never post the logs. I feel like most people treat hackers like magic. It as if these OPs expect us to say: "Oah yeah, let me just root your box and copy over those log files..."
Nov
1
answered CSP Reports: Ignoring Client Malware