30,044 reputation
336107
bio website bishopfox.com
location
age
visits member for 3 years, 10 months
seen 20 mins ago

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Nov
7
comment Is preventing XSS/HTML Injection really this simple?
What language or platform are you using? Usually the templating system you are using has an XSS filter.
Nov
5
revised defend against LOIC Hive Mind attack
added 49 characters in body
Nov
5
revised defend against LOIC Hive Mind attack
added 65 characters in body
Nov
5
revised defend against LOIC Hive Mind attack
added 17 characters in body
Nov
5
answered defend against LOIC Hive Mind attack
Nov
3
revised Intercepting SSL traffic on Android app
added 109 characters in body
Nov
3
comment Are GET parameters secure over https?
@threeFourOneSixOneThree OP never stated the webserver used, updated for the general case.
Nov
3
revised Are GET parameters secure over https?
added 201 characters in body
Nov
2
revised Intercepting SSL traffic on Android app
added 9 characters in body
Nov
2
answered Intercepting SSL traffic on Android app
Nov
1
revised CSP Reports: Ignoring Client Malware
deleted 6 characters in body
Nov
1
comment CSP Reports: Ignoring Client Malware
There are so many qeustions posted to Security.se "I'm having all these strage log entries", but then they never post the logs. I feel like most people treat hackers like magic. It as if these OPs expect us to say: "Oah yeah, let me just root your box and copy over those log files..."
Nov
1
answered CSP Reports: Ignoring Client Malware
Nov
1
comment Bypass Full ASLR+DEP exploit mitigation
@JDeff totally fair, who the hell named this crap?
Nov
1
revised Bypass Full ASLR+DEP exploit mitigation
added 40 characters in body
Nov
1
comment Bypass Full ASLR+DEP exploit mitigation
@JDeff The text segment, which is also called the code segment contains all of the application's functionality that isn't included by DLLs. In most application there should be a wealth of ROP gadgets available. The trick if finding the ones you need.
Nov
1
answered Bypass Full ASLR+DEP exploit mitigation
Oct
31
comment Is it fundamentally possible to validate that an unmodified version of your client connects to your server?
Your application is a guest on the attacker's machine, and guests need to follow the rules. The attacker makes all of these rules.
Oct
31
comment Is it fundamentally possible to validate that an unmodified version of your client connects to your server?
If you think that validating the client is the solution, then you are asking the wrong question.
Oct
31
revised Is there a secure way to share sessions in the same server with different sub domains?
added 3 characters in body