27,469 reputation
22892
bio website bishopfox.com
location
age
visits member for 3 years, 3 months
seen 16 hours ago

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Jan
7
awarded  Yearling
Jan
4
awarded  Notable Question
Dec
31
answered Missing Secure Attribute in Encrypted Session (SSL) Cookie Recheck
Dec
31
comment Identify users accessing hidden link in a website
@TestRunner i don't think you have provided enough information to assess that. But you are probably being attacked right now, like everyone else.
Dec
30
revised Cross site Scripting in HTTP Method?
added 3 characters in body
Dec
30
revised Cross site Scripting in HTTP Method?
added 10 characters in body
Dec
30
revised Identify users accessing hidden link in a website
added 1 characters in body
Dec
30
revised Cross site Scripting in HTTP Method?
added 218 characters in body
Dec
30
answered Cross site Scripting in HTTP Method?
Dec
30
answered Identify users accessing hidden link in a website
Dec
30
comment Are cross site scripting attacks and sql injection a good topic for my thesis?
This is a poor choice for a thesis topic because these attacks are so well understood and it is a difficult topic to expand upon. I would find a less popular topic.
Dec
30
answered Detection of function hooking in iOS
Dec
27
comment False positive Apache version in scanner results on Centos
@Michael but can you prove that this isn't a vulnerable version? CentOS has never impressed me...
Dec
27
answered False positive Apache version in scanner results on Centos
Dec
27
comment Can non-https assets be tampered with?
@CodesInChaos This is like cleaning your dishes, and then right before you serve the meal you go around smearing feces on every dish.
Dec
27
comment XSS Vector Without Forward Slashes or Spaces
look at the IE xss filter bypasses by whitehat.
Dec
26
comment What hacking risks a site has if it has no input boxes?
"input boxes" as the source of all vulnerabilities... I have never herd this before and will never hear this again.
Dec
26
revised How should we announce vulnerabilities in our application?
added 95 characters in body
Dec
25
comment Authencity of information displayed on an untrusted device
I don't understand the threat model here, what is wrong with the bluetooth pairing system?
Dec
25
revised How should we announce vulnerabilities in our application?
deleted 8 characters in body; edited title