27,409 reputation
22892
bio website bishopfox.com
location
age
visits member for 3 years, 3 months
seen Apr 10 at 20:42

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Dec
25
answered How should we announce vulnerabilities in our application?
Dec
22
revised ASP.NET Web API and potential XSS
added 63 characters in body
Dec
21
revised ASP.NET Web API and potential XSS
added 65 characters in body
Dec
21
comment Any eventhandlers that apply to hidden elements?
@Sajjad Pourali aah good call, I didn't test that exploit on the latest version of Opera.
Dec
21
revised Any eventhandlers that apply to hidden elements?
deleted 103 characters in body
Dec
20
answered Any eventhandlers that apply to hidden elements?
Dec
20
revised ASP.NET Web API and potential XSS
added 204 characters in body
Dec
20
answered ASP.NET Web API and potential XSS
Dec
20
reviewed Approve suggested edit on Any eventhandlers that apply to hidden elements?
Dec
20
revised Can too much web searching be a danger to a security professional?
added 37 characters in body
Dec
19
answered How does the stack cookie protect return address from being overwrite
Dec
18
comment Would siloing passwords into their own locked down schema improve security?
@Andrew Hoffman that is a great example of violating the principle of least privilege access.
Dec
18
revised Would siloing passwords into their own locked down schema improve security?
added 122 characters in body
Dec
18
answered Would siloing passwords into their own locked down schema improve security?
Dec
17
revised Is Django's built-in CSRF protection enough?
added 13 characters in body
Dec
17
revised Is Django's built-in CSRF protection enough?
added 126 characters in body
Dec
17
answered Is Django's built-in CSRF protection enough?
Dec
17
comment Is it safe to use PBKDF2 for hashing?
PBKDF2 cannot be efficiently implemented on a GPU because of the XOR operation performed between each iteration of the hash function.
Dec
17
comment Microsoft IIS Express
Perhaps you should ask your manager.
Dec
17
comment Protecting sensitive content in JS source code and Ajax cals
It is unclear why HTTPS is not sufficient.