28,345 reputation
23299
bio website bishopfox.com
location
age
visits member for 3 years, 7 months
seen Aug 16 at 19:25

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Dec
30
revised Cross site Scripting in HTTP Method?
added 218 characters in body
Dec
30
answered Cross site Scripting in HTTP Method?
Dec
30
answered Identify users accessing hidden link in a website
Dec
30
comment Are cross site scripting attacks and sql injection a good topic for my thesis?
This is a poor choice for a thesis topic because these attacks are so well understood and it is a difficult topic to expand upon. I would find a less popular topic.
Dec
30
answered Detection of function hooking in iOS
Dec
27
comment False positive Apache version in scanner results on Centos
@Michael but can you prove that this isn't a vulnerable version? CentOS has never impressed me...
Dec
27
answered False positive Apache version in scanner results on Centos
Dec
27
comment Can non-https assets be tampered with?
@CodesInChaos This is like cleaning your dishes, and then right before you serve the meal you go around smearing feces on every dish.
Dec
27
comment XSS Vector Without Forward Slashes or Spaces
look at the IE xss filter bypasses by whitehat.
Dec
26
comment What hacking risks a site has if it has no input boxes?
"input boxes" as the source of all vulnerabilities... I have never herd this before and will never hear this again.
Dec
26
revised How should we announce vulnerabilities in our application?
added 95 characters in body
Dec
25
comment Authencity of information displayed on an untrusted device
I don't understand the threat model here, what is wrong with the bluetooth pairing system?
Dec
25
revised How should we announce vulnerabilities in our application?
deleted 8 characters in body; edited title
Dec
25
answered How should we announce vulnerabilities in our application?
Dec
22
revised ASP.NET Web API and potential XSS
added 63 characters in body
Dec
21
revised ASP.NET Web API and potential XSS
added 65 characters in body
Dec
21
comment Any eventhandlers that apply to hidden elements?
@Sajjad Pourali aah good call, I didn't test that exploit on the latest version of Opera.
Dec
21
revised Any eventhandlers that apply to hidden elements?
deleted 103 characters in body
Dec
20
answered Any eventhandlers that apply to hidden elements?
Dec
20
revised ASP.NET Web API and potential XSS
added 204 characters in body