30,272 reputation
337108
bio website bishopfox.com
location
age
visits member for 3 years, 11 months
seen 11 hours ago

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Nov
25
comment ASP.NET Web API and potential XSS
@drogon I don't see how the OP's example ie exploitable. Perhaps you should write a Proof-of-Concept exploit to prove me wrong.
Nov
24
comment Why does this CSRF vulnerability work?
No exploit? How did it work?
Nov
19
comment Is $_SERVER[ ] a safe source of data in PHP?
It is customary to accept good answers. You should really choose an answer for this question.
Nov
19
comment _ _ VIEWSTATE to Protect Against CSRF
+1, additionally, this is a double-submit cookie based CSRF token.
Nov
17
awarded  Populist
Nov
13
revised Clarification on OAuth Client Secret
added 83 characters in body
Nov
13
comment Clarification on OAuth Client Secret
This question entirely hinges on something that you left out: How the hell are you using oauth? OAuth strength is that it is versatile.
Nov
13
answered Clarification on OAuth Client Secret
Nov
13
answered Proper way to allow access to systems within different offices?
Nov
12
comment SQL Injection Modify / Insert Table Values
"MySQL Server doesn't support the SELECT ... INTO TABLE Sybase SQL extension. Instead, MySQL Server supports the INSERT INTO ... SELECT". The into table query operator cannot be in the OP's injection.
Nov
12
revised SQL Injection Modify / Insert Table Values
deleted 24 characters in body
Nov
11
revised SQL Injection Modify / Insert Table Values
added 132 characters in body
Nov
11
comment SQL Injection Modify / Insert Table Values
@Abe Miessler Good point, updated.
Nov
11
revised SQL Injection Modify / Insert Table Values
added 170 characters in body
Nov
11
answered SQL Injection Modify / Insert Table Values
Nov
7
comment Is preventing XSS/HTML Injection really this simple?
What language or platform are you using? Usually the templating system you are using has an XSS filter.
Nov
5
revised defend against LOIC Hive Mind attack
added 49 characters in body
Nov
5
revised defend against LOIC Hive Mind attack
added 65 characters in body
Nov
5
revised defend against LOIC Hive Mind attack
added 17 characters in body
Nov
5
answered defend against LOIC Hive Mind attack