30,074 reputation
336107
bio website bishopfox.com
location
age
visits member for 3 years, 10 months
seen 6 mins ago

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Oct
29
comment CSRF Token Strategy
No csrf exploit?
Oct
29
revised CSRF Token Strategy
deleted 22 characters in body
Oct
29
comment CSRF Token Strategy
@gr8dane the SOP holds the fundamental answer to your question. Also, your example form is the definition of IDOR, that can't be ignored. You can't pass a user ID as a $_GET, it must be apart of the $_SESSION. The CSRF token is a $_SESSION variable, that is compared to a $_GET or $_POST variable, which creates a CSRF-synchronization token. This is a secret that the attacker cannot know, because of the SOP.
Oct
28
awarded  Enlightened
Oct
28
awarded  Nice Answer
Oct
28
revised CSRF Token Strategy
added 256 characters in body
Oct
28
answered CSRF Token Strategy
Oct
28
comment Where does /dev/random get its entropy?
I recommend reading random.c, it has more code comments than actual code. Second-hand information will be less informative than just looking at the source.
Oct
28
comment Difference Between MD4 and MD5 encryption
I wish we had a double-bold, and 24 point font for the 'not encryption algorithms'
Oct
28
comment SQL injection with single statement query
@Cory Carter If you are in a select, it is only a select. Subselect can be used to access other tables when injecting into a delete/update/insert. File IO should work within a select.
Oct
28
awarded  Nice Answer
Oct
27
awarded  Good Answer
Oct
23
comment SQL injection with single statement query
@Gumbo I updated my answer to link to the C client bindings that permit multiple queries for MySQL. This is not PHP related.
Oct
23
revised SQL injection with single statement query
added 19 characters in body
Oct
23
comment SQL injection with single statement query
@Gumbo or oracle, or postgresl, or HSQLDB, or really anything other than MS-SQL and SQLite. I find Query stacking doesn't work in 90-95% of pentests. I don't do PHP/MySQL very often, the op is using MySQL.
Oct
23
answered SQL injection with single statement query
Oct
22
revised How to exploit this include_once vulnerability in PHP?
added 491 characters in body
Oct
22
comment How to exploit this include_once vulnerability in PHP?
@programings That is cool exploit technique for leveraging LFI, but it doesn't apply to this bug. Sad day.
Oct
22
comment How to exploit this include_once vulnerability in PHP?
@jyzuz if one flaw doesn't give you everything, then you need to find another vulnerability that gives you what you need. We call these exploit chains.
Oct
22
revised How to exploit this include_once vulnerability in PHP?
added 102 characters in body