27,409 reputation
22892
bio website bishopfox.com
location
age
visits member for 3 years, 3 months
seen Apr 10 at 20:42

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Dec
16
comment How are zero days found?
Every day is full of zero days when you are an avid security researcher.
Dec
16
revised handle user-session-cookie and csrf token correctly for javascript app
added 33 characters in body
Dec
16
comment Getting rid of trojans on Windows XP - the basic toolkit
Re-install. Also XP will no longer receive security updateds in a few months. So that is something to look forward to.
Dec
16
comment Does Skype Trump SSLStrip?
Microsoft is ignoring the RFC's to address SSLStrip, IE contains more known vulnerabilities than any other piece of activity maintained code. The reflective XSS filter is completely and totally non-functional.
Dec
15
revised Hiding Bittorent clients
added 35 characters in body
Dec
14
comment What are the security implications of people downloading addons, wrongly thinking that they are safe?
@Martin Vegter I think there has been one or two cases of malware on addons.mozilla.org... which is a good sign because it means the community is finding and removing malware.
Dec
14
comment What are the security implications of people downloading addons, wrongly thinking that they are safe?
@Martin Vegter downloading a firefox addon that wasn't from addons.mozilla.org
Dec
13
comment File system history on USB drives
@olamotte This is not the role of a filesystem, but an application can use a filesystem to perform this action.
Dec
13
comment Site preventing user from closing tab/closing browser
@Jan Schejbal It is must worse than I expected: bugzilla.mozilla.org/show_bug.cgi?id=636374 . This bug maybe exploitable for a few more years :*(. Looks like I'll be using Chromium more often.
Dec
13
comment Site preventing user from closing tab/closing browser
bugzilla.mozilla.org/show_bug.cgi?id=636374
Dec
12
revised handle user-session-cookie and csrf token correctly for javascript app
added 43 characters in body
Dec
12
answered handle user-session-cookie and csrf token correctly for javascript app
Dec
12
revised How does SSLstrip work?
added 103 characters in body
Dec
12
revised Backup personal email on VPS - privacy, security and trust risks
added 16 characters in body
Dec
12
revised Backup personal email on VPS - privacy, security and trust risks
added 151 characters in body
Dec
12
revised Backup personal email on VPS - privacy, security and trust risks
added 151 characters in body
Dec
12
revised Backup personal email on VPS - privacy, security and trust risks
added 1070 characters in body
Dec
12
answered Backup personal email on VPS - privacy, security and trust risks
Dec
11
comment What is best method for retest blind sql vulnerability
What DBMS is your target using?
Dec
11
comment what is mXSS? anyone knows?
"Mario-XSS" hah, JS. Mario is a freakin' bad ass, solid research from that guy.