28,315 reputation
23299
bio website bishopfox.com
location
age
visits member for 3 years, 7 months
seen Aug 16 at 19:25

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Dec
13
comment File system history on USB drives
@olamotte This is not the role of a filesystem, but an application can use a filesystem to perform this action.
Dec
13
comment Site preventing user from closing tab/closing browser
@Jan Schejbal It is must worse than I expected: bugzilla.mozilla.org/show_bug.cgi?id=636374 . This bug maybe exploitable for a few more years :*(. Looks like I'll be using Chromium more often.
Dec
13
comment Site preventing user from closing tab/closing browser
bugzilla.mozilla.org/show_bug.cgi?id=636374
Dec
12
revised handle user-session-cookie and csrf token correctly for javascript app
added 43 characters in body
Dec
12
answered handle user-session-cookie and csrf token correctly for javascript app
Dec
12
revised How does SSLstrip work?
added 103 characters in body
Dec
12
revised Backup personal email on VPS - privacy, security and trust risks
added 16 characters in body
Dec
12
revised Backup personal email on VPS - privacy, security and trust risks
added 151 characters in body
Dec
12
revised Backup personal email on VPS - privacy, security and trust risks
added 151 characters in body
Dec
12
revised Backup personal email on VPS - privacy, security and trust risks
added 1070 characters in body
Dec
12
answered Backup personal email on VPS - privacy, security and trust risks
Dec
11
comment What is best method for retest blind sql vulnerability
What DBMS is your target using?
Dec
11
comment what is mXSS? anyone knows?
"Mario-XSS" hah, JS. Mario is a freakin' bad ass, solid research from that guy.
Dec
11
awarded  Popular Question
Dec
11
comment XSS when <, > and " are escaped
I believe this is well documented.
Dec
10
revised Why is activex said to be insecure?
added 58 characters in body
Dec
10
revised Why is activex said to be insecure?
added 10 characters in body
Dec
10
answered Why is activex said to be insecure?
Dec
10
comment How to retrieve the admin's password of a webapp?
Sounds like a challenge, and if you can't pass the challenge, then it looks like this test did its job.
Dec
10
awarded  Popular Question