32,313 reputation
347118
bio website bishopfox.com
location
age
visits member for 4 years, 4 months
seen 1 hour ago

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Jan
20
answered How to communicate securely
Jan
20
comment Vulnerable XSS Test
What about xssed.com?
Jan
19
comment Are open redirects a security concern?
@Pacerier URL shorteners are sometimes used in phishing attacks, but having a URL like paypal.com or chase.com would be more valuable.
Jan
19
comment why application/json content type have csrf token?
crossdomain.xml can only undermine CSRF protections. I don't think checking the content-type is a valid from of CSRF prevention.
Jan
19
comment What are HSTS Super Cookies?
HSTS has nothing to do with cookies. Do you have a source?
Jan
18
comment Kaminsky Bug DNS Cache Poisoning
Old DNS bug is old.
Jan
12
revised Acquiring remote forensic image from EC2 instance
added 42 characters in body
Jan
12
answered Acquiring remote forensic image from EC2 instance
Jan
12
comment Run a uploaded file with a double extension?
The "double-extension" attack works against Apache when the first extension isn't listed in the /etc/mime.types file, then it will fallback on the 2nd extension. Voting to close.
Jan
12
revised Is there a strong protection against CSRF executed from the sames server via stored XSS?
added 276 characters in body
Jan
12
answered Is there a strong protection against CSRF executed from the sames server via stored XSS?
Jan
10
comment What are the security issues of open ports?
The port the application uses to connect to it's database must never be exposed to an attacker, and it is vital for the application to function.
Jan
10
awarded  Enlightened
Jan
9
awarded  Nice Answer
Jan
9
answered What are the security issues of open ports?
Jan
9
comment Javascript and jQuery not secure over https
Have you considered using HTTP-Strict-Transport-Security (HSTS)?
Jan
7
awarded  Yearling
Jan
7
comment Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?
This is exactly what I was looking for. Good job, I like the updates.
Jan
7
accepted Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?
Jan
6
comment Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?
@CodesInChaos That is a good point, and it is not feasible to generate a second-pre-image in the relatively short lifespan of an HTTPS connection, it is just not the right type of bug... Unfortunately, this question is more geared towards the financial world where there are strict interpretations of what it means to be secure.