31,815 reputation
346116
bio website bishopfox.com
location
age
visits member for 4 years, 3 months
seen 2 days ago

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Jan
12
answered Is there a strong protection against CSRF executed from the sames server via stored XSS?
Jan
10
comment What are the security issues of open ports?
The port the application uses to connect to it's database must never be exposed to an attacker, and it is vital for the application to function.
Jan
10
awarded  Enlightened
Jan
9
awarded  Nice Answer
Jan
9
answered What are the security issues of open ports?
Jan
9
comment Javascript and jQuery not secure over https
Have you considered using HTTP-Strict-Transport-Security (HSTS)?
Jan
7
awarded  Yearling
Jan
7
comment Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?
This is exactly what I was looking for. Good job, I like the updates.
Jan
7
accepted Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?
Jan
6
comment Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?
@CodesInChaos That is a good point, and it is not feasible to generate a second-pre-image in the relatively short lifespan of an HTTPS connection, it is just not the right type of bug... Unfortunately, this question is more geared towards the financial world where there are strict interpretations of what it means to be secure.
Jan
6
awarded  Revival
Dec
30
comment Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?
This is the best answer so far. SHA1 is still a NIST approved algorithm, but should we be using it? Ideal is not so much keysize, but does the protocol suffer some non-trivial attack? SHA1 suffers from a non-trivial attack.
Dec
28
comment Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?
Some of the ciphers listed for "Modern compatibility" rely upon broken primitives.
Dec
28
revised Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?
edited body
Dec
28
asked Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?
Dec
26
comment Could a compromised WP database cause re-infection without the hacker needing to login into WP?
@lankip Honey Badger don't care about changing passwords.
Dec
26
revised Could a compromised WP database cause re-infection without the hacker needing to login into WP?
added 92 characters in body
Dec
26
revised Could a compromised WP database cause re-infection without the hacker needing to login into WP?
added 92 characters in body
Dec
26
comment Could a compromised WP database cause re-infection without the hacker needing to login into WP?
@blankip you maybe surprised. The OP didn't describe their infection, but there are bots that just compromise WP databases to post spam, and gain a kind of persistent-xss to deliver drive-by exploits.
Dec
26
comment MS03-026 RPC DCOM Exploit not working on metasploit
There is not enough information to answer this question. You maybe using a decade old exploit, maybe you are patched? Which one of the dozen or so dcom exploits are you attempting to use?