30,343 reputation
338108
bio website bishopfox.com
location
age
visits member for 3 years, 11 months
seen yesterday

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Nov
1
revised Bypass Full ASLR+DEP exploit mitigation
added 40 characters in body
Nov
1
comment Bypass Full ASLR+DEP exploit mitigation
@JDeff The text segment, which is also called the code segment contains all of the application's functionality that isn't included by DLLs. In most application there should be a wealth of ROP gadgets available. The trick if finding the ones you need.
Nov
1
answered Bypass Full ASLR+DEP exploit mitigation
Oct
31
comment Is it fundamentally possible to validate that an unmodified version of your client connects to your server?
Your application is a guest on the attacker's machine, and guests need to follow the rules. The attacker makes all of these rules.
Oct
31
comment Is it fundamentally possible to validate that an unmodified version of your client connects to your server?
If you think that validating the client is the solution, then you are asking the wrong question.
Oct
31
revised Is there a secure way to share sessions in the same server with different sub domains?
added 3 characters in body
Oct
31
revised Is there a secure way to share sessions in the same server with different sub domains?
deleted 1 character in body
Oct
30
revised Is there a secure way to share sessions in the same server with different sub domains?
added 45 characters in body
Oct
30
revised Is there a secure way to share sessions in the same server with different sub domains?
added 117 characters in body
Oct
30
revised Is there a secure way to share sessions in the same server with different sub domains?
added 507 characters in body
Oct
30
reviewed Approve Is there a secure way to share sessions in the same server with different sub domains?
Oct
30
answered Is there a secure way to share sessions in the same server with different sub domains?
Oct
29
comment CSRF Token Strategy
@gr8dane If a developer doesn't have a good understanding of the SOP, they will write hazardous software. There is no shortcut here, if you don't like the Google browser security handbook, look up Wikipedia, or a Mozilla reference.
Oct
29
revised CSRF Token Strategy
added 55 characters in body
Oct
29
comment What is same site scripting and what are some exploit scenarios?
Your title is almost longer than your question, and they are both different questions. wtf mate?
Oct
29
comment Rooted android cached password
If you have root can do whatever the hell you want.
Oct
29
revised CSRF Token Strategy
added 12 characters in body
Oct
29
revised CSRF Token Strategy
added 44 characters in body
Oct
29
comment CSRF Token Strategy
@gr8dane Perhaps you should be asking the question: "How can the same-origin policy protect my web application?"
Oct
29
comment CSRF Token Strategy
No csrf exploit?