29,555 reputation
234105
bio website bishopfox.com
location
age
visits member for 3 years, 9 months
seen 8 mins ago

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Sep
22
answered Question regarding browser windows when integrating with 3rd party payment software
Sep
22
awarded  attacks
Sep
21
revised Can anti-CSRF token prevent bruteforce attack?
added 30 characters in body
Sep
21
answered Can anti-CSRF token prevent bruteforce attack?
Sep
17
answered Extremely suspicious UDP network traffic when idle
Sep
16
comment Encrypting/decrypting our license key
consider reading: stackoverflow.com/questions/3002067/…
Sep
15
comment Imitation Gmail account created - what's the threat?
@Shaul oah ok, well then I'm not interested unless I can see the technical details.
Sep
15
revised How should I mitigate the XSS vulnerabilities in KnockoutJS described at mustache-security?
added 9 characters in body
Sep
15
answered How should I mitigate the XSS vulnerabilities in KnockoutJS described at mustache-security?
Sep
15
comment Imitation Gmail account created - what's the threat?
The OP should make the full SMTP headers available. Go into the email, and then "show original" from the message's drop-down.
Sep
15
revised How can document.referrer be used for XSS?
added 108 characters in body
Sep
15
answered How can document.referrer be used for XSS?
Sep
14
revised Security concept for Android app with PHP based REST API
deleted 36 characters in body
Sep
14
revised Security concept for Android app with PHP based REST API
deleted 9 characters in body
Sep
14
answered Security concept for Android app with PHP based REST API
Sep
14
revised OAuth - Why exchange the authcode for a token
added 33 characters in body
Sep
14
comment How To Patch LFI Vulnerability
The code is difficult to read, consider using the code formatting tool.
Sep
14
answered OAuth - Why exchange the authcode for a token
Sep
13
comment Tiny USB sticks
The machine that has the bitcoin wallet needs to be connected to the intent. You can give someone a QR code and then expect payment without violating the air gap.
Sep
13
comment drupal external authentication - how to handle password?
This design is insecure (CWE-257). We have already solved this problem and we call it OAuth.