30,084 reputation
336107
bio website bishopfox.com
location
age
visits member for 3 years, 10 months
seen yesterday

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Nov
7
comment Can a whitespace regex character be used to perform a javascript injection?
Its hard to tell what you are doing. In general whitespace and numeric input cannot lead to an injection attack... However, you maybe missing something far more dangerous. Also your regex only matches a single character...
Nov
7
answered What type of attacks can be used vs MongoDB?
Nov
7
comment How should permissions be stored?
why did you assume this was a sql database?
Nov
7
answered Seeking lightweight encryption - shareable between Delphi & C
Nov
6
awarded  Notable Question
Nov
6
revised How can a web application protect IE users when this browser doesn't support HSTS?
added 121 characters in body
Nov
6
revised How can a web application protect IE users when this browser doesn't support HSTS?
edited tags
Nov
6
revised How can a web application protect IE users when this browser doesn't support HSTS?
added 109 characters in body
Nov
6
answered How can a web application protect IE users when this browser doesn't support HSTS?
Nov
6
asked How can a web application protect IE users when this browser doesn't support HSTS?
Nov
6
comment How should permissions be stored?
What type of database are you using? Also, this is more of an SO question.
Nov
6
comment Should we force user to HTTPS on website?
@tylerl THat is a good question that probably deserves its own post. Really a redirect is just addressing a symptom of a problem. Having a redirect is a good thing, but you need to address mixed content vulnerabilities that would cause this to happen in the first place. Also set the "secure" flag on session id's. Also warn IE users that they are potentially vulnerable to attack.
Nov
6
comment Should we force user to HTTPS on website?
@tylerl Depends who you ask: w3schools.com/browsers/browsers_stats.asp . Personally I don't know anyone that uses IE. And you could not be more wrong about the redirect, the attacker can send whatever response they would like in a MITM attack, and SSLStrip will remove the https redirect for you. I am actually surprised i am even debating this, i thought this was obvious.
Nov
6
revised Should we force user to HTTPS on website?
added 26 characters in body
Nov
6
comment Should we force user to HTTPS on website?
@tylerl Throwing a 302 redirect over http to an https connection is trivial to exploit. If you don't see how this is serious problem, fire up wireshark and look at the traffic. HSTS is supported by chrome and firefox, which is the STRONG MAJORITY of browsers. IE has never been known for security, so i wouldn't be surprised if they just ignored this feature.
Nov
5
comment What is HiASLR?
i think you are confusing ForceASLR with High Entropy ASLR. related: blogs.msdn.com/b/ie/archive/2012/03/12/…
Nov
5
comment Can I encrypt a file incrementally?
You should get someone with experience to implement security systems. A lot can go wrong with cryptographic implementations.
Nov
5
revised Can I encrypt a file incrementally?
added 1 characters in body; edited title
Nov
5
comment What alternatives are there to the existing Certificate Authority system for SSL?
@makerofthings7 not that I know of.
Nov
5
answered What alternatives are there to the existing Certificate Authority system for SSL?