32,861 reputation
449122
bio website bishopfox.com
location
age
visits member for 4 years, 7 months
seen 9 hours ago

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Jan
5
comment how strong is AES without salt
@Novice User It sounds horribly insecure, but I'm not sure that follow. you.. what mode are you using?
Jan
5
revised how strong is AES without salt
added 55 characters in body
Jan
5
answered how strong is AES without salt
Jan
2
comment Strongest cryptographic algorithm available in PHP 5.3
md5 is not an encryption algorithm, its a hash function. Its also a broken hash function and should never be used for security.
Dec
31
answered ROP Exploitation on ARM
Dec
31
comment E-mail can be made to appear like it came from a big organization?
@FirstName LastName I remember reading some bug hunter's blog... but I can't find it now. Sorry.
Dec
31
comment E-mail can be made to appear like it came from a big organization?
@Jacco Exactly, thats why you need another vector like SMTP command injection.
Dec
31
revised E-mail can be made to appear like it came from a big organization?
added 1 characters in body
Dec
30
answered E-mail can be made to appear like it came from a big organization?
Dec
29
answered Test Android Secure Encrypted Traffic
Dec
29
comment Any one know about UDP traffic on source port 26221?
@leena Then there is not enough information to answer this question.
Dec
29
reviewed Approve Any one know about UDP traffic on source port 26221?
Dec
29
revised Any one know about UDP traffic on source port 26221?
added 128 characters in body
Dec
29
revised What are effective ways to prevent targeted phishing?
deleted 5 characters in body
Dec
29
comment is there any program that can tell me which files have been transferred from my computer thru the web
No, by the time a virus is running on your machine its probably too late.
Dec
29
answered Self-signed certificates usage for code signing purposes
Dec
29
answered Macbook pro, rootkithunter
Dec
29
comment Preventing user supplied javascript from posting to external server
The CSP can't solve this problem. The point of the application is that the attacker can supply arbitrary code to be executed. The CSP allows a developer to dictate where a script can come from in order to prevent an attacker from supplying arbitrary code. Chicken or the egg.
Dec
29
answered Any one know about UDP traffic on source port 26221?
Dec
29
comment Proving running code on a website is unchanged
@BeatMe thats not possible.