31,532 reputation
344114
bio website bishopfox.com
location
age
visits member for 4 years, 2 months
seen yesterday

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Dec
18
comment Resource consumption attacks against algorithms
@bonsaiviking This is a great answer. I am looking for other vulnerable algorithms, and he found a whole set!
Dec
15
revised Resource consumption attacks against algorithms
edited title
Dec
15
reviewed Approve Resource consumption attacks against algorithms
Dec
15
revised Resource consumption attacks against algorithms
added 247 characters in body; edited title
Dec
15
accepted How can a web application protect IE users when this browser doesn't support HSTS?
Dec
14
asked Resource consumption attacks against algorithms
Dec
11
comment How do I prevent this type of SQL injection attack?
parametrized quires, like every other sql injection ever.
Dec
10
comment Same-origin policy for file: URLs in Android browser?
@D.W. So what did you find out? Did you try it?
Dec
8
comment My website keeps getting infected
You should hire a professional.
Dec
8
comment What are the best Nmap Scripting Engine (NSE) service discovery scripts?
great info thanks.
Dec
8
revised What are the best Nmap Scripting Engine (NSE) service discovery scripts?
edited body
Dec
7
revised What are the best Nmap Scripting Engine (NSE) service discovery scripts?
added 228 characters in body
Dec
7
comment Same-origin policy for file: URLs in Android browser?
@D.W. They do use webkit, but I am not sure how they handle file://. That is a very good question... They could still be jailed. If I had a dev environment setup I would test it using an XHR to try and GET a juicy file.
Dec
7
asked What are the best Nmap Scripting Engine (NSE) service discovery scripts?
Dec
7
comment What are some steps to take for securing a Linux server that aren't in this list of obvious ones?
@orokusaki Ok, you probably have never written an exploit. But the best exploits are using the services against each other. For instance using the database to write a .php file in the web root. AppArmor helps with this, but your using ngix and everyone is running as www-data so you absolutely no separation what so ever. You just threw a bunch of criminals with construction equipment in the same jail cell.
Dec
7
revised What are some steps to take for securing a Linux server that aren't in this list of obvious ones?
edited body
Dec
7
comment What are some steps to take for securing a Linux server that aren't in this list of obvious ones?
total and complete disregard for application separation.
Dec
7
revised What are some steps to take for securing a Linux server that aren't in this list of obvious ones?
added 220 characters in body
Dec
7
answered What are some steps to take for securing a Linux server that aren't in this list of obvious ones?
Dec
7
revised Same-origin policy for file: URLs in Android browser?
added 184 characters in body