29,537 reputation
234105
bio website bishopfox.com
location
age
visits member for 3 years, 9 months
seen 4 hours ago

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Oct
25
comment Does filtering HTML syntax prevent a web shell from being dropped through a textbox?
not enough information.
Oct
25
comment Tracking down a rogue access point
No, the rouge access point was connected to their own network.
Oct
25
accepted Tracking down a rogue access point
Oct
24
revised Stack canaries protection and ROP
deleted 26 characters in body
Oct
24
revised Stack canaries protection and ROP
added 94 characters in body
Oct
24
comment Why firefox shows some connections are not secure?
@Iszi good point, updated
Oct
24
revised Why firefox shows some connections are not secure?
added 126 characters in body
Oct
24
revised Stack canaries protection and ROP
added 87 characters in body
Oct
24
answered Why firefox shows some connections are not secure?
Oct
24
answered Stack canaries protection and ROP
Oct
24
comment Is ProxyPass more secure than directly hosting PHP site?
@Shadok the flaws found in apache are in obscure modules and are much less severe. A new project is going to have a lot more problems.
Oct
23
comment Vuln Web App which includes LDAP Injection?
@Boaz Tirosh A demonstration is the best place to show a real attack.
Oct
23
revised Vuln Web App which includes LDAP Injection?
added 54 characters in body
Oct
23
answered Vuln Web App which includes LDAP Injection?
Oct
23
revised Do I always have to overwrite EIP to get to write on the stack in a buffer overflow?
added 115 characters in body
Oct
23
answered Do I always have to overwrite EIP to get to write on the stack in a buffer overflow?
Oct
23
answered Why is this certificate valid for so many domains?
Oct
23
comment Payment security on Android App
@AviD♦ well it should be avoided in favor of another system if possible. Often cryptography is the only tool that can be used, and that is perfect place for it.
Oct
23
answered Payment security on Android App
Oct
23
revised How “leaking pointers” to bypass DEP/ASLR works
added 58 characters in body