28,589 reputation
232100
bio website bishopfox.com
location
age
visits member for 3 years, 8 months
seen 2 hours ago

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


May
15
revised PHP - How to do safe input filtering in the light of multibyte encoding vulnerabilities?
added 71 characters in body
May
15
answered PHP - How to do safe input filtering in the light of multibyte encoding vulnerabilities?
May
15
revised PHP - How to do safe input filtering in the light of multibyte encoding vulnerabilities?
added 1 characters in body
May
14
revised How do I protect myself against 'hole 196'?
added 5 characters in body
May
14
answered How do I protect myself against 'hole 196'?
May
10
answered Questionable request to /user/soapCaller.bs
May
10
answered Why don't wifi managers remember mac addresses for hotspots to defeat the jasager attack?
May
8
comment Hiding version - valuable or just security by obscurity?
@StasM oah your totally correct, and that can be fixed with mod_rewrite.
May
8
answered Hiding version - valuable or just security by obscurity?
May
5
comment intrusion detection on own hotspot?
@user101579 Faild password attempts are a sign that everything is great, because if an attacker is using that method then they are clueless. The real attack is an offline brute force of the PSK handshake, which nothing can detect.
May
4
answered intrusion detection on own hotspot?
May
3
revised SRP 6a implementation C#
added 613 characters in body
May
3
revised SRP 6a implementation C#
deleted 551 characters in body
May
3
answered SRP 6a implementation C#
May
3
comment Is it Illegal to break out of a forum post by using CSS for example?
I have no idea what you are asking or why this would be illegal anywhere. Are you talking about xss?
May
2
comment Is DRM considered Confidentiality, Integrity, Availability, or some combination of the three?
+1 Nice, although isn't DRM (in)Security Though obscurity?
May
2
comment Checking if Mod_Rewrite is Enabled Remotely
-1 Booo you accepted the first answer.
May
1
comment Integrity monitoring for a LAMP server
@Sideshow Bob Apache should not have ownership or write access to the file. If they have access to the Apache account, they don't have very much.
May
1
answered What do I need to configure, to make sure my software uses /dev/urandom?
Apr
30
answered Integrity monitoring for a LAMP server