31,997 reputation
346117
bio website bishopfox.com
location
age
visits member for 4 years, 3 months
seen 14 hours ago

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Sep
25
comment Tampering req.getParameter() Vs req.getAttribute()
+1, Also an owasp top 10 violation.
Sep
25
comment Tampering req.getParameter() Vs req.getAttribute()
yep, obviously an owasp top 10 violation.
Sep
25
awarded  Excavator
Sep
25
comment How to hijack a session?
I fixed your clearly incorrect sql injection payload. (which would never be an attack pattern anyway...)
Sep
25
revised How to hijack a session?
this sql injection payload would never work.
Sep
25
comment Open source or common implementations for reverse proxy web application security
@jshin47 Getting hacked is never an option, I'm sure you understand. I only hope that others around you understand this.
Sep
25
revised Open source or common implementations for reverse proxy web application security
added 4 characters in body
Sep
25
answered Open source or common implementations for reverse proxy web application security
Sep
24
revised Testing http authentication via netcat
added 95 characters in body
Sep
24
answered Testing http authentication via netcat
Sep
23
revised How will security need to be changed if we can crack password hashes in quasi-polynomial time?
edited title
Sep
23
comment Why does Microsoft limit password length?
... also Microsoft isn't a good security role model.
Sep
23
comment What are the career paths in the (illegal) computer security field?
he is selling his shitty tool for like $100. I am sure he makes less than me.
Sep
21
comment What are the career paths in the (illegal) computer security field?
Maybe it was a VUpen employee ;). I upvoted, i thought it was helpful.
Sep
21
awarded  Nice Question
Sep
20
revised How to properly secure a $_GET in PHP?
added 4 characters in body
Sep
20
comment What are the career paths in the (illegal) computer security field?
Some people just don't understand business.
Sep
20
revised What are the career paths in the (illegal) computer security field?
added 5 characters in body
Sep
20
accepted Protecting yourself from a malicious VPN
Sep
20
asked What are the career paths in the (illegal) computer security field?