32,832 reputation
449122
bio website bishopfox.com
location
age
visits member for 4 years, 7 months
seen 14 hours ago

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Oct
7
revised Why is penetration testing important
added 5 characters in body
Oct
5
revised Why is penetration testing important
added 122 characters in body
Oct
5
answered Why is penetration testing important
Oct
5
revised DVWA vulnerability list or guide?
added 57 characters in body
Oct
5
answered DVWA vulnerability list or guide?
Oct
4
asked Should we start using SHA-3?
Oct
4
answered Should we start using SHA-3?
Oct
3
comment What about combining pkdf2 with scrypt?
I find that people who don't understand security tend throw all the security systems they have heard about without understanding that this combination doesn't improve anything. When auditing a code base, I see this as a weakness and it encourages me to find more complex flaws in a given system.
Oct
3
comment Using tor with SET to bypass firewall policy?
@user970533 email is sent using port 25, using SMTP. Use an open socks proxy (other than tor) to bypass your firewall. These proxies are plentiful, tens of thousands exist, you just have to find them. You have just been spoon fed, shitty script kiddie hacks.
Oct
3
answered What about combining pkdf2 with scrypt?
Oct
3
comment Using tor with SET to bypass firewall policy?
@user970533 Yes, I have answered your question.
Oct
3
answered Using tor with SET to bypass firewall policy?
Oct
3
awarded  Benefactor
Oct
3
accepted What are the career paths in the (illegal) computer security field?
Oct
3
comment Does Username + Password + Pin improve login security?
@ewanm89 I never said it was, but its what they want.
Oct
2
answered Does Username + Password + Pin improve login security?
Oct
2
revised OAuth2 Cross Site Request Forgery, and state parameter
added 7 characters in body
Oct
2
comment OAuth2 Cross Site Request Forgery, and state parameter
@Markus von Broady Clickjacking, Chaining and XSS is really as complex as attacks get for this RFC violation. There is really no other point in establishing a session for a victim unless you plan on riding on it with other attacks. If you had an XSS vulnerability in SO, this would be a pretty clean account hijack, which is nasty.
Oct
2
revised OAuth2 Cross Site Request Forgery, and state parameter
added 33 characters in body
Oct
2
awarded  Good Question