30,242 reputation
337108
bio website bishopfox.com
location
age
visits member for 3 years, 11 months
seen yesterday

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Aug
2
comment How to properly secure a $_GET in PHP?
@Andrew Smith defense in depth is one thing, but I think you lost me here. Maybe you should post a question on SQL impersonation as an open debate with security.se.
Aug
2
awarded  Enlightened
Aug
2
awarded  Nice Answer
Aug
2
revised How to properly secure a $_GET in PHP?
added 18 characters in body
Aug
2
answered How to properly secure a $_GET in PHP?
Jul
31
comment HTTP daemon and Webroot permissions
This is a bad idea, although after the site is deployed you could remove write privileges.
Jul
31
revised Why are passwords limited to 16 characters?
added 50 characters in body; added 29 characters in body
Jul
31
comment Why are passwords limited to 16 characters?
@curiousguy MD4, MD5 SHA0, SHA1 would be broken hash functions.
Jul
31
comment Why are passwords limited to 16 characters?
You are thinking of bcrypt (which is a hash function, not an encryption algorithm like blowfish) and 3-des using a feedback to create a hash function (which should never be used by anyone, ever).
Jul
31
revised Why are passwords limited to 16 characters?
deleted 7 characters in body
Jul
31
comment Why are passwords limited to 16 characters?
Hash functions can take an unlimited size input and will always the same output.
Jul
31
answered Why are passwords limited to 16 characters?
Jul
31
revised Sulley - optional element and command check
edited tags
Jul
31
answered on stack execution on windows 7 :: metasploit :: meterpreter :: executable crypter
Jul
31
comment What is the most cost effective way to comply with PCI requirement 6.5, developer training?
@Rup ...and everyone here is going to tell you that this is not the place to save money. Look at it as an investment, as in it will prevent future damages to your business.
Jul
31
comment What is the most cost effective way to comply with PCI requirement 6.5, developer training?
I think you mean: "What is the cheapest way to ignore regulations and get hacked?" Developer mistakes is the source of the problem.
Jul
27
awarded  appsec
Jul
26
comment How dependable can data encryption be without re-entry of password on startup?
@George Bailey That would require a cold boot attack, which isn't trivial.
Jul
25
answered How to detect cookie stuffing attacks?
Jul
25
comment Should IP addresses be validated to prevent SQL Injection?
+1 I agree. Also I have verified that at least with PHP+Apache this variable comes from Apache's socket and cannot be influenced. Also CSRF is still a problem with an ip address check.