32,519 reputation
449120
bio website bishopfox.com
location
age
visits member for 4 years, 5 months
seen 3 hours ago

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Oct
1
revised OAuth2 Cross Site Request Forgery, and state parameter
deleted 5 characters in body
Oct
1
revised How to prevent pay per show/click abuse?
added 58 characters in body
Oct
1
answered How to prevent pay per show/click abuse?
Oct
1
answered OAuth2 Cross Site Request Forgery, and state parameter
Sep
27
revised Can JavaScript defeat source port randomization?
edited body; edited title
Sep
27
revised SSL decryption in Wireshark
added 3 characters in body
Sep
27
answered SSL decryption in Wireshark
Sep
27
comment How can I scan open ports without being traced back
and FTP bounce scan...
Sep
27
revised What are the security challenges encountered with attribute exchange?
added 63 characters in body
Sep
27
answered What are the security challenges encountered with attribute exchange?
Sep
26
awarded  Promoter
Sep
26
revised Does anyone know about how LinkedIn was compromised?
added 86 characters in body
Sep
26
answered Does anyone know about how LinkedIn was compromised?
Sep
25
comment Tampering req.getParameter() Vs req.getAttribute()
+1, Also an owasp top 10 violation.
Sep
25
comment Tampering req.getParameter() Vs req.getAttribute()
yep, obviously an owasp top 10 violation.
Sep
25
awarded  Excavator
Sep
25
comment How to hijack a session?
I fixed your clearly incorrect sql injection payload. (which would never be an attack pattern anyway...)
Sep
25
revised How to hijack a session?
this sql injection payload would never work.
Sep
25
comment Open source or common implementations for reverse proxy web application security
@jshin47 Getting hacked is never an option, I'm sure you understand. I only hope that others around you understand this.
Sep
25
revised Open source or common implementations for reverse proxy web application security
added 4 characters in body