32,283 reputation
347118
bio website bishopfox.com
location
age
visits member for 4 years, 4 months
seen 2 days ago

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Sep
27
comment How can I scan open ports without being traced back
and FTP bounce scan...
Sep
27
revised What are the security challenges encountered with attribute exchange?
added 63 characters in body
Sep
27
answered What are the security challenges encountered with attribute exchange?
Sep
26
awarded  Promoter
Sep
26
revised Does anyone know about how LinkedIn was compromised?
added 86 characters in body
Sep
26
answered Does anyone know about how LinkedIn was compromised?
Sep
25
comment Tampering req.getParameter() Vs req.getAttribute()
+1, Also an owasp top 10 violation.
Sep
25
comment Tampering req.getParameter() Vs req.getAttribute()
yep, obviously an owasp top 10 violation.
Sep
25
awarded  Excavator
Sep
25
comment How to hijack a session?
I fixed your clearly incorrect sql injection payload. (which would never be an attack pattern anyway...)
Sep
25
revised How to hijack a session?
this sql injection payload would never work.
Sep
25
comment Open source or common implementations for reverse proxy web application security
@jshin47 Getting hacked is never an option, I'm sure you understand. I only hope that others around you understand this.
Sep
25
revised Open source or common implementations for reverse proxy web application security
added 4 characters in body
Sep
25
answered Open source or common implementations for reverse proxy web application security
Sep
24
revised Testing http authentication via netcat
added 95 characters in body
Sep
24
answered Testing http authentication via netcat
Sep
23
revised How will security need to be changed if we can crack password hashes in quasi-polynomial time?
edited title
Sep
23
comment Why does Microsoft limit password length?
... also Microsoft isn't a good security role model.
Sep
23
comment What are the career paths in the (illegal) computer security field?
he is selling his shitty tool for like $100. I am sure he makes less than me.
Sep
21
comment What are the career paths in the (illegal) computer security field?
Maybe it was a VUpen employee ;). I upvoted, i thought it was helpful.