28,235 reputation
23298
bio website bishopfox.com
location
age
visits member for 3 years, 7 months
seen Aug 16 at 19:25

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Apr
20
comment How to secure upload from desktop client to web application?
@bretik In my post I said specifically that trying to prevent an attacker from access the web application was impossible.
Apr
20
comment The safest way to access GMail on mobile devices
@AviD♦ No one is stopping you from posting an answer.
Apr
17
revised How to secure upload from desktop client to web application?
deleted 27 characters in body
Apr
17
revised How to secure upload from desktop client to web application?
added 46 characters in body
Apr
17
comment How to secure upload from desktop client to web application?
@Yoav Aner yeah, I disagree and should not spread these toxic ideas. SSL needs to be the default for everything. It consumes basically zero resources and stops a lot of nonsense.
Apr
17
comment How to secure upload from desktop client to web application?
@Yoav Aner well you can have an insecure file upload, if the files don't matter, i guess its important to note the OP's didn't mention what threats he cared about.
Apr
17
revised How to secure upload from desktop client to web application?
added 311 characters in body
Apr
17
answered How to secure upload from desktop client to web application?
Apr
16
comment XSS : Content-type: application/json
@D.W. well I did link to the CSRF prevention cheat sheet... You could also try reading Mozilla's "Origin" http header proposal.
Apr
16
comment XSS : Content-type: application/json
@D.W. I am not aware of the details of this api the OP was sparse. However, I disagree in the http referer part, an HTTP referer check is being used to prevent the CSRF vulnerability with the highest severity metric. (Motorolla Surfboard Cable modem DoS)
Apr
16
answered XSS : Content-type: application/json
Apr
9
revised HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?
added 69 characters in body
Apr
9
comment HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?
@Mr Moose Its the wrong tool for the job. And yes surprise surprise flickr built an insecure api, and i've collected tens of thousands of dollars from google as apart of their bug bounty program. All software has security problems.
Apr
9
comment Our company needs to conduct an audit of a large ASP.NET solution that was developed for us by a development company.
Hire someone who knows what they are doing.
Apr
8
answered HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?
Apr
8
comment What should I do when my boss asks me to fabricate audit log data?
This questions sounds like something from the CISSP exam.
Apr
8
answered Best resources to learn web security attacks?
Apr
7
comment Notifying Website w/Security Hole
Simple, don't notify them, you could be breaking the law.
Apr
6
revised SQL field level encryption, how safe is it?
deleted 51 characters in body
Apr
6
revised SQL field level encryption, how safe is it?
added 30 characters in body