30,310 reputation
337108
bio website bishopfox.com
location
age
visits member for 3 years, 11 months
seen 5 hours ago

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Dec
14
comment prevent session hijacking in PHP
-1 Don't write your own session handler. Use PHP session_start()
Dec
14
comment prevent session hijacking in PHP
First and foremost: Never write your own session handler.
Dec
8
comment Alternative ways to exploit this path traversal
Well first of all, there is some code preventing you from reading files, what does this code look like? We can't just magic away an error message.
Dec
6
comment Exploiting cve:2005-1794
A 9 year old exploit? Someone needs to take that exploit to disneyland for it's birthday, because it is certainly old enough.
Dec
5
comment Can my raw html website get hacked?
You still need a way to update this HTML, and that is a point of weakness.
Dec
5
comment Is there a secure way to share sessions in the same server with different sub domains?
*.example.com is a scope that encompasses all subdomains of example.com
Dec
3
comment Pros/Cons of internal pentest department vs external pentesters
I think a lot of companies would prefer to hire a skilled pentester, but this is just not possible. Pentesting firms and silicon valley eats up the top talent. You'll be lucky to find someone who can hack their way out of a paper bag.
Dec
3
comment How to avoid DDoS Attack
Is there a real security problem here, or is this homework?
Dec
3
comment PHP unserialize() object injection
+1, well put. It is not an easy exploit.
Dec
1
comment Passing session id in query string to maintain state in third party iframe - good practice?
This is not how SSO should work, use OAuth.
Nov
30
comment How can I explain to the client that rfc2385 TCP MD5 Checksums can't be turned on for linux webservers?
@Mark md5 is vulnerable to a 2nd pre-image attack. This attack is directly applicable to RFC2385, in that a malicious TCP packet could have the same checksum as an observed packet.
Nov
30
comment How can two clicks lead to better security in the context of, e.g., Twitter and Facebook share buttons?
@Bleeding Fingers privacy is a useful side-effect of a secure system.
Nov
30
comment Cannot get simple shellcode runner to work
Old buffer overflow is old.
Nov
30
comment DNS Rebinding attack - will the victim's browser send cookies?
I don't think this is accurate at all. No modern browser should be vulnerable to this. DNS rebinding was patched years ago.
Nov
30
comment Is this PHP code XSS proof?
@AcidShout XSS in that context could still be used for phishing. An attacker could build a fake login page using document.write().
Nov
27
comment is it sufficient to convert '(single-quote) to ` ' `
@Milen Your posts need to contain citation. Link to the OWASP XSS filter evasion cheat sheet, or XSS prevention cheat sheet.
Nov
27
comment is it sufficient to convert '(single-quote) to ` ' `
Why would filtering a single character fix XSS? What about param='</script><script>alert(1)//'
Nov
27
comment Is this PHP code XSS proof?
@Gumbo is right, this filter won't work for youtube links youtube.com/watch?v=EZTXYCJk05w
Nov
27
comment Is this PHP code XSS proof?
@Lucas NN Sorry I had trouble reading the code formatting in an previous revision. The only attacks I'm aware of would require the page to specify an alternative character set, such as GBK which permits multi-byte character consumption.
Nov
26
comment {Secure} Telnet connect to a console server from webbrowser
I'm pretty sure that "secure telnet" is an oxymoron.