29,690 reputation
236107
bio website bishopfox.com
location
age
visits member for 3 years, 9 months
seen 30 mins ago

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


20h
comment CSRF Token Strategy
@gr8dane If a developer doesn't have a good understanding of the SOP, they will write hazardous software. There is no shortcut here, if you don't like the Google browser security handbook, look up Wikipedia, or a Mozilla reference.
1d
comment What is same site scripting and what are some exploit scenarios?
Your title is almost longer than your question, and they are both different questions. wtf mate?
1d
comment Rooted android cached password
If you have root can do whatever the hell you want.
1d
comment CSRF Token Strategy
@gr8dane Perhaps you should be asking the question: "How can the same-origin policy protect my web application?"
1d
comment CSRF Token Strategy
No csrf exploit?
1d
comment CSRF Token Strategy
@gr8dane the SOP holds the fundamental answer to your question. Also, your example form is the definition of IDOR, that can't be ignored. You can't pass a user ID as a $_GET, it must be apart of the $_SESSION. The CSRF token is a $_SESSION variable, that is compared to a $_GET or $_POST variable, which creates a CSRF-synchronization token. This is a secret that the attacker cannot know, because of the SOP.
2d
comment Where does /dev/random get its entropy?
I recommend reading random.c, it has more code comments than actual code. Second-hand information will be less informative than just looking at the source.
2d
comment Difference Between MD4 and MD5 encryption
I wish we had a double-bold, and 24 point font for the 'not encryption algorithms'
2d
comment SQL injection with single statement query
@Cory Carter If you are in a select, it is only a select. Subselect can be used to access other tables when injecting into a delete/update/insert. File IO should work within a select.
Oct
23
comment SQL injection with single statement query
@Gumbo I updated my answer to link to the C client bindings that permit multiple queries for MySQL. This is not PHP related.
Oct
23
comment SQL injection with single statement query
@Gumbo or oracle, or postgresl, or HSQLDB, or really anything other than MS-SQL and SQLite. I find Query stacking doesn't work in 90-95% of pentests. I don't do PHP/MySQL very often, the op is using MySQL.
Oct
22
comment How to exploit this include_once vulnerability in PHP?
@programings That is cool exploit technique for leveraging LFI, but it doesn't apply to this bug. Sad day.
Oct
22
comment How to exploit this include_once vulnerability in PHP?
@jyzuz if one flaw doesn't give you everything, then you need to find another vulnerability that gives you what you need. We call these exploit chains.
Oct
22
comment How to exploit this include_once vulnerability in PHP?
@jyzuz you will never be able to read PHP code with an LFI, the whole point of the include() function is to execute the PHP code. If your smart, you can get a shell.
Oct
20
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
+1 this post is so good I deleted mine. Also your right, the ajax method does send cookies... but cookies are only sometimes displayed in the browser's network view. BURP saw the cookies, and BURP's XHR CSRF builder is a good method of delivering CSRF exploits. Thank you for clarifying this for me.
Oct
19
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
-1 I don't believe the OPs question anything to do with a strange, non-standards complaint browser, and as far as I can tell this answer nothing to do with exploitation of CSRF. I would take away the -1, but I can't.
Oct
19
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
@SilverlightFox I updated my post to contain more detailed information on why XHRs are simply not useful in exploiting CSRF.
Oct
19
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
@SilverlightFox, aah you are right I was partially mistaken. An XHR needs to have the withCredentials attribute, you need the cookie in order to ride on the session with CSRF. Which is why XHRs are never used in CSRF exploits.
Oct
19
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
@SilverlightFox I'm sorry, but it just doesn't work that way. Prove me wrong, show me a CSRF exploit that you have written that uses an XHR. (This is an impossible task for a modern browser.) If the target has CORS enabled, the the web app has bigger problems than CSRF.
Oct
19
comment How is the same origin policy causing my PoC to fail when I don't need to read return data?
@SilverlightFox I should reiterate, XHR can never be used in a CSRF attack because the CORS pre-flight request prevents this attack.