27,409 reputation
22892
bio website bishopfox.com
location
age
visits member for 3 years, 3 months
seen Apr 10 at 20:42

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Feb
14
comment xp_cmdshell: should it ever be used?
@spaghettidba I am dead serious, as a pentester xp_cmdshell() is a god send. What makes it so bad is that no one at Microsoft even thinks to fix this issue. I'm very happy to encounter Microsoft products and applications built on the Microsoft platform because they are weak. Fun fact, my first 0-day was in a Microsoft security product when I was 16, which was more than a decade ago.
Jan
30
comment Session id on page html source code
+1 You cant use HTTPONly if you write the session id to the page. If the session id is in the URL you will print it out to paper if you print one of the pages!
Jan
30
comment Session id on page html source code
You can bind a cookie to a specific path /php, and /node_js. So you can still use the Secure and HTTPOnly cookie directives, and have a secure session handler.
Jan
30
comment Session id on page html source code
I guess you have never heard of "defense in depth."
Jan
27
comment Building a web application security focused team
IMO, if a person can't write exploit code they have no business being in this team. Make sure they understand post-exploitation. When we are recruiting this is an area that we focus on, and most recruits fail in understanding why vulnerabilities are valuable to a hacker. Sure they can find some vulnerabilities, but that isn't enough to keep you from getting hacked.
Jan
23
comment Can isolated forms be dangerous for my server security?
Read the OWASP top 10.
Jan
21
comment What kind of virus attack is this? And what do I do now?
You have provided no useful information, all anyone can tell you is that the "the attack" resulted in remote code execution. Probably started from timthumb or just neglecting basic security practices like UPDATES, and now your website is backdoored all to hell and re-sold on the blackmarket. Enjoy!
Jan
16
comment Valid Characters For Magnetic stripe
@PsychoData I stand by my answer, bits can be cast as any datatype. Without the OP providing his use, then the general case fits best.
Dec
31
comment Identify users accessing hidden link in a website
@TestRunner i don't think you have provided enough information to assess that. But you are probably being attacked right now, like everyone else.
Dec
30
comment Are cross site scripting attacks and sql injection a good topic for my thesis?
This is a poor choice for a thesis topic because these attacks are so well understood and it is a difficult topic to expand upon. I would find a less popular topic.
Dec
27
comment False positive Apache version in scanner results on Centos
@Michael but can you prove that this isn't a vulnerable version? CentOS has never impressed me...
Dec
27
comment Can non-https assets be tampered with?
@CodesInChaos This is like cleaning your dishes, and then right before you serve the meal you go around smearing feces on every dish.
Dec
27
comment XSS Vector Without Forward Slashes or Spaces
look at the IE xss filter bypasses by whitehat.
Dec
26
comment What hacking risks a site has if it has no input boxes?
"input boxes" as the source of all vulnerabilities... I have never herd this before and will never hear this again.
Dec
25
comment Authencity of information displayed on an untrusted device
I don't understand the threat model here, what is wrong with the bluetooth pairing system?
Dec
21
comment Any eventhandlers that apply to hidden elements?
@Sajjad Pourali aah good call, I didn't test that exploit on the latest version of Opera.
Dec
18
comment Would siloing passwords into their own locked down schema improve security?
@Andrew Hoffman that is a great example of violating the principle of least privilege access.
Dec
17
comment Is it safe to use PBKDF2 for hashing?
PBKDF2 cannot be efficiently implemented on a GPU because of the XOR operation performed between each iteration of the hash function.
Dec
17
comment Microsoft IIS Express
Perhaps you should ask your manager.
Dec
17
comment Protecting sensitive content in JS source code and Ajax cals
It is unclear why HTTPS is not sufficient.