30,343 reputation
338108
bio website bishopfox.com
location
age
visits member for 3 years, 11 months
seen yesterday

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Dec
10
answered Parallel HTTPS connection remote and local host
Dec
3
answered How to perform penetration testing of Blackberry mobile applications?
Nov
30
answered Cannot get simple shellcode runner to work
Nov
30
answered How can two clicks lead to better security in the context of, e.g., Twitter and Facebook share buttons?
Nov
30
answered Is it considered a CSRF if it requires a unique identifier which is not a CSRF token - not tied to the user session?
Nov
30
answered How can I explain to the client that rfc2385 TCP MD5 Checksums can't be turned on for linux webservers?
Nov
26
answered Someone faxed me a bunch of black paper
Nov
13
answered Clarification on OAuth Client Secret
Nov
13
answered Proper way to allow access to systems within different offices?
Nov
11
answered SQL Injection Modify / Insert Table Values
Nov
5
answered defend against LOIC Hive Mind attack
Nov
2
answered Intercepting SSL traffic on Android app
Nov
1
answered CSP Reports: Ignoring Client Malware
Nov
1
answered Bypass Full ASLR+DEP exploit mitigation
Oct
30
answered Is there a secure way to share sessions in the same server with different sub domains?
Oct
28
answered CSRF Token Strategy
Oct
23
answered SQL injection with single statement query
Oct
22
answered How to exploit this include_once vulnerability in PHP?
Oct
20
answered Using OAuth 2.0 without token storage
Oct
19
answered Security concerns with iframes