27,419 reputation
22892
bio website bishopfox.com
location
age
visits member for 3 years, 3 months
seen Apr 10 at 20:42

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Jan
27
answered Possible ways of exploiting PHP register_globals
Jan
25
answered Escaping rich text editor output
Jan
16
answered Valid Characters For Magnetic stripe
Dec
31
answered Missing Secure Attribute in Encrypted Session (SSL) Cookie Recheck
Dec
30
answered Cross site Scripting in HTTP Method?
Dec
30
answered Identify users accessing hidden link in a website
Dec
30
answered Detection of function hooking in iOS
Dec
27
answered False positive Apache version in scanner results on Centos
Dec
25
answered How should we announce vulnerabilities in our application?
Dec
20
answered Any eventhandlers that apply to hidden elements?
Dec
20
answered ASP.NET Web API and potential XSS
Dec
19
answered How does the stack cookie protect return address from being overwrite
Dec
18
answered Would siloing passwords into their own locked down schema improve security?
Dec
17
answered Is Django's built-in CSRF protection enough?
Dec
12
answered handle user-session-cookie and csrf token correctly for javascript app
Dec
12
answered Backup personal email on VPS - privacy, security and trust risks
Dec
10
answered Why is activex said to be insecure?
Dec
9
answered Hiding Bittorent clients
Dec
8
answered Is there an advantage to applying pbkdf2 to a key that's used to generate a MAC?
Dec
5
answered Is SSL secure enough for a REST API - has anyone used PGP or AES to encrypt the actual data inside SSL?