30,310 reputation
337108
bio website bishopfox.com
location
age
visits member for 3 years, 11 months
seen 2 hours ago

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Dec
1
revised Is it considered a CSRF if it requires a unique identifier which is not a CSRF token - not tied to the user session?
added 28 characters in body
Dec
1
revised How can two clicks lead to better security in the context of, e.g., Twitter and Facebook share buttons?
added 3 characters in body
Dec
1
revised Cannot get simple shellcode runner to work
deleted 22 characters in body
Nov
30
revised Cannot get simple shellcode runner to work
added 21 characters in body
Nov
30
revised Is it considered a CSRF if it requires a unique identifier which is not a CSRF token - not tied to the user session?
deleted 69 characters in body
Nov
30
revised How can I explain to the client that rfc2385 TCP MD5 Checksums can't be turned on for linux webservers?
added 5 characters in body
Nov
26
revised Someone faxed me a bunch of black paper
added 9 characters in body
Nov
13
revised Clarification on OAuth Client Secret
added 83 characters in body
Nov
12
revised SQL Injection Modify / Insert Table Values
deleted 24 characters in body
Nov
11
revised SQL Injection Modify / Insert Table Values
added 132 characters in body
Nov
11
revised SQL Injection Modify / Insert Table Values
added 170 characters in body
Nov
5
revised defend against LOIC Hive Mind attack
added 49 characters in body
Nov
5
revised defend against LOIC Hive Mind attack
added 65 characters in body
Nov
5
revised defend against LOIC Hive Mind attack
added 17 characters in body
Nov
3
revised Intercepting SSL traffic on Android app
added 109 characters in body
Nov
3
revised Are GET parameters secure over https?
added 201 characters in body
Nov
2
revised Intercepting SSL traffic on Android app
added 9 characters in body
Nov
1
revised CSP Reports: Ignoring Client Malware
deleted 6 characters in body
Nov
1
revised Bypass Full ASLR+DEP exploit mitigation
added 40 characters in body
Oct
31
revised Is there a secure way to share sessions in the same server with different sub domains?
added 3 characters in body