28,097 reputation
23197
bio website bishopfox.com
location
age
visits member for 3 years, 6 months
seen 5 hours ago

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Mar
12
revised Does truncating the cryptographic hash make it impossible to crack?
deleted 5 characters in body
Jan
27
revised Escaping rich text editor output
edited body
Jan
27
revised Escaping rich text editor output
added 5 characters in body
Jan
26
revised Escaping rich text editor output
added 34 characters in body
Jan
16
revised Valid Characters For Magnetic stripe
deleted 16 characters in body
Dec
30
revised Cross site Scripting in HTTP Method?
added 3 characters in body
Dec
30
revised Cross site Scripting in HTTP Method?
added 10 characters in body
Dec
30
revised Identify users accessing hidden link in a website
added 1 characters in body
Dec
30
revised Cross site Scripting in HTTP Method?
added 218 characters in body
Dec
26
revised How should we announce vulnerabilities in our application?
added 95 characters in body
Dec
25
revised How should we announce vulnerabilities in our application?
deleted 8 characters in body; edited title
Dec
22
revised ASP.NET Web API and potential XSS
added 63 characters in body
Dec
21
revised ASP.NET Web API and potential XSS
added 65 characters in body
Dec
21
revised Any eventhandlers that apply to hidden elements?
deleted 103 characters in body
Dec
20
revised ASP.NET Web API and potential XSS
added 204 characters in body
Dec
20
revised Can too much web searching be a danger to a security professional?
added 37 characters in body
Dec
18
revised Would siloing passwords into their own locked down schema improve security?
added 122 characters in body
Dec
17
revised Is Django's built-in CSRF protection enough?
added 13 characters in body
Dec
17
revised Is Django's built-in CSRF protection enough?
added 126 characters in body
Dec
16
revised handle user-session-cookie and csrf token correctly for javascript app
added 33 characters in body