1,535 reputation
11027
bio website serverfault.com
location
age 34
visits member for 4 years, 7 months
seen Mar 12 at 15:22

Do not trust any security related answers you see on SO. Not from me, not from anyone. There are very smart people on SO and there are excellent answers given, although the right answer is almost never chosen. Test everything, trust no one.

I have been writing exploit code for more than 4 years. I have spoken 3 years in a row at DEFCON. Currently I am the top answerer and asker of security questions on Stack Overflow.

I actively hunt for vulnerabilities and I have found many over the years. According to the Department of Homeland I have found a vulnerability with a severity metric of 13.5 which makes it into the top 1,000 most dangerous of all time and the most dangerous CSRF vulnerability ever discovered.


Feb
10
awarded  Teacher
Feb
10
answered Is my web server being compromised?
Feb
4
awarded  Scholar
Feb
4
accepted How can you obscure the fact that you are running Apache?
Jan
28
comment How can you obscure the fact that you are running Apache?
Who said I was defending against automated attacks? Giving any information to an attacker is a serious problem. I am a penetration tester and an exploit writer.
Jan
28
asked Secure IIS/MS-SQL
Jan
28
comment What is the best Web Application Firewall for IIS?
@Cheekysoft, your right, the pci-dss does however require an IPS or IDS and HTTP/HTTPS is the only thing open on the server.
Jan
28
comment What is the best Web Application Firewall for IIS?
@Cheekysoft, your right, it does however require an IPS or IDS and HTTP/HTTPS is the only thing open on the server.
Jan
28
comment What is the best Web Application Firewall for IIS?
Writing vulnerability free code is impossible. So then would it also be true that you should put up as many obstacles as possible.
Jan
27
asked What is the best Web Application Firewall for IIS?
Jan
24
answered Resetting salted Drupal admin password
Jan
24
awarded  Supporter
Jan
24
awarded  Student
Jan
23
awarded  Autobiographer
Jan
23
asked How can you obscure the fact that you are running Apache?
Jan
18
answered Lighttpd web server not reachable from outside
Jan
6
answered Brainstorm: Flood/DoS/DDoS Attack prevention ideas
Jan
5
answered Stuck on Login PhpMyAdmin
Jan
5
awarded  Editor
Jan
5
comment How can I use mod_rewrite to remove everything after the ? (question mark) in a URL?
I want the rules to work for all files on the system, not just index.php