1,560 reputation
11028
bio website serverfault.com
location
age 34
visits member for 4 years, 11 months
seen Dec 1 at 21:15

Do not trust any security related answers you see on SO. Not from me, not from anyone. There are very smart people on SO and there are excellent answers given, although the right answer is almost never chosen. Test everything, trust no one.

I have been writing exploit code for more than 4 years. I have spoken 3 years in a row at DEFCON. Currently I am the top answerer and asker of security questions on Stack Overflow.

I actively hunt for vulnerabilities and I have found many over the years. According to the Department of Homeland I have found a vulnerability with a severity metric of 13.5 which makes it into the top 1,000 most dangerous of all time and the most dangerous CSRF vulnerability ever discovered.


Jul
12
asked Connecting to a malicious VPN
May
25
asked How do I securly update a *BSD system?
Mar
19
asked Firewall rules that will cause problems for nmap
Mar
6
accepted DNS Lookup to Bind config file
Mar
4
answered Client-side certificates
Mar
1
revised DNS Lookup to Bind config file
added 30 characters in body
Mar
1
revised DNS Lookup to Bind config file
added 100 characters in body
Mar
1
accepted Can I do a ctrl-z without the process locking up?
Mar
1
asked DNS Lookup to Bind config file
Feb
25
comment What techniques are recommended to prevent a MITM attack when using a public/private key pairs (RSA)?
@user502052 When i say the entire session i mean ALL DATA transmitted between you and the client from the moment you issue a set-cookie to the moment you destroy that session.
Feb
25
answered What techniques are recommended to prevent a MITM attack when using a public/private key pairs (RSA)?
Feb
22
answered How to securely partition blog folder on existing Apache website
Feb
22
answered Are there any known security vulnerabilities to the built-in mercurial server?
Feb
22
answered DDoS Network Protection Devices
Feb
22
comment Repairing yum's repositories on a RHEL5
Yeah i have come to the conclusion that YUM is complete garbage and i'll avoid RHEL as much as i can. as for CentOS, i think that project is dead, they haven't released an update in a few years.
Feb
14
answered Recognizing a HTTP access vulnerability scan
Feb
7
accepted How can I find all of the domain names owned by a company?
Feb
7
comment How can I find all of the domain names owned by a company?
You sir are mistaken.
Feb
4
asked How can I find all of the domain names owned by a company?
Feb
2
comment Warning flagged by the 'rkhunter'
Linux kernel land rootkits are DEAD. Hypervisor rootkits still work and you don't have one, and you can't detect it with rkhunter.