1,545 reputation
11027
bio website serverfault.com
location
age 34
visits member for 4 years, 8 months
seen Mar 12 at 15:22

Do not trust any security related answers you see on SO. Not from me, not from anyone. There are very smart people on SO and there are excellent answers given, although the right answer is almost never chosen. Test everything, trust no one.

I have been writing exploit code for more than 4 years. I have spoken 3 years in a row at DEFCON. Currently I am the top answerer and asker of security questions on Stack Overflow.

I actively hunt for vulnerabilities and I have found many over the years. According to the Department of Homeland I have found a vulnerability with a severity metric of 13.5 which makes it into the top 1,000 most dangerous of all time and the most dangerous CSRF vulnerability ever discovered.


Feb
1
comment Warning flagged by the 'rkhunter'
Good question, but not for SO.
Jan
31
comment Getting started with a blacklist
@Peter the op added more info.
Jan
28
answered Getting started with a blacklist
Jan
28
comment Getting started with a blacklist
What operating system/platform are you using?
Jan
6
awarded  Yearling
Dec
9
comment Is my web server being compromised?
@John Well yeah the link is right there. It looks like the server down, which is good.
Dec
8
comment Is my web server being compromised?
@John I dug it out of the mzb.c file that its downloading and then compiling.
Dec
6
answered Do I need a hardware firewall for Win 2003?
Nov
18
comment How to thwart PHPMyAdmin attacks?
@Ton van den Heuvel no the "real problem" is getting hacked.
Nov
17
awarded  Nice Question
Nov
17
awarded  Popular Question
Nov
17
revised I just did a chmod -x chmod
edited tags
Nov
17
answered Is it worth running nessus as well as OpenVAS?
Nov
17
answered How to thwart PHPMyAdmin attacks?
Nov
16
comment Web Server Security Overkill?
@Aaron i'm not sure why you'd use nginx. You can use apache+mod_security as a proxy with whatever strange and featureless httpd you demand using.
Nov
15
answered Web Server Security Overkill?
Oct
27
comment How to exploit data being written to file
@Brian G being forced to write to input.dat isn't an issue alone unless you can pair it with another attack like an LFI vulnerability. Usually being able to write arbitrary files comes up in a directory traversal attack. In short this doesn't sound like a vulnerability.
Oct
27
comment How to exploit data being written to file
@Brian G without any specifics relating to this vulnerably i am posting on how other exploits are able to gain remote code execution by uploading a file.
Oct
27
answered How to exploit data being written to file
Oct
25
awarded  Tumbleweed