Jeff Forristal
More info
- Alias
- rain.forest.puppy
- Known for
- First public write-up of SQL injection (1998), Whisker, RFPolicy
As rain.forest.puppy he described SQL injection in Phrack in 1998 — a bug that still tops the charts.
In Phrack issue 54, December 1998, he showed how characters typed into a web form could slip into a SQL query against Microsoft SQL Server. Microsoft's response, by his account, amounted to "not our problem." A quarter-century later injection is still on the OWASP Top 10, which says more about the industry than about the article.
He also wrote the Whisker CGI scanner and the libwhisker library that Nikto was built on, plus RFPolicy (2000), an early explicit policy for how vendors should treat people who report vulnerabilities. As a researcher at Bluebox in 2013 he found Android's so-called Master Key bug in app signature verification.