RSNAKE▊
The researcher who put two words into the industry's mouth — "clickjacking" and "Slowloris" — and kept the XSS Cheat Sheet the whole field cribbed from. In 2009 an underground scene zine waved all of it away and called him a self-promoter who was "all about the hype, the drama, and seeing his name in lights." It is the oldest argument in security: who did the work versus who got the headline. This time the paperwork settles it, and not in the zine's favor.
Slowloris both helps identify the timeout windows of a HTTP server or Proxy server, can bypass httpready protection and ultimately performs a fairly low bandwidth denial of service.
Robert "RSnake" Hansen (@rsnake), in the documentation shipped inside his own Slowloris tool, 2009
- WHO
- Robert Hansen — "RSnake," American web-application-security researcher and executive FACT
- SCENE
- Ran the influential ha.ckers.org web-app-security lab and blog and the sla.ckers.org researcher forum through the 2000s; a fixture on the conference circuit (see DEF CON)
- THE DRAMA
- The 2009 underground zine Zero For 0wned dismissed him as chasing "the hype, the drama, and seeing his name in lights." The record answers with three named, adopted contributions
- WORK
- Co-coined "clickjacking" (2008, with Jeremiah Grossman); wrote Slowloris (2009); maintained the ha.ckers.org XSS Cheat Sheet; founded SecTheory (2006); later WhiteHat Security, OutsideIntel, Bit Discovery, Deputy CTO of Tenable FACT
- STATUS
- ACTIVE — working security executive, author, and host of The RSnake Show. Poacher turned gamekeeper, the ordinary way
This file is not an accusation; there is nothing here to accuse. RSnake is a legitimate, accomplished researcher whose vocabulary the whole industry still uses. The only "drama" on record is a single line in a 2009 scene zine that called him a hype-chaser. It stays in the file because it names the oldest quarrel in security — who built the thing versus who got the byline — and because, for once, the receipts settle it cleanly. The through-line is substance outrunning the insult.
the drama timeline
ACT I — THE LAB ON HA.CKERS.ORG (mid-2000s)
A researcher builds a public web-app-security lab and a forum, and the industry quietly starts cribbing from both.
-
MID-2000s
ha.ckers.org and sla.ckers.org
Hansen launches ha.ckers.org, by his own description "a hacker-centric web application security lab and blog," and the companion sla.ckers.org, "a forum for web application security experts." He maintains the ha.ckers.org XSS Cheat Sheet — a running catalogue of cross-site-scripting filter-evasion payloads that becomes a working reference across the field.
-
2006
SecTheory
He co-founds SecTheory LLC with James Flom — the security-research and consulting shop that anchors the next decade of work. The blog was the shopfront; the consultancy was the business.
ACT II — THE VOCABULARY (2008–2009)
Two words he helped put into the language, and a decade later they are still in the defenses.
-
2008
Coining "clickjacking"
With Jeremiah Grossman, Hansen coins the term "clickjacking" — a portmanteau of "click" and "hijacking" for an attack that invisibly overlays a legitimate site's buttons and tricks a user into clicking them. The pair pull their planned OWASP NYC demonstration at Adobe's request after finding the browser-agnostic exploit implicated a Flash flaw. The word enters the OWASP testing guide and every browser's frame-busting defenses.
-
JUN 17, 2009
Slowloris
Hansen releases Slowloris, a denial-of-service tool that takes a web server down from a single machine on minimal bandwidth by opening many connections and sending partial HTTP requests it never completes — holding the sockets open until the server exhausts its connection pool. It becomes a textbook low-and-slow DoS technique.
ACT III — THE ZINE (JULY 2009)
An underground crew publishes a scene zine and, in passing, writes him off.
-
JUL 2009
Zero For 0wned, issue 5
In a section comparing web-app-security figures, the anonymous zine Zero For 0wned takes a swipe: RSnake, it writes, "is all about the hype, the drama, and seeing his name in lights." It is a motive charge, not a competence one — the same passage concedes he "specializes" in web-application security. Against it stand three named, dated, still-in-use contributions from the preceding two years.
ACT IV — POACHER TO GAMEKEEPER (2010s–)
The researcher becomes the executive, and the notoriety becomes a career.
-
2010s
WhiteHat, OutsideIntel, Bit Discovery
Hansen serves as VP of Labs at WhiteHat Security — where he helped launch Aviator, a short-lived privacy-focused browser — then builds the corporate-intelligence platform OutsideIntel, which is folded into Bit Discovery (attack-surface management) in 2018.
-
2022–
Tenable, then out on his own again
Tenable acquires Bit Discovery in 2022 and Hansen becomes Deputy CTO, running its web-app-scanning and external-attack-surface programs. He now works through Grossman Ventures and Root Evidence, hosts The RSnake Show, and has written a book. The template the scene ran a hundred times: researcher, named exploit, consultancy, executive.
both sides, on the record
The zine's charge: Zero For 0wned dismissed RSnake as "all about the hype, the drama, and seeing his name in lights" — a self-promoter riding a buzzy new subfield rather than a quiet builder [6].
The fair, milder version: he is, undeniably, a relentless publicizer of his own findings — the branded blog and forum, the named exploits, the conference circuit, now a podcast and a book. Attention was always part of the method. Whether that is a flaw is a matter of taste, not fact.
The work is real and adopted: "clickjacking" is in the OWASP testing guide and every browser's frame-busting defenses; Slowloris is a textbook low-bandwidth DoS; the XSS Cheat Sheet was a working field reference. These are not press releases — they are still in use [1] [3] [4].
Naming loudly is how a thing gets defended: a technique with a name and a proof-of-concept gets patched, taught, and mitigated; an unnamed one festers. The publicity the zine sneered at is the mechanism by which the industry learned to block both attacks.
The insult was about motive, not competence: the zine's own passage conceded he "specializes" in web-application security. It could not deny the work; it could only guess at why he did it [6].
YOU DECIDE
The only knock on the record is a motive it cannot prove. The contributions it waves away are named, dated, and still in the defenses a decade and a half later. Publicity and substance are not mutually exclusive; in this file they arrived together, and one of them is verifiable.
The archive does not rank researchers by modesty. It keeps the OWASP guide, the vocabulary, and the one zine that called it hype — and lets the reader weigh them.
evidence locker
PRIMARY / FIRST-PARTY
rsnake.com — About FACT — his own bio: ha.ckers.org, sla.ckers.org, the XSS Cheat Sheet, clickjacking, Slowloris, SecTheory (2006, with James Flom), WhiteHat/Aviator, OutsideIntel, Bit Discovery, and Tenable Deputy CTO. Handle @rsnake verified here.
rsnake.com/about.html Slowloris — tool documentation FACT — the POD "ABSTRACT" shipped inside his own tool, describing what Slowloris does in his words (mirror of the original Perl source).
github.com/GHubgenius/slowloris.pl
REFERENCE
Wikipedia — Clickjacking ATTRIBUTED — "Grossman and Hansen coined the term 'clickjacking'" (2008); definition and the OWASP/Adobe disclosure context.
en.wikipedia.org/wiki/Clickjacking Jeremiah Grossman — clickjacking disclosure post ATTRIBUTED — contemporaneous 2008 write-up of the Grossman/Hansen clickjacking research.
blog.jeremiahgrossman.com
THE DRAMA & CROSS-LINKS
Exploit-DB — Zero For 0wned, issue 5 ATTRIBUTED — the anonymous 2009 zine's line that RSnake "is all about the hype, the drama, and seeing his name in lights." An opinion, quoted as the zine's, not this site's.
exploit-db.com/papers/12892
The standard. Robert "RSnake" Hansen is a living, working security professional. His contributions — clickjacking, Slowloris, the XSS Cheat Sheet — are stated as fact and at full strength, because they are documented and adopted industry-wide, much of it on his own site and inside his own tools. The single "hype-chaser" line is a 2009 zine's opinion, quoted as theirs, attributed, and answered by the record. No motive, no fraud, and no wrongdoing is asserted, because none is on the record. If a line here couldn't survive scrutiny, it wouldn't be on the page.