Rain Forest Puppy

"Rain Forest Puppy" (commonly abbreviated rfp, and signing technical papers as rain.forest.puppy) was the pseudonym of a security researcher active in the web-application-security scene of the late 1990s and early 2000s. Writing under this handle, rfp published some of the earliest widely circulated public documentation of SQL injection, built one of the first dedicated web-vulnerability scanners, and proposed one of the first formal frameworks for coordinating vulnerability disclosure with software vendors.

Early SQL injection research

On December 25, 1998, Phrack Magazine published rfp's article "NT Web Technology Vulnerabilities" (Phrack issue 54, article 8), signed only "by rain.forest.puppy / [WT] ." Alongside a survey of IIS, FrontPage, .HTR, and ColdFusion sample-application flaws, the article described in detail how attackers could "piggyback" additional SQL commands into unquoted numeric parameters passed to Microsoft SQL Server 6.5 through .IDC and .ASP pages — one of the earliest public, technical descriptions of what became known as SQL injection. rfp returned to related input-handling problems the following year with "Perl CGI problems" (Phrack issue 55, article 7, September 9, 1999), examining null-termination issues in Perl-based CGI scripts.

Whisker

rfp also authored Whisker, a command-line tool that checked web servers against a large, regularly updated list of known vulnerabilities and misconfigurations, making it one of the earlier dedicated web-vulnerability scanners; a 2002 profile also described it as "an anti-IDS Web scanning tool." Version 1.4 of Whisker was co-released with the hacker group Cult of the Dead Cow (cDc) at DEF CON 8 in 2000. The project is no longer maintained.

RFPolicy

On June 12, 2000, rfp posted "RFPolicy for vulnerability disclosure" to the Bugtraq mailing list, describing a short policy (hosted at the time on wiretrip.net, and later archived in full as "RFPolicy v2.0") that proposed giving software vendors five working days to respond to a private vulnerability report, with public disclosure recommended if a vendor stayed silent past that window without a reasonable request for more time. The policy also asked reporters to help vendors reproduce and fix issues, and asked vendors to credit reporters when issuing advisories or patches. rfp was explicit that RFPolicy was not put forward as a mandatory community standard: "My intent is not to push this policy onto the community," the Bugtraq post read; "everyone can obviously do whatever they feel like." It is often cited as among the earliest formal disclosure-coordination proposals, following one attributed to the hacker "Simple Nomad."

Later activity and identity

rfp remained active in the vulnerability-research community into the early 2000s and was among the security-industry figures involved in launching the Open Source Vulnerability Database (OSVDB), announced at Black Hat and DEF CON in August 2002.

rfp's real-world identity is unconfirmed and disputed. A 2002 profile in the Sydney Morning Herald, published after the Whisker/DEF CON 8 release, stated plainly that Rain Forest Puppy "prefers not to have his real name published," indicating deliberate, ongoing anonymity as of that date. Separately, a citation on Wikipedia's SQL injection article attributes the 1998 Phrack piece to a researcher named Jeff Forristal (later known for disclosing the 2013 Android "Master Key" vulnerability) — but that byline does not appear in the original Phrack article itself, the attribution is not repeated in Wikipedia's own articles on RFPolicy, Whisker/Cult of the Dead Cow, or the Phrack 55 piece (all of which credit only "Rain Forest Puppy"), and no independent reporting or primary statement confirming this link could be found. This article therefore treats rfp as a pseudonymous persona whose real name has not been reliably, publicly documented.

Timeline

• 1998-12-25Phrack issue 54, article 8, "NT Web Technology Vulnerabilities," published under the byline rain.forest.puppy; contains one of the earliest detailed public descriptions of SQL injection.
• 1999-09-09Phrack issue 55, article 7, "Perl CGI problems," published, addressing null-termination vulnerabilities in Perl CGI scripts.
• 2000Whisker version 1.4, rfp's web-vulnerability scanner, co-released with the Cult of the Dead Cow (cDc) at DEF CON 8.
• 2000-06-12RFPolicy, an early formal vulnerability-disclosure framework, announced by rfp on the Bugtraq mailing list.
• 2002-08-13Sydney Morning Herald profile describes rfp's Whisker tool and states he "prefers not to have his real name published," documenting deliberate anonymity.
• 2002-08rfp among the security-industry figures who launched the Open Source Vulnerability Database (OSVDB) project at Black Hat/DEF CON.