一位同学曾经不小心把密码发到了推特上……那是个很严重的安全漏洞。

我将分享一个我创造的。种。

多年、多年、多年以前，我工作的公司需要在他们的ASP网站上建立索引。所以我去设置索引服务器，排除了一些管理目录，一切都很好。

然而，我不知道有人给了一个销售人员ftp访问网络服务器，这样他就可以在家工作，这是拨号的日子，这是他交换文件的最简单的方式....他开始上传东西，包括详细说明我们服务....标记的文档当人们搜索“成本”时，索引服务器就会索引并开始提供服务。

记住，孩子们，白名单不是黑名单。

在这里根据记忆来解释，但它很接近……

<form action="secretpage.html" id="authentication"          
      onsubmit="return document.forms.authentication.password.value == 's3cr3t'">
    Enter password: <input type="password" name="password"><br>
    <input type="submit" name="Login" >
</form>

我认识的一个家伙用这个来保护他网站的“私人区域”。起初，他不愿意相信我，甚至他的浏览器都有这个不可靠的“查看源代码”功能。

About 3 years ago I built a site for a somewhat large non-profit organization in our state. When it came time to deploy the application to their web host server, I noticed an odd file named "cc.txt" or something obvious like that in their public site. It was under their web root, was getting served, and was a csv file of all their donor's names, addresses, credit card numbers, expiration dates, and CVV/CVC codes. I cannot count the number of times I brought the issue up - first to my boss, then our company accountant, the client's IT director, finally the client's President. That was 3 years ago. The file is still being served, it can even be googled. And it's been updated. I tend not to respond to their donation solicitations when I get them.

输入所需用户名:iboyd

输入密码:*********

该密码已被该用户名使用。请选择不同的密码。

IIS上的Web应用程序，没有文件上传过滤器。所以你可以上传exe，并做smf乐趣;)