我在The Daily WTF上看到过这个。

<script language="javascript">
<!--//
/*This Script allows people to enter by using a form that asks for a
UserID and Password*/
function pasuser(form) {
    if (form.id.value=="buyers") { 
        if (form.pass.value=="gov1996") {              
            location="http://officers.federalsuppliers.com/agents.html" 
        } else {
            alert("Invalid Password")
        }
    } else {  
        alert("Invalid UserID")
    }
}
//-->
</script>

恕我直言，没有什么比这更好的了。

About 3 years ago I built a site for a somewhat large non-profit organization in our state. When it came time to deploy the application to their web host server, I noticed an odd file named "cc.txt" or something obvious like that in their public site. It was under their web root, was getting served, and was a csv file of all their donor's names, addresses, credit card numbers, expiration dates, and CVV/CVC codes. I cannot count the number of times I brought the issue up - first to my boss, then our company accountant, the client's IT director, finally the client's President. That was 3 years ago. The file is still being served, it can even be googled. And it's been updated. I tend not to respond to their donation solicitations when I get them.

有一家银行通过其网站提供一些服务。开发人员考虑了任何作为整个系统的有效用户登录的人，他们使用URL来识别账号，因此只需更改URL上的ID，就可以查看其他账户的余额。

对于认为身份验证和授权是一回事的web开发人员来说，这是非常糟糕的。

此外，银行不通过其网站转账也很好，否则有些人会很富有;-)

最近，我被要求对一家公司的网站进行代码审查，希望我的雇主把这个网站作为一个维护项目。

我没花多长时间就发现了网站根目录下的纯文本文件，其中包含大约6000个客户的信用卡详细信息，包括账单名称、地址和CVV代码。它的名字甚至都没有想象力!

这是该网站最糟糕的问题，但它也充满了SQL注入问题。

我们礼貌地指出了这些问题，网站所有者将其退回到原始开发人员那里寻求解释。

I was going to earn my credit with the supervisor for my quite advanced graphics program at a SunOS / Solaris with instant messaging enabled where with zephyr.vars or whatever it was called you could make an image appear on your listed friend's screen like if you alowed me I could just send you an image that appeared on your display. While I was demoing the program I had written so that the supervisor could give me credit for it, one of my friends sitting close or in the next room made the photo big-mama.xxx appear on my screen. There was never any discussion or penalty because of the incident and I got credit for the project that for ½ second seemed like it was programmed to display big-mama.xxx instead of solving the problem. (Earlier) I updated perl scripts and waited for sysadmin to reflect the changes to ouside the FW. Then the database was gone and it was not a bug it was a feature since the data was stored with the source and therefore updating the source blanked the persistence.

物理访问或模拟登录提示或登录屏幕是另外两种困难的情况，不需要过多的算法技术，很容易理解物理访问提供了许多可能性，模拟登录提示是您可以在许多不同类型的计算机和环境上进行的事情。

我最近看到的最大安全漏洞是iOS 4 (iPhone)的锁屏漏洞，允许任何人立即访问任何iPhone(打电话、地址簿、通话记录、照片)。

http://www.pcworld.com/article/208813/ios_4_lock_screen_security_flaw_grants_access_to_contacts.html