你见过的最糟糕的安全漏洞是什么?为了保护罪犯,限制细节可能是个好主意。

不管怎样,这里有一个关于如果你发现了安全漏洞该怎么办的问题,还有一个关于如果公司(似乎)没有回应该怎么办的问题。


当前回答

Windows 95和98有史上最严重的漏洞。如果你只是按下取消,你将以管理员权限登录:)在我爸爸的工作中度过了美好的时光:D

其他回答

我希望你能发现这里的问题。(事实上,大错特错):

String emailBody = "";

for (int i = 0; i < subscribers.Count; i++)
{
    emailBody += "Hello " + subscribers[i].FirstName + ",";
    emailBody += "this is a reminder with your account information: \n\n:";
    emailBody += "Your username: " + subscribers[i].Username + "\n";
    emailBody += "Your password: " + subscribers[i].Password + "\n";
    emailBody += "Have a great day!";

    emailDispatcher.Send(subscribers[i].EmailAddress, emailBody);
}

最后一个接受者是最幸福的;)

我所见过的最糟糕的安全漏洞实际上是由你们公司编写的,导致谷歌机器人删除了我的整个数据库。

当我第一次学习经典ASP时,我编写了自己的基本博客应用程序。包含所有管理脚本的目录在IIS上受到NTLM的保护。有一天,我移动到一个新的服务器,忘记重新保护IIS中的目录(哎呀)。

博客主页有一个指向主管理界面的链接,主管理界面为每条记录都有一个DELETE link(没有确认)。

有一天,我发现数据库中的每一条记录都被删除了(数百条个人记录)。我以为是某个读者闯入了网站,恶意删除了所有的记录。

我从日志中发现:谷歌机器人爬了站点,跟踪管理链接,然后继续跟踪所有的DELETE链接,从而删除数据库中的每一条记录。我觉得我当之无愧的年度傻瓜奖被谷歌机器人无意中损害了。

谢天谢地,我有备份。

当我13岁的时候,我的学校为学生开设了一个社交网络。不幸的是,我发现了一个安全漏洞,可以将URI更改为另一个用户id,如“?”userID=123”,并为该用户登录。显然,我告诉了我的朋友们,最后学校的社交网络充满了色情。

不过我不推荐。

About 3 years ago I built a site for a somewhat large non-profit organization in our state. When it came time to deploy the application to their web host server, I noticed an odd file named "cc.txt" or something obvious like that in their public site. It was under their web root, was getting served, and was a csv file of all their donor's names, addresses, credit card numbers, expiration dates, and CVV/CVC codes. I cannot count the number of times I brought the issue up - first to my boss, then our company accountant, the client's IT director, finally the client's President. That was 3 years ago. The file is still being served, it can even be googled. And it's been updated. I tend not to respond to their donation solicitations when I get them.

默认登录凭据,特别是当是admin/root和密码时。