Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Take this scenario:

You browse the web and find a website that is vulnerable to SQL Injection. Being a good guy/gal you report the vulnerability to the site owner (if you are able to find contact details).

What do you do if no one replies back or they say thanks, but never get to fix the problem?

share|improve this question
add comment

3 Answers

up vote 5 down vote accepted

Start by reading the answers to these questions:

Start by trying again, possibly with a different email address (unless you received a personal confirmation, you cant be sure someone actually read your email).

If that doesnt work, I would say it depends:
If its a big, famous site with high visibility, there are sites to publish this to. ( http://isc.sans.edu/diary.html?storyid=8701 lists some, but I'm not completely comfortable with that.)
If its a smaller unknown site - theres no reason to publicize the vuln, it will just draw attackers that otherwise would not even know or bother with them.
Theres really not much else to do - you've already performed your civic duty.

share|improve this answer
add comment

Actually, this is a widespread problem. And no matter if this is small or big website, it happens to get no feedback due to many reasons - no valid contact e-mail, no one is willing to fix, someone just doesn't feel like it is his duty.

Usually, there should be many e-mails for contact with person that is somehow responsible for website management. Pentesters try something like admin@..., security@..., and etc. Other possibility to get e-mail is from DNS whois. That was about case how to find contact.

If you got response, but no one fixes vulnerability during some time, then try to send second mail. Do not spam till death, but kindly remind about issue.

If no one replies and no possibility to get in touch with website representatives, well, then there are still three ways what you can do. Bad sign, but that is a problem of website owner - do they really care? So, at this point you can:

  1. go full disclosure - for example, post at http://www.xssed.com/;
  2. leave vulnerability alone;
  3. patch yourself - yep, break in and fix vulnerability.

Points 1 and 3 are somehow risky, especially 3, but if you do really care, things can be worse. I suppose, that's it.

share|improve this answer
    
+1 Particularly for number 3. Obviously don't advise it but is a good point. –  Mark Davidson Nov 27 '10 at 20:43
add comment

You can check out very identical question asked at StackOverflow Hacking and exploiting - How do you deal with any security holes you find?

There is some good answers there discusisng the ethical thing to do, the legal thing you should do and more.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.