Reputation
556
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
3 8
Newest
 Nice Answer
Impact
~20k people reached

  • 0 posts edited
  • 0 helpful flags
  • 3 votes cast
Nov
30
awarded  Nice Answer
Jan
4
awarded  Nice Answer
Mar
23
awarded  Yearling
Mar
17
awarded  Notable Question
Mar
23
awarded  Yearling
Feb
10
awarded  Popular Question
Oct
28
awarded  Nice Question
Aug
9
revised Canonicalization & Output Encoding
fixed formatting mistake + typo
Aug
9
answered Canonicalization & Output Encoding
Jun
8
comment Class.forName injection and constructor invocation
In this case, I'm the auditor/attacker, and totally agree about stacktraces being a bad idea. I am interested in concrete examples and didn't know that FileOutputStream actually created/emptied files just by being constructed, so +1 for that! Any more examples? Being able to overwrite files is pretty nasty, depending on configuration. Overwriting configuration files could e.g. enable server-side scripts to be served as plain text, and overwriting .htaccess files could also bypass restrictions.
Jun
6
revised Class.forName injection and constructor invocation
added 13 characters in body
Jun
6
comment Class.forName injection and constructor invocation
Ok, some more possibilities: parameter: java.io.FileInputStream This will throw an exception if the init-string does not exist on the filesystem, which will make it possible to determine the location of arbitrary files.
Jun
6
revised Class.forName injection and constructor invocation
added 77 characters in body
Jun
6
asked Class.forName injection and constructor invocation
Mar
27
revised Reveal the True IP of a User
deleted 12 characters in body
Mar
27
answered Reveal the True IP of a User
Mar
25
awarded  Teacher
Mar
24
answered Forgotten password or reset link, which is more secure to email?
Mar
24
comment What's the practical limit for rainbow-table based bruteforce?
@SteveS Agree. I'd even wager that plain text password storage is more common than any hashing more complex than MD5.
Mar
24
awarded  Supporter