meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year, 3 months |
| seen | Jan 21 at 14:13 | |
| stats | profile views | 8 |
|
Mar 23 |
awarded | Yearling |
|
Feb 10 |
awarded | Popular Question |
|
Oct 28 |
awarded | Nice Question |
|
Aug 9 |
revised |
Canonicalization & Output Encoding fixed formatting mistake + typo |
|
Aug 9 |
answered | Canonicalization & Output Encoding |
|
Jun 8 |
comment |
Class.forName injection and constructor invocation In this case, I'm the auditor/attacker, and totally agree about stacktraces being a bad idea. I am interested in concrete examples and didn't know that FileOutputStream actually created/emptied files just by being constructed, so +1 for that! Any more examples?
Being able to overwrite files is pretty nasty, depending on configuration. Overwriting configuration files could e.g. enable server-side scripts to be served as plain text, and overwriting .htaccess files could also bypass restrictions. |
|
Jun 6 |
revised |
Class.forName injection and constructor invocation added 13 characters in body |
|
Jun 6 |
comment |
Class.forName injection and constructor invocation Ok, some more possibilities: parameter: java.io.FileInputStream
This will throw an exception if the init-string does not exist on the filesystem, which will make it possible to determine the location of arbitrary files. |
|
Jun 6 |
revised |
Class.forName injection and constructor invocation added 77 characters in body |
|
Jun 6 |
asked | Class.forName injection and constructor invocation |
|
Mar 27 |
revised |
Reveal the True IP of a User deleted 12 characters in body |
|
Mar 27 |
answered | Reveal the True IP of a User |
|
Mar 25 |
awarded | Teacher |
|
Mar 24 |
answered | Email forgotten password or send reset link, both just as insecure? |
|
Mar 24 |
comment |
What's the practical limit for rainbow-table based bruteforce? @SteveS Agree. I'd even wager that plain text password storage is more common than any hashing more complex than MD5. |
|
Mar 24 |
awarded | Supporter |
|
Mar 24 |
comment |
What's the practical limit for rainbow-table based bruteforce? Yes, naturally, that's why I specifically pointed out that the passwords were considered random in the context of the question. |
|
Mar 23 |
comment |
What's the practical limit for rainbow-table based bruteforce? What I'm interested in, basically, is what the upper bound on M+N is that can be bruteforced in practice, today, by a dedicated attacker (as per the scenarios). Perhaps the focus that I put on rainbow table was wrong. |
|
Mar 23 |
comment |
What's the practical limit for rainbow-table based bruteforce? Strange choice? It is one that I've seen in use pretty often, that's the only reason. And what does the size of 64bit+ come from? What's behind that figure? |
|
Mar 23 |
awarded | Editor |
