185 reputation
119
bio website bb.com.br
location Águas Claras, Brazil
age 30
visits member for 3 years, 1 month
seen May 4 at 14:18

I am actualy working for Banco do Brasil, building the app programs in Objective-C.


Jan
9
comment What is the severity if someone read the ConnectionStrings_Prod.config?
Hi. I was able to find a place with sql injection that only work if I have the password. And think what... I have it :D So, yes. This information can be useless. But, you can use it in another place. Thanks for the tips.
Dec
12
comment What is the severity if someone read the ConnectionStrings_Prod.config?
Lol, the "web based system" is just the web page. I just thought it a common name. This is not a intranet or things like that. Everyone can access and even login as administrator with a web browser in internet. Obvious the database is more restrict.
Dec
10
comment Is string concatenation vulnerable to null character in aspx?
As far I know, I tested for 0x00, %00, %00000. I see if I send " or & the function say it is a ilegal character for file name.
Dec
10
comment Is string concatenation vulnerable to null character in aspx?
lol, I already tested of %00. I understand that it need to check the file type. But the guys are saying it is too dificult for every type. They say they can't see a way to break it.
Mar
28
comment Is it possible to steal money directly from the systems of a big bank?
Ok, how much money you want? But first you need send-me a little to pay bank tax and trade tariffs :)
Mar
28
comment Are Three attempts to block login a good idea?
Sometimes I think to do a program that block all logins, I just need to test a wrong password in every account... But I can be fired :(