recently i was browsing a site, and i noticed that at the end of the URL it said id=168, which is a common indicator that the site is vulnerable to an SQL injection attack. i did some tests and found that i was right, that the site Was vulnerable and that any hacker that wanted to could do some serious damage. i sent them an email from their "contact us" link, informing them of the problem, and asking them to respond indicating that they received the message. it has been 3 weeks, and i have not received an answer. what is the best way to make sure that these people know about this hole in their site?
First, I'd do it semi-anonymously if possible. Laws against hacking are often broad and your actions could be construed as 'hacking' by a paranoid legal team/business types that are more annoyed with having to spend more on website development than having something secure.
Second, I would not explore the extent of the vulnerability due to legal issues. E.g., can I get password hashes? Can I get user data, etc.?
Third, do not disclose the vulnerability or threaten to do so to anyone not at their company; it may take weeks/months for them to get a designer to sensibly fix their existing code. (E.g., the lone developer is on vacation/incompetent/etc).
Fourth, I'd try and check to see if administrator/developer email addresses exist and contact them directly. The
contact-us page could be directed to a marketing department that does not understand what SQL injection means and ignored that email. Do the html pages have any author/company listed in the source code with email contact? Or can you run a
whois on the domain and find a technical contact?
whois stackexchange.com ... TECHNICAL CONTACT INFO Stack Exchange, Inc. Sysadmin Team 1 Exchange Plaza Floor 26 New York NY 10006 US Phone: +1.2122328280 Email Address: [email protected]
You could also try some of the standard emails for a domain (e.g.,
Finally, if none of that works, send another message via 'contact us' that links to articles that introduce what SQL injection is, what dangers it likely presents to their organization, why you noticed that their site was likely vulnerable to it (the same reason nefarious types will notice), and what they have to do to make their site protected against this specific attack.
I have sent off emails like the one you did and have rarely received a reply. Think of it from their point of view: some random person told them that they were hacking their site ... How do you respond to them? If I received an email like that, I'd quickly fix the problem and not respond. I wouldn't want to escalate the 'relationship' any further in case the person contacting me wanted more than just to inform.
There is also only so much you can be responsible for. You inform as best you can, then leave it up to them. It's their site, their risk, their costs to remedy.
There is also a legal concern that you might need to address. By announcing that you used the site in a way that the owner did not intend, you could be subject to hacking laws and you could be liable for any damage that the owner found even if you did not cause it. Know the laws of your jurisdiction and that of the target site.
Not all discoveries come from poking around live sites. CMS's can be downloaded and explored, the same with addons/plugins for the various CMS's.
There is often an arrogance amongst web maintainers when it comes to the security or perception of security they may hold to but I have found most authors to be pleasant and thankful for having stuff pointed out to them.
The most curteous way is to give them a warning then move on. If they do something about it they do something about it. I have of late had curtious responses from people I have contacted, only once last year I experienced a negative reaction to raising an issue, and twice I received no reply when I pointed out an error in CMS plugins.
Generally though the accepted no frills approach is: - notify the owner/author/developer of the issue ( not just a application system user ) - if reply within a week and is courteous, then give them time to fix and release an update if it is that sort of system ( CMS, plugins etc ), then release the bug via one of the online exploit db sites if they haven't already done so themselves. - however if no reply ( even an autoresponse does it for me ) after a couple of repeat notifications and a couple of weeks of waiting, or even worse, you receive a berating from the affected system owner, then 0day it to a bugtraq or exploit database site.
If they were intentionally ignoring your notification, the 0day whilst not the most popular method of notification, generally gets the message to them one way or another.