There's a certain website designed so that junior QAs learn to find bugs. Trouble is:
- there's no IP filtering
- users are very junior so they use their real names as user names and probably reuse their only password.
I do not intend to attack it nor do I have anything to gain from that; furthermore I've informed the owner of the security flaws - this should put Your moral compass at rest.
Imagine I want to attack it, but I am reluctant to exploit vulnerabilities of the server, router or ISP for fear of being legally liable. Nor am I on the same LAN. Can the traffic be somehow observed remotely?