3 ms·
In the absence of a clear guideline, Researcher101 should kick in; it was clearly the wrong thing to do. An apparent refusal to admit that in the write up is m
by ErrantX 11y ago
In the absence of a clear guideline, Researcher101 should kick in; it was clearly the wrong thing to do.
An apparent refusal to admit that in the write up is making it hard to put 100% support behind him.
There is no excuse: dumping the user table was too far.
Facebook went rather far too, of course.
- benmanns 11y agoThis wasn't the end-users table though, it was the admins table. What if there were a table called "security_keys" - would dumping that be disallowed?
- daveguy 11y agoYes. As much or more so than an end user table. You can't dump data and use dumped data acquired from a legitimate vulnerability to continue to gain access to additional resources.