3 ms·

So I did a bit of digging and found the website in question: http://www.mythaichicago.com/default.asp http://www.mythaichicago.com/default.asp Looks like they

by whyleyc 17y ago

So I did a bit of digging and found the website in question: http://www.mythaichicago.com/default.asp http://www.mythaichicago.com/default.asp Looks like they're still experiencing "issues" - http://www.mythaichicago.com/order.asp?locationid=000004 http://www.mythaichicago.com/order.asp?locationid=000004 reports: "Sorry, On-line ordering is currently undergoing service." No clear indicator who the web design company behind it is though.

Quarrelsome 17y ago
How did you dig that one backwards... ? As far as I could tell you only had an image of the site.....?
- lenni 17y ago
  Screenshot + TinEye?
- whyleyc 17y ago
  Yep just from images (and Google) - I examined one of the images from the post at a higher resolution (by clicking on it) and took a look at the map on the right-hand side. It was a map of Thailand, so that gave me the type of restaurant. From there it was just a simple Google query combining that knowledge with the URL structure revealed in the blog post: http://www.google.co.uk/search?q=thai+restaurant+locationid%3D000004 http://www.google.co.uk/search?q=thai+restaurant+locationid%... Then it was just a case of working through the list of possibilities (it was second on that list) :-)
  - DougBTX 17y ago
    Good searching. Looks like you've found quite a few more vulnerable sites too.
    - dacort 17y ago
      I would wager to say a large majority of .asp sites out there are vulnerable to these types of issues. Most were coded before common sanitization and security practices were observed during dev, not to mention built in to frameworks.
  - 3ds 17y ago
    http://www.google.com/search?q=inurl%3Amenu.asp%3Flocationid+restaurant http://www.google.com/search?q=inurl%3Amenu.asp%3Flocationid...
- BigZaphod 17y ago
  Obviously he just zoomed in and kept saying "enhance image" to his computer until the answer was revealed in a tiny shadow on one of the pixels...
  - MicahWedemeyer 17y ago
    Damn this thing and it's ability to only upvote once!
RyanMcGreal 17y ago
>No clear indicator who the web design company behind it is though. At least the content isn't hidden behind a wall of Flash.
jrockway 17y ago
Very interesting. This is one of my favorite lunch spots; the people that actually run the restaurant are a friend of a friend, and they are super-nice. Too bad they got caught up in this.
- tptacek 17y ago
  The one by DePaul is a block away from our office.
  - deleted 17y ago
    [deleted]

by whyleyc 17y ago

Quarrelsome 17y ago

How did you dig that one backwards... ? As far as I could tell you only had an image of the site.....?

lenni 17y ago
Screenshot + TinEye?
whyleyc 17y ago
Yep just from images (and Google) - I examined one of the images from the post at a higher resolution (by clicking on it) and took a look at the map on the right-hand side. It was a map of Thailand, so that gave me the type of restaurant. From there it was just a simple Google query combining that knowledge with the URL structure revealed in the blog post: http://www.google.co.uk/search?q=thai+restaurant+locationid%3D000004 http://www.google.co.uk/search?q=thai+restaurant+locationid%... Then it was just a case of working through the list of possibilities (it was second on that list) :-)
- DougBTX 17y ago
  Good searching. Looks like you've found quite a few more vulnerable sites too.
  - dacort 17y ago
    I would wager to say a large majority of .asp sites out there are vulnerable to these types of issues. Most were coded before common sanitization and security practices were observed during dev, not to mention built in to frameworks.
- 3ds 17y ago
  http://www.google.com/search?q=inurl%3Amenu.asp%3Flocationid+restaurant http://www.google.com/search?q=inurl%3Amenu.asp%3Flocationid...
BigZaphod 17y ago
Obviously he just zoomed in and kept saying "enhance image" to his computer until the answer was revealed in a tiny shadow on one of the pixels...
- MicahWedemeyer 17y ago
  Damn this thing and it's ability to only upvote once!

RyanMcGreal 17y ago

>No clear indicator who the web design company behind it is though. At least the content isn't hidden behind a wall of Flash.

jrockway 17y ago

Very interesting. This is one of my favorite lunch spots; the people that actually run the restaurant are a friend of a friend, and they are super-nice. Too bad they got caught up in this.

tptacek 17y ago
The one by DePaul is a block away from our office.
- deleted 17y ago
  [deleted]