6 ms·

Lovely to know they aren't smart enough to check their other urls: http://www.mythaichicago.com/menu.asp?locationid=000004%20OR%201%20=%201 http://www.mythaich

by imajes 17y ago

Lovely to know they aren't smart enough to check their other urls: http://www.mythaichicago.com/menu.asp?locationid=000004%20OR%201%20=%201 http://www.mythaichicago.com/menu.asp?locationid=000004%20OR... also, the site was built with dreamweaver. Telltale JS markers. Makes me think it's a web agency/ad agency type. EDIT: these are the people responsible: http://www.orangefuse.com/ http://www.orangefuse.com/ - who built www.linusinc.com. I chose another orangefuse site at random and produced an XSS error and a potential path disclosure error (i.e. read other things on the server).

ahi 17y ago
You were able to figure out the orangefuse site? It's flash hell. Only half my clicks are even registering. edit: christ they suck. Check out justlines.com (warning: autoplay sound). Click on portfolio and try to actually use the scrolly thing on the left.
- cmelbye 17y ago
  I can not see how it's possible for people to produce such crap and be okay with it. I couldn't work there without having my perfectionist tendencies causing me to go insane.
  - techiferous 17y ago
    http://www.walk-outs.com/ http://www.walk-outs.com/
tptacek 17y ago
Be careful! People are not always reasonable about security testing, and if they're in the middle of an active investigation about a compromise, you can get slurped up into it by poking at them. That's a time suck and a hassle you do not want.
- imajes 17y ago
  A good point. My gut tells me these people haven't truly gotten it yet. It doesn't take much to go, "hmm, i wonder if any other part of my application might be vulnerable" and these people certainly haven't done that.
  - tptacek 17y ago
    It's the people that don't get it that you have to worry about, because they're just going to let their lawyers do the judging.
- jrockway 17y ago
  Tor++.
clickguy1 17y ago
Could you delete that link? I clicked on it out of habit, but tptacek's comment has me paranoid that my IP is going to end up in an investigation. I'm guessing other people would prefer to just not have the option to click on it.
- Jeema3000 17y ago
  Eh I think you're ok - if they're tracking visitors that closely, they'd know that you came to that link from here after it was already made public. Plus ycombinator.com gets a ton of traffic so I'm sure you're not the only one. :) But yea, probably not a bad idea to delete that link anyway...
  - tptacek 17y ago
    You have no reason to think you're OK for clicking the link. Dazzlingly stupid things like this have happened to people before.
  - clickguy1 17y ago
    I don't think it would help my case if they knew the referring site was called Hacker News.
- ErrantX 17y ago
  Nothing they would be able to do about it particularly. A large number of people probably clicked that link. Getting warrants (or the police) to track up all of the IP's isnt going to happen :) Also: im not sure what they could do. Certainly it breaks no laws I know of.
  - seldo 17y ago
    It could be stretched to "unauthorized use of a computer system" which is the legal definition of hacking. It doesn't have to be difficult to qualify as criminal.
    - ErrantX 17y ago

by imajes 17y ago

ahi 17y ago

You were able to figure out the orangefuse site? It's flash hell. Only half my clicks are even registering. edit: christ they suck. Check out justlines.com (warning: autoplay sound). Click on portfolio and try to actually use the scrolly thing on the left.

cmelbye 17y ago
I can not see how it's possible for people to produce such crap and be okay with it. I couldn't work there without having my perfectionist tendencies causing me to go insane.
- techiferous 17y ago
  http://www.walk-outs.com/ http://www.walk-outs.com/

tptacek 17y ago

Be careful! People are not always reasonable about security testing, and if they're in the middle of an active investigation about a compromise, you can get slurped up into it by poking at them. That's a time suck and a hassle you do not want.

imajes 17y ago
A good point. My gut tells me these people haven't truly gotten it yet. It doesn't take much to go, "hmm, i wonder if any other part of my application might be vulnerable" and these people certainly haven't done that.
- tptacek 17y ago
  It's the people that don't get it that you have to worry about, because they're just going to let their lawyers do the judging.
jrockway 17y ago
Tor++.

clickguy1 17y ago

Could you delete that link? I clicked on it out of habit, but tptacek's comment has me paranoid that my IP is going to end up in an investigation. I'm guessing other people would prefer to just not have the option to click on it.

Jeema3000 17y ago
Eh I think you're ok - if they're tracking visitors that closely, they'd know that you came to that link from here after it was already made public. Plus ycombinator.com gets a ton of traffic so I'm sure you're not the only one. :) But yea, probably not a bad idea to delete that link anyway...
- tptacek 17y ago
  You have no reason to think you're OK for clicking the link. Dazzlingly stupid things like this have happened to people before.
- clickguy1 17y ago
  I don't think it would help my case if they knew the referring site was called Hacker News.
ErrantX 17y ago
Nothing they would be able to do about it particularly. A large number of people probably clicked that link. Getting warrants (or the police) to track up all of the IP's isnt going to happen :) Also: im not sure what they could do. Certainly it breaks no laws I know of.
- seldo 17y ago
  It could be stretched to "unauthorized use of a computer system" which is the legal definition of hacking. It doesn't have to be difficult to qualify as criminal.
  - ErrantX 17y ago