4 ms·
just to confirm. within this scheme, all a website needs is 2 form fields "userid" and "password" , they don't even have to do anything, and if you crawled it,
by lazylizard 9y ago
just to confirm. within this scheme, all a website needs is 2 form fields "userid" and "password" , they don't even have to do anything, and if you crawled it, you've hacked it?
- dsacco 9y agoIf the login interface actually works (i.e. it's actually an access control), and you successfully login with credentials that aren't yours - yes, you've hacked it. It's only a hack if you intend to do it and the interface is a good faith implementation. I don't really follow your question in this comment and the other one though - what do you mean about CIA desires? You need to understand that a technical control represents a control in order to intentionally bypass it.
- lazylizard 9y agothe problem is good faith and desire? if theres a bunch of numbers in my url after i login, and i'm oh so curious what i'd see if i increment that number by 1, now i'm hacking? i mean, i believe the website simply didnt want to implement session control, if i saw someone else's account details, is that acceptable interpretation? there's no "rule of the internet" that says we must only navigate by provided links on a html page, is there?
- dsacco 9y ago> if theres a bunch of numbers in my url after i login, and i'm oh so curious what i'd see if i increment that number by 1, now i'm hacking Under the definition above, if you do it to deliberately bypass the control, then yes. If you do it out of curiosity without believing you might subvert any control, then no you're not hacking.