4 ms·

Holy hell... I was expecting some old ncurses mainframe design with shitty interface, but if it's just an href... seems like it'd be trivial to hack and cause h

Holy hell... I was expecting some old ncurses mainframe design with shitty interface, but if it's just an href... seems like it'd be trivial to hack and cause havoc

Karunamon 9y ago
I really, really hope there’s no JS on that page. Because if there is, given the poor design, it’s probably vulnerable to XSRF. Gives a whole new meaning to critical vulnerabilities. Sheesh.
- astura 9y ago
  XSRF has nothing to do with JavaScript. A site is vulnerable to XSRF if it doesn't use tokens when performing critical operations, critical operations are (usually) performed using HTTP POST, which can be done via form submission... token generation and validation is done server side... You can perform a successful XSRF attack in a browser with javascript completely disabled.
  - Karunamon 9y ago
    Wait, so what am I thinking of? The phenomena where if you can get a website to display output of your choosing in a non sanitized way, you can abuse that to cause code to be executed by the user.
    - catmanjan 9y ago
      XSS (cross site scripting)
goatlover 9y ago
Just slap a web interface over everything. I was expecting something old, too. But this is worse, since it's so easy to click the wrong link.
JdeBP 9y ago
An old ncurses or mainframe design would not have had a shitty interface like that. It would have used more than 2 colours. It would have used consistent capitalization. It would not have underlined everything. It would have divided up menu options into related groups. * http://www.cheapraybansunglassesa.com/wp-content/uploads/2017/10/as400-computer-system-keyesmail-connecting-to-a-mail-server-of-as400-computer-system.jpg http://www.cheapraybansunglassesa.com/wp-content/uploads/201... * https://i.stack.imgur.com/8LzMo.jpg https://i.stack.imgur.com/8LzMo.jpg * http://thinview.com/images/emulator.gif http://thinview.com/images/emulator.gif * http://hunterstrainingassociates.com/images/ispf1_25.gif http://hunterstrainingassociates.com/images/ispf1_25.gif * https://as400iseries.files.wordpress.com/2013/03/libraries1.png https://as400iseries.files.wordpress.com/2013/03/libraries1.... * https://seasoft.com/assets/seasoft.com/seasoft.com/public/uploads/accordion/226/_1200x/Anti-Virus_Headline_1.JPG https://seasoft.com/assets/seasoft.com/seasoft.com/public/up...
fallingfrog 9y ago
I can almost guarantee it's a COBOL mainframe with a much more sensible UI which they put a screen scraper over to make it more "modern looking".

Holy hell... I was expecting some old ncurses mainframe design with shitty interface, but if it's just an href... seems like it'd be trivial to hack and cause havoc

Karunamon 9y ago

I really, really hope there’s no JS on that page. Because if there is, given the poor design, it’s probably vulnerable to XSRF. Gives a whole new meaning to critical vulnerabilities. Sheesh.

astura 9y ago
XSRF has nothing to do with JavaScript. A site is vulnerable to XSRF if it doesn't use tokens when performing critical operations, critical operations are (usually) performed using HTTP POST, which can be done via form submission... token generation and validation is done server side... You can perform a successful XSRF attack in a browser with javascript completely disabled.
- Karunamon 9y ago
  Wait, so what am I thinking of? The phenomena where if you can get a website to display output of your choosing in a non sanitized way, you can abuse that to cause code to be executed by the user.
  - catmanjan 9y ago
    XSS (cross site scripting)

goatlover 9y ago

Just slap a web interface over everything. I was expecting something old, too. But this is worse, since it's so easy to click the wrong link.

JdeBP 9y ago

An old ncurses or mainframe design would not have had a shitty interface like that. It would have used more than 2 colours. It would have used consistent capitalization. It would not have underlined everything. It would have divided up menu options into related groups. * http://www.cheapraybansunglassesa.com/wp-content/uploads/2017/10/as400-computer-system-keyesmail-connecting-to-a-mail-server-of-as400-computer-system.jpg http://www.cheapraybansunglassesa.com/wp-content/uploads/201... * https://i.stack.imgur.com/8LzMo.jpg https://i.stack.imgur.com/8LzMo.jpg * http://thinview.com/images/emulator.gif http://thinview.com/images/emulator.gif * http://hunterstrainingassociates.com/images/ispf1_25.gif http://hunterstrainingassociates.com/images/ispf1_25.gif * https://as400iseries.files.wordpress.com/2013/03/libraries1.png https://as400iseries.files.wordpress.com/2013/03/libraries1.... * https://seasoft.com/assets/seasoft.com/seasoft.com/public/uploads/accordion/226/_1200x/Anti-Virus_Headline_1.JPG https://seasoft.com/assets/seasoft.com/seasoft.com/public/up...

fallingfrog 9y ago

I can almost guarantee it's a COBOL mainframe with a much more sensible UI which they put a screen scraper over to make it more "modern looking".