3 ms·
Why do you think he "only" downloaded the source ? He wrote: I got 1.2 GB of data to go through. The data-set contained: Wordpress configuration f
by TekMol 8y ago
Why do you think he "only" downloaded the source ? He wrote:
I got 1.2 GB of data to go through. The data-set
contained:
Wordpress configuration files (yes, they use Wordpress)
including hashed user credentials for the backend login
Database passwords for production databases
Log files
A lot of PHP source code
(who could have guessed?!)
much more …
- ashelmire 8y agoThey publicly hosted their .git folder on their web server (which it says in the blog post). They had those things committed to version control (stupid) and publicly served it (stupid). Nothing was stolen.
- coldcode 8y agoIf something is available via HTTP that you didn't want, how is it different than downloading HTML that you did? The protocol knows nothing about your intent.
- jonknee 8y agoBecause that's not user data? That's code...
- sdinsn 8y ago> Database passwords for production databases You can use those to obtain user data. > Log files Easily could contain user data.