4 ms·
Not going to say it's not a problem or that it doesn't require fixing. I acknowledge that it can be an issue for some people. However, can someone elaborate th
by w4rh4wk5 6y ago
Not going to say it's not a problem or that it doesn't require fixing. I acknowledge that it can be an issue for some people.
However, can someone elaborate the actual (practical) implications. I.e. problems that emerged from such an issue in the past and caused significant damage in some way.
- hn8788 6y agoI've done pentests where we found a vulnerability that allows writing to arbitrary directories if you have sufficient permissions, and knowing the directory structure would make it so you don't have to guess which directories exist. It would also help if you were trying to bruteforce a login because it can show you what format the username is, like first initial + last name. It's not really much on it's own, but it could definitely be used to make other security issues more effective.