3 ms·

"I thought about writing an email to these people, let them know about the vulnerabilities in their code, and the bad practices they have, but I didn’t at this

• r1ch 5y ago
  Once he found the SQL injection, downloading the tables was too far IMO. On the other hand if he had stopped at this point, the company would have no idea about the weak admin credentials that could lead to real data breach and internal compromise at a later date.
  • indigodaddy 5y ago
    If he has no malicious intent and is not going to view/sell or do anything malicious with the data, I think it’s fine or even beneficial for him to continue to find further vulnerabilities and then report the whole package of vulnerabilities to the company. As long as he wraps it up within a few hours or say max 24 hrs and then immediately reports after that.
• uncomputation 5y ago
  Yeah, once I read that, the entire rest of the post had a suspect tone, even if it was very informative and enlightening (as someone with 0.00 infosec experience). I understand if you discover the vulnerability from curiosity and stop and report. But to keep going to “find more things [about] the company” seems pretty obviously illegal or at least gray morally.
• nerdawson 5y ago
  Yeah, very poor judgement. What he did was deeply unethical and almost certainly illegal. You don't get a free pass to break into wherever you like simply because your intentions aren't malicious. That's what professional pen-testers are for.