3 ms·
> echo json_encode($search_results); This is how I found out how much I, and all other contractors were being paid. And also how much the contracting company w
by idworks1 5y ago
> echo json_encode($search_results);
This is how I found out how much I, and all other contractors were being paid. And also how much the contracting company was actually charging the clients. All the data was being returned in a json but the very little was being displayed.
Looking at the story, this is more of a posture thing. I'm sure the Governor is surrounded with people who can tell him that no hacking took place, but why miss an opportunity to show you take the privacy of Missourians to heart.
- 0x262d 5y agowow, what fraction of websites leak data I want to look at? should I be poking at every non-tech-giant site I go to?
- cowsup 5y agoCareful, son, you're quickly entering elite hacker turf.
- samstave 5y agoDont worry, I only do all this behind 7 proxies. Plus I called google and they know all about it.
- photochemsyn 5y agoThe analogy is going up to a house and checking all the doors and windows to see if they are locked. That's rather like port scanning, a form of 'poking'. If you go to a state government web site and do that, even if you don't exfiltrate data or load it up with ransomware, it's definitely very shady behavior, although it seems there are no laws against it in the USA (some ISPs will ban users caught doing this however). Obviously if you broke into someone's house and then asked them to pay you for your 'vuln discovery', err... However, I think looking at HTML code on a public facing web page is not that. If you hang naked pictures of yourself on your front door, you don't get to complain when people take pictures of them. 1. https://www.calyptix.com/top-threats/port-scanning-legal-answers-companies/ https://www.calyptix.com/top-threats/port-scanning-legal-ans...
- ajmurmann 5y agoThe data was send to my browser. The more fitting analogy to me is that I get a letter and a huge pile of documents in a giant binder. Some of the documents are referenced in the letter. Now the sender gets upset because I started looking at the documents in the binder that weren't referenced in their cover letter.
- ajmurmann 5y agoSorry to add some more to my own analogy: some of the unreferenced pages in the giant binder also sometimes will contain wiretapping devices.
- codegeek 5y agoYou will be surprised. Do a "Inspect Element" and have fun filtering on "XHR requests". Notice that JSON that a lot of those requests return. but sshhhh, you didn't hear this from me.
- cmckn 5y agoLast year, when a Nintendo Switch was difficult to come by, I found that a large retailer’s API returned exact stock counts (and even restock dates in some cases) for any physical store you wanted. Got a Switch for myself and a couple friends in an afternoon.
- r1ch 5y agoWith the move to client-side rendering, too many. The backend becomes dumber and dumber and all logic such as filtering data moves to the frontend. You'd be surprised what you can find poking around at APIs that client-side apps use.