3 ms·
This reminds me of setting up a file hosting server at home in high school so i could work on projects from school without constantly burning cds or dealing wit
by yummypaint 4y ago
This reminds me of setting up a file hosting server at home in high school so i could work on projects from school without constantly burning cds or dealing with terrible thumb drives. Sketchy php, no authentication, no sanitization. Just browse to a file and click upload. In hindsight it's kind of shocking it wasn't taken over
- bombcar 4y agoIf you built it yourself, it's highly likely nobody ever found it. Even back then most of the "script kiddies" on the internet were using pre-packaged exploits for known software, not searching every single possible IP for forms with upload buttons.
- LukeShu 4y agoAs someone who was a highschooler 2008-2012 who built their own simple PHP apps for things: Script kiddies of the time definitely were scanning for arbitrary forms. Not necessarily trying to exploit the code, but just anything that would allow them to post spam.
- TOGoS 4y agoI had a big data loss event back in 2008ish when someone found out, I'm guessing, that they could upload a PHP file to an upload-anything form on my home server. I thought I was keeping it secure by disallowing ".php" files, but I think some MultiView option I had set in Apache allowed them to upload .php.somethingelse and still have it get executed, blowing away, sadly, all my Subversion repos. Switched everything I could salvage to Git after that and never looked back. Also I no longer trust Apache to directly serve user-uploaded files. :P Long story short, someone apparently went to a non-zero amount of effort to hack my homebrew file-upload form.