3 ms·
This reminds me of one of my coworkers who was interviewing around for his next job. One company he was interviewing for had a website with public facing user p
by hoherd 3y ago
This reminds me of one of my coworkers who was interviewing around for his next job. One company he was interviewing for had a website with public facing user profiles. My coworker found a SQL injection vuln and wrote a POC virus that would spread to any other account that was logged in while viewing an infected profile and took it with him to his interview, gave them the code, and showed them how they could fix it. He said they were really thankful for the information, but as he was retelling the story to us later we all talked about how that could have gone very badly.
- intelVISA 3y agoLucky for him but that kinda approach can go sideways for the 'candidate' very easily I fear.
- beebmam 3y agoThere's no way he found this without actually performing sql injection attacks. Not a good idea.
- hoherd 3y agoTrue. AFAIK he had created multiple accounts to play with, so he was exploiting his own test accounts. But as I said, we all talked about how risky of a move that was.
- moneywoes 3y agoDid they give him the job? Unfortunately doesn’t sound like a scalable application strategy
- hoherd 3y agoHah, indeed! IIRC he decided not to take the position and stay with the company. I don't know if they made him an offer.