5 ms·

What if they incremented a number in a url on a publicly available website?

by beaglesss 2y ago

debo_ 2y ago
Is this a reference to a past event? I don't get it.
- deleted 2y ago
  [deleted]
- hyperhello 2y ago
  It's an incredibly basic form of pen testing. For example, this reply page URL refers to id=41393364, which is presumably your comment. So what happens if I replace it with a different number? Probably something innocent, but maybe not.
  - deleted 2y ago
    [deleted]
- qup 2y ago
  Yes. https://www.reddit.com/r/IAmA/comments/1ahkgc/i_am_weev_i_may_be_going_to_prison_under_the/ https://www.reddit.com/r/IAmA/comments/1ahkgc/i_am_weev_i_ma...
  - bjoli 2y ago
    Jeez, I just read about him. Was he the first who went down the alt right pipeline? What happened there? From goatse security to the Daily Stormer.
- beaglesss 2y ago
  In part yes but inevitably devolves into an ad hominem attack against the most high profile case of a guy who did it, who is now hiding in Ukraine on a Prednistrovian passport after having his conviction overturned (temporarily) giving him an escape window.
  - fnfjfk 2y ago
    > hiding in Ukraine Huh. Uh, weird choice, given, well, you know…
    - bjoli 2y ago
      Before he spent some time in Transnistria as well, which is also a weird choice.
      - beaglesss 2y ago
        It's an excellent choice IMO from his perspective. They grant citizenship after 1 year with not a lot of questions and have a cash economy. And they don't extradite to the US.
        jojobas 2y ago
        They'll also not above confiscating your cash and killing you if its suits them. Or (before the war) they wouldn't think twice to send you to Russia to be used as a bargaining chip.
        beaglesss 2y ago
        Weev is effectively banned from the banking system. The list of places with enough infrastructure to survive as a hacker, without foreign citizenship and in a cash/crypto economy with no extradition treaty is thin. I'm sure Transnistria might do that but apparently it wasn't worth their time to kill him. Seems better than North Korea, Iran, or the bush of Africa.
    - pbhjpbhj 2y ago
      Maybe not. If you claim to be living in an active warzone and go missing who would look for you? Flee to Western Europe under an assumed identity, get taken in as a refugee?
      - 2y ago
- debo_ 2y ago
  Thanks for all the references / replies, folks. I appreciate it.
- mmsc 2y ago
  Another one from Australia from over a decade ago: https://amp.smh.com.au/technology/super-bad-first-state-set-police-on-man-who-showed-them-how--770000-accounts-could-be-ripped-off-20111018-1lvx1.html https://amp.smh.com.au/technology/super-bad-first-state-set-...
aftbit 2y ago
Yeah I wouldn't have convicted weev either. There is a difference though. He used that incremented number to access actual user PII. These guys created a user with no PII and no actual malicious use.
- rawling 2y ago
  It looks like they got access to a list of names of existing users.

What if they incremented a number in a url on a publicly available website?

debo_ 2y ago

Is this a reference to a past event? I don't get it.

deleted 2y ago
[deleted]
hyperhello 2y ago
It's an incredibly basic form of pen testing. For example, this reply page URL refers to id=41393364, which is presumably your comment. So what happens if I replace it with a different number? Probably something innocent, but maybe not.
- deleted 2y ago
  [deleted]
qup 2y ago
Yes. https://www.reddit.com/r/IAmA/comments/1ahkgc/i_am_weev_i_may_be_going_to_prison_under_the/ https://www.reddit.com/r/IAmA/comments/1ahkgc/i_am_weev_i_ma...
- bjoli 2y ago
  Jeez, I just read about him. Was he the first who went down the alt right pipeline? What happened there? From goatse security to the Daily Stormer.
beaglesss 2y ago
In part yes but inevitably devolves into an ad hominem attack against the most high profile case of a guy who did it, who is now hiding in Ukraine on a Prednistrovian passport after having his conviction overturned (temporarily) giving him an escape window.
- fnfjfk 2y ago
  > hiding in Ukraine Huh. Uh, weird choice, given, well, you know…
  - bjoli 2y ago
    Before he spent some time in Transnistria as well, which is also a weird choice.
    - beaglesss 2y ago
      It's an excellent choice IMO from his perspective. They grant citizenship after 1 year with not a lot of questions and have a cash economy. And they don't extradite to the US.
      - jojobas 2y ago
        They'll also not above confiscating your cash and killing you if its suits them. Or (before the war) they wouldn't think twice to send you to Russia to be used as a bargaining chip.
        beaglesss 2y ago
        Weev is effectively banned from the banking system. The list of places with enough infrastructure to survive as a hacker, without foreign citizenship and in a cash/crypto economy with no extradition treaty is thin. I'm sure Transnistria might do that but apparently it wasn't worth their time to kill him. Seems better than North Korea, Iran, or the bush of Africa.
  - pbhjpbhj 2y ago
    Maybe not. If you claim to be living in an active warzone and go missing who would look for you? Flee to Western Europe under an assumed identity, get taken in as a refugee?
    - 2y ago
debo_ 2y ago
Thanks for all the references / replies, folks. I appreciate it.
mmsc 2y ago
Another one from Australia from over a decade ago: https://amp.smh.com.au/technology/super-bad-first-state-set-police-on-man-who-showed-them-how--770000-accounts-could-be-ripped-off-20111018-1lvx1.html https://amp.smh.com.au/technology/super-bad-first-state-set-...

aftbit 2y ago

Yeah I wouldn't have convicted weev either. There is a difference though. He used that incremented number to access actual user PII. These guys created a user with no PII and no actual malicious use.

rawling 2y ago
It looks like they got access to a list of names of existing users.