> If I would be the attacker I would probably do a SELECT hostname FROM scanresults WHERE webserver == vulnerable-version you would suck. 1. write exploit 2.

> If I would be the attacker I would probably do a SELECT hostname FROM scanresults WHERE webserver == vulnerable-version you would suck. 1. write exploit 2. send exploit 3. a) it worked - pwned b) didn't work - safe against this exploit btw have you heard of security patches? > I don't see how this applies to server information disclosure. http://en.wikipedia.org/wiki/Secure_by_design http://en.wikipedia.org/wiki/Secure_by_design