3 ms·

This guy claims SQL injection and XSS.

• akama 13y ago
  Dave Kennedy is a reputable source of security info. If he claims something, I would be inclined to listen.
• deleted 13y ago
  [deleted]
• tptacek 13y ago
  Where did you see those claims? I would not be amazed to learn that there was SQLI on the site, but I don't see it in his report. Are you talking about his report to the press earlier in November? He appeared to have been referring to cached search autocomplete terms with SQL syntax in them, evidence of people attempting SQL injection against the site. Which, of course, people would do whether the site was Healthcare.gov or CatBnb.com.
  • wdewind 13y ago
    Maybe he didn't, I tried to guess what he meant when he says, > "Everything from hacking someone's computer so when you visit a website it tries your computer back to being able to extract first names, last names, locations" at 0:24 and guessed XSS + SQLI but I could be wrong about the SQLI now that I'm paying closer attention to how he phrased it.