I haven't heard it used in the "wild" yet, and it's not a MITM attack. Just shows how useless this verification method is - if you're hitting a PHP built site -

I haven't heard it used in the "wild" yet, and it's not a MITM attack. Just shows how useless this verification method is - if you're hitting a PHP built site - a relatively simple hack would be to find a PHP page that allows you to upload something, most hosts don't upload to the root but I imagine it'd be trivial to use the upload process against itself. I know W3schools is often thought of as useless, but for the upload script example on there there is no validation: http://www.w3schools.com/php/php_file_upload.asp http://www.w3schools.com/php/php_file_upload.asp I imagine uploading something called "../verifyme.txt" would upload it to the root of the website.