mmmooo

9 ms·

61.
by mmmooo 14y ago
Kind of, anything in permited_uri_chars is allowed. This includes spaces, slashes, commas, %, and a handful of others by default. As I said only skimmed quickly so maybe I'm missing it. Will take a deeper look in a bit once not on mobile.
62.
by mmmooo 14y ago
I live by the communist motto. Trust, but verify.
63.
by mmmooo 14y ago
GET's are all removed (by default), but for uri segments you'll just get some character filters, and some anti-xss attempts (assuming you have that on). Nothing anywhere near sufficient to prevent sql injection. Again, didn't dig too deep,
64.
by mmmooo 14y ago
Just as a quick look, this thing is riddled w/ potential sql injections..a number of unchecked/unescaped uri controlled variables. In some cases there's validation of numerics w/ +=0, but in many cases (e.g. $sort_col) there's none.
65.
by mmmooo 15y ago
"a database", not "the database". it was an actual query result, which for whatever reason I couldn't get to format in any way readable
66.
by mmmooo 15y ago
Not even that uncommon in their scope: select count( ) from profiles where first_name='or'; +----------+ | count( ) | +----------+ | 839 | +----------+ (out of dataset of ~40mil g+ users).
67.
by mmmooo 15y ago
I'm not saying that 100+F degree air is not livable, just relaying non-medical personal experience. I'm not doubting there were other factors, other then the heat, but it was more then just unpleasant. I've been to arizona in the summer (
68.
by mmmooo 15y ago
speaking as someone who has been inside a "hot" datacenter of a few thousand servers (after a failed ac system which didn't trip the alarms for a few hours), uncomfortable does not really begin to cover it. The extremely dry, hot air was q
69.
by mmmooo 15y ago
correct, you would not see IP header, if you were snooping encrypted wireless traffic. But thats not really what was described.. They describe a "wireless router monitoring device"...however I don't think think they mean "wireless router",
70.
by mmmooo 15y ago
tsk-tsk for using the host header value to calculate links in the left side bar to the forums.. e.g. http://forums.110.120/forums/thread/277238.aspx
71.
by mmmooo 15y ago
Looks like just a new owner of 70.32.92.201 where they still have some old dns records pointed..and what you see is the default vhost on new owner's site, blackoakam.com. Nothing to see here.
72.
by mmmooo 15y ago
Exactly, and even if it was 5%, which by no means it is, what % of time is the request vs response. Sounds like this a solution to a non-problem.