full-disclosure - more chess fun...;)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: roelof at sensepost.com (Roelof Temmingh)
Subject: more chess fun...;)

Speaking of chess - a friend invited me tonight to play a game of "email
chess" on Shockwave's site. There's no authentication ... the URL looks
like this:

http://www.shockwave.com/rd/ec.cgi?id=2004/2/1/12029_xxxxxx&player=b

Where xxxx is a random number.

Now, take a guess what happens if you change the "b" at the end (clearly
for "black") to "w" (for white). It goes a bit like this:

"now THAT was a crap move..why did you do THAT?"
"uhmmm...I didn't! It moved by itself?!"

<evil grin>

Thought it to be slightly amusing..:)
Roelof.

=====================
Roelof Temmingh
+27 12 667 4737
GMT+2
=====================