full-disclosure - Re: Fun with Foundstone

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue Feb 14 19:49:44 2006
From: davek_throwaway at hotmail.com (Dave Korn)
Subject: Re: Fun with Foundstone

orangeofficer@...hmail.com wrote:
> Things for a security company not to do in a webapp:
>
> 1. Do not auto-populate form fields on the page with customer names.
>
> 2. If you ignore rule number 1, don't use a simple, predictable id
> for said auto-population.
>
> https://download.foundstone.com/?o=^2155

  LOL, blocked already!

> Rinse, increment, and repeat for a list of Foundstone
> customers...or at least a list of companies they've let download
> software.

... or at least a list of a million-and-one variants on "M. Mouse" and "Noah 
Body" ...

   ... nearly _all_ of whom appear to live in Beverley Hills.

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....