[Full-disclosure] Re: Fun with Foundstone
davek_throwaway at hotmail.com
Tue Feb 14 19:49:10 GMT 2006
orangeofficer at hushmail.com wrote:
> Things for a security company not to do in a webapp:
> 1. Do not auto-populate form fields on the page with customer names.
> 2. If you ignore rule number 1, don't use a simple, predictable id
> for said auto-population.
LOL, blocked already!
> Rinse, increment, and repeat for a list of Foundstone
> customers...or at least a list of companies they've let download
... or at least a list of a million-and-one variants on "M. Mouse" and "Noah
... nearly _all_ of whom appear to live in Beverley Hills.
Can't think of a witty .sigline today....
Full-Disclosure is hosted and sponsored by Secunia.