News for hackers. Stuff that matters.

A comment on No Easter Eggs in Curl. Parent comment

Re:No Easter Eggs in Curl by dmitriid on Monday December 06, 2021 @11:14AM (#29461542)
The arsenal of attacks includes "let's try and figure out server version", too.

Because if you know the version, it gives you a shortcut, and you can immediately switch to a smaller arsenal designed for that specific version.

[ Parent | on HN ]
Re:No Easter Eggs in Curl by notfed on Monday December 06, 2021 @11:51AM (#29462136)
On an individual basis it's sometimes hard to see the harm in this. But more specifically the problem with version identifiers is that attackers can scan across many servers, iterating which ones have a certain vulnerable version.
[ Parent | on HN ]