Re:Reporter may be prosecuted for using “view source”
by jdavis703 on Thursday December 30, 2021 @01:07PM
(#29739331)
SQL injection is probably malformed input in lots of cases and should return a 400 Bad Request. If you are returning a 200 maybe you really did want to take SQL (think of Mode or PHPMyAdmin).
[ Parent
| on HN ]
Re:Reporter may be prosecuted for using “view source”
by underwater on Thursday December 30, 2021 @04:31PM
(#29741692)
That's the entire point of hacking, circumventing protections that the server has in place to get a response you were not supposed to get. The status code is irrelevant.
The same applies in the real world too. If I perform a social engineering hack and get you to pay a fake invoice, it's still theft (or fraud), even though someone willingly and deliberately sent you money.
Re:Reporter may be prosecuted for using “view source”
by Tagbert on Thursday December 30, 2021 @03:22PM
(#29740997)
That assumes that the server recognized it as invalid. It it had, then it should take measured to block the input, but if the attack succeeded then the server would not be recognizing the attach and would respond with a 200