Recon and Attack Vectors from My Logs

Re:Recon and Attack Vectors from My Logs by elric on Sunday October 02, 2022 @09:17AM (#33055638)

We had to modify an application we built for a bank. Stuff could be deleted using HTTP DELETE (after authentication & authorization, of course), which was very much Verboten by their "security" policy. Instead we had to delete using HTTP GET or POST.

[ Parent | on HN ]

Re:Recon and Attack Vectors from My Logs by sam_lowry_ on Sunday October 09, 2022 @01:40PM (#33143472)

I recently came across a Hashcash implementation which used sha-256 instead of sha-1 because of "corporate security" forbidding sha-1.

[ Parent | on HN ]