How to inform about a website that it can be hacked?
-
Thank you for the advice Ranjan :rose:... But after reading all the replies , I have come to a conclusion that honesty can get me killed... Why take chances? Let other people enjoy the free goods. Since those are digital good, it will never run out-of-stock...
-
well, you could go through a proxy web service to a second proxy then to the web mail.... :-D
Beauty is in the eye of the beer-holder Be careful which toes you step on today, they might be connected to the foot that kicks your butt tomorrow. You can't scare me, I have children.
-
If you're worried about potential repercussions, and you have acted in good faith, I would suggest that you should just create a one off email account, and then send them the details.
*pre-emptive celebratory nipple tassle jiggle* - Sean Ewington
"Mind bleach! Send me mind bleach!" - Nagy Vilmos
CodeStash - Online Snippet Management | My blog | MoXAML PowerToys | Mole 2010 - debugging made easier
Well they could still track his IP address. That said I'd think they'd be happy that he reported this to them.
Regards, Nish
My technology blog: voidnish.wordpress.com
-
I recently bought some digital goods from a website. I paid online via credit card and got access to a limited resources to be downloaded. While downloading those goods, I found that just by changing the query string parameter in the URL I can download other items that I have not purchased. How can I inform the website owners about this vulnerability? Will the website owner charge me with the offense of hacking since the goods I did not pay for were downloaded on my machine when I was testing this vulnerability . I did not use them neither save them on my machine. I just discarded the download dialog box.
You are probably right that you should be careful here. The webshop owner will forward this to the webshop creator and assuming they'll try anything to avoid a legal consequences themselves, they may try to sue you instead. A judge may not fully understand the difference between testing a website and "testing" if you could steal a car (even if someone left the keys in the ignition). So protecting your anonymity is probably advisable in this case.
.
-
Well they could still track his IP address. That said I'd think they'd be happy that he reported this to them.
Regards, Nish
My technology blog: voidnish.wordpress.com
I hesitated to mention that if he was so paranoid on it, he could visit a cyber-cafe to send the message.
*pre-emptive celebratory nipple tassle jiggle* - Sean Ewington
"Mind bleach! Send me mind bleach!" - Nagy Vilmos
CodeStash - Online Snippet Management | My blog | MoXAML PowerToys | Mole 2010 - debugging made easier
-
I recently bought some digital goods from a website. I paid online via credit card and got access to a limited resources to be downloaded. While downloading those goods, I found that just by changing the query string parameter in the URL I can download other items that I have not purchased. How can I inform the website owners about this vulnerability? Will the website owner charge me with the offense of hacking since the goods I did not pay for were downloaded on my machine when I was testing this vulnerability . I did not use them neither save them on my machine. I just discarded the download dialog box.
One option is to send your email via proxy. Not the internet kind but the classic kind. If you have a friend who lives out of state or even better out of the country, better yet a lawyer, just send your message to them and get them to copy and paste it into a new email, to trash the headers. That way your friend can honestly say it wasn't him but he is just informing them on behalf of another concerned friend of his/hers. This way your friend has absolutely no connection with the site, make sure they haven't purchased something from them before, and you are safe because your friend wouldn't tell them who you are ... even when their pulling your friends fingernails out. This even seems to be a little much because, as it was pointed out before, the website owner/developer will sure be happy someone pointed it out instead of posting the details online and costing them potentially thousands of dollars in lost sales.
Don't comment your code - it was hard to write, it should be hard to read!
-
I wish I remembered the article I read a few weeks (months) back. Basically, it was about a guy being charged for hacking because he changed the URL parameters when he visited a site. So, be careful with your decision. The laws are so strict and the punishments are so harsh now (e.g. Aaron Swartz) that I am even afraid to post anything on the web.
-
I recently bought some digital goods from a website. I paid online via credit card and got access to a limited resources to be downloaded. While downloading those goods, I found that just by changing the query string parameter in the URL I can download other items that I have not purchased. How can I inform the website owners about this vulnerability? Will the website owner charge me with the offense of hacking since the goods I did not pay for were downloaded on my machine when I was testing this vulnerability . I did not use them neither save them on my machine. I just discarded the download dialog box.
aspnet_regiis -i wrote:
I have come to a conclusion that honesty can get me killed[^].
What in the heck kind of software are you downloading? Never mind... :~
It was broke, so I fixed it.
-
I hesitated to mention that if he was so paranoid on it, he could visit a cyber-cafe to send the message.
*pre-emptive celebratory nipple tassle jiggle* - Sean Ewington
"Mind bleach! Send me mind bleach!" - Nagy Vilmos
CodeStash - Online Snippet Management | My blog | MoXAML PowerToys | Mole 2010 - debugging made easier
What about the fingerprints he is going to left behind? I would suggest altering his fingers with an acid before that.
There is only one Vera Farmiga and Salma Hayek is her prophet! Advertise here – minimum three posts per day are guaranteed.
-
I recently bought some digital goods from a website. I paid online via credit card and got access to a limited resources to be downloaded. While downloading those goods, I found that just by changing the query string parameter in the URL I can download other items that I have not purchased. How can I inform the website owners about this vulnerability? Will the website owner charge me with the offense of hacking since the goods I did not pay for were downloaded on my machine when I was testing this vulnerability . I did not use them neither save them on my machine. I just discarded the download dialog box.
aspnet_regiis -i wrote:
Will the website owner charge me with the offense of hacking since the goods I did not pay for
That would be pretty sad if they do. They should consider it damage control cost and be thankful that you saved their a**es.
I wasn't, now I am, then I won't be anymore.
-
I recently bought some digital goods from a website. I paid online via credit card and got access to a limited resources to be downloaded. While downloading those goods, I found that just by changing the query string parameter in the URL I can download other items that I have not purchased. How can I inform the website owners about this vulnerability? Will the website owner charge me with the offense of hacking since the goods I did not pay for were downloaded on my machine when I was testing this vulnerability . I did not use them neither save them on my machine. I just discarded the download dialog box.
I saw something similar on a beverage company's website once. You gave them a username and password to log in. Once you did you saw &clientID=123 in the URL. By changing this you could see ANY of their other clients information and place orders for them. Does Bob in Connecticut need $1200 of french roast? Only one way to find out... :rolleyes:
Play my game Gravity: IOS[^], Android[^], Windows Phone 7[^]
-
aspnet_regiis -i wrote:
Will the website owner charge me with the offense of hacking since the goods I did not pay for
That would be pretty sad if they do. They should consider it damage control cost and be thankful that you saved their a**es.
I wasn't, now I am, then I won't be anymore.
-
I recently bought some digital goods from a website. I paid online via credit card and got access to a limited resources to be downloaded. While downloading those goods, I found that just by changing the query string parameter in the URL I can download other items that I have not purchased. How can I inform the website owners about this vulnerability? Will the website owner charge me with the offense of hacking since the goods I did not pay for were downloaded on my machine when I was testing this vulnerability . I did not use them neither save them on my machine. I just discarded the download dialog box.
aspnet_regiis -i wrote:
I found that just by changing the query string parameter in the URL I can download other items that I have not purchased.
Why you’ve done this on a first place? And what the first guy who found the cow milk is drinkable was trying to do?
There is only one Vera Farmiga and Salma Hayek is her prophet! Advertise here – minimum three posts per day are guaranteed.
-
What about the fingerprints he is going to left behind? I would suggest altering his fingers with an acid before that.
There is only one Vera Farmiga and Salma Hayek is her prophet! Advertise here – minimum three posts per day are guaranteed.
And shaving his body so he doesn't leave hair behind; wouldn't want trace DNA coming back and biting him. Oh, and while he's at it, he should wear a mask to thwart video surveillance.
*pre-emptive celebratory nipple tassle jiggle* - Sean Ewington
"Mind bleach! Send me mind bleach!" - Nagy Vilmos
CodeStash - Online Snippet Management | My blog | MoXAML PowerToys | Mole 2010 - debugging made easier
-
I wish I remembered the article I read a few weeks (months) back. Basically, it was about a guy being charged for hacking because he changed the URL parameters when he visited a site. So, be careful with your decision. The laws are so strict and the punishments are so harsh now (e.g. Aaron Swartz) that I am even afraid to post anything on the web.
This? Somewhat similar to what you're talking about.
-
And shaving his body so he doesn't leave hair behind; wouldn't want trace DNA coming back and biting him. Oh, and while he's at it, he should wear a mask to thwart video surveillance.
*pre-emptive celebratory nipple tassle jiggle* - Sean Ewington
"Mind bleach! Send me mind bleach!" - Nagy Vilmos
CodeStash - Online Snippet Management | My blog | MoXAML PowerToys | Mole 2010 - debugging made easier
A mask will be highly suspicious, someone could call the authorities. A little face surgery, or temporally sex change, will be more appropriate given the circumstances.
There is only one Vera Farmiga and Salma Hayek is her prophet! Advertise here – minimum three posts per day are guaranteed.
-
I recently bought some digital goods from a website. I paid online via credit card and got access to a limited resources to be downloaded. While downloading those goods, I found that just by changing the query string parameter in the URL I can download other items that I have not purchased. How can I inform the website owners about this vulnerability? Will the website owner charge me with the offense of hacking since the goods I did not pay for were downloaded on my machine when I was testing this vulnerability . I did not use them neither save them on my machine. I just discarded the download dialog box.
-
I recently bought some digital goods from a website. I paid online via credit card and got access to a limited resources to be downloaded. While downloading those goods, I found that just by changing the query string parameter in the URL I can download other items that I have not purchased. How can I inform the website owners about this vulnerability? Will the website owner charge me with the offense of hacking since the goods I did not pay for were downloaded on my machine when I was testing this vulnerability . I did not use them neither save them on my machine. I just discarded the download dialog box.
-
Well they could still track his IP address. That said I'd think they'd be happy that he reported this to them.
Regards, Nish
My technology blog: voidnish.wordpress.com
Nish Sivakumar wrote:
That said I'd think they'd be happy that he reported this to them.
In general that is unlikely to be true. One can suppose any number of corporate scenarios - Company bought the shopping cart software. - Company contracts via another company for a shopping cart site. - Large company with small in house development. - Company which contracted custom site. - Small company with large (compared to rest of company) development staff. I suspect that only the last would be happy about it.
-
Anonymous email can not be a foolproof solution since it can also be traced. Now after reading all these replies, I think it will be a waste of my hard earned money to send a international snail mail to a person who can get me sued..
aspnet_regiis -i wrote:
Anonymous email can not be a foolproof solution since it can also be traced.
Rather certain that is not true. There is of course a difference between annoymous email and just creating an email account and using ficticious registration information.
