@(#)Mordred Labs - web security notices ?

[Sir Mordred <mordred () s-mail com>]

Hi,

Well, security admins build honeypots/honeynets to discover
the attack methods, but the only thing they are capable is catching 
a damn kid, who just scanned a very big range of ip addresses and finally
discovered that one host with the ip "1.2.3.4" and the name
"honeypot1.mycompany.com" (and RedHat 6 default install) is vulnerable to a
remote overflow,
for which (i.e. overflow) that kid happen to have an exploit,
which (i.e. exploit) have been coded and published by gobbles one
or two year ago (that kid does not remember such sort of things of
course)...., long preface, yeah? :-)

Note i did not mention about web application security guides, asp best
practices ... etc ... etc

So what?

We are planning to release "security notices" on a regular basis. 
They will be containing an information on the real state of web application
security, with the real world examples.
The examples will be well known high profile web sites/enterprise portals,
mostly the ones which claims to be security related (yeah, even some
hack-groups sites :-) ),
and blame us if our notices will be disclosuring that
when you reguest url http://phpbb.com/news.php?id=11',
you get back something like:
[snip]
Could not query news database
109
/home/virtual/phpbb.com/news.php
SELECT * FROM phpbb_news WHERE news_id = 11\'
[snip]

Leave the anwser to the question "could i actually own the website which
suffers from such vulnerability" as a exercise to the reader.
Remember the article "How i hacked packetstorm" by rfp?
Perhaps we should call these notices "How i almost hacked victim.com"
:-)

We greatly appreciate any thoughts and ideas, even flames, concerning this
topic.

Best regards,
// Sir Mordred










________________________________________________________________________
This letter has been delivered unencrypted. We'd like to remind you that
the full protection of e-mail correspondence is provided by S-mail
encryption mechanisms if only both, Sender and Recipient use S-mail.
Register at S-mail.com: http://www.s-mail.com
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html