[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]
> Form variable names are no protection if one of them works as an email > address, your bot would just work through permutations till one of them > delivers an email to you. At which point you know you have an > exploitable form and could take the time to look at it manually. > I've actually seen a tool that checks for multiple exploits on different cms/blogware. Works like a web crawler, collects data and when given the command, it starts attacking and trying out all exploits and methods known to man. Only way to protect so far is custom codebase and server side validations. J. -- The Mailing List for the Devon & Cornwall LUG http://mailman.dclug.org.uk/listinfo/list FAQ: http://www.dcglug.org.uk/linux_adm/list-faq.html