OpenBSD website hacked

[Luke has no name]

http://tinyurl.com/57n7ny

Pretty insane, isn't it? :)

[Luffield]

Yeah, pretty insane. The person who did it didn't choose the most subtle way to make their point, did they? :-\

[jonabyte]

http://www.openbsd.org/cgi-bin/cvsweb/src/?sortby=%22%3E%3Ch1%20style=%22position:absolute;t op:10px;font-size:72pt%22%3E%3Cblink%3ENetBSD%20is%20more%20sec ure%3C/blink%3E%3C/h1%3E


That's not a hack, well at least not on the web server.

[PmDematagoda]

Remove the:-

?sortby=%22%3E%3Ch1%20style=%22position:absolute;t op:10px;font-size:72pt%22%3E%3Cblink%3ENetBSD%20is%20more%20sec ure%3C/blink%3E%3C/h1%3E
after /src and it all becomes normal, I think that link was just specially made to fool people.

[x0as]

http://www.microsoft.com/en/us/default.aspx?pf=true&navGroupName=Ubuntu%20is%20more%20secure

So did microsoft :lolflag:

[keiichidono]

I saw an obvious use of HTML in the URL to make it display on page, it's tom foolery. @Above post, i think you mean to link here (http://www.microsoft.com/en/us/default.aspx?pf=true&navGroupName=Ubuntu%20is%20a%20better%20operating% 20system%20than%20Windows%20in%20every%20way).

[eragon100]

Well it's certainly nice of them to admit it, but eh... I am a bit :confused:, anyway :lolflag:

[Luke has no name]

I saw an obvious use of HTML in the URL to make it display on page, it's tom foolery. @Above post, i think you mean to link here (http://www.microsoft.com/en/us/default.aspx?pf=true&navGroupName=Ubuntu%20is%20a%20better%20operating% 20system%20than%20Windows%20in%20every%20way).

Looks like the hole was closed here.

[fatality_uk]

Hacked :lol:
That's not even a script baby, never mind a script kiddie!!!


method="post" solves numpties messing about like that.

[fluteflute]

method="post" solves numpties messing about like that.

Oh course you can achieve a similar effect, but just not by a simple link. :)

[Le-Froid]

Looks like the hole was closed here.

Nice bump :p

[cardinals_fan]

Looks like the hole was closed here.
What hole?

[aaaantoine]

Hacked :lol:
method=post solves numpties messing about like that.

Validating the query string would be more useful in this case.

This isn't exactly a useful hack, other than a proving that some dangerous things can potentially be done via querystring.

Now, if you used that URL to store text in a database, you'd have a real dangerous vulnerability.

[_DD_]

Its simple XSS/injection/whatever.

Rule #1 of scripting... never trust any variable.

[D-EJ915]

Looks like the hole was closed here.
there never was a hole :P