- cross-posted to:
- [email protected]
You must log in or register to comment.
little bobby tables’ dad.
Could even be his twin - that joke is from 2007, if little Bobby was in kindergarten then he’d be around 22 by now and could be trying to land his first job out of college!
Wow, an XKCD-style feel-old fact about XKCD.
Little Bobby Tables all grown up 😢
What’s the second one do?
Bypassing authentication or checks by incorporating a statement that always returns true, and doing an ‘or’ operation with the statement being injected. It manipulates the return value of the SQL statement to make it always return true, so if the website is checking if the statement returned true to indicate, for example, the password is correct, it will now think that was the case.
I remember the first time I shipped a website with that SQL injection.
It got taken over surprisingly quickly.
Crackers work hard.
Edit: Wait, does that mean you did it again? Haha.
I just wiped the DB and put it back online again.
I did fix it, but had to rewrite a lot of the PHP backend, which took a couple days.
And yes, I did release another website with SQL injection… It was a personal website for my brother and the pagination was vulnerable. I had written a simple CMS for it, but Instead of a password I just generated an obscure URL with completely open access to edit the DB directly.
The pagination got hacked but I fixed it pretty quickly (by checking the page number was in fact a number).
Surprisingly the CMS never got hacked before I moved him over to WordPress.
Younger me learned a lot of web dev lessons the hard way.
ETA: This was all when I was a teen and I had nobody in my life to teach me these things. I was self taught from a PHP book from the library.
Ah yes, the honest days of development, when you just got your hands dirty and didn’t have to worry about expensive formal education and stupid interview tactics.
It was fun and I learned a lot. I mostly did small time jobs for local companies and used the money for my tuition. Most sites were just static HTML, and I could program flash, so there wasn’t much risk to it.
I am glad we have git instead of various backup folders on an ftp server, continuous integration, unit tests, and frameworks/accessible info to prevent the more basic errors.
There is reasons it ended, and some of them good. Sorry, got caught up in nostalgia a bit there.
You can still write open source stuff without needing anything besides technical knowledge, if you are in a situation where you have extra time and energy after feeding yourself.
So does that imply they already knew the candidate they were hiring, and were just checking if this is the guy?
IDK I didn’t think that much into it lol
Yeah, this seems like an exploit for those cases.
No the interviewer is personification of the naive backend that checks only that a specific row is present in the DB, or that’s how I read it.
So I guess the interview is handled by a non-vulnerable intermediate process, which adds the hire to the the main table of employees when at some point in a successful interview, and then calls a notification process that just searches it?
yeah something like “if new candidate in employee DB == hired”
