What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 127 Stack Exchange communities.

I am studying security with a pragmatic approach. Since someone pointed me to some "hacker" tools, I am testing the security of my own electronic assets. I have had many doubts since this, but I am afraid of asking them for the sake of my personal reputation. How do the SO and SF communities treat such questions?

Examples of such questions:

"Is it possible to takeover a site with SQL injection vulnerability limited to 100 chars with a SQL Server 2000 backend?"

Examples of possible reactions:

"If you were white hat, you would solve the detected vulnerability instead of investigating further"

share|improve this question
    
You might also like to look at the answers to meta.stackexchange.com/questions/12621/… –  mas Aug 5 '09 at 15:47
add comment

4 Answers

up vote 2 down vote accepted

Asking about attacking a site is NOT the same as preventing vulnerabilities. Asking about how to attack gets to the core of the security question in a much more direct way.

That said, as you can get a feel here on Meta, people will no doubt get the wrong idea. You must "translate' your questions to make it clear that you're not a hacker. That's not hard, since phrasing is a flexible art.

share|improve this answer
    
Instead of "how to attack" I decided to rephrase it as "how to prove that it is vulnerable" –  Jader Dias Oct 5 '09 at 0:24
    
Nice! I love it when you can say the EXACT same thing with different words, instead of changing the concept. –  Yar Oct 16 '09 at 8:41
add comment

I think the problem here is in the phrasing. Rather than ask if it's possible to "take over a site" under a certain circumstance, ask if that site is "vulnerable to attack" under that circumstance.

share|improve this answer
    
thanks, your answer would change the answers from a "How to attack" to an "How to prevent attacks" –  Jader Dias Aug 5 '09 at 13:41
add comment

"Is my SQL Server 2000 secure from SQL injection, if I limit the input to 100 chars?"
Ask the right question ;-)

share|improve this answer
add comment

You should be able to ask whatever questions you like, to get a better picture of potential vulnerabilities. There is so much information out there that it's not worth trying to limit yourself.

Presumably you're asking about how to protect yourself, rather than how to attack other sites.

Rob

share|improve this answer
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .