Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 158 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

I am studying security with a pragmatic approach. Since someone pointed me to some "hacker" tools, I am testing the security of my own electronic assets. I have had many doubts since this, but I am afraid of asking them for the sake of my personal reputation. How do the SO and SF communities treat such questions?

Examples of such questions:

"Is it possible to takeover a site with SQL injection vulnerability limited to 100 chars with a SQL Server 2000 backend?"

Examples of possible reactions:

"If you were white hat, you would solve the detected vulnerability instead of investigating further"

share|improve this question
You might also like to look at the answers to… – mas Aug 5 '09 at 15:47
up vote 2 down vote accepted

Asking about attacking a site is NOT the same as preventing vulnerabilities. Asking about how to attack gets to the core of the security question in a much more direct way.

That said, as you can get a feel here on Meta, people will no doubt get the wrong idea. You must "translate' your questions to make it clear that you're not a hacker. That's not hard, since phrasing is a flexible art.

share|improve this answer
Instead of "how to attack" I decided to rephrase it as "how to prove that it is vulnerable" – Jader Dias Oct 5 '09 at 0:24
Nice! I love it when you can say the EXACT same thing with different words, instead of changing the concept. – Dan Rosenstark Oct 16 '09 at 8:41

I think the problem here is in the phrasing. Rather than ask if it's possible to "take over a site" under a certain circumstance, ask if that site is "vulnerable to attack" under that circumstance.

share|improve this answer
thanks, your answer would change the answers from a "How to attack" to an "How to prevent attacks" – Jader Dias Aug 5 '09 at 13:41

"Is my SQL Server 2000 secure from SQL injection, if I limit the input to 100 chars?"
Ask the right question ;-)

share|improve this answer

You should be able to ask whatever questions you like, to get a better picture of potential vulnerabilities. There is so much information out there that it's not worth trying to limit yourself.

Presumably you're asking about how to protect yourself, rather than how to attack other sites.


share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .