I am studying security with a pragmatic approach. Since someone pointed me to some "hacker" tools, I am testing the security of my own electronic assets. I have had many doubts since this, but I am afraid of asking them for the sake of my personal reputation. How do the SO and SF communities treat such questions?

Examples of such questions:

"Is it possible to takeover a site with SQL injection vulnerability limited to 100 chars with a SQL Server 2000 backend?"

Examples of possible reactions:

"If you were white hat, you would solve the detected vulnerability instead of investigating further"


4 Answers 4


Asking about attacking a site is NOT the same as preventing vulnerabilities. Asking about how to attack gets to the core of the security question in a much more direct way.

That said, as you can get a feel here on Meta, people will no doubt get the wrong idea. You must "translate' your questions to make it clear that you're not a hacker. That's not hard, since phrasing is a flexible art.

  • Instead of "how to attack" I decided to rephrase it as "how to prove that it is vulnerable"
    – Jader Dias
    Commented Oct 5, 2009 at 0:24
  • Nice! I love it when you can say the EXACT same thing with different words, instead of changing the concept. Commented Oct 16, 2009 at 8:41

I think the problem here is in the phrasing. Rather than ask if it's possible to "take over a site" under a certain circumstance, ask if that site is "vulnerable to attack" under that circumstance.

  • thanks, your answer would change the answers from a "How to attack" to an "How to prevent attacks"
    – Jader Dias
    Commented Aug 5, 2009 at 13:41

"Is my SQL Server 2000 secure from SQL injection, if I limit the input to 100 chars?"
Ask the right question ;-)


You should be able to ask whatever questions you like, to get a better picture of potential vulnerabilities. There is so much information out there that it's not worth trying to limit yourself.

Presumably you're asking about how to protect yourself, rather than how to attack other sites.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .