Breaking a specific system and How to demonstrate an understanding of concepts involved

Question

I recently noticed that a lot of questions asking for how can I exploit this specific code or filter get closed (but a lot of them also do not get closed) or marked as duplicates of the general topic they cover.

I think that often it's not very clear where the line is between on- and off-topic with these kinds of questions.

It seems that the main purpose of this close reason:

Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem.

is to avoid script kiddies, to avoid questions of the type how to hack website X, and to avoid questions which are only relevant to this code, and this code alone.

A clarifying post here might help to handle these kinds of questions more uniformly.

Examples of what I mean:

1. asking how to exploit a login page, closed as duplicate of the general What is SQL injection? question which doesn't answer the question at all.
2. asking how to exploit login page, open
3. asking how to exploit login page, open
4. asking how to exploit login page, closed
5. asking how to exploit login page, open
6. asking how to exploit login page, closed
7. asking how to bypass ' -> '' filtering in SQL injection, closed
8. asking how to bypass /<(?:\w+)\W+?[\w]/ in XSS, open
9. asking how to bypass /(script|javascript|src|onerror|%|<|>)/g) in XSS, closed
10. asking how to bypass [\w/$!.*-]+$ in XSS, open
11. asking how to bypass filtering of < and >, closed

You get the idea. Some might be duplicates of others, some handle very specific edge cases, but I can't really see a pattern for how these questions are handled, it seems very random. [the questions are from different years, but that also doesn't seem to play a role.]

I don't think the difference is that some demonstrate an understanding of the concepts involved and some don't. One problem seems to be that this is rather vague.

Another problem seems to be the meaning and intention behind the close reason break the security of a specific system for you. What is a specific system? A website? A piece of software? Code that is only used by the OP, but nowhere else?

So I think it would be good to clarify:

• how does one demonstrate an understanding of the concepts involved? And is this really a good part of the close reason?
• what exactly is meant by break the security of a specific system for you?
• in general, are questions like here is my code/filter[, i tried x and y, but for reason z that doesn't work]. how to exploit this? on-topic or off-topic? And when/why is this the case?

Answer 1

I'm seeing some trends in the questions you highlighted (I know it is a small sample set).

1. The OP admits he doesn't know about SQLi - the duplicate question might not answer the question as asked, but provides the background he needs to know
2. Is from 3 years ago, just basic code review, left open because a legacy question
3. is from 2.5 years ago and would likely be closed if asked now, just basic code review
4. is an "exercise" and the OP doesn't have access to the server - classic "help me hack this"
5. is from 1.5 years ago and would likely be closed if asked now, just basic code review
6. is 4 months old, closed, just basic code review
7. is new and the OP doesn't have access to the server - classic "help me hack this"
8. is more about a regex interpretation - different from "help me interpret my own operational code" - I believe this is valid to leave open
9. OP admits that it is a "challenge question" - doesn't show how far he came on his own
10. 2 years old - more of a regex interpretation
11. is new and shows zero understanding or research of the very simple problem

What I'm seeing in the sample set is that, yes, older questions were left open, but the community has shifted and is getting weary of the "code review" type of questions (especially since there is now a forum for that). Homework/challenge questions are closed quickly. Regex questions get people excited to solve the puzzle so they stay open even if they should be closed.

But how do we approach new questions better? I'd say that the ambiguity of the phrase "break the system for you" is ok because it covers a wide range of valid things.

Demonstrating an understanding is key. I, personally, am weary of having to handle questions when I find the answer in a Google query using the question's very own subject line. Those questions become low quality noise.

I, personally, would leave open a question that said Here is my code/filter, I tried x and y, but for reason z that doesn't work. I've read a and b, but I am no further in reaching an answer. What am I missing? and the code sample was not an entire operational code set (like the whole authentication code block). The question is targeted, the problem is constrained, and the OP displays that he did more work than simply copy/pasting his entire program in a question to us.

Answer 2

IMHO its rubbish, there are three problems here, the first is that there is a large number of users that don't recognize that offensive skills are useful for defense, the closing of offensive computing questions is nothing new:

What determines if a question should be considered Blackhat?

Clarify our stance on black hat questions

https://security.meta.stackexchange.com/search?q=blackhat

The second problem is that this specific excuse is used liberally, such as someone asking about exploiting MS08-67 in a lab and getting shut down with this reason and then I have to go and vote to reopen...

The third problem is that it just teaches the script kiddies to lie, and state that they are testing the security of their own website and do a quick search and replace on logs/tool output. Voila, now their "blackhat" question is a "whitehat" question.

Other methods are used too, such as diverting questions about memory corruption or shellcode to other SO sites or closing them as off topic, I just spotted this in my close votes queue as off topic:

Buffer Overflow : segmentation error at 0x90909090