Is this question about doing damage on a system ethical and on-topic?

Question

The following question understandably popped up in the Hot Network Questions:

I have the ability to run arbitrary Python code on the 'apache' user. What damage can I do?

To my surprise, however, it basically boils down to "I was tipped off to a vulnerability, help me exploit it". Maybe It's just me, but it doesn't even come off as hypothetical. It doesn't seem, in the slightest, to be in the interest of securing the server, or covering up holes, but further breaking an already broken system.

Are questions like the above question on-topic? Are requests for help in exploiting security holes acceptable on security.SE?

Answer 1

I think the question is on topic, ethical and useful. If you find a vulnerability on your system you need to do these things:

• Make a decision if you should take down the app immediately.
• Figure out if an attacker has already used the vulnerability to breach your system.

Understanding what the vulnerability could be used for is key to both those things, and indeed the OP was given the very valuable advice to take the app down immediately. Had he not asked, he might not have realised how sever the vulnerability was.

There is a close reason for people asking help on how to hack things:

Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem.

However, I dont think it applies here:

• Question does not ask how to breach a system, just what damage a vulnerability could do.
• OP demonstrates some basic understanding of the topic.