2

The following question understandably popped up in the Hot Network Questions:

I have the ability to run arbitrary Python code on the 'apache' user. What damage can I do?

To my surprise, however, it basically boils down to "I was tipped off to a vulnerability, help me exploit it". Maybe It's just me, but it doesn't even come off as hypothetical. It doesn't seem, in the slightest, to be in the interest of securing the server, or covering up holes, but further breaking an already broken system.

Are questions like the above question on-topic? Are requests for help in exploiting security holes acceptable on security.SE?

| |
3

I think the question is on topic, ethical and useful. If you find a vulnerability on your system you need to do these things:

  • Make a decision if you should take down the app immediately.
  • Figure out if an attacker has already used the vulnerability to breach your system.

Understanding what the vulnerability could be used for is key to both those things, and indeed the OP was given the very valuable advice to take the app down immediately. Had he not asked, he might not have realised how sever the vulnerability was.

There is a close reason for people asking help on how to hack things:

Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem.

However, I dont think it applies here:

  • Question does not ask how to breach a system, just what damage a vulnerability could do.
  • OP demonstrates some basic understanding of the topic.
| |
  • Very interesting. I did not know about that close reason, and the openness to breaking systems here. I will have to give this some more thought and digest what I thought was blatantly unethical. – Amani Kilumanga Jun 9 '16 at 11:29
  • 1
    @AmaniKilumanga This has been discussed a lot in the past. Here is a good start if you want to read those discussions. It has links to older ones. – Anders Jun 9 '16 at 11:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .