1

I am talking about

Image upload vulnerability checking in php script

How do we know that this is really OP`s server? Do we support such questions at all?

  • 2
    It doesn't really matter if we "know this is really OP's server". We should give people the benefit of the doubt, since something that may help a black hat will also help a white hat. – forest Apr 6 '18 at 1:04
7

I closed it under

Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem

With my personal emphasis being on, demonstrate an understanding of the concepts involved being missing... it was basically, "Do some work for me."

4

Do we support such questions at all?

In the linked question, OP just dropped some code and asked if it's vulnerable. This sounds to me like a blatant request for code review and definitely didn't demonstrate much research effort.

However, I think they could have made it an acceptable question if

  • they created more of a MCVE instead of just half-pasting, half-linking their original code,

  • they pointed out a specific part of the code which they are unsure about and

  • gave their own thoughts on what's wrong with it and why they suspect it may be vulnerable.

How do we know that this is really OP`s server?

We can never be 100% sure a question is asked in good faith. But we can at least demand that askers do their own research, and try to give educational answers that talk about the involved patterns and techniques instead of just providing them with a free list vulnerabilities in their code.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .