▲ 657 ▼ stop over engineering (programming.dev) submitted 10 months ago by CodiUnicorn@programming.dev to c/programmer_humor@programming.dev 64 comments fedilink hide all child comments
[–] luciferofastora@feddit.org 8 points 10 months ago (1 child) Pentesters: "Bet" permalink fedilink source parent hideshow 2 child comments replies: [–] Blackmist@feddit.uk 1 point 10 months ago (1 child) I haven't been down to test their public wifi in the cafe to see if that can access it. The guy who installed it used to work for us and is a known clown, so it's entirely possible. Although if it is, there's way worse things they can do from there. Like connect to the actual database for a start. permalink fedilink source parent hideshow 2 child comments replies: [–] luciferofastora@feddit.org 2 points 10 months ago Does the database use the same authentication and permissions as the API? If the API authenticates against the DB with a technical user, it may be still be an exploitable vulnerability for people who can't access the DB directly but can access the API. I don't know what database it is, what other databases run on the same server and what privileges might be achievable or escalatable, but generally "there are worse weaknesses" isn't a solid security policy. You could give me a VPN access and I'll take a look around :p (Please don't, actually – in case it needs to be said, running pentests on prod is a dangerously bad idea already even before we get to the whole "trusting a stranger on the Internet just because they sound sorta knowledgeable" issue) permalink fedilink source parent
[–] Blackmist@feddit.uk 1 point 10 months ago (1 child) I haven't been down to test their public wifi in the cafe to see if that can access it. The guy who installed it used to work for us and is a known clown, so it's entirely possible. Although if it is, there's way worse things they can do from there. Like connect to the actual database for a start. permalink fedilink source parent hideshow 2 child comments replies: [–] luciferofastora@feddit.org 2 points 10 months ago Does the database use the same authentication and permissions as the API? If the API authenticates against the DB with a technical user, it may be still be an exploitable vulnerability for people who can't access the DB directly but can access the API. I don't know what database it is, what other databases run on the same server and what privileges might be achievable or escalatable, but generally "there are worse weaknesses" isn't a solid security policy. You could give me a VPN access and I'll take a look around :p (Please don't, actually – in case it needs to be said, running pentests on prod is a dangerously bad idea already even before we get to the whole "trusting a stranger on the Internet just because they sound sorta knowledgeable" issue) permalink fedilink source parent
[–] luciferofastora@feddit.org 2 points 10 months ago Does the database use the same authentication and permissions as the API? If the API authenticates against the DB with a technical user, it may be still be an exploitable vulnerability for people who can't access the DB directly but can access the API. I don't know what database it is, what other databases run on the same server and what privileges might be achievable or escalatable, but generally "there are worse weaknesses" isn't a solid security policy. You could give me a VPN access and I'll take a look around :p (Please don't, actually – in case it needs to be said, running pentests on prod is a dangerously bad idea already even before we get to the whole "trusting a stranger on the Internet just because they sound sorta knowledgeable" issue) permalink fedilink source parent
