241–247 of 247 posts
Earlier quoted context omitted.
Absolutely not. > Did you get mid-high 5 figures for a serverside vulnerability? I hear the Russians are paying $300k for Postfix! But the UAE might pay $400k through Crowdfense. These numbers are definitely real. How could they not be? They're right there on a web page. > Oh, you've done business with them then? Know someone who has? You’re replies have been snide and rude and you trying to pivot and say “you were m…
[flagged]
Earlier quoted context omitted.
One usually uses "query builder" pattern for that. Also, regarding placeholders, historically many DB and frameworks do not support passing lists for a value in a placeholder (like "WHERE id IN(?)") so users of such software fall back to string concatenation.
ORMs and query builders ARE concatenating strings.
Earlier quoted context omitted.
What do you think the venn diagram looks like for people willing and able to find things like that prior to LLMs and also sell them to a broker, and are also stupid enough to flaunt a massive flashing "arrest me!!!" sign Closest you're going to get is something like those kids in florida who just got wrapped for putting malware into steam games and draining peoples accounts. They were going to get caught anyways but…
Is this comment pure speculation, or do you have knowledge (or anecdotal evidence) of a similar exploit being sold for $500k?
Earlier quoted context omitted.
They would not catch it, it requires combining multiple vulns.
I just meant the SQLi (which is the basis of the chain), not the full chain.
Earlier quoted context omitted.
[flagged]
Let me convince you! :-) There are match expressions and arrow functions: $slug = $title |> trim(...) |> (fn($str) => str_replace(' ', '-', $str)) |> (fn($str) => str_replace('.', '', $str)) |> strtolower(...); There is meta-programming with annotations: final class PostsController { #[AccessControl(fn(Request $request, Post $post) => $request->user === $post->getAuthor() )] public function update(Request $request, P…