Hacker News Reader

there is this shit https://github.com/dreadlocked/Drupalgeddon2 that i saw in my logs.

how to report it to github

I'm not sure why you think GitHub ought to take down code for a proof of concept.

its not exactly proof of a concept, there is also a version that allows you to execute anything "as in wget a backdoor" look at the code, with this code you can execute anything at the target/victim.

hell, look right at the message when the target is vulnerable.

Good News Everyone! Target seems to be exploitable (Code execution)! w00hooOO!

Pretty much any non-obfuscated PoC that anyone could come up with for this vulnerability would be trivial to adapt to run malicious code. This doesn't really lower the bar for anyone, and as long as there's no malicious payload, it doesn't seem legally or morally wrong.

(This is not to say that you couldn't end up in a situation where you'll spend a few years and a truckload of money in a legal fight because you've released something like this.)

Reply on news.ycombinator.com