Comment by sigmoid10 | Hacker News Reader

Comment by sigmoid10 | Hacker News Reader

Parent Full thread

>I'd heard of sqlmap but I didn't realize it was so good

The blog correctly explains how it has become pretty useless in our age where noone writes their own database integration anymore and everyone uses off-the-shelf components, but man... I remember a time when it felt like literally every sufficiently complex web service was vulnerable to sql injection. You could write a small wrapper for sqlmap, hook it up to the results of a scraper, let it run over night on every single piece of data sent to the server and the next day you'd have a bunch of entry points to choose from. It even handled WAFs to some degree. I'm out of it-sec for several years now, but I still remember every single command line argument for sqlmap like it was yesterday.

Ive always admired hn for bringing me people in very different spaces. Of the development teams I've worked with in the last year pretty much all of them were writing injectable code by default. Ive got an email from an executive in a saas telling me they aren't worried because they geofilter china.

what?

Implying Chinese hackers can't use a VPN to bypass that geofilter lol

Even more ironic considering that China already geofences itself and using a VPN it pretty much a requirements if you want to communicate with the outside world.

Chances are that these hackers are bypassing that filter without even realizing it.

Chinese state-employed hackers don't have to worry about VPNs.

I wonder how many of these "state-employed hackers" are just random criminals and their bots, doing regular criminal stuff like stealing money from bank accounts.

I easily see people claiming they are the target of a foreign government because it gives them importance and it is less shameful than a spam botnet.

The real security pros set their keyboard language to Russian.

Isn't it enough to have the Cyrillic keyboard installed?

oh damn you're showing your age here!! :)

Ship, ship, ship, and when we get discovered we/you/they write a nice corp spin email "we deeply care for our customers, acted responsibly to inform our clients promptly and worked fast to mitigate all relevant risks" (I've read enough of this BS comms so I don't need LLMs to make one for me). Right?

Reply on news.ycombinator.com