Anyone know exactly what Daniel tried to do on the DEC site? The article refers to performing a directory traversal attack. I assume that he simply removed parts of the URL to "back track" and look at other parts of the donation site. Unless he tried a more "advanced" manipulation (for example fooling around with adding "../" and "%255" syntax to URL parameters) this seems like complete overkill.

Does anyone have any links to the court transcripts for this case, or have any other information on what specifically happened?

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11337/32581#32581