carldr.com

# a good interview question for a php developer

$ cat test.php 
<?
if( !isset($_GET['filename']) || strpos($_GET['filename'],"../") ) {
  die();
}
echo "Hacked.";
?>
$ wget -q -O/dev/stdout http://localhost/test.php?filename=../../../../etc/hosts
Hacked.

Get them to explain why you’re hacked. If they don’t know, don’t give them the job.

10:10 <carldr> I thought you were waiting for stuff to do, which is why you
               were fannying about.
10:11 <steven> heh, i was looking up the .exists? method
10:11 <carldr> On the playstation site?
10:13 <steven> and looking when new games are out on the playstation network :)