Monitordroid-Web-Application
Monitordroid-Web-Application copied to clipboard
tyler124
Vulerabilities Scanning
Hello there, I hope you continue working on this project. I'd like to perform a penetration testing on it, as I've already found code that leads to SQL injections, if I craft an example in which I exploit it and then a piece of secure code, would you accept the pull request? Thanks, Nico from Argentina.
Nico,
We would love it if you could alert us to any insecure source-code we may have, because we as developers are somewhat inexperienced when it comes to security. We would gladly accept any modifications to the source code which would make it more secure.
Thanks, Tyler Butler Monitordroid Lead Developer On 11/9/2014 6:33 PM, belazaras wrote:
Hello there, I hope you continue working on this project. I'd like to perform a penetration testing on it, as I've already found code that leads to SQL injections, if I craft an example in which I exploit it and then a piece of secure code, would you accept the pull request? Thanks, Nico from Argentina.
— Reply to this email directly or view it on GitHub https://github.com/tyler124/Monitordroid-Web-Application/issues/2.
Sorry for not answering earlier, yes, not sql injection for the moment as you used PDO, right? But I did find some bugs related to not checking if the user is logged in or has a valid session, I will do a pull request as an example in one of the pages fixing it, and then you can do the same with the others =D
Are you talking about the live commercial application hosted at http://monitordroid.com? Because there is no access control in the open source version listed here.
Yes, I'm talking about pages like this one, where I guess one shouldn't be able to see without logging in first: http://www.monitordroid.com/app/command.php
Hi, are you still there? I can pull request you with an example on, say the command.php file, showing how to properly check if there is a valid session. Let me know if you're interested :D
Hello i've just done a vulnerability scan of your live site @monitordroid.com I will email [email protected] with the full document. I found 6 High Alerts and 2 Mediums my email is [email protected]. We are a new security analysis company.
