The linked document describes all the obvious parts that have been known foreer,... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		gohrt on Nov 5, 2014 \| parent \| context \| favorite \| on: Reflected File Download: A New Web Attack Vector The linked document describes all the obvious parts that have been known foreer, but doesn't mention the interesting part: what webservices respond to user input (URL) by serving a previously nonexistent (server-side) document with a name derived from the URL.

lnanek2 on Nov 5, 2014 [–]

There are a lot of URLs that echo back the content from the path/parameters. google.com/s/whatever mentions /s/whatever is not found for example.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact