What the world think we do..

I am Front End dev at a medium size company and I had to teach my PM how to create use case diagrams... Things are getting better and better at this dream job.

Password hashing using md5, it is 2016!! I have seen a sys admin update a user password using a MySQL query

This used to be a stress toy...

They added a javascript that checks the login info. Worst part an if statement was the only thing keeping you from logging in without the correct password

You guys converted me.

I "grew up" with Visual Studio (from VS 2005). My programming career started with VBA. (All C#)

Occasionally tried to program android with eclipse... never worked out.

I know java a little bit.

To day I decided (thanks to your rants) to start a VM with ubuntu and explore Linux and start with C.

Once upon a time, in a proprietary e-commerce framework used by few hundred sites...

I just took over a project where the previous developer stored password in two separate fields.

password & password_visible

First was encrypted and used for authentication. Second was plaintext password and was shown in the admin panel.

Hope to meet this god someday, I'd sure ask why the hell did he use encrypted password for authentication anyway. 😂

Well on my last full-time job, that ware using cookies for authentication (not something new, eh?). The thing is, you see, the cookies had the 'accountId' which if you change to another number, kaboom you're that account, oh but that was not all, there was an option to mark the account type in there 'accountType', which was kind of obvious in VLE (virtual learning environment), 'Teacher', 'Student', 'Manager' put what of those values and boom you are that role for the session

Thing was open of SQL injection from the login form, from said cookies and form every part you can pass input to it, when I raised the question to my TL he said 'no one is going to know about thatt, I don't see what is the problem', then escalated to higher management 'oh well speak to *tl_guy*'

Oh and bonus points for it being written in ASP CLASSIC in 2014+ (I was supposed to rewrite, but ended up patching ASP code and writing components in PHP)

In 2015-2016, in a private college, charging kind-of big money per year

The best I have seen and exploited was years ago with a web shop that allowed me to set my own check-out price by just inspecting the element and setting the desired price. It just happily advanced to the next step where they invoked the payment provider with my custom price. Unfortunately the shop doesn't exist anymore. I have encountered many more security leaks but this one was so easy and lucrative to exploit.

way to go

Got me thinking

We must do it ! We just must !