[Full-Disclosure] more chess fun...;)

[Roelof Temmingh <roelof@sensepost.com>]

Speaking of chess - a friend invited me tonight to play a game of "email
chess" on Shockwave's site. There's no authentication ... the URL looks
like this:

http://www.shockwave.com/rd/ec.cgi?id=2004/2/1/12029_xxxxxx&player=b

Where xxxx is a random number.

Now, take a guess what happens if you change the "b" at the end (clearly
for "black") to "w" (for white). It goes a bit like this:

"now THAT was a crap move..why did you do THAT?"
"uhmmm...I didn't! It moved by itself?!"

<evil grin>

Thought it to be slightly amusing..:)
Roelof.


=====================
Roelof Temmingh
+27 12 667 4737
GMT+2
=====================

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html