Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
-
@iiii A perfect 5/7
-
@qwwerty Haha, it’s a good thought but there was also a token parameter that I excluded for brevity
-
@deadlyRants what?
-
@NoOneCares I didn’t give the real domain
-
-
To give them the benefit of the doubt :
This might be stupidity rather than malicious intent.
They might just have added some Id to avoid duplicate submissions.
They know they work with tech so if they really wanted to maliciously do tracking without getting caught they wouldn't have done it with a query param.
Still - a valid concern.
Obviously it's not anyonmius with that url.
Even if "no one will look at that" it's a huge privacy risk. -
@jiraTicket Why not both? Malicious idea and stupid execution.
-
@qwwerty employee ids seem sequential, so i would say yes, all are available via bruteforce
HR: Everyone must fill out these 100% anonymous surveys about how you feel about our company, it’s leadership, and how likely you are to leave in the next 6 months etc. Please be 100% honest, since again it is 100% anonymous. Reminder! You must use the individual links we sent to you, do NOT use someone else’s link. Oh did we say it’s 100% anonymous?
The Link:
www. surveygen .com/ companysurvey123 ?employeeName=boombodies &employeeId=6969
Dev: …
rant
human resource machine
garbage collection
management logic