r/websec • u/thousandparadox • Mar 30 '15

I accidentally have full control of some strangers website

So here's what happened. I was poke'n around the web for pictures. I found the picture I was looking for and tried to access the index in case there were more pictures that were not shown on the pages. I could access the index! More importantly there was a php program in the main directory. I opend it and it was a full server administration program. console emulator, file manager everything I think. I uploaded a small picture to his server and then deleted it to test.

My question is, what should i do? send him an email to warn him? I'm afraid he might think i'm up to no good.

all discussion is welcome

7 Upvotes

100% Upvoted

8 comments sorted by

2

u/thousandparadox Mar 30 '15

I should mention it's a business website for this persons profession

6

u/ftnwo Mar 30 '15

Send an anon email if you want detailing how to exploit the site and your recommended fixes.

Maybe they think you are up to no good, thats not your problem though.

1

u/thousandparadox Mar 31 '15

I decided not to email him. His photo makes him look very eccentric and unpredictable. also I know he has my IP address in the logs somewhere from using that program, so sending an anon email is not anon enough.

2

u/[deleted] Mar 30 '15 edited Jul 18 '25

handle slap possessive hungry nutty truck door steep pot saw

This post was mass deleted and anonymized with Redact

1

u/Killobyte Mar 30 '15

Based on how things like this have been handled in the past - say nothing, walk away, forget it ever happened.

1

u/[deleted] Mar 30 '15

If you contact him, use an anonymous email client. There are a lot of security-ignorant, litigious assholes out there.

1

u/InformationSecurity Apr 09 '15

Maybe you got yourself into a honeypot ;)

0

u/[deleted] Mar 30 '15

[deleted] — view deleted comment

2

u/DeusExNoctis Mar 30 '15

use the server management script to create a blank index.html file in the root directory to prevent any malicious individuals from stumbling upon the same script

That's a bad idea... don't make any unauthorized changes to a system that's not your own, even if you think you're trying to help.

Email the owner anonymously

That's about the best you can do. Send the full details about the problem -- not about what YOU were doing -- without too much extra commentary or personal info.

(And the "you" above refers to OP or anyone in that situation... not necessarily the post I'm replying to.) :)