POPA ReconThe finding said RCE. The second tester asked one question and the ticket died.
The finding said RCE. The second tester asked one question and the ticket died. Last year I inherited a “critical RCE” from an automated pass.The request looked perfect. Parameter host. Payload 8.8.8.8; sleep 5. Status 200. Response time jumped from ~800ms to ~6s. The scanner wrote OS command injection, confidence high. The client had already seen the word critical in the draft.I replayed it once. Same delay. Replay again. 1.1s. Again. 7s. Again. 900ms. The sleep was not in the response body. id came back as the literal string id. expr 41 + 1 came back as the literal string. The page was a dia…
The excerpt is quoted from a public Telegram channel, which owns its text.