Salut, Voici la réponse que je propose pour M. Vulnerabilité: **************************** Thanks for your answer, Mr. Panggau. I will transmit your proposal this week to the laboratory board. The laboratory board has to approve your proposal (as you might know, France is a very bureaucratic country!). It would be better if I could have your CV to join to the proposal, in order we could deliver a stronger external consulting case to the board. Could you please send me your CV? The board will meet next Friday, February 9. I will be presenting our case and we will get back to you then. Cheers Frank ****************************** Jorge Garcia Flores Ingénieur de recherche CNRS LIPN - Université Paris 13 http://lipn.univ-paris13.fr/~garciaflores/ Le 02/02/2018 à 16:02, Franck Butelle a écrit :
Le gars veut de l'argent...
je ne réponds pas tout de suite, gagnons du temps...
-------- Message transféré -------- Sujet : Re: Re: I Found Vulnerability On the Site (http://lipn.univ-paris13.fr/) Date : Fri, 2 Feb 2018 21:56:47 +0700 De : Arnold Panggau <arnoldtriwardhana08@gmail.com> Pour : Franck Butelle <franck.butelle@lipn.univ-paris13.fr>
Hi Franck, And here's the help I've built for you, I've created a vulnerability report for this issue, which I recommend for you, which helps you figure out the vulnerability and fix it. the report will contain: 1. location of the vulnerability page 2. how to fix it (Sample Script Code) 3. how to find vulnerabilities on the website 4. how can I exploit the vulnerability to find your DB by exploiting that vulnerability. 5. the tools I use for Site testing 6. and of course how to secure it.
And of course it's not free. I usually get paid by my clients 500Euros - 1000Euros for SQLI vulnerabilities like this.
calm You can offer the price? You can pay me by paypal or bitcoin.
And you can consult about vulnerabilities and vulnerability reports to me.
thank you
On 2 February 2018 at 21:45, Franck Butelle <franck.butelle@lipn.univ-paris13.fr <mailto:franck.butelle@lipn.univ-paris13.fr>> wrote:
Mr Panggau:
Thanks for detecting the security hole. We are perfectly aware of the dangers that SQL injection represents to our data. We will look thoroughly to protect our code from it.
As a public education institution, we might be too busy providing free education for our students and we surely lack the necessary time and funding ressources to protect our code as it should.
Your help would be highly appreciated (you are already helping us by detecting the failure). What collaboration options are you considering?
Best regards