WOO plain text

[ILCisDEAD]

@article

CASE #7: AMAZON.COM? WHAT?

Yes, Amazon will still let you login with clear-text. Seriously. I’m not making this up.

Here’s a typical POST:
POST http://www.amazon.com/exec/obidos/flex-sign-in-done/NUMBER HTTP/1.0
Accept: /
Referer: http://www.amazon.com/exec/obidos/flex-sign-in/ref=BLAHBLAH?_encoding=UTF8
&response=wheres-my-stuff&method=POST&opt=a
Accept-Language: en-us
Content-Type: application/x-www-form-urlencoded
Proxy-Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322; InfoPath.1)
Host: www.amazon.com
Content-Length: 198
Pragma: no-cache
Cookie:

_encoding=UTF8&method=POST&opt=a&page=help/ya-sign-in-secure.html&response=wheres-my-stuff
&email=myemail@pantsflappinginthewind.com&action=sign-in&next-page=help/ya-register-secure.html
&password=MY_PASSWORD_FLAPPING_IN_THE_WIND&x=138&y=9
Content-type: text/plain

i was rather shocked at that one… i mean at least md5 it!

whats worse is that most of the people on this forum don’t know what plain text means?!@!

and here i am telnetting into unix… i’m such a hypocrit