微软鲍勃 (来源:Dan's 20th Century Abandonware)

如果您第三次输入密码错误，系统将询问您是否忘记密码。

http://img132.yfrog.com/img132/8397/msbob10asignin15.gif

但是，你可以输入任何新密码，它会替换原来的密码，而不是像继续提示输入正确的密码，直到输入正确的密码，或者在多次尝试错误后锁定你!任何人都可以用任何密码“保护”的Microsoft Bob帐户这样做。

不需要事先进行身份验证。 他的意思是，用户1只需要三次输入密码错误，然后第四次输入新密码就可以更改自己的密码，而不必使用“更改密码”。

这也意味着User1可以修改User2, User3…以完全相同的方式。任何用户都可以更改其他用户的密码，只要输入三次错误密码，然后在出现提示时输入新密码，然后他们就可以访问该帐户。

http://img132.yfrog.com/img132/9851/msbob10asignin16.gif

http://www.metasploit.com/users/hdm/tools/debian-openssl/

去年，我发现我所在的公司用来处理支票/报表的网站充满了SQL注入漏洞。

不用说，他们很快就把洞补好了。

一个“安全”的网站，每个页面都是加密的，但登录页面!

令人惊讶的是没有人提到社会工程，但我从这篇文章中得到了乐趣。

总结:恶意用户可以买几十个u盘，在里面装上自动运行的病毒或木马，然后在深夜把这些u盘撒在公司的停车场里。第二天，每个人都来上班，被闪闪发光的、糖果形状的、不可抗拒的硬件绊倒，并对自己说:“哦，哇，免费的闪存盘，我想知道里面有什么!”——20分钟后，整个公司的网络都被冲洗掉了。

I was going to earn my credit with the supervisor for my quite advanced graphics program at a SunOS / Solaris with instant messaging enabled where with zephyr.vars or whatever it was called you could make an image appear on your listed friend's screen like if you alowed me I could just send you an image that appeared on your display. While I was demoing the program I had written so that the supervisor could give me credit for it, one of my friends sitting close or in the next room made the photo big-mama.xxx appear on my screen. There was never any discussion or penalty because of the incident and I got credit for the project that for ½ second seemed like it was programmed to display big-mama.xxx instead of solving the problem. (Earlier) I updated perl scripts and waited for sysadmin to reflect the changes to ouside the FW. Then the database was gone and it was not a bug it was a feature since the data was stored with the source and therefore updating the source blanked the persistence.

物理访问或模拟登录提示或登录屏幕是另外两种困难的情况，不需要过多的算法技术，很容易理解物理访问提供了许多可能性，模拟登录提示是您可以在许多不同类型的计算机和环境上进行的事情。