lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 4 Aug 2006 10:02:13 +0300
From: Georgi Guninski <guninski@...inski.com>
To: "pdp (architect)" <pdp.gnucitizen@...glemail.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Attacking the local LAN via XSS

On Fri, Aug 04, 2006 at 12:35:48AM +0100, pdp (architect) wrote:
> For that purpose three prerequisites are needed:
> 
>   1. page that is controlled by the attacker, lets call it evil.com
>   2. border router vulnerable to XSS

do you need javascript in all cases? unless you badly need http POST, doing
blind <img src=http://ip/cgi-bin/readmailreallyfast>, iframe src=, may have 
interesting side effects. 

-- 
where do you want bill gates to go today?

EOM











_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists