full-disclosure - Re: [WEB SECURITY] Useful technique when performing XSS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 7 Feb 2007 21:09:33 +0000
From: "pdp (architect)" <pdp.gnucitizen@...glemail.com>
To: "Amit Klein" <aksecurity@...il.com>
Cc: full-disclosure@...ts.grok.org.uk, WASC Forum <websecurity@...appsec.org>
Subject: Re: [WEB SECURITY] Useful technique when
	performing XSS

Hei Amit,

On 2/7/07, Amit Klein <aksecurity@...il.com> wrote:
> pdp (architect) wrote:
> > Amit,
> >
> > :) This is not about who did it first.
>
> Agreed. But it would be nice to receive the credit ;-)

Sorry man. I knew that you have discussed this before I would
definitely give you the credits. :)

> > BTW, your example is broken.
> > location.search does not include the fragment identifier.
> >
>
> Guilty as charged. I remember working directly with document.location
> (which includes the hostname and path) when I investigated the issue,
> then when I wrote my text I decided that a more elegant way would be
> with the ".search" property, but I failed to verify that it actually
> works. Thanks for pointing this out, and here's the formal errata:
>
>     In
> http://www.webappsec.org/lists/websecurity/archive/2005-10/msg00030.html,
> the example should be:
>
>     http://target.site/vulnscript.cgi?injectme=
> <http://target.site/vulnscript.cgi?injectme=><script>eval(document.location.substr(...[fill
> in the offset here]...))</script>#...JS payload here...
>
>     Thanks to "pdp (architect)" for pointing this out.
>
> Regardns,
> -Amit
>
>
> > Cheers
> >
> > On 2/7/07, Amit Klein <aksecurity@...il.com> wrote:
> >> pdp (architect) wrote:
> >> > http://www.gnucitizen.org/blog/playing-in-large
> >> >
> >> > Basically this article is about how to squeeze more data into size
> >> > restricted, unsanitized field. This technique can also be used to hide
> >> > attackers activities.
> >> >
> >> It seems that you've stumbled upon something I already disclosed:
> >> http://www.webappsec.org/lists/websecurity/archive/2005-10/msg00030.html
> >>
> >> Sorry...
> >> -Amit
> >>
> >>
> >
> >
>
>


-- 
pdp (architect) | petko d. petkov
http://www.gnucitizen.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/