full-disclosure - Client-side JavaScript XSS Scanner

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 16 Jul 2007 20:23:23 +0100
From: "pdp (architect)" <pdp.gnucitizen@...glemail.com>
To: full-disclosure@...ts.grok.org.uk, owasp-leaders@...ts.owasp.org, 
	"WASC Forum" <websecurity@...appsec.org>
Subject: Client-side JavaScript XSS Scanner - runs
	straight from your browser

http://www.gnucitizen.org/blog/javascript-xss-scanner

This POC shows how easy is to implement XSS scanner by using only
JavaScript and a few tricks from the Web2.0 world. Similar technique
can be easily implemented into AJAX/XSS worms which will allow them to
propagate across several domains and also find new vulnerabilities on
their own.

Don't be evil. Use the POC for educational and demonstration purposes only.

-- 
pdp (architect) | petko d. petkov
http://www.gnucitizen.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/