full-disclosure - Re: Facebook vuln.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 23 May 2011 01:48:22 +0530
From: Atul Agarwal <atul@...fence.com>
To: ichib0d crane <themadichib0d@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Facebook vuln.

Well, this has been there for quite a long time.

Another variation (which can control the title content too, making it more
believable) :

https://www.facebook.com/connect/connect_to_node_error.php?title=Really%3F&body=Hello%20World
!

But yes, AFAIK, html tags cannot be injected. Although, a self-xss attack
could be done.

https://www.facebook.com/connect/connect_to_node_error.php?title=Official%20Facebook%20Script&body=Copy%20and%20paste%20the%20following%20script%20in%20the%20address%20bar%20:%20javascript:alert(document.cookie)
;

That's the max you could do with it (I think!)

Thanks,
Atul Agarwal
Secfence Technologies
http://www.secfence.com

On Mon, May 23, 2011 at 12:16 AM, ichib0d crane <themadichib0d@...il.com>wrote:

>  Turns out....not so much :P
>
>
> https://www.facebook.com/connect/connect_to_node_error.php?body=%3Cscript%3Ealert%28String.fromCharCode%2888,%2083,%2083%29%29%3C/script%3E
>
>  Sure maybe there is a way to bypass the filter but good luck.
>
>  Probably be a good idea to include a better PoC next time.
>
> > On Sun, May 22, 2011 at 11:28 AM, Gustavo <gustavorobertux@...il.com>
> wrote:
> >
> https://www.facebook.com/connect/connect_to_node_error.php?body=VULNERABLE
> >
> > :(
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/