bugtraq - Re: [scip_Advisory 2003-01] MSN search results.aspx Cross Site Scripting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Law11-OE25KpzxDPHpr00000ab5@hotmail.com>
Date: Wed, 23 Jul 2003 02:02:40 -0700
From: "morning_wood" <se_cur_ity@...mail.com>
To: "Marc Ruef" <maru@...p.ch>, <bugtraq@...urityfocus.com>,
   <full-disclosure@...ts.netsys.com>, <news@...uriteam.com>,
   <submissions@...ketstormsecurity.org>
Subject: Re: [scip_Advisory 2003-01] MSN search results.aspx Cross Site Scripting

> Exploit     http://search.msn.ch/results.aspx?srch=105&FORM=AS5&
>             q=%3cscript%3ealert('test')%3b%3c%2fscript%3etest
>             (URL is splitted into two parts; it doesn't work anymore)

looks like ..
http://uk.search.msn.com/results.aspx?q=%3Cscript%3Ealert%28%22sl0th+owj+j00r+arse%22%29%3C%2Fscript%3E&x=30&y=16&FORM=SMCRT

posted on 0day by sl0th dated Tue Jun 10 22:35:53 BST 2003

original link here ..
http://nothackers.org/pipermail/0day/2003-June/000010.html  which did XSS
at the time posted

morning_wood
http://nothackers.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html