lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Sun,  2 Nov 2003 18:14:01 +0100
From: <>
To: <>
Cc: <>, <>
Subject: [bWM#014] Cross-Site-Scripting @ pathforwarding domains (multivendor: Strato, 1&1, HostEurope) 
ben moeckel security research 

badWebMasters security advisory #014 
Cross-Site-Scripting @ pathforwarding domains (multivendor: Strato, 1&1,

Discovery date: 2003-07-23 
Original advisory: (text/html) 

Legal Notice: 
Copyright 2003 by Benjamin Klimmek (ben moeckel - badWebMasters)! 
You may distribute it unmodified. 
You may not modify it and distribute it or distribute parts of it 
without giving credits and the URL where the original advisory can be 
This document may change without notice. 

ben moeckel ( 

Many webhoster offer a cheap way to get a own domain for a existing 
homepage (domainforwarding). To hide the real url (url-cloaking) those 
domains are based on a html-frameset. 

A malicious user may use the "pathforwarding"-feature to include 
javascript; Strato, 1&1 and HostEurope are vulnerable to this issue. 


All Vendors have been contacted, no response!  

1&1 Internet AG 

Strato Medien AG 

Host Europe 

Thanks to "knuth" and "sir-markus" from 

Comments, suggestions, updates, anything else? 



badWebMasters - ben moeckel security research 
copyright 2k1-3 by Benjamin Klimmek / Germany

Full-Disclosure - We believe in it.

Powered by blists - more mailing lists