bugtraq - Multiple Vulnerabilities in Pocket IE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050127040252.5091.qmail@www.securityfocus.com>
Date: 27 Jan 2005 04:02:52 -0000
From: kers0r <root@...lum-nz.com>
To: bugtraq@...urityfocus.com
Subject: Multiple Vulnerabilities in Pocket IE

Multiple Vulnerabilities in Pocket IE 
--------------------------------------

Pocket IE Attack Overview:

There are several weaknesses in Pocket IE that can be used to trick end users into submitting local and/or sensitive data, such as usernames and passwords. The potential for exploiting these vulnerabilities are restricted only by an attacker&#8217;s imagination. However, Pocket IE is not as powerful as its big brother, and as such, an attacker is limited in what techniques she can use to launch the attack. For example, Pocket IE has no support for the IFrame tag, which is extremely useful in XSS and browser-based attacks. In addition, Pocket IE does not support every JavaScript command commonly used by attackers. The final example presented is an attempt to combine these individual flaws into one attack and is only meant to serve as a proof of concept.

To view the examples and a detailed write up please point your browser to the following link
http://www.airscanner.com/tests/ie_flaw/ie_attack.htm

Credit: Seth Fogie
http://www.airscanner.com
Airscanner Research Labs