full-disclosure - Re: New Web Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200301231432.h0NEWYQs060009@cgisecurity.net>
From: bugtraq at cgisecurity.net (zeno)
Subject: Re: New Web Vulnerability - Cross-Site Tracing

> It seems like everyone is missing the point... Why bother going through 
> the trouble setting up a page to steal someone's cookies when you can 
> relay web-based attacks directly through their browser. Think of all the 

Exactly. Not only that but it is possible to relay spam with this type of attack. Aka the user
opens up an email attachment with this code in it, or visits a website, and their browser
then starts spamming whoever is specified in the code. While this isn't easily done it is
completely possible.

Another point I'd like to make is this.

1. Hotmail's attachments allow javascript inside them.(nothing is filtered)
2. If I sent you an email with a attach like this the virus scanners wouldn't pick it up
therefore making the user think it is safe to open it.
3. The user opens the attachment.
4. I can send a trace to the users hotmail server and steal there login info.
(this would require a knowledge of which server they use. This can easily be done if you simply
compile a list and check every server inside the javascript code)
5. With hotmail or other webmails it may also be possible to actually spam from their
account.

Many many possibilities. 

- zeno@...security.com