full-disclosure - logically stopping xss

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20030723032834.GA4079@SDF.LONESTAR.ORG>
From: petard at sdf.lonestar.org (petard)
Subject: logically stopping xss

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, Jul 22, 2003 at 09:33:00PM -0400, Justin Shin wrote:
> i know there's a lot of stupid jokes about XSS vulns right now, but I was wondering if there is any firewall or IDS software that can look for suspicious GET requests ... ie.
> 
> GET /vulnerablewebapp/?<XSS SHZNIT>
> 
> I'm sure there's a program out there ... and I'm stupid, please don't kill me...
> 

It's a little-known tool, to be sure :-)

Here's an example:
http://www.snort.org/snort-db/sid.html?sid=1667

Hope this helps... (or did I totally misunderstand your question?

petard


- --
top-post: n., v. - [common] To put the newly-added portion of an email or Usenet  response before the quoted part, as opposed to the more logical sequence of  quoted portion first with original following. [...]  This term is generally used pejoratively with the implication that  the offending person is a newbie, a Microsoft addict  (Microsoft mail tools produce a similar format by default), or simply a  common-and-garden-variety idiot.
	- The jargon file
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (NetBSD)

iD8DBQE/HgDYgkiZ59A0kiQRAh8UAJ9elCfSYzpH02VfOeMYn5NZKA+QnQCfVGg3
LXa1GtmiNI2A3c+hF085i08=
=+DHb
-----END PGP SIGNATURE-----