full-disclosure - Search Engine XSS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20030723173531.3012cd83.list@hardlined.com>
From: list at hardlined.com (Shanphen Dawa)
Subject: Search Engine XSS

So why not show one of these legitimate examples instead of the overused window popup script?

It would just be easier to ascertain the level of severity if an actual DoS string or this "trusted internal call" was exploited.

I am sure there are a lot of forms that can be a victim of a xss string, but how many of them can actually be used for anything useful (from an attacker point of view)?

On Wed, 23 Jul 2003 11:34:53 -0700
"morning_wood" <se_cur_ity@...mail.com> wrote:

> both..
> 
> > Can you use this to DoS the server?
>  consider that the server must process the requests.. i think it can be a
> DoS issue with enough length and quanity of the requests.
> 
> >Can you use this to gain access to areas on the server otherwise not
> available?
> 
> many servers assume a call to "/somefolder/somefile.ext" is a trusted
> internal call.
> where http://theserver/somefolder/somefile.ext
> 
> morning_wood
> http://exploitlabs.com
> 
> 
> 
> 

-- 
/*
"To avoid all evil, to cultivate good, 
and to cleanse one's mind  
this is the teaching of the Buddhas."

Martin Ekendahl
http://www.hardlined.com
martin@...dlined.com
*/