Message-ID: <cd8f1f1e0512210815h145c0796v@mail.gmail.com>
Date: Wed Dec 21 16:15:27 2005
From: yoo.fok at gmail.com (fok yo)
Subject: XSS vulnerabilities in Google.com

exactly.
n3td3v's nothing but a pose, she's trying to be a respected security
researcher, but she hides behind an anonymous nick. What groundbreaking
research did n3tf4rt conduct? Nothing, still google has 68K+ hits for
n3td3v, waste of bandwidth, storage, time.
This is an ongoing pollution which should come to an end. Please nd, KILL
yourself, don't even post your suicide note to fd (although that would be
the post of the year).
I hope google or yahoo sue n3td0rk for reverse engineering their web apps.
Jealousy is something for 14yo girls, bitch.

2005/12/21, GroundZero Security <fd@....org>:
>
> google or yahoo, google or yahoo ..blah go find some real bugs noone is
> jealous of you, we just think
> its redicilous how you try to show off with your non existing skills and
> reputation. you are the greatest lamer
> i'v seen on this list sofar. so instead of braging about how great you
> are, you should actually try and learn about
> security then soon you will realize that your xss shit is just pathetic
> and nothing to be proud of.
> you think finding some simple xss in a website such as yahoo or google
> makes you superior to everyone else here ?
> 99% of the people on this list are more skilled than you, thats fact! so
> stop trying to show off it wont work.
> code a double free() remote exploit, then i would agree that you have
> skill. until you do that shut the fuck up kiddie.
> when i started over 11 years ago, you couldnt even spell the word
> computer. so please you should finally realize
> that you are at the wrong place. i mean look around how many people
> complain about you beeing annoying.
> oh and if you couldnt figure it out by now, groundzero is my company you
> little moron.
> -sk
> ----- Original Message -----
> From: "n3td3v" <xploitable@...il.com>
> To: "GroundZero Security" <fd@....org>; <full-disclosure@...ts.grok.org.uk
> >
> Sent: Wednesday, December 21, 2005 4:26 PM
> Subject: Re: [Full-disclosure] XSS vulnerabilities in Google.com
>
>
> > Your argument for having Google and Yahoo vulnerabilities (especially
> > XSS) banned from FD is very poor. GroundZero or whoever you may be.
> > Please get off the list and stop disrespecting others who do disclose
> > vulnerabilities in Google And Yahoo
> >
> > On 12/21/05, GroundZero Security <fd@....org> wrote:
> > >
> > > > Sure, but "google != howardsblog.com". A large part of the
> population
> > > > (including myself) relies on Google's various services for
> day-to-day
> > > > use. I sure as hell would not feel comfortable knowing that I'm
> using
> > > > a service that can potentially leak my information.
> > >
> > > i'm not talking about some shitty site that noone knows, but a lof of
> big websites have
> > > such vulnerabilities.
> > >
> > > > That's quite a blanket statement to make. I'm sure a few people in
> the
> > > > "security community" would like to know that there exists a
> > > > vulnerability in a Google service.
> > >
> > > yeah maybe but if we end up posting about every site that offers
> services to users
> > > and has xss issues then this list would be reciving a flood of mails
> :P
> > > its not hard to test for xss, so if you are really so afraid of it go
> test it yourself and
> > > notify the website owner.
> > >
> > > > No. But a site need not be audited to discover a bug.
> > >
> > > ah ok so you think illegal activity is the way to go ?
> > > you cant just audit any site you want you know, but hey
> > > if you want to get a visit from the feds why dont you audit some
> gov/mil i'm sure
> > > there are lots of xss to discover :P
> > >
> > > > XSS can do a lot of harm. A compromised administrator account is
> > > > generally a compromised server. There are some good XSS resources on
> > > > the web you can read up on.
> > >
> > > no as they dont rely on /etc/passwd users but have their own database
> usually
> > > via mysql or so and a compromised admin user on some webinterface isnt
> always
> > > going to end up in compromise of the whole server unless the admin is
> stupid
> > > enough to use the same passwords for root and the webbased software.
> > > in most cases this will only end up in control of the web parts i.e.
> some forum.
> > > i agree that this is a problem, but its still not resulting in root
> access on the shell.
> > > oh and i dont have to read about it so keep your sarcasm to yourself.
> > >
> > > > Then, my friend, you have discovered a bug.
> > >
> > > mhm sure, imagine you find a DoS in your precious google, then you
> would take them
> > > down and you really belive they would thank you for that ? you would
> be raided in no time.
> > > you think they would belive you that you did it only for a good cause
> ? yeah right...
> > >
> > >
> > > > "There are 10 types of people. Those who understand binary, and
> those
> > > > who don't."
> > >
> > > you dont...
> > >
> > >
> > > _______________________________________________
> > > Full-Disclosure - We believe in it.
> > > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > > Hosted and sponsored by Secunia - http://secunia.com/
> > >
> >
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051221/93347fab/attachment.html

Powered by blists - more mailing lists