full-disclosure - Internet Explorer drag&drop 0day

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue Feb 14 21:45:57 2006
From: Thierry at Zoller.lu (Thierry Zoller)
Subject: Internet Explorer drag&drop 0day

Dear Markus,

M> under the heading  "Do you have a demonstration ?", both links to the
M> demo "exploit" are dead.
Yes they are, I was to lazy to remove them. I will replace them with
some working PoC heise.de links.

M> I assume in an attempt to hide the target url you meant to use the
M> * onclick * javascript event, or even the * onmousedown * or * onmouse * up,
M> but surely not the * onmouseover * !
No I used on mouse over. The "exploit" was a PoC nothing more, I think
to recall it launched calc.exe or similar (google for shreddersub7)

M> You are aware that you current chosen method would have launched your
M> exploit on the machine of a prospective customer,
The links are supposed to do so.

M> Please give your web designer a whack on the side of the head though.
That would be me.... ouch! that hurt.

I know I need a redesign for sake of usability.

-- 
http://secdev.zoller.lu
Thierry Zoller
Fingerprint : 5D84 BFDC CD36 A951 2C45  2E57 28B3 75DD 0AC6 F1C7