full-disclosure - excessive xss vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3a166c090605081708y4f53d948i879330ca21a500c3@mail.gmail.com>
Date: Tue May  9 01:08:14 2006
From: n3td3v at gmail.com (n3td3v)
Subject: excessive xss vulnerabilities

On 5/9/06, Christian Swartzbaugh <feofil@...il.com> wrote:
> there is a high volume of xss vulnerabilities on this list. take the next
> step to disclose why xss important for the affected program. for instance,
> creating a test case that does something privileged or malicious towards a
> visitor. in attempting to create a keystroke logger in javascript i've found
> it drops random keystrokes (i think its a speed problem). and i would be
> interested in seeing more malicious javascript.
>
> again please justify why xss is valuable in disclosures of these
> vulnerabilties
> even if its just a cookie stealer, please show why an attacker would want
> those cookies or how he/she could use them to create a security issue.
>
> thanks
> feofil


Xtra Sex Sex The Planet!       ;-)