| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 7 Aug 2006 19:49:47 -0700
From: "Mad World" <penetrator@...e.in.th>
To: <thomas.pollet@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Re: micosoft.com xss
Why do you need it ?
You already discovered xss, the rest of "job" is just matter of technique.
I think majority of xss submitters here could do it by various means.
M$ is lost in its own complexity of how to do simple things.
If you could ever give me reasonable answer for why do you need this $hit - I could give you the "rest", like others could.
SomeMan
--- thomas.pollet@...il.com wrote:
From: Thomas Pollet <thomas.pollet@...il.com>
Date: Mon, 7 Aug 2006 21:02:02 +0200
>Hello,
>I have found that microsoft.com fails to filter html properly on some pages.
>http://support.microsoft.com/newsgroups/default.aspx?lang=en&cr=US&dg=microsoft.public.ccf&sloc=us');alert('xss<http://support.microsoft.com/newsgroups/default.aspx?lang=en&cr=US&dg=microsoft.public.ccf&sloc=us%27%29;alert%28%27xss>
>this causes javascript to be executed when a user clicks the help link.
>Someone knows how to get js executed on page load?
>greets,
>Thomas
_____________________________________________________________
Visit Thailand @ http://www.sawadee.com
Websearch and email: DNSASIA.com .... FAST!
128k dialup: login.samuinet.com
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists