full-disclosure - Re: Is OWASP vulnerable ??

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 11 Mar 2007 09:11:25 +0000 (UTC)
From: jf <jf@...glingpointers.net>
To: Scarlet Pimpernel <kishfellow@...oo.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Is OWASP vulnerable ??

Sorry, I didn't mention this in my original reply, if you type the
variable name into google you'll get several hits from the wiki software
they use, appearantly it used to be considered a security hole by the
authors of the software if the wiki was embedded in another frame, so
thats what that check was, however anymore it is disabled by default, and
web app authors being what they are, disabled most likely means they
commented out the declaration.

On Sat, 10 Mar 2007, Scarlet Pimpernel wrote:

> Date: Sat, 10 Mar 2007 13:06:34 -0800 (PST)
> From: Scarlet Pimpernel <kishfellow@...oo.com>
> To: Andrew Farmer <andfarm@...il.com>
> Cc: full-disclosure@...ts.grok.org.uk
> Subject: Re: [Full-disclosure] Is OWASP vulnerable ??
>
> Hey Andrew :)
>
> Corrected the blog entry, Thanks for your email...
>
> Also added "jf at danglingpointers dot net" ... since he was the first to reply.
>
> I hope this is just a bug, probably something that could cause minimal damage and not a vulnerability.
>
> Cheers :)
> Kish
>
> Andrew Farmer <andfarm@...il.com> wrote: On 10 Mar 07, at 09:23, Scarlet Pimpernel wrote:
> > Hello all,
> >
> > There is an undefined function in OWASP website's javascript code
> > (wikibits.js)
> > called wgBreakFrames. This can cause potential damage to the site
> > if used maliciously.
> >
> ...
> > if (wgBreakFrames) {
> ...
>
> First of all, that's a variable, not a function. Creating a function
> called "wgBreakFrames" wouldn't execute the function.
>
> Second of all, I'm not really sure how that could be "used
> maliciously". If you're able to inject Javascript into the window
> context, you can already do whatever you like to the user's browser.
> So I'm not quite sure how this is supposed to "cause potential damage
> to the site".
>
>
>
> Remember there is alwayz someone who knows more than us out there
>
>
> ---------------------------------
> Be a PS3 game guru.
> Get your game face on with the latest PS3 news and previews at Yahoo! Games.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/