full-disclosure - Re: First cross-domain XSS worm (not)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <25525.1184604170@turing-police.cc.vt.edu>
Date: Mon, 16 Jul 2007 12:42:50 -0400
From: Valdis.Kletnieks@...edu
To: Berend-Jan Wever <berendjanwever@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: First cross-domain XSS worm (not)

On Mon, 16 Jul 2007 16:51:22 BST, Berend-Jan Wever said:

> without XMLHTTPRequest. I've been told that people saw XSS worms as early as
> 2000, but I have found no evidence to support this: let me know if you know
> something.

It's quite possible that they were out there, but nobody noticed them because
nobody was *looking* for them.  At most sites, if it doesn't trip the IDS,
it literally never happened.  If your intrusion detection system only has
templates for mammals, a hell of a lot of alligators can wander through and
you'll never see one....

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/