lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 5 Nov 2007 11:29:01 -0500
From: "Eric Rachner" <eric@...hner.us>
To: "'reepex'" <reepex@...il.com>, <full-disclosure@...ts.grok.org.uk>,
	"'pdp \(architect\)'" <pdp.gnucitizen@...glemail.com>
Subject: Re: on xss and its technical merit

1.       "XSS isn't technical"

 

That, sir, is an argument that XSS is *more* important to customers, not
less.  When you snatch user credentials from a web portal login page, or own
the entire population of client desktops 'cause they're all configured to
totally trust the vulnerable site, the notion that "any fool could've found
that" is just one more reason to take the issue seriously.

 

Second, XSS exploits can get pretty effing technical.  Try using XSS to do
something meaningful to a cookieless app that uses client certificate
authentication.  It'll give you a real appreciation for why people write
things like xssproxy.

 

 

5.       "Only lamers publish XSS"

 

Posting about XSS bugs on wherever.com = lame.

Posting about XSS bugs in shipping software products = cool.

 

Re. what's lame, it's because the case for full disclosure doesn't work for
web sites.  Seriously.  There are a million regulatory schemes in place
(PCI, SOX, HIPAA, GLBA, SB1386, etc, etc) that exist to penalize
organizations for failing to protect customer data.  Any hacker who wants to
feel righteous can anonymously tell a company that they're vulnerable, and
later, when the company gets owned, that hacker can bust their balls by
telling the world how they made the company aware of the threat, yet nothing
was done to mitigate it.

 

Re. what's cool, it's because for a software product, there is no
legislation to protect customers' interests.  (i.e., no product liability)
Therefore, we have the full disclosure debate, and anyone who believes in
full disclosure for buffer overflows has no reason to look down their nose
at a meaningful XSS advisory.

 

Unless they just gotta feel cool.

 

 

From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of reepex
Sent: Sunday, November 04, 2007 2:26 PM
To: full-disclosure@...ts.grok.org.uk; pdp (architect)
Subject: [Full-disclosure] on xss and its technical merit

 

Pdp architect and I have been emailing back and forth about whether xss has
a place in fd, bugtraq, or the security research area at all.  He decided
that we should start a discussion about in on here and gets peoples
unmoderated opinion.  This discussion should not concern whether its
important due to stealing bank info, paypal, whatever it should only stick
to xss as a pure research area.  Or as pdp described it: 

"we are talking about whether XSS is as technical as other security
disciplines. We are also talking about whether it should have a deserved an
recognized place among FD readers and contributers. however, the topic wont
cover only whether you can detect or inject  XSS, this is lame. it will
cover the whole 9 yards... pretty much all the topics covered inside the XSS
book." 

My ideas on the topic are 

1) XSS isnt techincal no matter how its used 
2) people who use xss on pentests/real hacking/anything but phishing are
lame and only use it because they cannot write real exploits (non-web) or
couldnt find any other web bugs (sql injection, cmd exec,file include,
whatever) 
3) XSS does not have a place on this list or any other security list and i
remember when the idea of making a seperate bugtraq for xss was proposed and
i still think it should be done.
4) if you go into a pentest/audit and all you get out is xss then its a
failed pentest and the customer should get a refund. 
5) publishing xss shows your weakness and that you dont have the ability to
find actual bugs ( b/c xss isnt a vuln its crap )

i think pdp is going to respond first. should be fun ;)


Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists