full-disclosure - Re: yahoomail dom based xss vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <184251.79251.qm@web46104.mail.sp1.yahoo.com>
Date: Tue, 15 Jun 2010 01:18:15 -0700 (PDT)
From: pratul agrawal <pratulag@...oo.com>
To: skg102@...il.com
Cc: full-disclosure@...ts.grok.org.uk, security@...oo.com, info@...t-in.org.in
Subject: Re: yahoomail dom based xss vulnerability

Its working Bro.  I think u had done some mistakes so u try it again with check that javascript execution feature is enable in your browser. and bro for execution of script it is must to use proper syntax that contain special characters. just put "><script>alert(123)<script>  in the New Folder field comes in the Move button and you will saw a pop up message with 123 reflected.

Have a nice time bro,
Pratul Agrawal

--- On Tue, 15/6/10, ㅤ ㅤRockey <skg102@...il.com> wrote:

From: ㅤ ㅤRockey <skg102@...il.com>
Subject: Re: [Full-disclosure] yahoomail dom based xss vulnerability
To: 
Cc: full-disclosure@...ts.grok.org.uk, security@...oo.com, info@...t-in.org.in
Date: Tuesday, 15 June, 2010, 5:10 AM

Tried reproducing on yahoo mail
both on the classic and new one . Error message i got in both cases were

"Sorry, but your folder name has prohibited characters (please use letters, numbers, dashes, and underscores). Please fix it and try again."

Cheers,
Rockey

--
It's all about Hacking and Security

http://h4ck3r.in/

-----Inline Attachment Follows-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/