full-disclosure - Re: yahoomail dom based xss vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <8188EAAF-03CE-4D29-BC52-ACF9F5A5678F@b3nji.com>
Date: Tue, 15 Jun 2010 10:57:58 +0100
From: Benji <me@...ji.com>
To: pratul agrawal <pratulag@...oo.com>
Cc: "info@...t-in.org.in" <info@...t-in.org.in>,
	"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>,
	"security@...oo.com" <security@...oo.com>
Subject: Re: yahoomail dom based xss vulnerability

Sup bro

I waz checkin owt ur javascriptz skriptz and waz wonderin if u cud  
explain how diz shiz werks.

Peaze.

Sent from my iPhone

On 15 Jun 2010, at 09:18, pratul agrawal <pratulag@...oo.com> wrote:

> Its working Bro.  I think u had done some mistakes so u try it again  
> with check that javascript execution feature is enable in your  
> browser. and bro for execution of script it is must to use proper  
> syntax that contain special characters. just put "><script>alert(123) 
> <script>  in the New Folder field comes in the Move button and you  
> will saw a pop up message with 123 reflected.
>
> Have a nice time bro,
> Pratul Agrawal
>
> --- On Tue, 15/6/10, ㅤ ㅤRockey <skg102@...il.com> wrote:
>
> From: ㅤ ㅤRockey <skg102@...il.com>
> Subject: Re: [Full-disclosure] yahoomail dom based xss vulnerability
> To:
> Cc: full-disclosure@...ts.grok.org.uk, security@...oo.com, info@...t-in.org.in
> Date: Tuesday, 15 June, 2010, 5:10 AM
>
>
> Tried reproducing on yahoo mail
> both on the classic and new one . Error message i got in both cases  
> were
>
> "Sorry, but your folder name has prohibited characters (please use  
> letters, numbers, dashes, and underscores). Please fix it and try  
> again."
>
> Cheers,
> Rockey
>
> --
> It's all about Hacking and Security
>
> http://h4ck3r.in/
>
>
> -----Inline Attachment Follows-----
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/