Bugtraq mailing list archives
XSS in Null HTTPd
From: "Matthew Murphy" <mattmurphy () kc rr com>
Date: Mon, 2 Sep 2002 11:57:11 -0500
Null HTTPd is a simple HTTP server that runs on Win32/Unix systems. It is quite basic, but offers good CGI support. A vulnerability in Null HTTPd may allow cross-site scripting via a 404 page: http://localhost/a?x=<SCRIPT>alert(document.URL)</SCRIPT> You have to place this in the query string so that it doesn't get the typical "%xx..." urlencode treatment from the browser. If the code is encoded in any way, it prevents the vulnerability from working. "The reason the mainstream is thought of as a stream is because it is so shallow." - Author Unknown
Current thread:
- XSS in Null HTTPd Matthew Murphy (Sep 02)