Full Disclosure mailing list archives
Exploiting reflected XSS vulnerabilities, where user input must come through HTTP Request headers
From: kuza55 <kuza55 () gmail com>
Date: Wed, 11 Jul 2007 18:09:23 +1000
Contents: ======================================= 1.0 Introduction 2.0 The User_Agent Header 3.0 (Known) Firefox & Safari Request Header Injection (Sometimes) 4.0 Attacking Caching Proxies 5.0 References 1.0 Introduction ======================================= Ever since Adobe patched Flash player to stop attackers spoofing certain headers such as Referer, User-Agent, etc, it has been considered impossible to exploit XSS vulnerabilities where the user input is taken from a request header, e.g. when a website prints out what User-Agent a user's browser is sending, without escaping it. With the exception of the Referer header which we can control enough to exploit XSS attacks through it. I want to showcase several ways in which we can still exploit these vulnerabilities. The rest of the write-up is at: http://kuza55.blogspot.com/2007/07/exploiting-reflected-xss.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Exploiting reflected XSS vulnerabilities, where user input must come through HTTP Request headers kuza55 (Jul 11)