Full Disclosure mailing list archives
Microsoft Anti-Cross Site Scripting Library Bypass
From: Web Sec <root () 80sec com>
Date: Sat, 14 Aug 2010 16:02:07 +0800
Microsoft use anti-xss library to filter content from user,but there is some VULN in the library,so anyone can bypass this function to make a XSS attack.All webapps use anti-xss library will be unsecue(Maybe include Hotmal,Office,IE......) You can use this code to bypass it,and there maybe othere cases to do this : <style> }@import url('//127.0.0.1/1.css');aaa {;} </style> <div id="x">Fuck Ie</div> More information: http://www.wooyun.org/bug.php?action=view&id=190
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Microsoft Anti-Cross Site Scripting Library Bypass Web Sec (Aug 16)