Vulnerability Development mailing list archives
Re: 5 char XSS?
From: "Serg B" <sergeslists () gmail com>
Date: Sun, 27 Apr 2008 00:53:47 +1000
Am I the only one who sees the irony of an XSS related email/question and example URLs to click? Heh. Serg On Thu, Apr 24, 2008 at 9:36 AM, Kristian Erik Hermansen <kristian.hermansen () gmail com> wrote:
Just been noticing all the talk about Obama and Clinton sites and how the media keeps making a big deal out of all these XSS vulns, heh. However, I have a rather technical question about what, if anything, you can do when you have such a small buffer to exploit XSS? Check out this one I found and is not listed by xssed.com for hillaryclinton.com. You only get 5 chars to inject. So, are there any tricks that could possibly be used to expand the limitation via perhaps some unicode kung-fu here? Dunno, but thought it might be insteresting bring up because this is a common scenario in zip code search fields. The fix for Clinton is as simple as whitelisting the input field set to [0-9]... http://www.hillaryclinton.com/actioncenter/event/?mt=0&d=250&z=%22%3EXSS&s=z&EventSearchAndResults%3A_ctl0.x=0&EventSearchAndResults%3A_ctl0.y=0 Regards, -- Kristian Erik Hermansen -- "Clever ones don't want the future told. They make it."
Current thread:
- 5 char XSS? Kristian Erik Hermansen (Apr 24)
- Re: 5 char XSS? Serg B (Apr 28)
- Re: 5 char XSS? Kristian Erik Hermansen (Apr 28)
- Re: 5 char XSS? kuza55 (Apr 29)
- Re: 5 char XSS? Kristian Erik Hermansen (Apr 28)
- Re: 5 char XSS? Serg B (Apr 28)