WebApp Sec mailing list archives
Re: what does this allow ?
From: "Kevin Spett" <kspett () spidynamics com>
Date: Thu, 19 Jun 2003 09:34:34 -0400
Cross-site scripting vulnerabilities are indeed real and should be addressed. If you'd like to know more about how they work and how they can be used by an attacker to gain unauthorized access to a system, consider the following resources: SPI Dynamics XSS Whitepaper: http://www.spidynamics.com/whitepapers/SPIcross-sitescripting.pdf CGISecurity XSS Faq: http://www.cgisecurity.com/articles/xss-faq.shtml Apache XSS Info: http://httpd.apache.org/info/css-security/ Kevin Spett SPI Labs http://www.spidynamics.com/ ----- Original Message ----- From: "Vince Hoffman" <Vince.Hoffman () uk circle com> To: <webappsec () securityfocus com> Sent: Thursday, June 19, 2003 5:20 AM Subject: what does this allow ?
Hi all, I was running a routine nessus scan on some servers i administrate and one of them gave me a warning of The following requests seem to allow the reading of sensitive files or XSS. You should manually try them to see if anything
bad
happens : /default.asp?gateway=<script>alert('foo')</script> I tried that and it worked, I forwarded it to a developer for that machine and he didnt seem worried by it. Should he be ? A bit vague i know but webapps arent realy my forte. Thanks, Vince
Current thread:
- what does this allow ? Vince Hoffman (Jun 19)
- Re: what does this allow ? Kevin Spett (Jun 19)
- Re: what does this allow ? Gary H. Jones II (Jun 19)
- <Possible follow-ups>
- Fwd: what does this allow ? Peter Wood (Jun 19)
- RE: what does this allow ? Calderon, Juan C (EM, DDEMESIS) (Jun 19)
- RE: what does this allow ? Vince Hoffman (Jun 19)