Re: Execution of Javascript from PERL

[Martin Eiszner <martin () websec org>]

hola,

On Thu, 17 Apr 2003 10:52:45 -0400
"Brass, Phil (ISS Atlanta)" <PBrass () iss net> wrote:

**********
> The real problem is not getting the JavaScript in the page to execute,
> it's getting it to execute in a meaningful context 
**********


from the security-testing point of view its not necessary to execute any script .. because:
 
IF input 
        "<script>thingstodo();</script>"
LEADS TO output 
        "<script>thingstodo();</script>"

the application is definitively vulnerable !!! 


and it is a confuguration-issue to check for all "known" and "unknown" script-tags and -objects !!




nice day, 
mEi


-- 
WebSec.org / Martin Eiszner
Gurkgasse 49/Top14
1140 Vienna
Austria / EUROPE

mei () websec org
http://www.websec.org
tel: 0043 699 121772 37