Re: myspace hack

[Tim Brown <tmb () 65535 com>]

On Friday 14 Oct 2005 15:29, Reynolds, Jake wrote:
> I wouldn't consider this an XSS attack. Where in the attack did information
> cross sites? This seems like it is an embedded XSS attack in that a
> malicious script was entered into a profile in hopes that victims would
> view and execute it. However, nothing was sent across sites via the script.
> The vulnerability was a lack of output validation in my opinion, which is
> the same vulnerability that an XSS attack would exploit. I don't know how
> you would classify the attack... Probably "self-replicating session
> riding". Yeah that has a nice FUD-factor to it.

I coined the term Same Site Scripting to describe the act of abusing 
XMLHttpRequest whilst playing around with this attack vector for a paper I'm 
writing.  Anyone have a better suggestion?

Cheers,
Tim
-- 
Tim Brown
<mailto:tmb () 65535 com>