Re: Search Engine XSS

["morning_wood" <se_cur_ity () hotmail com>]

both..

> Can you use this to DoS the server?
 consider that the server must process the requests.. i think it can be a
DoS issue with enough length and quanity of the requests.

> Can you use this to gain access to areas on the server otherwise not
available?

many servers assume a call to "/somefolder/somefile.ext" is a trusted
internal call.
where http://theserver/somefolder/somefile.ext

morning_wood
http://exploitlabs.com



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html