Full Disclosure mailing list archives
Re: [WEB SECURITY] Useful technique when performing XSS
From: Amit Klein <aksecurity () gmail com>
Date: Wed, 07 Feb 2007 23:31:35 +0200
pdp (architect) wrote:
Hei Amit, On 2/7/07, Amit Klein <aksecurity () gmail com> wrote:pdp (architect) wrote:Amit, :) This is not about who did it first.Agreed. But it would be nice to receive the credit ;-)Sorry man. I knew that you have discussed this before I would definitely give you the credits. :)
No worries, mate!
In http://www.webappsec.org/lists/websecurity/archive/2005-10/msg00030.html, the example should be: http://target.site/vulnscript.cgi?injectme= <http://target.site/vulnscript.cgi?injectme=><script>eval(document.location.substr(...[fill in the offset here]...))</script>#...JS payload here...
Of course, I meant document.location.href.substr(...), i.e.: http://target.site/vulnscript.cgi?injectme=><script>eval(document.location.substr(...[fill in the offset here]...))</script>#...JS payload here... -Amit _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Useful technique when performing XSS pdp (architect) (Feb 07)
- Re: [WEB SECURITY] Useful technique when performing XSS Amit Klein (Feb 07)
- Re: [WEB SECURITY] Useful technique when performing XSS pdp (architect) (Feb 07)
- Re: [WEB SECURITY] Useful technique when performing XSS Amit Klein (Feb 07)
- Re: [WEB SECURITY] Useful technique when performing XSS pdp (architect) (Feb 07)
- Re: [WEB SECURITY] Useful technique when performing XSS Amit Klein (Feb 07)
- Re: [WEB SECURITY] Useful technique when performing XSS pdp (architect) (Feb 07)
- Re: [WEB SECURITY] Useful technique when performing XSS Amit Klein (Feb 07)