Full Disclosure mailing list archives
Re: Opera Stored Cross Site Scripting
From: "avivra" <avivra () gmail com>
Date: Thu, 23 Oct 2008 01:52:13 +0200
Hi, Just found a way to use Stefano's opera:config idea to execute code from remote. Instead of changing the HTTP Proxy, an attacker can change the default external mail application to "\\evil\malware.exe ", or to local commands (e.g. ftp.exe which can be used to download malicious binaries from remote). Also, there is a need to change the "Mail Handler" settings to "2", so opera will execute the external mail application, instead of the default opera mail application. After changing the settings, the attacker can simply set the location to "mailto:" to execute the code. A proof-of-concept which executes the Windows Calculator can be found here: http://raffon.net/research/opera/history/op.html Cheers, --Aviv. http://aviv.raffon.net
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Opera Stored Cross Site Scripting avivra (Oct 22)
- Re: Opera Stored Cross Site Scripting Roberto Suggi (Oct 23)
- Re: Opera Stored Cross Site Scripting Stefano Di Paola (Oct 23)
- <Possible follow-ups>
- Re: Opera Stored Cross Site Scripting Kanedaaa Bohater (Oct 23)