Re: yahoomail dom based xss vulnerability

[Benji <me () b3nji com>]

Sup bro

I waz checkin owt ur javascriptz skriptz and waz wonderin if u cud  
explain how diz shiz werks.

Peaze.

Sent from my iPhone

On 15 Jun 2010, at 09:18, pratul agrawal <pratulag () yahoo com> wrote:

> Its working Bro.  I think u had done some mistakes so u try it again  
> with check that javascript execution feature is enable in your  
> browser. and bro for execution of script it is must to use proper  
> syntax that contain special characters. just put "><script>alert(123) 
> <script>  in the New Folder field comes in the Move button and you  
> will saw a pop up message with 123 reflected.
>
> Have a nice time bro,
> Pratul Agrawal
>
> --- On Tue, 15/6/10, ㅤ ㅤRockey <skg102 () gmail com> wrote:
>
> From: ㅤ ㅤRockey <skg102 () gmail com>
> Subject: Re: [Full-disclosure] yahoomail dom based xss vulnerability
> To:
> Cc: full-disclosure () lists grok org uk, security () yahoo com, info () cert-in org in
> Date: Tuesday, 15 June, 2010, 5:10 AM
>
>
> Tried reproducing on yahoo mail
> both on the classic and new one . Error message i got in both cases  
> were
>
> "Sorry, but your folder name has prohibited characters (please use  
> letters, numbers, dashes, and underscores). Please fix it and try  
> again."
>
> Cheers,
> Rockey
>
> --
> It's all about Hacking and Security
>
> http://h4ck3r.in/
>
>
> -----Inline Attachment Follows-----
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/