Full Disclosure mailing list archives
Re: XSS in Oracle default fcgi-bin/echo
From: "Thor (Hammer of God)" <thor () hammerofgod com>
Date: Wed, 13 Oct 2010 21:14:53 +0000
You make wrong assumptions, and jump to conclusions: - Not anyone, but bona-fide ones only. - I do not "own" an Oracle site to test. Were not those obvious to right-thinking people?
You misunderstand. Irrespective of the method you choose to validate "bona-fide" recipients of your PoC, you will have no control over what the recipient chooses to do with it once they have it. As such, logic dictates that your PoC be considered "public" the moment you release it. If there was any "obvious" point missed, it was that fact. My original position stands: either disclose the code publically - in other words - don't fool yourself into thinking you are somehow being responsible by "validating" recipients prior, or simply send the code to Oracle and ask them if works or not. It's unfortunate that you consider simple logic as assumptive or a presupposition but I respect your right to do so. t _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- XSS in Oracle default fcgi-bin/echo paul . szabo (Oct 07)
- Re: XSS in Oracle default fcgi-bin/echo Nahuel Grisolia (Oct 08)
- Re: XSS in Oracle default fcgi-bin/echo psy (Oct 09)
- Re: XSS in Oracle default fcgi-bin/echo paul . szabo (Oct 10)
- Re: XSS in Oracle default fcgi-bin/echo psy (Oct 09)
- <Possible follow-ups>
- Re: XSS in Oracle default fcgi-bin/echo paul . szabo (Oct 13)
- Re: XSS in Oracle default fcgi-bin/echo Thor (Hammer of God) (Oct 13)
- Re: XSS in Oracle default fcgi-bin/echo paul . szabo (Oct 13)
- Re: XSS in Oracle default fcgi-bin/echo Thor (Hammer of God) (Oct 13)
- Re: XSS in Oracle default fcgi-bin/echo paul . szabo (Oct 13)
- Re: XSS in Oracle default fcgi-bin/echo Thor (Hammer of God) (Oct 13)
- Re: XSS in Oracle default fcgi-bin/echo Riyaz Walikar (Oct 17)
- Re: XSS in Oracle default fcgi-bin/echo paul . szabo (Oct 18)
- Re: XSS in Oracle default fcgi-bin/echo Thor (Hammer of God) (Oct 13)
- Re: XSS in Oracle default fcgi-bin/echo Nahuel Grisolia (Oct 08)