Re: itunes.apple.com owned by webapp malicious host

[matador matador <m4t4d00r () gmail com>]

Anyway the main point that I was wondering before is:

What's happen if the sql inj bot was smarter? (For example: Using
"obfuscation" technique)

Probably nothing because iTunes sanitized the input.

2011/4/1 Benji <me () b3nji com>

> Is that a yes or a no?
>
> On 4/1/11, matador matador <m4t4d00r () gmail com> wrote:
> > I am 15 years old :)
> >
> > 2011/4/1 Benji <me () b3nji com>
> >
> > > No they don't. All your link implies is that either a) someone
> > > compromised the itunes account associated with that band and added the
> > > script, or b) it was injected into place.
> > >
> > > However at no point is the javascript executed.
> > >
> > > Sigh, do you have a CSSIP aswell?
> > >
> > > On 4/1/11, matador matador <m4t4d00r () gmail com> wrote:
> > > > Seems that Websense agree with me...
> http://community.websense.com/blogs/securitylabs/archive/2011/03/29/lizamoon-mass-injection-28000-urls-including-itunes.aspx
> > > > ... or better they copy and paste my trivial link ... LOL! :)))
> > > >
> > > > 2011/3/29 Cal Leeming <cal () foxwhisper co uk>
> > > >
> > > > > Unconfirmed, seems to escape fine for me.
> > > > >
> > > > > On Tue, Mar 29, 2011 at 3:22 PM, matador matador
> > > > > <m4t4d00r () gmail com>wrote:
> > > > >
> > > > > > Enjoy! :)
> > > > > >
> > > > > > http://www.google.com/search?q=lizamoon.com+site%3Aapple.com
> > > > > >
> > > > > > _______________________________________________
> > > > > > Full-Disclosure - We believe in it.
> > > > > > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > > > > > Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/