Re: User Agent XSS anyone?

[Luca Carettoni <luca.carettoni () ikkisoft com>]

On Wednesday 22 April 2009, Zack Payton wrote:
> Hi all,
>
> I was just curios if anyone was aware of any interesting ways to
> exploit user-agent based xss.
> I suppose it would be easy in conjunction with HTTP response
> splitting, but is anyone aware of any other vectors beside those
> present in custom browser extensions?
> I am interested in hearing about all vectors though, even those in
> custom browser extensions.

Just few weeks ago I was testing an ASPX app with a similar problem.
Basically, it uses the User-Agent header in order to detect the user's browser 
since most of the selection tabs work with IE only.
I was using Firefox and I got the warning: "Your browser (Mozilla/5.0) may be 
not compatible with...". The version number made me suspicious and, finally, 
I was able to inject something like "Mozilla/<XSS> ".

Cheers,
Luca 

-- 
NibbleSecurity
http://nibblesec.org

------------------------------------------------------------------------
This list is sponsored by: InfoSec Institute

Tired of using other people's tools? Why not learn how to write your own exploits? 
InfoSec Institute's Advanced Ethical Hacking class teaches you how to write stack and heap buffer overflow exploits for 
Windows and Linux. Gain your Certified Expert Penetration Tester (CEPT) cert as well. 

http://www.infosecinstitute.com/courses/advanced_ethical_hacking_training.html
------------------------------------------------------------------------