Vulnerability Development mailing list archives
Re: Sourceforge.net XSS
From: Juan C Calderon <johnccr () yahoo com>
Date: Mon, 17 Apr 2006 14:13:17 -0500 (CDT)
Gee. you are right, my bad. Related to the topic, there are other ways apart from email to lure people and have an XSS in a URL executed at their computers, Blogs and Bug tracking systems are a good example. You simple post a comment with a malicious URL, in this case the malicious code is not executed just by seeing the page but by clicking in a link (on copy&paste in case of a text link). Just one more step than a regular XSS stored at server side. Definitely it is more complex since you have to "go phishing", but still doable and dangerous. Regards and sorry again, JC =There are many naive and desperate people out there= --- v9 <v9 () fakehalo us> escribió:
alright. folks, enough with the unrelated XSS stories, for the last time, i'm simply saying not all XSS are the same...i am talking about XSS that doesn't get saved on the server and has to be included in the url... i don't know how much more clear to make this. "http://something.com/...?[XSS HERE]" style. i'm quite aware of samy's myspace worm, good idea, however that is completely different from what i am and have been talking about. samy's worm was stored on the server and shown to all who viewed his myspace page. these kind of XSS are in a url you'd have to create yourself, you wouldn't ever stroll across this, as you have to make it in the url to work. so as i said before, encoded/phishing (emails) is about the only possible use for these that i can see, and not even to a good extent(easier to just use the usual <A HREF> style misdirection, and has more options). if someone can tell me otherwise, post a RELATED reply. (ie. in-url XSS) On Mon, 17 Apr 2006, Juan C Calderon wrote:Hello, I want to share with you this information I gotfromthis same list back in April 5th, It is about aviruscreated with an XSS at a myspace website (checkthelist archives). Myspace.com - Intricate Script InjectionVulnerabilityadvisory http://www.silent-products.com/advisory4.5.06.txt The myspace hack story http://fast.info/myspace/ There are very interesting links at the end ofthispaper relating to XSS viruses and theirdifferenceswith traditional viruses. http://www.bindshell.net/papers/xssv.html hope it is interesting to you, this is just alittleexample of what a XSS can do, Cheers, JC __________________________________________________ Correo Yahoo! Espacio para todos tus mensajes, antivirus yantispam ¡gratis!Regístrate ya - http://correo.espanol.yahoo.com/
__________________________________________________ Correo Yahoo! Espacio para todos tus mensajes, antivirus y antispam ¡gratis! Regístrate ya - http://correo.espanol.yahoo.com/
Current thread:
- Sourceforge.net XSS the . spikey (Apr 09)
- <Possible follow-ups>
- Re: Sourceforge.net XSS v9 (Apr 12)
- Re: Sourceforge.net XSS Daniel (Apr 12)
- Re: Re: Sourceforge.net XSS v9 (Apr 13)
- Re: Sourceforge.net XSS ascii (Apr 13)
- Re: Sourceforge.net XSS Juan C Calderon (Apr 17)
- Re: Sourceforge.net XSS v9 (Apr 17)
- Re: Sourceforge.net XSS morgan allen (Apr 18)
- Re: Sourceforge.net XSS Valdis . Kletnieks (Apr 18)
- Re: Sourceforge.net XSS Juan C Calderon (Apr 18)
- Re: Sourceforge.net XSS v9 (Apr 17)