[Full-disclosure] on xss and its technical merit

Pdp architect and I have been emailing back and forth about whether xss has
a place in fd, bugtraq, or the security research area at all. He decided
that we should start a discussion about in on here and gets peoples
unmoderated opinion. This discussion should not concern whether its
important due to stealing bank info, paypal, whatever it should only stick
to xss as a pure research area. Or as pdp described it:

"we are talking about whether XSS is as technical as other security
disciplines. We are also talking about whether it should have a deserved an
recognized place among FD readers and contributers. however, the topic wont
cover only whether you can detect or inject XSS, this is lame. it will
cover the whole 9 yards... pretty much all the topics covered inside the XSS

My ideas on the topic are

1) XSS isnt techincal no matter how its used
2) people who use xss on pentests/real hacking/anything but phishing are
lame and only use it because they cannot write real exploits (non-web) or
couldnt find any other web bugs (sql injection, cmd exec,file include,
3) XSS does not have a place on this list or any other security list and i
remember when the idea of making a seperate bugtraq for xss was proposed and
i still think it should be done.
4) if you go into a pentest/audit and all you get out is xss then its a
failed pentest and the customer should get a refund.
5) publishing xss shows your weakness and that you dont have the ability to
find actual bugs ( b/c xss isnt a vuln its crap )

i think pdp is going to respond first. should be fun ;)
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • [Full-disclosure] [xssworm.com] Alert : XSS Worms - Cross-Site Scripting and Web 2.0 App
    ... We are proud to announce the grand-opening of XSS Worm: Cross Site ... XSS - a word commonly used by modern security experts to categorize a wide ... But it's not only XSS Worms ...
  • [Full-disclosure] Drupal Link Module XSS Vulnerability
    ... Security Risk: Moderately Critical ... Cross Site Scripting (XSS) Vulnerability ...
  • [ MDVSA-2014:233 ] wordpress
    ... Updated wordpress package fixes security vulnerabilities: ... XSS in media playlists. ... All packages are signed by Mandriva for security. ...
  • RE: Cross Site Scripting Vulnerabilities - XSS
    ... internal mechanism to prevent remote viewing of the Internet History. ... Cross Site Scripting Vulnerabilities - XSS ... successful execution of script in each instance might be similar, ... security measures that prevent XSS. ...
  • Re: Is Basecamp - risky?
    ... Security does not seems high on their priority list. ... Ummm their response has stated they will not fix or worry about their XSS issues because they feel internal/intranet is their prime audience. ... Subject: Is Basecamp - risky? ... Don't use Basecamp if you care about security. ...