Re: [Full-disclosure] on xss and its technical merit



What about when xss leads to stack overflows and command injections? See http://xs-sniper.com. It would seem that if you subscribe to the thought that only attacks that take over a victims computer are valid, then you would have to now admit xss as valid as well.

Nate
Sent via BlackBerry from T-Mobile

-----Original Message-----
From: reepex <reepex@xxxxxxxxx>

Date: Sun, 4 Nov 2007 13:26:17
To:full-disclosure@xxxxxxxxxxxxxxxxx, "pdp (architect)" <pdp.gnucitizen@xxxxxxxxxxxxxx>
Subject: [Full-disclosure] on xss and its technical merit


Pdp architect and I have been emailing back and forth about whether xss has a place in fd, bugtraq, or the security research area at all.  He decided that we should start a discussion about in on here and gets peoples unmoderated opinion.  This discussion should not concern whether its important due to stealing bank info, paypal, whatever it should only stick to xss as a pure research area.  Or as pdp described it:

"we are talking about whether XSS is as technical as other security disciplines. We are also talking about whether it should have a deserved an recognized place among FD readers and contributers. however, the topic wont cover only whether you can detect or inject  XSS, this is lame. it will cover the whole 9 yards... pretty much all the topics covered inside the XSS book."

My ideas on the topic are

1) XSS isnt techincal no matter how its used
2) people who use xss on pentests/real hacking/anything but phishing are lame and only use it because they cannot write real exploits (non-web) or couldnt find any other web bugs (sql injection, cmd exec,file include, whatever)
3) XSS does not have a place on this list or any other security list and i remember when the idea of making a seperate bugtraq for xss was proposed and i still think it should be done.
4) if you go into a pentest/audit and all you get out is xss then its a failed pentest and the customer should get a refund.
5) publishing xss shows your weakness and that you dont have the ability to find actual bugs ( b/c xss isnt a vuln its crap )

i think pdp is going to respond first. should be fun ;)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: [Full-disclosure] LinkedIn_User Account Delete using Click jacking
    ... If you all think XSS, even reflected or DOM-based sucks..probably you don't ... Full-Disclosure - We believe in it. ... Charter: http://lists.grok.org.uk/full-disclosure-charter.html ... Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)
  • Re: [Full-disclosure] Arin.net XSS
    ... It works in IE just fine and probably some other browsers. ... This prevents the script from being interpreted properly via the Address bar. ... Subject: [Full-disclosure] Arin.net XSS ... I think that XSS in many instances is a serious issues. ...
    (Full-Disclosure)
  • Re: [Full-disclosure] yahoomail dom based xss vulnerability
    ... I do know about DOM and XSS, I wasn't able to reproduce this bug on my end ... that's all the story Bro, hope you understand what i really want to say. ... [Full-disclosure] yahoomail dom based xss vulnerability ... Hosted and sponsored by Secunia - ...
    (Full-Disclosure)
  • Re: [Full-disclosure] Month of ActiveX Bug
    ... [Full-disclosure] Month of ActiveX Bug ... Even XSS bugs in open source perl webmail apps. ... Charter: http://lists.grok.org.uk/full-disclosure-charter.html ... Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)
  • RE: [Full-disclosure] Re: Arin.net XSS
    ... You need to copy and paste the full URL into your browser for the XSS to take place. ... Full-Disclosure - We believe in it. ... If you have received this email in error please notify the system manager. ... message contains confidential information and is intended only for the individual named. ...
    (Full-Disclosure)