[REVS] XSS - Cross Site Scripting, Detection and Prevention
From: SecuriTeam (support_at_securiteam.com)
Date: 10/01/03
- Previous message: SecuriTeam: "[NEWS] TCLHttpd Contains Two Vulnerabilities (Directory Browsing, XSS)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 1 Oct 2003 11:10:28 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
XSS - Cross Site Scripting, Detection and Prevention
------------------------------------------------------------------------
SUMMARY
The below linked paper tries to explain what XSS (CSS) vulnerabilities
are, and provides some examples on how they can be exploited in a
malicious way.
DETAILS
Introduction:
This paper was written with no criminal intents in mind. During security
audits, Michael noticed that many custom-made and third party web
applications do not filter thoroughly characters, which turns them
vulnerable to cross-site scripting. Cross-site scripting is a common
security flaw, and it pops up several times on mailing. During both
security audits and security courses, people asked how to exploit this, so
that is the main reason for making this tutorial.
ADDITIONAL INFORMATION
The complete paper can be found at:
<http://angelo.scanit.biz/papers/xss.pdf>
http://angelo.scanit.biz/papers/xss.pdf.
The information has been provided by <mailto:michael@scanit.be> Michael
Hendrickx.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: SecuriTeam: "[NEWS] TCLHttpd Contains Two Vulnerabilities (Directory Browsing, XSS)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
