Re: Can you exploit this XSS?

From: dd (dd_at_ghettohackers.net)
Date: 11/19/03

  • Next message: Sverre H. Huseby: "Re: Can you exploit this XSS?" 
    Date: Wed, 19 Nov 2003 13:59:55 -0800
To: Paul Johnston <paul@westpoint.ltd.uk>

    Paul,

    What you have run into is called attribute encoding. When dealing html
    tag attributes enclosed inside of quotation marks, the only char that is
    "required" to encode is ". I usually recommend more robust output encoding.

    Given you description, this is not normally exploitable. Depending on
    the browser it may be possible to trick some browsers into thinking your
    html is broken by injecting line feeds and starting up new tags.

    dd

    Paul Johnston wrote:

    > Hi,
    >
    > While auditing a web app, I've found the site redirects not found pages
    > to a login screen. This contains an element like:
    >
    > <input type="hidden" name="tageturl" value="XXX">
    >
    > Now, the XXX bit is controlled by the user, and it seems the only
    > characters escaped are " and & - i.e.
    > <script>alert(document.cookie)</script> gets through (hence my tool
    > alerted me).
    >
    > Can this be exploited for XSS? I can't see how to immediately, but it
    > seems possible.
    >
    > Paul
    >

  • Next message: Sverre H. Huseby: "Re: Can you exploit this XSS?"

    Relevant Pages

    • Re: Where to get BeautifulSoup--www.crummy.com appears to be down.
      ... Beautiful Soup uploaded to my website: ... obtaining a sensible parse tree in the face of common HTML errors. ... the encoding of an HTML or XML document, ... appears after this Tag in the document.""" ...
      (comp.lang.python)
    • encoding during elementtree serialization
      ... ElementTree's XML serialization routine implied by tree._write(file, node, encoding, namespaces looks like this (elided): ... if tag is Comment: ... I believe encoding during recursion makes serialization slightly slower than it could be if we could get away with not encoding any pcdata or attribute values during recursion. ...
      (comp.lang.python)
    • Re: HTML META tag
      ... >From what I've seen of XML, the encoding appears to be a requirement. ... Sometimes the encoding is specified in the tag at the top of the ... For some reason, this following line ...
      (microsoft.public.vb.general.discussion)
    • Re: SGF and character encodings
      ... encoding beforehand, and might fail to even find the CA tag. ... SmartGo switches to use the encoding in the file as soon as ... SmartGo lets users set a default encoding that's used when no CA tag is ...
      (rec.games.go)