Gee. you are right, my bad.

Related to the topic, there are other ways apart from
email to lure people and have an XSS in a URL executed
at their computers, Blogs and Bug tracking systems are
a good example.

You simple post a comment with a malicious URL, in
this case the malicious code is not executed just by
seeing the page but by clicking in a link (on
copy&paste in case of a text link). Just one more step
than a regular XSS stored at server side.

Definitely it is more complex since you have to "go
phishing", but still doable and dangerous.

Regards and sorry again,

=There are many naive and desperate people out there=

--- v9 <v9@xxxxxxxxxxx> escribió:

alright. folks, enough with the unrelated XSS
stories, for the last time,
i'm simply saying not all XSS are the same...i am
talking about XSS that
doesn't get saved on the server and has to be
included in the url... i
don't know how much more clear to make this.

"[XSS HERE]" style.

i'm quite aware of samy's myspace worm, good idea,
however that is
completely different from what i am and have been
talking about.

samy's worm was stored on the server and shown to
all who viewed his
myspace page. these kind of XSS are in a url you'd
have to create
yourself, you wouldn't ever stroll across this, as
you have to make it in
the url to work.

so as i said before, encoded/phishing (emails) is
about the only possible
use for these that i can see, and not even to a good
to just use the usual <A HREF> style misdirection,
and has more options).
if someone can tell me otherwise, post a RELATED
reply. (ie. in-url XSS)

On Mon, 17 Apr 2006, Juan C Calderon wrote:


I want to share with you this information I got
this same list back in April 5th, It is about a
created with an XSS at a myspace website (check
list archives). - Intricate Script Injection

The myspace hack story

There are very interesting links at the end of
paper relating to XSS viruses and their
with traditional viruses.

hope it is interesting to you, this is just a
example of what a XSS can do,


Correo Yahoo!
Espacio para todos tus mensajes, antivirus y
antispam ¡gratis!
Regístrate ya -

Correo Yahoo!
Espacio para todos tus mensajes, antivirus y antispam ¡gratis!
Regístrate ya -