Re: strange requests sent to my WWW

piotr_sobolewski@xxxxxxxxxxxxxxx writes:

Scott W Gifford wrote:

[...]

On another note, though your script is safe from that attack, you may
be vulnerable to a less severe cross-site scripting attack, and should
really escape any HTML that happens to be in $goto.

Why? Any HTML code somebody puts in $goto will be interpreted on the local
machine of the guy who sent the request.

Right, that's a cross-site scripting attack:

http://www.cgisecurity.com/articles/xss-faq.shtml

Putting clever HTML in there makes it possible to steal from the
client any cookies you've set on your site if they visit a link, trick
somebody who trusts your site into viewing the attacker's page
thinking it's yours, or leverage any special trust somebody has in
your site (for example if a client has allowed it to install code,
show popups, run ActiveX, etc.).

----Scott.
.

Relevant Pages

  • Re: strange requests sent to my WWW
    ... Any HTML code somebody puts in $goto will be interpreted on the local ... that's a cross-site scripting attack: ... It's always safer to escape any user-controlled data before including ...
    (comp.security.misc)
  • Re: strange requests sent to my WWW
    ... Any HTML code somebody puts in $goto will be interpreted on the local ... that's a cross-site scripting attack: ...
    (comp.security.misc)
  • [NT] BadBlue 302 Status Message XSS
    ... BadBlue is susceptible to a cross-site scripting attack in its HTTP ... Obviously, if you pass in HTML markup, it continues into the reply ... This vulnerability cannot be exploited on Internet Explorer, ... HTML, as the entity is downloaded, displayed, and then the redirect ...
    (Securiteam)
  • Re: IF THEN for button?
    ... If Radiobutton1 is pressed and option group lsteditorial is selected, ... if Radiobutton1 is pressed and option group lstpres is selected, goto ... HTML cannot do this. ... implement them with client-side scripting or server-side scripting; ...
    (comp.lang.php)
  • Re: Learnig to Build a Tree View Control
    ... if you goto the book store and look at the javascript/html section, ... should find lots of material on this and other html ui components. ...
    (microsoft.public.dotnet.framework.aspnet.webcontrols)