Re: Yet another major Hotmail security hole - injecting

From: Brian Hampson (brianat_private)
Date: Thu Sep 23 1999 - 13:31:16 PDT

Next message: David Brumley: "solaris DoS"

Previous message: Jonathan James: "SV: Yet another major Hotmail security hole - injecting"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

When we last heard from you, the following words rang out across the 'Net:

>I tested your script on my own Hotmail account, but the execution of the
>Javascript failed. I'm using Netscape Communicator 4.05.

>I also tested the same script using Internet Explorer 4.0 build 4.72.3110.4
>SP1, it didn't execute in IE.

The Javascript alert works in IE5.  I don't think the "first message in your
mailbox part" does though.

I had cobbled together a very basic HTML message consisting of:

<HTML><BODY>

-YOUR FAVOURITE CODE HERE INCLUDING ASCII replacement for javascript-

</BODY></HTML>

I can't see that Hotmail will ever be able to block javascript if this is the
case...think..you could replace any letter, or any combination of letters.
Major coding hassle.

--

   Brian P. Hampson                  ASL Analytical Service Laboratories Ltd
   System Administrator,             Vancouver, BC (604)253-4188
     ----------------- http://www.ASL.CA/ ----------------------------

Speaking for myself, not ASL

Next message: David Brumley: "solaris DoS"
Previous message: Jonathan James: "SV: Yet another major Hotmail security hole - injecting"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:04:51 PDT