On Thu, 7 Nov 2002, Nick Simicich wrote: > If I understand the XSS vulnerability correctly, it is all based on the > ability of javascript to access cookies through the document.cookie > property. No, it's not just about that. You can also include scripts that will perform some action on your behalf, by redirecting to a script that does something (i e, an XSS bug in a web-based Usenet client might open up the possibility for an attacker to post to Usenet under your name). This is done by simply including HTML code like: <script>self.location.href="/script.cgi?param1=the¶m2=blue¶m3=mask" </script> or even: <meta http-equiv="Refresh" content="0; URL=/script.cgi?param1=the¶m2= blue¶m3=mask"> (The latter version doesn't even use JavaScript.) To sum this all up, stating that XSS is all about JavaScript being able to access cookies to steal someone's password is an oversimplification. // Ulf Harnhammar VSU Security ulfhat_private _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
This archive was generated by hypermail 2b30 : Fri Nov 08 2002 - 22:54:56 PST