"netscape navigator" is cracked.

From: Liu Die Yu (liudieyuinchinaat_private)
Date: Tue Apr 29 2003 - 02:12:43 PDT

  • Next message: paul: "RE: Windows Server 2003 Security Guide available"

    
     ('binary' encoding is not supported, stored as-is)
    ##################
    #
    #  Readers' Favorite - Make Notes in Your Browser today!
    #  http://liudieyuinchina.vip.sina.com/domex/aPoP/
    #  http://domex.int.tc/
    #
    ##################
    
    
    "netscape navigator" is cracked.
    ("that's all" is end of file if you are in a hurry)
    
    [tested]
    OS:Windows Server 2003 Enterprise
    Browser: "Netscape Navigator 7.02"
    "Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.0.2) Gecko/20030208 
    Netscape/7.02 "
    
    
    [demo]
    at
    http://liudieyuinchina.vip.sina.com/DomainDot/DomainDot-MyPage.htm
    or
    http://umbrella.mx.tc ==> "DomainDot-MyPage" section
    
    
    [screenshot]
    at
    http://liudieyuinchina.vip.sina.com/DomainDot/DomainDot-Screenshot.htm
    or
    http://umbrella.mx.tc ==> "DomainDot-Screenshot" section
    
    
    [exp]
    URL "http://[Domain]./[DirectoryName]/[FileName]"(one more dot 
    after "[Domain]") will actually navigate your browser to:
    "http://[Domain]/[DirectoryName]/[FileName]".
    then "document.domain" is "[Domain]."(one more dot in "document.domain").
    
    try to execute javascript:
    [CODE.JAVASCRIPT]document.domain=""
    
    after being set to an empty string, document.domain is auto-caculated to 
    be [DirectoryName].
    of course, "[DirectoryName]" can be "www.paypal.com", but you still cannot 
    access document at "www.paypal.com" by just having "www.paypal.com" 
    as "document.domain".
    
    now, you make "document.domain" to be "w.www.paypal.com", then set it 
    to "www.paypal.com". 
    you can access document at "www.paypal.com" now.
    
    
    that's all.
    
    
    [how]
    do you still remember "IE dot bug"?
    ( http://online.securityfocus.com/archive/1/273168/2002-05-18/2002-05-
    24/0 )
    
    they are so similar, aren't they?
    
    
    [gean]
    i hope you'll get well soon!
    
    
    [people]
    wish you all a nice day!
    
    greetings to:
    Sandblad(the guy who found "IE dot bug"), "the Pull", dror( 
    http://www.drorshalev.com/ ), bin, gean, dross and iainm.
    
    
    ##################
    #
    #  Readers' Favorite - Make Notes in Your Browser today!
    #  http://liudieyuinchina.vip.sina.com/domex/aPoP/
    #  http://domex.int.tc/
    #
    ##################
    
    -----
    all mentioned stuff can always be found at:
    Umbrella: MaX TeCh
    
    http://umbrella.mx.tc
    



    This archive was generated by hypermail 2b30 : Tue Apr 29 2003 - 10:37:44 PDT