XSSed | Cross Site Scripting (XSS) attacks information and archive
Another Ebay permanent XSSWritten by KFTuesday, 13 November 2012 The Indian security researcher Shubham Upadhyay aka Cyb3R_Shubh4M, sent us a new permanent XSS affecting the products listings on Ebay.com read more... F-Secure, McAfee and Symantec websites again XSSedWritten by DPFriday, 13 January 2012 Once again, the websites of the three famous antivirus vendors are vulnerable to cross-site scri
XSS (Cross Site Scripting) Cheat Sheet
XSS (Cross Site Scripting) Cheat Sheet Esp: for filter evasion By RSnake Note from the author: XSS is Cross Site Scripting. If you don't know how XSS (Cross Site Scripting) works, this page probably won't help you. This page is for people who already understand the basics of XSS attacks but want a deep understanding of the nuances regarding filter evasion. This page will also not show you how to
2008-02-08
文字化けに関する原因一覧表があったのでメモ。ただし、ここにのっていないのもある。 文字化け::BugbearR's Wiki 激しく力作也。 いえ、実践的なXSS防御の話ではないのです。どうみても役に立たないことを少しばかり。昨晩ごにょっていて個人的に面白かったので。 <script> for(J in{to:0})for(K in{String:0})for(L in{char:0})for(M in{At:0}){{a=(198)[J+K](16)}{alert(a[L+M](0))}} </script>ええと、手書きで上に書いたコードが正しければ、きっと、"c"がalertされると思います。このコードを読んだだけでわかった人はエライです。 基本的にOperaとFirefoxとIEとで動作させたいのと… 使っていいメタキャラは最小限にしたかったので、「:」「(」「)」「{」「}」「[
printenv at xss-quiz.int21h.jp
printenv at xss-quiz.int21h.jp Your IP address: 133.242.243.6 () NameValue HTTP_ACCEPT*/* HTTP_CACHE_CONTROLno-cache HTTP_CONNECTIONclose HTTP_HOSTxss-quiz.int21h.jp HTTP_USER_AGENTHatenaBookmark/4.0 (Hatena::Bookmark; Analyzer) QUERY_STRING REMOTE_ADDR133.242.243.6 REQUEST_METHODGET REQUEST_SCHEMEhttp REQUEST_URI/
UTF-7 XSS Cheat Sheet
Countermeasures against XSS with UTF-7 are: Specify charset clearly (HTTP header is recommended) Don't place the text attacker can control before <meta> Specify recognizable charset name by browser. For more information about UTF-7 trick, see "Cross-site scripthing with UTF-7". These XSS patterns are tested on IE6 and IE7. Yosuke HASEGAWA <hasegawa@openmya.hacker.jp> Last modified: 2008-01
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
