Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Web-App-Sec
[Top] [All Lists]

Re: myspace hack

Subject: Re: myspace hack
Date: Fri, 14 Oct 2005 16:04:39 +0100
On Friday 14 Oct 2005 15:29, Reynolds, Jake wrote:
I wouldn't consider this an XSS attack. Where in the attack did information
cross sites? This seems like it is an embedded XSS attack in that a
malicious script was entered into a profile in hopes that victims would
view and execute it. However, nothing was sent across sites via the script.
The vulnerability was a lack of output validation in my opinion, which is
the same vulnerability that an XSS attack would exploit. I don't know how
you would classify the attack... Probably "self-replicating session
riding". Yeah that has a nice FUD-factor to it.

I coined the term Same Site Scripting to describe the act of abusing 
XMLHttpRequest whilst playing around with this attack vector for a paper I'm 
writing.  Anyone have a better suggestion?

Cheers,
Tim
-- 
Tim Brown
<mailto:tmb@65535.com>

<Prev in Thread] Current Thread [Next in Thread>