4 ms·
Stored XSS Vulnerability in Amazon (or How to hack Amazon with a book)
- iwwr 16y agoThe Bobby Tables of literature
- schrototo 16y agoThis has to be the funniest XSS hack of all time.
- jerf 16y agoJust replicated the Stallown3d!1 one, it's still there. Actually a useful link to have; I've had some difficulty convincing people in the past that this sort of injection is a big deal and that's a convenient, harmless way to prove the point.
- pbhjpbhj 16y agoDoesn't that mean you only need to control http://ha.ckers.org/s.js http://ha.ckers.org/s.js (or similar) rather than write a book?
- kingofspain 16y agoCouple of $$, Createspace. Bait-y title. Merry xmas!
- Groxx 16y agoThat is an epic XSS hack. I think they won.
- infinity 16y agoThis is fantastic! Great find. It reminds me a little of the idea of pen and paper attacks, like this http://news.ycombinator.com/item?id=1721494 http://news.ycombinator.com/item?id=1721494 But writing a book as an attack vector is certainly epic.
- Mithrandir 16y agoCouldn't do it w/o logging in, until I copied the url from the author's picture. http://www.amazon.com/XSS-Attacks-Scripting-Exploits-Defense/dp/1597491543/ref=sr_1_1?ie=UTF8&qid=1292506849&sr=8-1 http://www.amazon.com/XSS-Attacks-Scripting-Exploits-Defense...
- Mithrandir 16y agoha.ckers is down. :(
- code_duck 16y agoNow THAT would be an elaborate hack to pull off. Obviously Amazon never thought of that! Between this and the magic goggles, this week is turning out to be so interesting.
- FluidDjango 16y agoPossibly fixed? I'm not seeing this vulnerability now via Mac FireFox 3.6.12 or Safari.
- infinity 16y agoIt seems so, I'm not seeing this with Internet Explorer. The Book Preview does not work at all in Opera :-(