4 ms·

This is vulnerable to XSS: http://hashify.me/PGlmcmFtZSBzcmM9ImphdmFzY3JpcHQ6YWxlcnQoJ1dlYWsgc2VjdXJpdHknKTsiPgoK http://hashify.me/PGlmcmFtZSBzcmM9ImphdmFzY3Jp

• Cushman 16y ago
  That's a feature. You can encode an entire webpage, including JavaScript, and, yes, including alerts. As long as they don't have user accounts or database access or such, XSS doesn't let an attacker do anything meaningful. It's not weak security, it's just how the site works. Edit: To point out the obvious, your iframe trickery is not necessary. Script tags are not escaped, nor are event attributes: http://hashify.me/PGRpdiBvbmNsaWNrPSJhbGVydCgnVGhpcyBpc25cJ3QgcG9vciBzZWN1cml0eSwgaXRcJ3MgYSB3ZWJwYWdlIHdpdGggSmF2YVNjcmlwdC4nKTsiPkNsaWNrIGhlcmUuPC9kaXY+Cg== http://hashify.me/PGRpdiBvbmNsaWNrPSJhbGVydCgnVGhpcyBpc25cJ3...
  • hashify 16y ago
    > That's a feature. Agreed! One can always link someone to a static HTML page with <script>alert('fu')</script> in the body, but no one would tag that "XSS". Does hashify.me make it easier to send annoying alert messages to your friends? Sure. Annoying, but no more harmful than sending them to the static equivalent.
    • sweis 15y ago
      Fair enough. It's similar to embedding third-party gadgets for things like iGoogle. However, in practice that content is sanitized. Note there are risks to hosting arbitrary Javascript beyond stealing cookies. For example, you can steal browser history, discover NAT IP addresses, scan intranet ports, etc. Here's a presentation by Jeremiah Grossman covering some of these attacks: http://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Grossman.pdf http://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Gro... Of course, attackers can host malicious content anywhere they control. I could just as easily send someone a bit.ly link to a malicious site I control.
• ecaradec 15y ago
  It's also vulnerable to html injection... by design
• PsyVisions 15y ago
  XSS? you really don't know the meaning of those 3 letters...