4 ms·
That's a feature. You can encode an entire webpage, including JavaScript, and, yes, including alerts. As long as they don't have user accounts or database acce
by Cushman 16y ago
That's a feature. You can encode an entire webpage, including JavaScript, and, yes, including alerts.
As long as they don't have user accounts or database access or such, XSS doesn't let an attacker do anything meaningful. It's not weak security, it's just how the site works.
Edit: To point out the obvious, your iframe trickery is not necessary. Script tags are not escaped, nor are event attributes: http://hashify.me/PGRpdiBvbmNsaWNrPSJhbGVydCgnVGhpcyBpc25cJ3QgcG9vciBzZWN1cml0eSwgaXRcJ3MgYSB3ZWJwYWdlIHdpdGggSmF2YVNjcmlwdC4nKTsiPkNsaWNrIGhlcmUuPC9kaXY+Cg== http://hashify.me/PGRpdiBvbmNsaWNrPSJhbGVydCgnVGhpcyBpc25cJ3...
- hashify 16y ago> That's a feature. Agreed! One can always link someone to a static HTML page with <script>alert('fu')</script> in the body, but no one would tag that "XSS". Does hashify.me make it easier to send annoying alert messages to your friends? Sure. Annoying, but no more harmful than sending them to the static equivalent.
- sweis 16y agoFair enough. It's similar to embedding third-party gadgets for things like iGoogle. However, in practice that content is sanitized. Note there are risks to hosting arbitrary Javascript beyond stealing cookies. For example, you can steal browser history, discover NAT IP addresses, scan intranet ports, etc. Here's a presentation by Jeremiah Grossman covering some of these attacks: http://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Grossman.pdf http://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Gro... Of course, attackers can host malicious content anywhere they control. I could just as easily send someone a bit.ly link to a malicious site I control.