4 ms·
Reflected XSS? Do you mean stored? If Dave is testing for reflected XSS he's going to be alert(1)'ing or using img tag....Which is not a persistent xss... For
by theboss 13y ago
Reflected XSS? Do you mean stored? If Dave is testing for reflected XSS he's going to be alert(1)'ing or using img tag....Which is not a persistent xss...
For reflected xss to affect every user on the site he's going to have to use his own toolkit to send a malicious link to every user on the site....
- tptacek 13y agoI mean reflected. The kind you don't expect to get stored. If that's a surprise to you, you might not test a lot of websites, because this comes up somewhat regularly. By the way, the XSS payload has nothing to do with the persistence of the attack. You alert() stored XSS in testing too.
- theboss 13y agoI do test a lot of websites actually but I mis-understood what you meant. Like the other guy said this area is grey. If he accidentally finds a stored xss of the magnitude you suggest I'm 100% sure he still wouldn't go to jail. Who tests with a malicious payload? There would be no malicious intent in the situation and no unauthorized access...still.
- tptacek 13y agoYou didn't say this was a grey area. You said "Nobody will EVER go to jail for an XSS" and then cited the CFAA as evidence of that fact, suggesting that you might have some minor gaps on how XSS works and that you definitely have major gaps on how CFAA works. Pro-tip: avoid stringing "Nobody will EVER go to jail for" and "CFAA" together in the same paragraph.
- theboss 13y agoLet me rephrase. Nobody will go to jail for the level of poking and prodding I expect Dave is trying. I'm 100% sure the CFAA won't send anyone to jail for alert(1) My 100% is a gut feeling. I'll quit computers if I'm wrong
- tptacek 13y agoI doubt anyone is going to get in trouble over the PDF report I read about Healthcare.gov, but that's not why I'm commenting.