Re: security contact for uat.edu needed

On 31-jul-2007, at 0:42, Hans Wolters wrote:

> Hi there,
>
> Anyone that knows how to contact responsible persons at uat.edu?
> root@ and security@ do not seem to work.
>

Thanks all for your suggestions. Current state:

abuse@ does not work and is listed in rfcignorant (since April this year).
noc@ seems to work but does not answer
whois contact person, seems to work but does not answer

Other addresses do seem to work but do not answer either.

Currently I can only announce the following. Uat runs a site called hackersdegree.com. This
is a site that allows persons to toy with a javascript shell. It's not a dangerous bug but it allows
people to insert XSS into it.

The bigger problem is that they are also providing a link to liverperson.net. The people coding
the site do not check any user input and therefor allow usernames with xss injected to. Let me
be clear, this is not to be blamed on liveperson.net, I have found other instances that will talk
to the liveperson.net robots that are not having these problems.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

The XSS used is not a simple <script>alert(foo.bar) thingy, it's slightly more complicated.

If some of you are able to contact a whitehat over there then please let them contact me if
they need more information, I am not wasting money calling abroad for something that is not a problem for me. A university tricking students to graduate in security should be able to secure their own sites.

Best regards,

Hans Received on Fri Aug 3 15:25:11 2007