Re: New Web Vulnerability - Cross-Site Tracing

On Wed, 2003-01-22 at 13:31, xss-is-lame@hushmail.com wrote:
>
> -----BEGIN PGP SIGNED MESSAGE-----
to able to get JavaScript/Flash/etc executed on the victim's system as a PREREQUISITE.

certainly.

>
> So, to summarize:
get arbitrary JavaScript executed on a web client, in a different zone.

this is correct. Via a web page, message board, web mail, etc etc etc.

>
> Is this a useful thing to know if you're looking for a way to steal cookies? Sure!
Is this a revolutionary tactic that will allow you to compromise the security of any of the webservers listed in the whitepaper? No.

Ok... we are not talk about "rooting" the web server here, but compromising the user credentials client-side. The credentials be it cookies or basic authentication, from a protected domain. You can now XSS any domain from the users browser even if the domain has no web apps at all.

> This isn't any different from the many, many, many known ways of violating
someone's HTTP client if you can get them to execute Flash or JavaScript or ActiveX of your choice.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

I must disagree... this is a much much different way to perform a credential theft. But...for the sake of information, can you provide me a link where they do it in this manner?   

We've seen dozens of holes in IE's security constraints that allow attackers to view files, steal cookies or execute commands. Unlike Guninski or GreyMagic's advisories, this one has simply been built up to ridiculous proportions with marketting language in the press release and in the ExtremeTech article.

Again, not using this method. Received on Wed Jan 22 18:47:18 2003