Via Brad Neuberg: RSnake’s XSS (Cross Site Scripting) Cheatsheet: Esp: for filter evasion.

Limitations on cross site scripting (XSS hereafter) have been troubling me as I try to write enhancements to our library catalog, but the reasons for the prohibition are sound. Without them I could snort your browser cookies (RSnake lists: “cookie/credential stealing/replay/session riding” among the threats, but a well-planned attack could also fetch resources from internal webservers and deliver them to external data thieves).
It turns out you can insert JavaScript in <img> tags (among many, many others) and obfuscate it with Unicode, hex, and other less-readable encodings or by inserting tab characters (“&#x09;”) or newlines (“&#x0A;”). It would be impossible for me to list every possible attack vector, but RSnake takes a good stab at it.

If you allow users to insert HTML in comments, you should be aware of this….

tags: browser threats, cheatsheet, cross site javascript, cross site scripting, filter evasion, internet threats, javascript, scripting, threat, threats, web, web browser, xss

Posted November 1, 2005 by Casey Bisson
Categories: Technology. Tags: browser threats, cheatsheet, cross site javascript, cross site scripting, filter evasion, internet threats, javascript, scripting, threat, threats, web, web browser, xss.

4 Comments

Comments RSS TrackBack Identifier URI

Leave a comment

Name (required)

Mail (will not be published) (required)

Website

 

User contributed tags for this post:

4 pig com (985) - 666 com (972) - WWW 666 COM (752) - www.666.com (286) - Heaven 666 (203) - porno sx (174) - videos 666 com (172) - good sexs (158) - 666 SEX (131) - WWW 4 PIG COM (128) - haven 666 (117) - heaven 666.com (108) - www.heaven 666.com (107) - 666 porno (101) - pig porno (88) - heaven666 (79) - heaven 666.org (76) - heaven 666 com (74) - heven 666 (67) - porno 666 (62) - 666 sex com (61) - www videos 666 com (60) - www.4 pig.com (51) - www.heaven 666 (51) - porno sxs (50) - www heaven 666 com (48) - sex 666 (44) - bad sexs (43) - 666 com videos (41) - heawen 666 (40) - 4 pig (39) - www.heaven 666.org (39) - videos.666.com (38) - www.heaven.666.com (37) - www.heaven.666 (36) - bad girlsex (35) - 3 pig com (35) - www.videos.666.com (35) - www.worldsx.com (35) - www.4.pig.com (34) - heaven.666.com (34) - haeven 666 (33) - haven 666.com (32) - videos 666.com (32) - www.4pig.com (31) - pig sex com (30) - sx porno (29) - sexs good (27) - ways to have good sex (27) - WWW 4 PIG (27) - www 4pig com (27) - www.videos 666.com (27) - 666 haven (26) - 4pig (26) - xss (24) - feed the pig com (24) - heaven.666.org (24) - sexs in bad (22) - haven 666 com (22) - porno f lm (21) - bad sex com (21) - sexs org (21) - www sex 666 com (20) - www.heaven 666. (20) - 666 movies (19) - www=xxx=666 (18) - 50 sexs (17) - 666 sexs (17) - ways to have sex (17) - www xxx-666-xxx com (17) - 4 pig porno (16) - porno.sx (16) - sex.666.com (16) - 666 (15) - 666 videos (15) - sex 666 com (15) - www.heaven.666.org (15) - sexs (14) - www.videos sex.com (14) - 4pig com (14) - 666 heven (14) - porno.sxs (14) - pig com (13) - www.xxx videos.com (13) - sexs 666 (12) - sxs porno (12) - xxx.666.com (12) - xxx-666-xxx.com (12) - www.xxx.666. (12) - sexs go (11) - RSnake (11) - how to have good sex com (11) - would (11) - http://www google com do/ (11) - www world sx com (11) - 4.pig.com (11) - www.heaven666.com (11) - pig sex.com (10) - how to have good sexs (10) - good sex com (10) - www4 pig com (10) - PORNO SX COM (10) - www heaven 666 (10) - www.sex pg.com (10) - 666.sex.com (10) - 4pig porno (10) - www.xxx 666.com (9) - sexs 3 (9) - www 666 sex com (9) - www 4 pig ro (9) - www com 666 (9) - heaven 666 org (9) - 4pig.com (9) - www.xxx.videos.com (9) - cheatsheet (8) - pigs porno (8) - videos porno 666 com (8) - porno 666 com (8) - www sex 666 (8) - porno sx 89 (8) - 666 heaven (8) - heaven.666 (8) - heven 666.com (8) - haven.666 (8) - www.666.sex.com (8) - 666.heaven (8) - xxx-666-xxx (8) - 666-sex.com (8) - all (7) - 4 sex com (7) - sexs ways (7) - in bad sexs (7) - video 666 com (7) - 4pig sex (7) - http://www google es/ig?sourceid=navclient&hl=es&am (7) - sex 666.com (7) - sex.666 (7) - porno.sx.com (7) - xxx.666.xxx (7) - www.xxx.666 (7) - video.666.com (7) - www.4.pig (7) - xxx-666.com (7) - www.world sx.com (7) - scripting (6) - video google insert html (6) - pig sex (6) - WWW 666 SEX (6) - 666 movies com (6) - 4 p g com (6) -