Via Brad Neuberg: RSnake’s XSS (Cross Site Scripting) Cheatsheet: Esp: for filter evasion.

Limitations on cross site scripting (XSS hereafter) have been troubling me as I try to write enhancements to our library catalog, but the reasons for the prohibition are sound. Without them I could snort your browser cookies (RSnake lists: “cookie/credential stealing/replay/session riding” among the threats, but a well-planned attack could also fetch resources from internal webservers and deliver them to external data thieves).
It turns out you can insert JavaScript in <img> tags (among many, many others) and obfuscate it with Unicode, hex, and other less-readable encodings or by inserting tab characters (“&#x09;”) or newlines (“&#x0A;”). It would be impossible for me to list every possible attack vector, but RSnake takes a good stab at it.

If you allow users to insert HTML in comments, you should be aware of this….

tags: browser threats, cheatsheet, cross site javascript, cross site scripting, filter evasion, internet threats, javascript, scripting, threat, threats, web, web browser, xss

Related:

• Simple Bookmarklet Demo
• [Insert Word Here] Is Hurting Your Network
• Ryan Eby’s Pursuit of Live-Search
• Sweet Cheat Sheets
• Automated Website Screen Captures on OS X

Posted November 1, 2005 by Casey
Categories: Technology. Tags: browser threats, cheatsheet, cross site javascript, cross site scripting, filter evasion, internet threats, javascript, scripting, threat, threats, web, web browser, xss.

4 Comments

Comments RSS TrackBack Identifier URI

Leave a comment

Name (required)

Mail (will not be published) (required)

Website

 

User contributed tags for this post:

4 pig com (985) - 666 com (972) - WWW 666 COM (750) - Heaven 666 (194) - www.666.com (189) - videos 666 com (172) - porno sx (163) - good sexs (153) - WWW 4 PIG COM (128) - 666 SEX (124) - haven 666 (102) - 666 porno (95) - pig porno (86) - www.heaven 666.com (86) - heaven 666.com (81) - heaven 666 com (74) - heaven666 (69) - 666 sex com (61) - www videos 666 com (60) - porno 666 (58) - heven 666 (57) - www heaven 666 com (48) - porno sxs (47) - bad sexs (43) - 666 com videos (41) - 4 pig (39) - www.heaven 666 (38) - sex 666 (36) - bad girlsex (35) - heawen 666 (35) - 3 pig com (35) - www.heaven.666 (33) - www.heaven.666.com (33) - videos.666.com (32) - haeven 666 (32) - pig sex com (30) - www.videos.666.com (28) - haven 666.com (28) - ways to have good sex (27) - www 4pig com (27) - sx porno (27) - sexs good (27) - WWW 4 PIG (27) - videos 666.com (26) - www.4pig.com (26) - 666 haven (25) - www.videos 666.com (25) - www.worldsx.com (24) - feed the pig com (24) - www.4 pig.com (24) - xss (24) - www.4.pig.com (23) - haven 666 com (22) - sexs in bad (22) - sexs org (21) - porno f lm (21) - bad sex com (21) - heaven.666.com (21) - www sex 666 com (20) - www.heaven 666. (20) - 666 movies (19) - 4pig (18) - www xxx-666-xxx com (17) - 50 sexs (17) - ways to have sex (17) - 666 sexs (17) - www=xxx=666 (17) - 4 pig porno (16) - 666 (15) - sex 666 com (15) - 666 videos (15) - porno.sx (14) - sexs (14) - www.videos sex.com (14) - sex.666.com (14) - pig com (13) - porno.sxs (13) - sexs 666 (12) - sxs porno (12) - www.xxx videos.com (12) - sexs go (11) - www.xxx.666. (11) - www.heaven 666.org (11) - http://www google com do/ (11) - how to have good sex com (11) - 4pig com (11) - would (11) - www world sx com (11) - PORNO SX COM (10) - good sex com (10) - www4 pig com (10) - 4.pig.com (10) - www heaven 666 (10) - how to have good sexs (10) - 666 heven (9) - www.sex pg.com (9) - sexs 3 (9) - www 666 sex com (9) - www 4 pig ro (9) - www.xxx 666.com (9) - pig sex.com (9) - www com 666 (9) - pigs porno (8) - xxx.666.com (8) - 666 heaven (8) - heaven.666 (8) - www.666.sex.com (8) - 666.sex.com (8) - cheatsheet (8) - videos porno 666 com (8) - www sex 666 (8) - porno 666 com (8) - xxx-666.com (7) - 4 sex com (7) - heven 666.com (7) - http://www google es/ig?sourceid=navclient&hl=es&am (7) - sex 666.com (7) - RSnake (7) - all (7) - porno sx 89 (7) - xxx-666-xxx.com (7) - video 666 com (7) - sexs ways (7) - www.world sx.com (7) - in bad sexs (7) - 4 pig.com (6) - 666-sex.com (6) - 666 porna (6) - www.4.pig (6) - WWW 666 SEX (6) - scripting (6) - 666 movies com (6) - heaven 666.org (6) - 4pig.com (6) - 4 p g com (6) - www.xxx.666 (6) - videos 666 (6) - pig sex (6) - haven 666 porno (6) - 4.pig.ro (6) - video google insert html (6) - 4pig sex (6) - cross (5) - xxx-666-xxx (5) - www 4 sex (5) - sex with pig com (5) - www.666.com. (5) - www.videos.sex.com (5) - www 666 porno (5) - 4 pigs porno (5) -