No, this is using Crazy Browser, which does not escape HTML before sending - I routinely use it to verify other cross site scripting results. It seems something about the response is making it escape the characters. Does anyone know why?
Paul
I occasionally find servers that exhibit cross site scripting flaws when you use nasl/telnet to investigate. However, if you try to reproduce this in a browser, for some reason the browser escapes the html control characters. The example just now is a Resin server, producing a 404 error message. I've seen it before in other situations.Probably - a lot of browsers escape the HTML before sending it, thereby
Is this really a vulnerability?
hiding the flaw.
-- Paul Johnston Internet Security Specialist Westpoint Limited Albion Wharf, 19 Albion Street, Manchester, M1 5LN England Tel: +44 (0)161 237 1028 Fax: +44 (0)161 237 1031 email: [EMAIL PROTECTED] web: www.westpoint.ltd.uk
_______________________________________________ Nessus mailing list [EMAIL PROTECTED] http://mail.nessus.org/mailman/listinfo/nessus
