Hey all,
This fairly short and pretty cool vectored attack came through on the
dailydave; thought I'd share it here:
- Ben
---------------------
Hi -
Back in 2002 I had published details of a vulnerability affecting most
web browsers. It detailed a security flaw that allows attackers to
abuse non-HTTP protocols to launch Cross Site Scripting attacks even
when a target web application was not vulnerable to XSS.
Six years later I'm releasing an update to this research in this
paper. This security vulnerability still affects popular web browsers
nowadays and the following browsers were tested as vulnerable:
* Internet Explorer 6
* Internet Explorer 7
* Internet Explorer 8 (beta 1)
* Opera 9.27
* Opera 9.50
* Safari 1.32
* Safari 3.1.1
Others have described how to abuse behavior for purposes other than
Cross Site Scripting. NGSSoftware previously published a paper called
"Inter-Protocol Exploitation" which references the original
EyeonSecurity paper.
Paper at:
http://resources.enablesecurity.com/resources/the%20extended%20html%20form%20attack%20revisited.pdf
or http://tinyurl.com/5d88ll
_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk
NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com
Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php
