pdp (architect) wrote: > Hei Amit, > > On 2/7/07, Amit Klein <[EMAIL PROTECTED]> wrote: >> pdp (architect) wrote: >> > Amit, >> > >> > :) This is not about who did it first. >> >> Agreed. But it would be nice to receive the credit ;-) > > Sorry man. I knew that you have discussed this before I would > definitely give you the credits. :) >
No worries, mate! >> In >> http://www.webappsec.org/lists/websecurity/archive/2005-10/msg00030.html, >> >> the example should be: >> >> http://target.site/vulnscript.cgi?injectme= >> <http://target.site/vulnscript.cgi?injectme=><script>eval(document.location.substr(...[fill >> >> >> in the offset here]...))</script>#...JS payload here... >> Of course, I meant document.location.href.substr(...), i.e.: http://target.site/vulnscript.cgi?injectme=><script>eval(document.location.substr(...[fill in the offset here]...))</script>#...JS payload here... -Amit _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
