Hei Amit, On 2/7/07, Amit Klein <[EMAIL PROTECTED]> wrote: > pdp (architect) wrote: > > Amit, > > > > :) This is not about who did it first. > > Agreed. But it would be nice to receive the credit ;-)
Sorry man. I knew that you have discussed this before I would definitely give you the credits. :) > > BTW, your example is broken. > > location.search does not include the fragment identifier. > > > > Guilty as charged. I remember working directly with document.location > (which includes the hostname and path) when I investigated the issue, > then when I wrote my text I decided that a more elegant way would be > with the ".search" property, but I failed to verify that it actually > works. Thanks for pointing this out, and here's the formal errata: > > In > http://www.webappsec.org/lists/websecurity/archive/2005-10/msg00030.html, > the example should be: > > http://target.site/vulnscript.cgi?injectme= > <http://target.site/vulnscript.cgi?injectme=><script>eval(document.location.substr(...[fill > in the offset here]...))</script>#...JS payload here... > > Thanks to "pdp (architect)" for pointing this out. > > Regardns, > -Amit > > > > Cheers > > > > On 2/7/07, Amit Klein <[EMAIL PROTECTED]> wrote: > >> pdp (architect) wrote: > >> > http://www.gnucitizen.org/blog/playing-in-large > >> > > >> > Basically this article is about how to squeeze more data into size > >> > restricted, unsanitized field. This technique can also be used to hide > >> > attackers activities. > >> > > >> It seems that you've stumbled upon something I already disclosed: > >> http://www.webappsec.org/lists/websecurity/archive/2005-10/msg00030.html > >> > >> Sorry... > >> -Amit > >> > >> > > > > > > -- pdp (architect) | petko d. petkov http://www.gnucitizen.org _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
