While I generally agree with your assessment of the self-aggrandizing nature of Aditya's posts, I would argue that "Double Trap" XSS is at least academically interesting. It can defeat even a perfect filter designed to catch only a single valid instance of script tags in user input.
I say academically because attempting to do input filtering to stop XSS is a horrible approach; anyone attempting to write input filters to catch the infinite permutations of executable markup and myriad encodings thereof is wasting his time. -j On 6/15/07, Michal Zalewski <[EMAIL PROTECTED]> wrote: > On Tue, 12 Jun 2007 [EMAIL PROTECTED] wrote: > > > In an admittedly brief review of this page, I saw nothing useful or > > informative to my career in information assurance. > > Aditya has a history of using security mailing lists to advertise > his various security consulting projects (metaeye.org, etc) under the > guise of fairly bogus whitepapers and vulnerability reports: > > http://portal.spidynamics.com/blogs/jeff/archive/2007/04/16/ASP.NET-encoding-shortcomings-_2800_review-of-MetaEye-analysis_2900_.aspx > http://www.webappsec.org/lists/websecurity/archive/2007-03/msg00079.html > http://www.webappsec.org/lists/websecurity/archive/2007-03/msg00115.html > > As a rule, these claim to discuss cutting-edge attack techniques whilist > in fact describing something remarkably mundane (register_globals as > "Global Space Exploitation", form-based XSS as "Double Trap Attacks"). > > I would advise WEBSECURITY moderators to exercise... well, moderation in > approving his non-advisory posts: > > http://www.webappsec.org/lists/websecurity/archive/2007-06/msg00010.html > http://www.webappsec.org/lists/websecurity/archive/2007-06/msg00019.html > > /mz > > > ---------------------------------------------------------------------------- > Join us on IRC: irc.freenode.net #webappsec > > Have a question? Search The Web Security Mailing List Archives: > http://www.webappsec.org/lists/websecurity/ > > Subscribe via RSS: > http://www.webappsec.org/rss/websecurity.rss [RSS Feed] > > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
