On Wed, Nov 19, 2003 at 11:14:07AM +0000, Paul Johnston wrote:
> Hi,
>
> I occasionally find servers that exhibit cross site scripting flaws when
> you use nasl/telnet to investigate. However, if you try to reproduce
> this in a browser, for some reason the browser escapes the html control
> characters. The example just now is a Resin server, producing a 404
> error message. I've seen it before in other situations.
>
> Is this really a vulnerability?
Probably - a lot of browsers escape the HTML before sending it, thereby
hiding the flaw.
-- Renaud
_______________________________________________
Nessus mailing list
[EMAIL PROTECTED]
http://mail.nessus.org/mailman/listinfo/nessus
