Re: Web 2.0 backdoors made easy with MSIE XMLHttpRequest

2007-02-05 Thread Amit Klein
Michal Zalewski wrote: On Sat, 3 Feb 2007, Michal Zalewski wrote: xmlhttp.open(GET\thttp://dione.ids.pl/\tHTTP/1.0\n\n;, x,true); Funny enough, Paul Szabo was quick to point out that Amit Klein found the same vector that I used here for client-side backdoors in May 2006 (still not

Re: Web 2.0 backdoors made easy with MSIE XMLHttpRequest

2007-02-03 Thread Michal Zalewski
On Sat, 3 Feb 2007, Michal Zalewski wrote: xmlhttp.open(GET\thttp://dione.ids.pl/\tHTTP/1.0\n\n;, x,true); Funny enough, Paul Szabo was quick to point out that Amit Klein found the same vector that I used here for client-side backdoors in May 2006 (still not patched?! *shrieks in horror*),