-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 08/04/2012 10:10 AM, Taras wrote: > Hi, all! > > JFYI: currently I'm working on optimize xss&contect code to pass > wavsep unittests.
Great stuff! I've been watching your SVN commits :) Specifically from the test_xss.py file, from the list of WAVSEP test cases, how many are passing? How many are we missing? Do you think we'll be able to cover them all? Please don't forget about the false positive tests, which we should be able to pass too. > One of problems to solve now is double context (How may of you > watched Inception movie [0]? :): Great movie, and funny to see how you related those two things :) > > <html> <input type="button" value="ClickMe" onClick="var > customerName='PAYLOAD'"> </html> > > As you see here JS context is inside HTML attribute (JS event > handler) onlick. Oh wow, so you'll have to verify that you can break out of the ' context and then the " one! Was your code designed to handle something like that? > > [0] http://www.imdb.com/title/tt1375666/ > - -- Andrés Riancho Project Leader at w3af - http://w3af.org/ Web Application Attack and Audit Framework Twitter: @w3af GPG: 0x93C344F3 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iEYEARECAAYFAlAdO0sACgkQLgy+VpPDRPO7awCgtUz5Chd+NIfPGVKHfRSfyjXG +4sAoL8pzLCc6CZ2PrT1DLHjathTySD8 =J+L1 -----END PGP SIGNATURE----- ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ W3af-develop mailing list W3af-develop@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/w3af-develop
