Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: on xss and its technical merit
From: reepex <reepex () gmail com>
Date: Sun, 4 Nov 2007 18:11:50 -0600

you see i do not agree with this because you are relying on other bugs to
make xss useful and again you are relying on interaction from the user.

any bug that requires another (form of) bug to be useful or that requires
user interaction is inherently weaker then then other "any time" bugs like
bof/sql injection/whatever

On Nov 4, 2007 5:16 PM, pdp (architect) <pdp.gnucitizen () googlemail com>
wrote:

well valid point. XSS can alway be used as a career to whatever kind
of attack you have in there. Just imagine the MySpace XSS warm
combined with the IE VML or one of these ActiveX bugs that allow you
to write into arbitery files on the file system (so that it is not a
software bug). Hmmm?

On Nov 4, 2007 11:51 PM,  <nate.mcfeters () gmail com> wrote:
What about when xss leads to stack overflows and command injections?
 See http://xs-sniper.com.  It would seem that if you subscribe to the
thought that only attacks that take over a victims computer are valid, then
you would have to now admit xss as valid as well.

Nate
Sent via BlackBerry from T-Mobile


-----Original Message-----
From: reepex <reepex () gmail com>

Date: Sun, 4 Nov 2007 13:26:17
To:full-disclosure () lists grok org uk, "pdp (architect)" <
pdp.gnucitizen () googlemail com>
Subject: [Full-disclosure] on xss and its technical merit


Pdp architect and I have been emailing back and forth about whether xss
has a place in fd, bugtraq, or the security research area at all. He decided
that we should start a discussion about in on here and gets peoples
unmoderated opinion. This discussion should not concern whether its
important due to stealing bank info, paypal, whatever it should only stick
to xss as a pure research area. Or as pdp described it:

"we are talking about whether XSS is as technical as other security
disciplines. We are also talking about whether it should have a deserved an
recognized place among FD readers and contributers. however, the topic wont
cover only whether you can detect or inject XSS, this is lame. it will cover
the whole 9 yards... pretty much all the topics covered inside the XSS
book."

My ideas on the topic are

1) XSS isnt techincal no matter how its used
2) people who use xss on pentests/real hacking/anything but phishing are
lame and only use it because they cannot write real exploits (non-web) or
couldnt find any other web bugs (sql injection, cmd exec,file include,
whatever)
3) XSS does not have a place on this list or any other security list and
i remember when the idea of making a seperate bugtraq for xss was proposed
and i still think it should be done.
4) if you go into a pentest/audit and all you get out is xss then its a
failed pentest and the customer should get a refund.
5) publishing xss shows your weakness and that you dont have the ability
to find actual bugs ( b/c xss isnt a vuln its crap )

i think pdp is going to respond first. should be fun ;)

 _______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/




--
pdp (architect) | petko d. petkov
http://www.gnucitizen.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]