First of all, read this :
http://www.cgisecurity.net/articles/xss-faq.shtml
Then if you findout that the webserver itself is vulnerable to XSS, which i doubt.
You might have found a CGI hosted on the server vulnerable to XSS, in any case once you find out for sure, then see if that website/CGI is responsible for issuing cookies or for the Authentication of cookies.
If it is not, then your XSS alert is going to be an alert only in your Final Report, and you could say that the bad-coding or non-security conscious coding practices have been exercised during coding of CGI's.
Regards
--------
Muhammad Faisal Rauf Danka
Head of GemSEC / Chief Technology Officer
Gem Internet Services (Pvt) Ltd.
web: www.gem.net.pk
Key Id: 0x784B0202
Key Fingerprint: 6F8C EDCF 6C6E 06A5 48D7 6A20 C592 484B
784B 0202
_____________________________________________________________
---------------------------
[ATTITUDEX.COM]
http://www.attitudex.com/
---------------------------
_____________________________________________________________
Promote your group and strengthen ties to your members with email@yourgroup.org by Everyone.net http://www.everyone.net/?btn=tag
----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/
Received on Aug 21 2002
Intro
