WebApp Sec: Cross Site Scripting in Google

[RSnake <rsnake () shocking com>]

Google is vulnerable to cross site scripting attacks.  I found a
function built off their add RSS feed function that returns HTML if a
valid feed is found.  It is intended as an AJAXy (dynamic JavaScript
anyway) call from an inline function and the page is intended to do
sanitation of the function.  However, that's too late, and it returns
the HTML as a query string, that is rendered, regardless of the fact
that it is simply a JavaScript snippet.

Here is the post that explains the whole thing:

http://ha.ckers.org/blog/20060704/cross-site-scripting-vulnerability-in-google/


-RSnake
http://ha.ckers.org/
http://ha.ckers.org/xss.html
http://ha.ckers.org/blog/feed/

-------------------------------------------------------------------------
Sponsored by: Watchfire

Securing a web application goes far beyond testing the application using 
manual processes, or by using automated systems and tools. Watchfire's 
"Web Application Security: Automated Scanning or Manual Penetration 
Testing?" whitepaper examines a few vulnerability detection methods - 
specifically comparing and contrasting manual penetration testing with 
automated scanning tools. Download it today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmm
--------------------------------------------------------------------------