Re: XSS at msn.com и cisco.com

[Barrie Dempster <barrie () reboot-robot net>]

On Saturday 12 August 2006 14:35, Valery Marchuk wrote:
> > I bet you haven't the balls all to search on nsa.gov and fbi.gov :>
>
> It looks like I have :) See my next message "XSS at nsa.gov" or just visit
> my blog
> http://www.securitylab.ru/blog/tecklord/179.php

http://lists.grok.org.uk/pipermail/full-disclosure/2005-May/thread.html#34263

I Reported this rather lame finding to them a while back as well as some other 
possible issues. Got no reply, and as the discussion back then indicated 
there could be a number of reasons for this, from them not really worrying 
about it to it being a honeypot like attempt or other such theories.

Personally, I don't think they care all that much but I do think lame security 
issues on the website of any organisation undermines their credentials for 
handing out security advice to others.

I know that the seriousness of XSS is contentious in these parts but that's 
not a debate I'd care to enter - I have my own ideas of the threat level of 
XSS.


-- 
With Regards..
Barrie Dempster (zeedo) - Fortiter et Strenue

              - http://reboot-robot.net -

"He who hingeth aboot, geteth hee-haw" Victor - Still Game

Attachment: smime.p7s
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/