Top 10 Web Hacking Techniques

2009

The 2009 Top 10 Web Hacking Techniques: all 10 winners and 98 nominated and collected techniques, each with its researcher, summary and preserved source.

98 records · 10 in the top ten · open this year in the interactive archive

The top ten

#1 Creating a Rogue CA Certificate Alexander Sotirov, Marc Stevens, Jacob Appelbaum, Arjen Lenstra, David Molnar, Dag Arne Osvik and Benne de Weger
Announcement of the 25C3 result in which an MD5 chosen-prefix collision was used against a commercial CA still signing with MD5, producing a rogue intermediate CA certificate trusted by every common browser. It can…
#2 HTTP Parameter Pollution (HPP) Stefano Di Paola
Announces the AppSec EU 2009 talk naming HTTP Parameter Pollution. Injecting query string delimiters lets an attacker add or override parameters a server or client later re-parses, so hardcoded values can be replaced…
#3 Flickr's API Signature Forgery Vulnerability (MD5 extension attack) Thai Duong and Juliano Rizzo
Advisory MOCB-01 combines MD5 length extension with delimiter-free API parameter signing to forge requests for Flickr applications without their shared secret. It documents the attack, PHPFlickr redirect abuse, vendor…
#4 Cross-domain search timing Chris Evans
Demonstrates cross-domain data theft using only request timing. An attacker page loads a victim's search URL and times img onerror/onload or an iframe onload, giving a one-bit fast/slow oracle. Against Yahoo! Mail this…
#5 Slowloris HTTP DoS ha.ckers.org
Slowloris opens many HTTP connections and keeps each alive with partial headers, consuming a threading web server's finite worker pool with very few packets and no load spike. Apache falls while IIS on the same box does…
#6 Microsoft IIS 0-Day Vulnerability Parsing Files (semi-colon bug) Soroush Dalili
IIS 6 and earlier truncate a filename at a semicolon when choosing a handler, so malicious.asp;.jpg is passed to asp.dll and executed while an uploader that inspects only the trailing extension sees a JPEG. Found by…
#7 Exploiting Unexploitable XSS stephensclafani.com
Google's ServiceLogin auth URLs let an attacker silently log a victim into an account the attacker controls, and Google CSRF tokens were bound to the account rather than the session. Combining the two turned self-only…
#8 Our Favorite XSS Filters and how to Attack them sirdarckcat
A recap of the Black Hat USA 2009 talk on breaking XSS filters, pointing at the slides and a co-presenter's write-up. It records a fixed Google imgres same-origin exception, a PHP 4/5/6 utf8_decode flaw enabling filter…
#9 RFC1918 Caching Security Issues Robert Hansen
Because everyone reuses the same RFC1918 ranges, a hostile VPN peer or cafe MITM can route a victim to its own 10.x/192.168.x hosts and leave cached JavaScript behind. When the tunnel drops, the cache is served again…
#10 DNS Rebinding (3-part series) ha.ckers.org
A worked scenario for combining persistent cookies with DNS rebinding: the attacker's site plants a cookie carrying an XSS payload, forces a browser restart to release the DNS pin, then rebinds to an intranet address…

Also collected

A brief description of how to become a CA Mike Zusman
A short note separating two questions about certificate authorities: anyone can create a CA, and OpenSSL walkthroughs show how. Becoming a trusted CA is a policy matter instead, so the post assembles the root-programme…
A more plausible E4X attack Chris Evans
Firefox's E4X made raw XML valid JavaScript, so an XML inbox feed pulled cross-domain via a script tag parsed in the attacker's origin. Because E4X evaluates curly braces inside XML values, mail subjects of '{ x =' and…
A Wolf in Sheep's Clothing: The Dangers of Persistent Web Browser Storage Michael Sutton
A survey of persistent browser storage — HTTP cookies, Flash Local Shared Objects, Google Gears and HTML5 database storage — and the abuse each enables. It introduces client-side SQL injection (csSQLi): XSS on a site…
About CSS Attacks sirdarckcat
Releases the clickjacking proofs of concept held back from Bluehat v8. Ghost Mirror clones the target page's HTML and hides everything but the button, giving a size-independent cross-browser overlay; Frame Cropping uses…
Active Man in the Middle Attacks Ory Segal
An announcement of Adi Sharabani's OWASP AU keynote on active man-in-the-middle attacks against web applications. An attacker on a public network injects into a response from an uninteresting HTTP site and uses it to…
Advanced SQL injection to operating system full control Bernardo Damele Assumpção Guimarães
Black Hat Europe 2009 slides mapping SQL injection to full OS control. File access uses LOAD_FILE/DUMPFILE, COPY/lo_export and BULK INSERT/debug.exe; command execution uses custom UDF shared libraries and xp_cmdshell…
Apple's Safari 4 also fixes cross-domain XML theft Chris Evans
Safari 4 fixed a cross-domain XML theft in which one origin could read another origin's XML: XHTML, AJAX RPC responses and authenticated feeds. The demo steals the XML of a logged-in Gmail user's inbox. The post argues…
Apple's Safari 4 fixes local file theft attack Chris Evans
Notes that Safari 4 fixed an XXE attack against the parsing of XSL XML, which let a remote page read local files; demos are given for Safari 3 on MacOS and Windows. Observes that Safari 3 resisted XXE across…
Attack - PDF Silent HTTP Form Repurposing Attacks Aditya K Sood
A malicious PDF form built on Adobe's XFA model puts a javascript: URL in an HTTP submit button's target, so clicking it runs script in the domain hosting the PDF rather than making a cross-domain call. Because Acro JS…
Attacks on JavaScript Mashup Communication Adam Barth, Collin Jackson and William Li
Analyses four design choices in JavaScript mashup communication: lexical vs dynamic authorization, interfaces vs asymmetry, typed vs untyped, and values vs objects. Proof-of-concept escalations abuse caller, arguments…
Blind SQL Injection: Inference thourgh Underflow exception dbellucci.blogspot.com
A blind SQL injection with no true/false oracle is turned into one by arithmetic: dividing by INSTR(SUBSTR(...)) raises a divide-by-zero exception whenever a guessed character is wrong, and the application's error…
Bonus Safari XXE (only affecting Safari 4 Beta) Chris Evans
A WebKit regression in the Safari 4 Beta reopened XML external entity resolution, letting a crafted XML document read and exfiltrate local files. The regression was noticed through a collision with the Chrome sandbox…
Breaking the Security Myths of Extended Validation SSL Alexander Sotirov and Mike Zusman
Shows how a trusted non-EV certificate can undermine an EV certificate indicator through subordinate content, same-origin window control, certificate switching and cached responses. The slides trace attack sequences and…
Browser scheme/slash quirks Arshan Dabirsiaghi
While defeating a product that blocked anything resembling a URL in a Location header, the author found browsers accept malformed scheme/slash forms. Internet Explorer follows http:\\google.com with backslashes, and…
Bypassing CSP for fun, no profit Gareth Heyes
A Content Security Policy bypass using UTF-7 and JSON. Any site with a JSON feed an attacker can influence can carry fully UTF-7 encoded script, because the encoding conceals quotes and other string characters from…
Bypassing OWASP ESAPI XSS Protection inside Javascript securethoughts.com
OWASP ESAPI's encodeForJavaScript() hex-escapes untrusted input, but document.write() and eval() decode those escapes back at execution time, so escaped data still fires XSS once it lands in an HTML-body or eval…
Clickjacking & OAuth stephensclafani.com
Applies clickjacking to OAuth: a malicious consumer frames a service provider's authorization page and overlays the approve button, so a user granting access believes they clicked something harmless. Reviews the…
Code-Injection Attacks in Browsers Supporting Policies (return-to-JavaScript) Elias Athanasopoulos, Vasilis Pappas and Evangelos P. Markatos
A W2SP 2009 paper on XSS attacks that defeat browser-enforced policy frameworks. It examines BEEP, which whitelists trusted scripts in the browser, and shows attacks analogous to return-to-libc that reuse…
Cross-Channel Scripting and Reverse Cross-Channel Scripting Hristo Bojinov, Elie Bursztein, Eric Lovett and Dan Boneh
Stanford audited 21 embedded devices from 16 brands - NAS, switches, IP cameras, photo frames, phones, routers, printers and lights-out modules - and found every one vulnerable. It names cross-channel scripting: script…
Cross-Origin JavaScript Capability Leaks: Detection, Exploitation, and Defense Adam Barth, Joel Weinberger and Dawn Song
USENIX Security 2009 paper page for work by Barth, Weinberger and Song on cross-origin JavaScript capability leaks, where a reference to an object from another origin escapes and defeats the same-origin policy. The…
Cross-protocol XSS with non-standard service ports Arshan Dabirsiaghi
Browsers render non-HTTP responses without requiring HTTP headers, and IE ignores the port when deciding DOM origin. A multipart form POST drives an FTP or SMTP server on a non-standard port into reflecting attacker…
Cross-Site Identification (XSid) blog.quaji.com
Names Cross-Site Identification (CSID/XSid): a social network is made an involuntary identifying service. An image link on any third-party site silently drives the logged-in victim's browser to the attacker's SN…
Cross-subdomain Cookie Attacks Mike Bailey
Announces a Toorcon talk and paper on client-side trust in subdomains. Cookie scoping implements its security policy backwards, granting a subdomain more trust than its parent rather than less as the DNS hierarchy would…
CSRF And Ignoring Basic/Digest Auth ha.ckers.org
CSRF against routers and similar devices protected by Basic or Digest auth normally raises a login popup that warns the victim. Requesting the target URL through a CSS background-image on a DIV suppresses that dialog in…
De-cloaking in IE7.0 Via Windows Variables ha.ckers.org
IE7 expands Windows environment variables written as %name% when a URL is pasted into the address bar, so a link containing %computername% or %appdata% returns the machine name and the user's home path to the logging…
Detecting browsers javascript hacks Gareth Heyes
A collection of minimal browser-detection expressions that cannot be overwritten by the page, each keyed to an engine quirk: negative indexes on a regex or function for Firefox versions, '\v'=='v' for IE, a regex…
Detecting IE in 12 bytes Gareth Heyes
A twelve-byte Internet Explorer detection, improving on a 32-byte version by Andrea Giammarchi. The expression IE='\v'=='v' relies on IE not treating \v as a vertical tab escape, so the escaped character compares equal…
Detecting Private Browsing Mode Jeremiah Grossman
Send a visitor to a unique, never-before-seen URL, then use the CSS visited-link colour history hack to test whether that URL now counts as visited. If it does not, a privacy feature is actively blocking history: Safari…
DNS Rebinding for Credential Brute Force ha.ckers.org
Second part of a DNS rebinding series: rebinding gives read access to a firewalled login page, so an attacker can brute-force weak, guessable authentication cookies such as username=bob or id=1234567 without ever…
DNS Rebinding for Scraping and Spamming ha.ckers.org
Third part of a DNS rebinding series: because search engines ignore the Host header and serve over plain HTTP, an attacker can rebind a domain and have visitors' own browsers scrape Google, defeating CAPTCHAs and IP…
DoS attacks via Abuse of Functionality vulnerabilities websecurity.com.ua
Shows abuse-of-functionality flaws escalating into denial of service. Power Phlogger's extchange.php renames the application's .php files to .php3 on a direct request, breaking the site. Remote-fetch services at…
Enumerating logins via Abuse of Functionality vulnerabilities websecurity.com.ua
Reports that the username-availability checkers on large sites are an abuse-of-functionality flaw that leaks valid logins. On YouTube's signup form the Check Availability AJAX response distinguishes existing from free…
Expanding the control over the operating system from the database Bernardo Damele A. G.
The SOURCE Barcelona 2009 deck shows how database access becomes operating-system control: file read/write and command execution across MSSQL, MySQL and PostgreSQL, then a sys_bineval() UDF that runs a Metasploit…
Exploiting Facebook Application XSS Holes to Make API Requests theharmonyguy
Closing report of the Month of Facebook Bugs, which found XSS in over 9,700 Facebook applications. Because an application's page carries its session secret, an XSS there becomes an API request forgery: a…
Exploiting IE8 UTF-7 XSS Vulnerability using Local Redirection securethoughts.com
IE8 fixed UTF-7 charset inheritance by refusing it across origins, but still allowed it from a same-domain child page. Serving a same-origin child frame and then redirecting it to the target site restores the…
Flash Origin Policy Issues Mike Bailey
Flash objects run scripts in the origin they are served from, and a SWF needs no .swf extension or content-type to execute, so any site serving user-uploaded files from its own domain is exploitable. Content overloading…
Forget sidejacking, clickjacking, and carjacking: enter "Formjacking" Arshan Dabirsiaghi
Formjacking, found by Jerry Hoff while testing AntiSamy. An injected self-closing <form/> tag makes FF3 and IE7 ignore the real <form> that follows, so every input on the page submits to the attacker. AntiSamy's tag…
Generic cross-browser cross-domain theft Chris Evans
Browsers sent cookies on cross-domain CSS loads and let the CSS parser skip any leading junk, so an attacker who controls two injection points in a victim page can wrap its response in a CSS string and exfiltrate it…
Gmail - Google Docs Cookie Hijacking through PDF Repurposing Aditya K Sood
A PDF mailed to a victim is rendered harmlessly by the Google Docs viewer, but choosing print converts it back to its original form and opens it in the browser through the Adobe plugin. Acro JS then runs with an…
Google Translate - Google User Content - File Uploading Cross - XSS and Design Stringency - A Talk Aditya K Sood
Files uploaded to Google Translate were rendered on translate.googleusercontent.com with their scripts and iframes intact, so translated attacker content executed in a Google-hosted context. Google treated it as by…
Hacking CSRF Tokens using CSS History Hack securethoughts.com
CSRF tokens carried in URLs can be brute-forced entirely on the client using the CSS visited-link history hack, generating no server traffic for an IDS or WAF to see. A five-character base16 token space was exhausted in…
Hash Information Disclosure Via Collisions - The Hard Way ha.ckers.org
A thought experiment on using precomputed hash collisions as a fingerprinting oracle. Registering a password and then logging in with a known colliding string reveals which hashing algorithm and salting scheme a site…
Hellfire for redirectors websecurity.com.ua
An open redirector on an ordinary site can be paired with a shortener such as tinyurl.com so each service redirects to the other indefinitely, a looped DoS that loads both hosts. Mozilla halts loops signalled by…
Hijacking Opera's Native Page using malicious RSS payloads securethoughts.com
Untrusted RSS feed content is rendered in Opera's Feed Subscription Page, a native page running in a higher-privileged zone than the internet zone. Escaping that page's HTML tag whitelist and sanitiser lets a crafted…
Hijacking Safari 4 Top Sites with Phish Bombs Inferno
CVE-2009-2196: a page could script a hidden, blurred window to visit chosen sites repeatedly until Safari 4's Top Sites panel replaced the victim's real thumbnails with attacker pages. Combined with the CSS history hack…
How to use Google Analytics to DoS a client from some website. sirdarckcat
Oversized cookies push a request past Apache's header-size limit, so a victim gets HTTP 400 and is locked out of a site. Google Analytics is abused to plant them: a host named google.* fools its organic-referer…
HTML+TIME XSS attacks Pastebin
A collected set of Internet Explorer HTML+TIME findings. Attaching behavior:url(#default#time2) through a style attribute exposes timing event handlers such as onbegin on arbitrary elements, and #default#anchorclick…
HTML5 new XSS vectors Gareth Heyes
HTML5's autofocus attribute gives automatic XSS execution inside an attribute injection where angle brackets are filtered, replacing the need for CSS expressions or -moz-binding. Pairing autofocus with onfocus fires…
HTML5 XSS Gareth Heyes
The new HTML5 audio and video tags carry event handlers that fire automatically on an invalid source, giving XSS without user interaction. The vectors <video src=1 onerror=alert(1)> and <audio src=1 onerror=alert(1)>…
I know what your friends did last summer Gareth Heyes
Twitter's publicly available JSON feeds leaked who a visitor is and who their friends are to any site they browsed. Including the feed with a script tag and defining a setter on Object.prototype for the 'user' key…
IE8 Link Spoofing - Broken Status Bar Integrity Aditya K Sood
Internet Explorer 7 and 8's status address bar can be made to show a different destination from the one a link actually opens. Scripted handlers rewrite the target after the browser has painted the status text, so the…
Inline UTF-7 E4X javascript hijacking Gareth Heyes
Cross-domain theft of XML data using E4X and a UTF-7 charset, needing no variable assignment in the target. Injecting a UTF-7 encoded record into the XML closes the surrounding tags and opens a new E4X assignment, so…
iPhone SSL Warning and Safari Phishing ha.ckers.org
Mobile Safari's invalid-certificate prompt does not say which host the certificate belongs to, so a 1x1 iframe pointing at an HTTPS site with a bad certificate asks the user to accept something they cannot attribute…
itms Decloaking ha.ckers.org
An iframe pointing at itms:www.apple.com:[email protected] bypasses the iTunes handler's restriction on which domain it may contact. Because the handler follows the operating system's network settings rather than the…
Location based XSS attacks Gareth Heyes
DOM XSS delivered through location.hash, which the browser never sends to the server, so server-side filters and WAFs see only half the payload. The server half calls eval(location.hash.slice(1)); a stronger variant…
Millions of PDF invisibly embedded with your internal disk paths securethoughts.com
Printing a locally saved web page to PDF through Internet Explorer's print handler embeds the file's full local disk path invisibly in the PDF title attribute, separate from the visible footer and not removable through…
MSWord Scripting Object XSS Payload Execution Bug and Random CLSID Stringency Aditya K Sood
Chrome and WebKit execute the URL passed in an OBJECT element's PARAM value, with or without a CLSID, even though ActiveX class identifiers mean nothing outside IE. A javascript: URI in param name="url" therefore fires…
New PHPIDS vector Gareth Heyes
A PHPIDS bypass using IE's language attribute to declare an event handler as VBScript, a very old feature never used in XSS and absent from the cheatsheet. VBScript needs no parentheses to call a function and the plus…
New Tricks for Defeating SSL in Practice (sslstrip & null-prefix certificates) Moxie Marlinspike
Black Hat DC 2009 deck introducing sslstrip: rather than attacking TLS, a MITM rewrites https links and 302s in passing HTTP traffic, strips secure cookies and content encodings, and serves a padlock favicon. It reports…
OAuth Security Advisory 2009.1: OAuth 1.0 Request Token Session Fixation oauth.net
A session fixation flaw in the OAuth 1.0 three-legged authorization flow. The attacker starts the flow at an honest consumer, saves the authorization URI containing his own Request Token, and lures a victim into…
OpenID association poisoning Andrew Arnott
Describes a possible OpenID association-store flaw: a malicious provider chooses another provider’s association handle and replaces its shared secret. A relying party that indexes associations incorrectly could reject…
Opera XSS vectors Gareth Heyes
Opera still honoured the table background attribute as a javascript: URL, and a fuzzer's protocol findings turned out to be real rather than false positives. Arbitrary Unicode characters can be repeated between the…
PHPIDS bypass Gareth Heyes
A PHPIDS filter bypass that reads as English prose to defeat the centrifuge detection, while backslash line continuations build the string 'alert' across lines to evade the regular expressions. The payload takes 'this'…
PHPIDS unserialize() Vulnerability: Reusing Framework Object Chains Stefan Esser
Explains how PHPIDS turns inspection of attacker input into unsafe PHP object deserialization. In Zend Framework applications, a crafted object graph can chain a logging destructor through mail shutdown and layout…
Ping pong obfuscation Gareth Heyes
Internet Explorer honours a language attribute and labelled statements inside event handlers, so an event can be switched to VBScript, and execScript bounces execution between VBScript and JavaScript repeatedly…
Popup & Focus URL Hijacking ha.ckers.org
A snippet replaces the page shortly after load, so the address bar a user checked no longer matches what they see. Applied to a download prompt, a page posing as addons.mozilla.org triggers a Firefox add-on install…
Pretty-Bad-Proxy: An Overlooked Adversary in Browsers' HTTPS Deployments Shuo Chen, Ziqing Mao, Yi-Min Wang and Ming Zhang
Pretty-Bad-Proxy is a malicious proxy that breaks the end-to-end guarantees of HTTPS without breaking any cryptography, by targeting the browser rendering layers above HTTP. The vulnerabilities let an attacker who can…
Pwning Opera Unite with Inferno's Eleven Inferno
Eleven flaws in the Opera Unite 10 beta, tested against Build 1703. Username and computer-name enumeration, service-owner IP and port disclosure, plain-HTTP service pages, phishing hosted on trusted operaunite.com, CSRF…
Quicky Firefox DoS ha.ckers.org
A four-line script hangs Firefox indefinitely: a loop to 65536 that appends one character at a time and calls document.write on the whole growing string each pass. The author expected the slow-script prompt and instead…
Results, Unicode Left/Right Pointing Double Angel Quotation Mark Jeremiah Grossman
Two years after a full-disclosure thread suggested it, WhiteHat Sentinel scan data confirmed that some applications normalise angle-quotation and angle-bracket characters into < and >. Across samples of 300 to 1000…
RFC 1918 Blues ha.ckers.org
Short post introducing a whitepaper on RFC 1918 private address space. With certain browsers and VPN clients, the flat reuse of ranges like 192.168.1.* makes IP collisions likely, so a client can be steered onto an…
Secure Content Sniffing for Web Browsers, or How to Stop Papers from Reviewing Themselves Adam Barth, Juan Caballero and Dawn Song
Browsers' content sniffing can treat uploaded non-HTML files as HTML, so a crafted paper uploaded to a conference system can script the site and submit its own reviews. The authors built high-fidelity models of four…
Session Fixation Via DNS Rebinding ha.ckers.org
An attacker logs into goodguy.com, replays his own cookies from badguy.com, and serves badguy.com DNS with a one-second TTL before dropping its firewall. The browser rebinds badguy.com to goodguy.com's address, and…
SMB Decloaking ha.ckers.org
An iframe pointing at a file:// UNC path makes Internet Explorer open an SMB connection to the attacker's host, which a packet capture reads for the real username, IP address, computer name and service pack. It needs no…
SMBEnum ha.ckers.org
SMBEnum, from a DefCon talk with Jabra, enumerates files on a Windows machine from inside Internet Explorer by requesting local images, CSS and scripts over SMB. It is the same cross-zone leak as Gregory Panakkal's 2004…
Socket Capable Browser Plugins Result In Transparent Proxy Abuse thesecuritypractice.com
Announcement of a paper behind CERT VU#435052. Where a transparent proxy routes by destination host header rather than IP, a socket-capable plug-in such as Flash can open a raw connection and forge that header, reaching…
TLS Renegotiation authentication gap (CVE-2009-3555) Chris Taschner
CERT note for CVE-2009-3555, the SSL and TLS renegotiation authentication gap. A man in the middle completes its own handshake, sends chosen plaintext, then relays the client's handshake as a renegotiation, so the…
Twitter misidentifying context Gareth Heyes
Escaping quotes is not enough inside a JavaScript event attribute, because HTML entities are decoded before the script runs. Twitter escaped the literal quote characters in an onclick handler, but the named and numeric…
Unauthorized TinyURL URL Enumeration Vulnerability securethoughts.com
Points out that TinyURL aliases are short, sequential-ish and unauthenticated, so anyone can walk the redirect endpoint and harvest the targets. A short Perl script generating random IDs and reading the Location header…
Unraveling Unicode: A Bag of Tricks for Bug Hunting Chris Weber
A Black Hat USA 2009 deck cataloguing how Unicode handling breaks security boundaries: best-fit mapping, NFKC/NFKD normalisation, overlong UTF-8, over-consumption of ill-formed MBCS bytes, character deletion and casing…
URL Hiding - new method of URL Spoofing attacks websecurity.com.ua
Some sites are listed in Google results with no URL shown at all, spotted on a domain whose name begins with an underscore. Chained with the author's earlier URL-spoofing tricks, this hides a long or suspicious address…
URL Spoofing vulnerability in bots of search engines MustLive
URL spoofing using space characters: http://www.site.com%20www.site2.com displays the first host in the address bar but loads the second. GoogleBot and Yahoo! Slurp index such addresses and Mozilla 1.7.x and IE6 follow…
Using Blended Browser Threats involving Chrome to steal files on your computer Inferno
CVE-2009-3931. Chrome auto-downloads files sent with Content-Disposition attachment and warns only on blacklisted extensions; .mht, .mhtml and .svg were absent from that list. Clicking the downloaded file opens it in…
Weaponizing the Web / MonkeyFist Nathan Hamiel and Shawn Moyer
Introduces MonkeyFist for constructing dynamic cross-site requests using leaked referrer state or separately retrievable values. Configurable redirect, form and session-fixation handlers illustrate how unique-looking…
Web pages Detecting Virtualized Browsers and other tricks Jeremiah Grossman
Shows how a web page can tell whether the visiting browser runs in a VM, so malware can withhold payloads from analysis sandboxes. Non-standard screen dimensions read from JavaScript give windowed VMware away, and a…
XMLHTTPReqest "Ping" Sweeping in Firefox 3.5+ ha.ckers.org
Firefox 3.5's CORS cross-domain XMLHttpRequest hides whether a target page exists, but the attacker can still issue the initial request. Live hosts answer immediately while absent ones hang for 20-75 seconds, and that…
XSS Relocation Attacks through Word Hyperlinking Aditya K Sood
Enterprise applications that let users upload a Word document and preview it as HTML convert the document's hyperlinks without filtering them. A hyperlink carrying an inline javascript: payload therefore survives the…
Yahoo Babelfish - Possible Frame Injection Attack - Design Stringency Aditya K Sood
Yahoo Babelfish translated any supplied URL with no referrer check and displayed no notice on the translated page, so arbitrary content could be loaded in an iframe inside the yahoo.com context. Removing the…