Re: [OT] "Hacker Safe"

This WebDNA talk-list message is from

2007

It keeps the original formatting. numero = 69482
interpreted = N
texte = Hi DonovanI use Hacker Safe for some of my clients.The biggest problem that I had (not really big) was if someone put a script into a textarea and the script was then processed, to solve the problem make sure all textarea entries are URL'd so that they won't return "<" or ">" this then stops any script for processingOn 15/11/2007, at 11:58 AM, Donovan Brooke wrote:> Hello,>> I am working with a client that uses a service called> "hacker safe". They notified me of a "volnurability"> in a site I've been working on that involves sending> javascript in a URL. I am trying to determine the> scope of this "volnurability" as it seems just about> every dynamic site on the planet is suseptable to this.>> For example, use this URL to access the Apple store> which appears to be volnurable in the same way.> (you may have to repair email linebreaks before using):>> http://store.apple.com/1-800-MY-APPLE/WebObjects/AppleStore.woa/wa/RSLID?nnmm=browse&mco=%3E%22%3E%3Cscript%3Ealert%28123%29%3C/script%3E%3C%22&node=home/shop_iphone/family/iphone>>> What kind of "harmful" javascript could replace the> non-harmful example 123 script?...>> Hacker Safe says:> The damage caused by such an attack can range from stealing> session and cookie data from your customers to loading a> virus payload onto their computer via browser.>> stealing "session" info does not sound good... I never> store anything sensitive in cookies, so I don't think> that is a problem. I have no idea what "loading a virus> payload onto their computer via browser" means.>> What's your thoughts?>> Donovan>>>> -- > =o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o> DONOVAN D. BROOKE EUCA Design Center>> <- Web Development (specializing in eCommerce),->> <- Desktop Publishing, Print Consulting, Labels ->> <- Glass Blowing, and Art Glass ->>> PH/FAX:> 1 (608) 770-3822> Web:> http://www.egg.bz | http://www.euca.us> =o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o>> -------------------------------------------------------------> This message is sent to you because you are subscribed to> the mailing list .> To unsubscribe, E-mail to: > To switch to the DIGEST mode, E-mail to >> Web Archive of this list is at: http://webdna.smithmicro.com/-------------------------------------------------------------This message is sent to you because you are subscribed to the mailing list .To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to Web Archive of this list is at: http://webdna.smithmicro.com/ Associated Messages, from the most recent to the oldest:

Re: [OT] "Hacker Safe" ( Matthew A Perosi 2007)
Re: [OT] "Hacker Safe" ( Donovan Brooke 2007)
Re: [OT] "Hacker Safe" ( Donovan Brooke 2007)
Re: [OT] "Hacker Safe" ( Clint Davis 2007)
Re: [OT] "Hacker Safe" ( Matthew A Perosi 2007)
Re: [OT] "Hacker Safe" ( Donovan Brooke 2007)
Re: [OT] "Hacker Safe" ( Stuart Tremain 2007)
[OT] "Hacker Safe" ( Donovan Brooke 2007)

Hi DonovanI use Hacker Safe for some of my clients.The biggest problem that I had (not really big) was if someone put a script into a textarea and the script was then processed, to solve the problem make sure all textarea entries are URL'd so that they won't return "<" or ">" this then stops any script for processingOn 15/11/2007, at 11:58 AM, Donovan Brooke wrote:> Hello,>> I am working with a client that uses a service called> "hacker safe". They notified me of a "volnurability"> in a site I've been working on that involves sending> javascript in a URL. I am trying to determine the> scope of this "volnurability" as it seems just about> every dynamic site on the planet is suseptable to this.>> For example, use this URL to access the Apple store> which appears to be volnurable in the same way.> (you may have to repair email linebreaks before using):>> http://store.apple.com/1-800-MY-APPLE/WebObjects/AppleStore.woa/wa/RSLID?nnmm=browse&mco=%3E%22%3E%3Cscript%3Ealert%28123%29%3C/script%3E%3C%22&node=home/shop_iphone/family/iphone>>> What kind of "harmful" javascript could replace the> non-harmful example 123 script?...>> Hacker Safe says:> The damage caused by such an attack can range from stealing> session and cookie data from your customers to loading a> virus payload onto their computer via browser.>> stealing "session" info does not sound good... I never> store anything sensitive in cookies, so I don't think> that is a problem. I have no idea what "loading a virus> payload onto their computer via browser" means.>> What's your thoughts?>> Donovan>>>> -- > =o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o> DONOVAN D. BROOKE EUCA Design Center>> <- Web Development (specializing in eCommerce),->> <- Desktop Publishing, Print Consulting, Labels ->> <- Glass Blowing, and Art Glass ->>> PH/FAX:> 1 (608) 770-3822> Web:> http://www.egg.bz | http://www.euca.us> =o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o>> -------------------------------------------------------------> This message is sent to you because you are subscribed to> the mailing list .> To unsubscribe, E-mail to: > To switch to the DIGEST mode, E-mail to >> Web Archive of this list is at: http://webdna.smithmicro.com/-------------------------------------------------------------This message is sent to you because you are subscribed to the mailing list .To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to Web Archive of this list is at: http://webdna.smithmicro.com/ Stuart Tremain

DOWNLOAD WEBDNA NOW!

Re: [OT] "Hacker Safe"

2007

Top Articles:

Related Readings: