Back to list
5 char XSS?
Apr 23 2008 11:36PM
Kristian Erik Hermansen (kristian hermansen gmail com)
Just been noticing all the talk about Obama and Clinton sites and how
the media keeps making a big deal out of all these XSS vulns, heh.
However, I have a rather technical question about what, if anything,
you can do when you have such a small buffer to exploit XSS? Check
out this one I found and is not listed by xssed.com for
hillaryclinton.com. You only get 5 chars to inject. So, are there
any tricks that could possibly be used to expand the limitation via
perhaps some unicode kung-fu here? Dunno, but thought it might be
insteresting bring up because this is a common scenario in zip code
search fields. The fix for Clinton is as simple as whitelisting the
input field set to [0-9]...
Kristian Erik Hermansen
"Clever ones don't want the future told. They make it."
[ reply ]
Copyright 2010, SecurityFocus