Skip to Content.
Sympa Menu

internetworkers - Barney, Peeps, and Web Security

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: Steven Champeon <schampeo AT hesketh.com>
  • To: InterNetWorkers <internetworkers AT franklin.oit.unc.edu>
  • Subject: Barney, Peeps, and Web Security
  • Date: Thu, 27 Apr 2000 17:09:42 -0400 (EDT)



Hey, gang -

I just wrote an article for Webmonkey, entitled "XSS, Trust, and Barney"
that you might want to take a look at. It discusses the "Cross-Site
Scripting" problem, in some detail, and shows you how to abuse Web sites
that don't check form input for dangerous characters. Oh, and it also talks
about big purple dinosaurs.

<http://hotwired.lycos.com/webmonkey/00/18/index3a.html>

It's an astonishingly widespread problem, as this URL will demonstrate:


<http://hotwired.lycos.com/webmonkey/00/18/index3a_page6.html?tw=%3CIMG%20SRC%3Dhttp%3A%2F%2Fbarneyonline.com%2Fimages%2Fbab3.gif%3E>

No one is safe. Trust no one. Especially not Gina:


<http://hotwired.lycos.com/webmonkey/00/18/index3a_page6.html?tw=%3CIMG%20SRC%3Dhttp%3a%2f%2fwww%2emarshmallowpeeps%2ecom%2fimages%2fpeeps_animation%2eGIF%3E>

It's a very serious problem, as well, so go check your code!

--
tired of being an underappreciated functionary in a soulless machine?
hesketh.com is hiring: <http://hesketh.com/careers/>





  • Barney, Peeps, and Web Security, Steven Champeon, 04/27/2000

Archive powered by MHonArc 2.6.24.

Top of Page