internetworkers AT lists.ibiblio.org
Subject: Internetworkers: http://www.ibiblio.org/internetworkers/
List archive
- From: Steven Champeon <schampeo AT hesketh.com>
- To: InterNetWorkers <internetworkers AT franklin.oit.unc.edu>
- Subject: Barney, Peeps, and Web Security
- Date: Thu, 27 Apr 2000 17:09:42 -0400 (EDT)
Hey, gang -
I just wrote an article for Webmonkey, entitled "XSS, Trust, and Barney"
that you might want to take a look at. It discusses the "Cross-Site
Scripting" problem, in some detail, and shows you how to abuse Web sites
that don't check form input for dangerous characters. Oh, and it also talks
about big purple dinosaurs.
<http://hotwired.lycos.com/webmonkey/00/18/index3a.html>
It's an astonishingly widespread problem, as this URL will demonstrate:
<http://hotwired.lycos.com/webmonkey/00/18/index3a_page6.html?tw=%3CIMG%20SRC%3Dhttp%3A%2F%2Fbarneyonline.com%2Fimages%2Fbab3.gif%3E>
No one is safe. Trust no one. Especially not Gina:
<http://hotwired.lycos.com/webmonkey/00/18/index3a_page6.html?tw=%3CIMG%20SRC%3Dhttp%3a%2f%2fwww%2emarshmallowpeeps%2ecom%2fimages%2fpeeps_animation%2eGIF%3E>
It's a very serious problem, as well, so go check your code!
--
tired of being an underappreciated functionary in a soulless machine?
hesketh.com is hiring: <http://hesketh.com/careers/>
- Barney, Peeps, and Web Security, Steven Champeon, 04/27/2000
Archive powered by MHonArc 2.6.24.