Cenzic 232 Patent
Paid Advertising
sla.ckers.org is
ha.ckers sla.cking
Sla.ckers.org
If you have some interesting news or want to throw up a link to discuss it, here's the place. Anything is okay, even shameless vendor launches (since that is often applicable to what we work on). 
Go to Topic: PreviousNext
Go to: Forum ListMessage ListNew TopicSearchLog In
Opera sucks!
Posted by: sirdarckcat
Date: October 03, 2009 02:04PM

Evendo we all LOVE opera for having lots and lots of xss vectors that dont work on any other browser.. I just woke up of bed at 3am thinking I found a way of "avoiding" opera of executing the background:url(''); xss vector.. and guess what.. it crashed with signs of memory corruption (unless its normal to have EAX pointing to 0x006a0061 that is ja, and to 0x004a0041 that is JA depending if the payload starts with javascript: or JAVASCRIPT:)

The awesome POC is:

<script>
var style="font-family:courier;background:url('javascript:123');";
window.a=document.createElement("a");
a.setAttribute("style",style);
alert(a.style.background);
</script>

so, now I dont even asume opera is gonna fix it, I'll just asume its another feature.. I mean, they did Opera unite didnt they?

--------------------------------
http://sirdarckcat.blogspot.com/ http://www.sirdarckcat.net/ http://foro.elhacker.net/ http://twitter.com/sirdarckcat



Edited 1 time(s). Last edit at 10/03/2009 02:04PM by sirdarckcat.

Options: ReplyQuote
Re: Opera sucks!
Posted by: sirdarckcat
Date: October 03, 2009 02:08PM

btw.. for those of you guys that dont know what is opera unite..



it's that big scary red arrow.

--------------------------------
http://sirdarckcat.blogspot.com/ http://www.sirdarckcat.net/ http://foro.elhacker.net/ http://twitter.com/sirdarckcat

Options: ReplyQuote
Re: Opera sucks!
Posted by: Reiners
Date: October 06, 2009 09:34AM

nice find, which version did you use ?

Options: ReplyQuote
Re: Opera sucks!
Posted by: sirdarckcat
Date: October 06, 2009 02:26PM

fwiw, gareth just confirmed me this may be not exploitable.

I tested on 9 and 10.

greetz!

--------------------------------
http://sirdarckcat.blogspot.com/ http://www.sirdarckcat.net/ http://foro.elhacker.net/ http://twitter.com/sirdarckcat

Options: ReplyQuote
Re: Opera sucks!
Posted by: Gareth Heyes
Date: October 07, 2009 03:57AM

@sirdarckcat

I'm no expert dude :)

That particular poc doesn't seem to be but if it was modified slightly then maybe it could be more serious

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Options: ReplyQuote
Re: Opera sucks!
Posted by: Kyran
Date: November 18, 2009 12:29AM

Just stopping in to say, quickly, I stopped using Opera the moment they put Opera Unite into their beta. For those that remember me, kind of a big deal for me to stop. Lol.

- Kyran

Options: ReplyQuote
Re: Opera sucks!
Posted by: rvdh
Date: November 18, 2009 12:39AM

Hi Kyran!

Options: ReplyQuote
Re: Opera sucks!
Posted by: klaus
Date: November 26, 2009 10:04AM

Kyran Wrote:
-------------------------------------------------------
> Just stopping in to say, quickly, I stopped using
> Opera the moment they put Opera Unite into their
> beta. For those that remember me, kind of a big
> deal for me to stop. Lol.


100% agree. Good bye Opera.

Options: ReplyQuote


Sorry, only registered users may post in this forum.