Paid Advertising
SLA.CKERS.ORG
HA.CKERS SLACKING
Where you should disclose your vulnerabilities. Go read RFPolicy if you want to do responsible disclosure, and go here for when all else fails.
Google XSS == Gmail pwnage
Posted by: beford (IP Logged)
Date: September 24, 2007 01:22AM
[www.google.com]
I've added 2 pocs on my (new :P) blog [blog.beford.org]
I'd consider that one of them is kinda scary.
Edited 1 time(s). Last edit at 09/24/2007 02:06AM by beford.
I've added 2 pocs on my (new :P) blog [blog.beford.org]
I'd consider that one of them is kinda scary.
Edited 1 time(s). Last edit at 09/24/2007 02:06AM by beford.
Re: Google XSS == Gmail pwnage
Posted by: ma1 (IP Logged)
Date: September 24, 2007 05:58AM
BTW, do you think your host could stand slashdotting?
--
*hackademix.net*
There's a browser safer than Firefox... Firefox, with NoScript
--
*hackademix.net*
There's a browser safer than Firefox... Firefox, with NoScript
Re: Google XSS == Gmail pwnage
Posted by: Gareth Heyes (IP Logged)
Date: September 24, 2007 06:08AM
Nice find beford :)
This proves everything is insecure, there are just degrees of insecurity
------------------------------------------------------------------------------------------------------------
"-/style=-=expression(/*WAFs..Evasion..Filters'/-/*',/**/alert(/People who say it cannot be done should not interrupt those who are doing it./)//);"
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [www.businessinfo.co.uk]
This proves everything is insecure, there are just degrees of insecurity
------------------------------------------------------------------------------------------------------------
"-/style=-=expression(/*WAFs..Evasion..Filters'/-/*',/**/alert(/People who say it cannot be done should not interrupt those who are doing it./)//);"
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [www.businessinfo.co.uk]
Re: Google XSS == Gmail pwnage
Posted by: id (IP Logged)
Date: September 24, 2007 12:18PM
ma1 Wrote:
-------------------------------------------------------
> BTW, do you think your host could stand
> slashdotting?
It has at least 3 times.
-id
-------------------------------------------------------
> BTW, do you think your host could stand
> slashdotting?
It has at least 3 times.
-id
Re: Google XSS == Gmail pwnage
Posted by: rsnake (IP Logged)
Date: September 24, 2007 01:05PM
Plus a bunch of diggs too - and reddits - those were the worst.
- RSnake
Gotta love it. http://ha.ckers.org
- RSnake
Gotta love it. http://ha.ckers.org
Re: Google XSS == Gmail pwnage
Posted by: ma1 (IP Logged)
Date: September 24, 2007 01:29PM
id Wrote:
-------------------------------------------------------
> ma1 Wrote:
> --------------------------------------------------
> -----
> > BTW, do you think your host could stand
> > slashdotting?
>
>
> It has at least 3 times.
Mine too, but I meant beford's ;)
At any rate, good to know for the future...
--
*hackademix.net*
There's a browser safer than Firefox... Firefox, with NoScript
-------------------------------------------------------
> ma1 Wrote:
> --------------------------------------------------
> -----
> > BTW, do you think your host could stand
> > slashdotting?
>
>
> It has at least 3 times.
Mine too, but I meant beford's ;)
At any rate, good to know for the future...
--
*hackademix.net*
There's a browser safer than Firefox... Firefox, with NoScript
Re: Google XSS == Gmail pwnage
Posted by: id (IP Logged)
Date: September 24, 2007 02:17PM
ah yeah, I should read the thread more carefully...looks like blog.beford.org is hosted, so I'm guessing it could, but he may be charged for bandwidth so I'd wait for a response before doing it.
This server can handle a lot of traffic, but the line is only 768k up, so that's the bottleneck, and I don't really care if it is a bit slow for a day, so go for it if it ever comes up.
-id
This server can handle a lot of traffic, but the line is only 768k up, so that's the bottleneck, and I don't really care if it is a bit slow for a day, so go for it if it ever comes up.
-id
Re: Google XSS == Gmail pwnage
Posted by: thrill (IP Logged)
Date: September 24, 2007 02:45PM
Quote:and I don't really care if it is a bit slow for a day
That's so noble of you... diq.
--thrill
---
It is not the degrees you hold, but the mind you possess. - thrill
Re: Google XSS == Gmail pwnage
Posted by: id (IP Logged)
Date: September 24, 2007 03:08PM
I swear I'm going to move the server someday...
-id
-id
Re: Google XSS == Gmail pwnage
Posted by: thrill (IP Logged)
Date: September 25, 2007 01:13PM
Yeah, and it'll probably be the day after I shut it down and move out of my house.. ;)
--thrill
---
It is not the degrees you hold, but the mind you possess. - thrill
--thrill
---
It is not the degrees you hold, but the mind you possess. - thrill
Sorry, only registered users may post in this forum.
sla.ckers.org RSS feed
Board haX0r3d together by ha.ckers.org, forshizzle.
SecTheory Security Consulting *