And to update you guys on this, this actually does work. Dotster allowed me to put a little snipet in part of my address and rsnake and I have found a couple of vulnerable whois servers that actually run the script.
But rsnake is too lazy to get a screen capture of it, and I would hate to give you all my info.. so here's my screen shot to prove it works:
EDIT: I went ahead and made the image smaller since RSnake wants to blog about it, also, here's the info on how it looks if you do a command line whois:
Technical Contact:
xxxxx, xxxxx domains@xxxxxxx.com
Some Company Name Here
P.O. Box xxxx
<script>alert("your browser is br0k3d")</script>
Pleasanton, California 94588
US
415-555-1212
--thrill
---
It is not the degrees you hold, but the mind you possess. - thrill
Edited 1 time(s). Last edit at 12/30/2007 03:25PM by thrill.
