[Video] - Build a backdoor in OpenSSH 6.4p1 with Kali Linux
This time I show you, how to build a "backdoor" in your own OpenSSH 6.4p1 installation under Kali Linux
Continue reading "[Video] - Build a backdoor in OpenSSH 6.4p1 with Kali Linux"
SSCHADV2013-010 - developer.mozilla.org DOMbased Cross-site Scripting vulnerability
|
Advisory:
|
developer.mozilla.org - DOM based Cross-site Scripting vulnerability
|
|
Advisory ID:
|
SSCHADV2013-010
|
|
Author:
|
Stefan Schurtz
|
|
Affected Software:
|
Successfully tested on developer.mozilla.org
|
|
Vendor URL:
|
|
|
Vendor Status:
|
fixed
|
==========================
Vulnerability Description
==========================
Vulnerability Description
==========================
The website 'developer.mozilla.org' is prone to a DOM based XSS vulnerability
HTML5 Security Cheatsheet
Here you can find the HTML5 Security Cheatsheet, which is a nice source of some good XSS payloads.
For Example:
XSS via formaction – requiring user interaction (1)
A vector displaying the HTML5 form and formaction capabilities for form hijacking outside the actual form
Self-including DOM Worker XSS
A self-including code snippet utilizing a DOM worker and firing a message event to itself causing script execution
|
0?<script>Worker("#").onmessage=function()eval(.data)</script> :postMessage(importScripts(‘data:;base64,cG9zdE1lc3NhZ2UoJ2FsZXJ0KDEpJyk’))
|
Self-hijacking JSON literals
In case parts of a JSON literal are controlled by user input there’s a risk to allow auto-harvesting values from later object members.
|
<script>[{‘a’:Object.prototype.defineSetter(‘b’,function(){alert(arguments[0])}),‘b’:[‘secret’]}]</script>
|