Comments on: More Javascript fuzzing http://www.thespanner.co.uk/2007/08/05/more-javascript-fuzzing/ A tool for designers dealing with programmers dealing with designers... Tue, 14 Oct 2008 01:40:46 +0000 http://wordpress.org/?v=2.6.2 By: Gareth Heyes http://www.thespanner.co.uk/2007/08/05/more-javascript-fuzzing/#comment-316 Gareth Heyes Mon, 06 Aug 2007 21:34:57 +0000 http://www.thespanner.co.uk/2007/08/05/more-javascript-fuzzing/#comment-316 I've updated the fuzzer, it now includes: 1. All html tags and attributes. 2. Send code to Firebug. 3. Lowercase, Uppercase, Random case for tags, events and attributes. 4. You can now specify the character range. 5. Fuzzing of HTML tags. 6. Backticks in the quote style. I’ve updated the fuzzer, it now includes:

1. All html tags and attributes.
2. Send code to Firebug.
3. Lowercase, Uppercase, Random case for tags, events and attributes.
4. You can now specify the character range.
5. Fuzzing of HTML tags.
6. Backticks in the quote style.

]]> By: Gareth Heyes http://www.thespanner.co.uk/2007/08/05/more-javascript-fuzzing/#comment-315 Gareth Heyes Mon, 06 Aug 2007 19:39:49 +0000 http://www.thespanner.co.uk/2007/08/05/more-javascript-fuzzing/#comment-315 Thanks for the suggestions Mario :) I shall sort them out tonight, I'm going to store the results of any javascript execution as well. Then I can provide a table for everyone to see. Thanks for the suggestions Mario :)

I shall sort them out tonight, I’m going to store the results of any javascript execution as well. Then I can provide a table for everyone to see.

]]> By: .mario http://www.thespanner.co.uk/2007/08/05/more-javascript-fuzzing/#comment-314 .mario Mon, 06 Aug 2007 19:36:10 +0000 http://www.thespanner.co.uk/2007/08/05/more-javascript-fuzzing/#comment-314 sorry - I meant 'all'-option for tags and attributes... sorry - I meant ‘all’-option for tags and attributes…

]]> By: .mario http://www.thespanner.co.uk/2007/08/05/more-javascript-fuzzing/#comment-313 .mario Mon, 06 Aug 2007 19:35:06 +0000 http://www.thespanner.co.uk/2007/08/05/more-javascript-fuzzing/#comment-313 Hi damn cool - thanks! But - some more suggestions: - src and rel attributes are missing - object, embed and style tags are missing - all-option for tags and quotes would be cool - quotes are missing backticks - if 'show code' could probe for firebug and show the code in the console it would be awesome for copy&paste issues Great work - it's becoming really useable! Greetings, .mario Hi
damn cool - thanks!

But - some more suggestions:
- src and rel attributes are missing
- object, embed and style tags are missing
- all-option for tags and quotes would be cool
- quotes are missing backticks
- if ’show code’ could probe for firebug and show the code in the console it would be awesome for copy&paste issues

Great work - it’s becoming really useable!

Greetings,
.mario

]]> By: Gareth Heyes http://www.thespanner.co.uk/2007/08/05/more-javascript-fuzzing/#comment-309 Gareth Heyes Mon, 06 Aug 2007 14:58:14 +0000 http://www.thespanner.co.uk/2007/08/05/more-javascript-fuzzing/#comment-309 I've uploaded a new version now. There's no logging on the system because I haven't had time to sort it out but if anyone gets javascript execution please let me know. It's worked 3 times for me using the following: 1. <body 'onload="alert(1);" class="javascript:alert(2);">test</body> 2. <body "onload="alert(1);" class="javascript:alert(2);">test</body> 3. Character number : 13 before the handler I’ve uploaded a new version now. There’s no logging on the system because I haven’t had time to sort it out but if anyone gets javascript execution please let me know.

It’s worked 3 times for me using the following:
1.
<body ‘onload=”alert(1);” class=”javascript:alert(2);”>test</body>
2.
<body “onload=”alert(1);” class=”javascript:alert(2);”>test</body>
3. Character number : 13 before the handler

]]> By: .mario http://www.thespanner.co.uk/2007/08/05/more-javascript-fuzzing/#comment-306 .mario Mon, 06 Aug 2007 13:35:13 +0000 http://www.thespanner.co.uk/2007/08/05/more-javascript-fuzzing/#comment-306 cool - looking forward for that! cool - looking forward for that!

]]> By: Gareth Heyes http://www.thespanner.co.uk/2007/08/05/more-javascript-fuzzing/#comment-304 Gareth Heyes Mon, 06 Aug 2007 13:19:18 +0000 http://www.thespanner.co.uk/2007/08/05/more-javascript-fuzzing/#comment-304 Thanks Mario Yeah I'll change the way it outputs and allow 50 results. Good suggestions thanks :) I've not looked at the Mozilla one yet, I'll check it out though. Expect an update soon Thanks Mario

Yeah I’ll change the way it outputs and allow 50 results. Good suggestions thanks :)

I’ve not looked at the Mozilla one yet, I’ll check it out though.

Expect an update soon

]]> By: .mario http://www.thespanner.co.uk/2007/08/05/more-javascript-fuzzing/#comment-303 .mario Mon, 06 Aug 2007 13:11:40 +0000 http://www.thespanner.co.uk/2007/08/05/more-javascript-fuzzing/#comment-303 Hi Gareth, nice tool! But why not displaying more than one result - it's pretty annoying that one has to click over and over again. I think displaying 20 - 50 results would be cool. Also it would be great not to work with alert() but with row coloring. Just overwrite alert to color the table row green where it's originating or sth similar. BTW: Have you tried the mozilla fuzzer? It's pretty cool and it would enrich you fuzzer if you'd add maybe another tab with the fuzzer output from Rhino - also limited to 20-50 statements. What do you think? Greetings, .mario Hi Gareth,

nice tool! But why not displaying more than one result - it’s pretty annoying that one has to click over and over again. I think displaying 20 - 50 results would be cool.

Also it would be great not to work with alert() but with row coloring. Just overwrite alert to color the table row green where it’s originating or sth similar.

BTW: Have you tried the mozilla fuzzer? It’s pretty cool and it would enrich you fuzzer if you’d add maybe another tab with the fuzzer output from Rhino - also limited to 20-50 statements.

What do you think?

Greetings,
.mario

]]>