Comments on: New XSS vector http://www.thespanner.co.uk/2008/08/26/new-xss-vector/ A tool for designers dealing with programmers dealing with designers... Wed, 08 Sep 2010 00:33:14 +0000 http://wordpress.org/?v=2.6.2 By: Милан http://www.thespanner.co.uk/2008/08/26/new-xss-vector/#comment-1356 Милан Mon, 10 Nov 2008 11:53:17 +0000 http://www.thespanner.co.uk/?p=221#comment-1356 Also works in IE8. thx Also works in IE8. thx

]]> By: naughty.spanky.boy http://www.thespanner.co.uk/2008/08/26/new-xss-vector/#comment-1294 naughty.spanky.boy Fri, 29 Aug 2008 07:51:04 +0000 http://www.thespanner.co.uk/?p=221#comment-1294 Hi, I have an idea, for protecting websites against XSS attacks. Why not ban all the tags, and allow only predefined ones with 'special' care. Like, allow img only with src that starts with a http://, or allow a href but only if http https is found. Hi,

I have an idea, for protecting websites against XSS attacks. Why not ban all the tags, and allow only predefined ones with ’special’ care. Like, allow img only with src that starts with a http://, or allow a href but only if http https is found.

]]> By: Gareth Heyes http://www.thespanner.co.uk/2008/08/26/new-xss-vector/#comment-1293 Gareth Heyes Thu, 28 Aug 2008 10:48:00 +0000 http://www.thespanner.co.uk/?p=221#comment-1293 @jim Hey jim thanks, why don't you put a online demo of ESAPI like <a href="http://demo.phpids.org/" rel="nofollow">Mario's smoketest</a>? Then we'll see how good it is :) @jim

Hey jim thanks, why don’t you put a online demo of ESAPI like Mario’s smoketest? Then we’ll see how good it is :)

]]> By: Jim Manico http://www.thespanner.co.uk/2008/08/26/new-xss-vector/#comment-1292 Jim Manico Wed, 27 Aug 2008 22:56:01 +0000 http://www.thespanner.co.uk/?p=221#comment-1292 If only everyone had the power of ESAPI.encoder().encodeForHTMLAttribute(String userData); Great find, good job! If only everyone had the power of

ESAPI.encoder().encodeForHTMLAttribute(String userData);

Great find, good job!

]]> By: superhei http://www.thespanner.co.uk/2008/08/26/new-xss-vector/#comment-1290 superhei Wed, 27 Aug 2008 05:17:04 +0000 http://www.thespanner.co.uk/?p=221#comment-1290 hi Gareth Heyes good job it work in ie6/7/8 hi Gareth Heyes

good job
it work in ie6/7/8

]]> By: Gareth Heyes http://www.thespanner.co.uk/2008/08/26/new-xss-vector/#comment-1289 Gareth Heyes Tue, 26 Aug 2008 21:54:27 +0000 http://www.thespanner.co.uk/?p=221#comment-1289 Emailed rsnake but they won't be added to the cheat sheet because there is no new event handler and javascript: is already mentioned Emailed rsnake but they won’t be added to the cheat sheet because there is no new event handler and javascript: is already mentioned

]]> By: Gareth Heyes http://www.thespanner.co.uk/2008/08/26/new-xss-vector/#comment-1288 Gareth Heyes Tue, 26 Aug 2008 21:25:46 +0000 http://www.thespanner.co.uk/?p=221#comment-1288 Also works in IE8 I'll email him Also works in IE8

I’ll email him

]]> By: x-tense http://www.thespanner.co.uk/2008/08/26/new-xss-vector/#comment-1287 x-tense Tue, 26 Aug 2008 21:16:31 +0000 http://www.thespanner.co.uk/?p=221#comment-1287 You can remove the value of src attribute: <isindex type=image onerror=alert(1) src=> (only tested on IE6) Did you ask to rsnake to add this vector ? You can remove the value of src attribute:

<isindex type=image onerror=alert(1) src=>

(only tested on IE6)

Did you ask to rsnake to add this vector ?

]]>