In the first part of this series, we discussed the entry points that an intruder could use to attack our “building,” our metaphor for network security. In the next few posts, we shall focus on the next level: attack vectors. If vulnerabilities are the entry points, then attack vectors are the ways attackers can launch Read more…
Tags: buffer overflow, cross-site scripting, SQL Injection, xss
Recently, xiaonei.com (a Chinese social-networking site, similar to Facebook) fixed a cross-site scripting (XSS) vulnerability known as “HTTP Response Splitting.” This flaw occurs when a web application does not properly filter carriage returns and linefeeds (%0d%0a). This allows an attacker to split the HTTP response header like so: HTTP/1.1 200 OK ”¦ Set-Cookie: _de=a\r\n\r\n <script>alert(/XSS/);</script>; Read more…
Posts tagged under xss