«
Expand/Collapse
96 items tagged "ajax"
Related tags:
wordpress [+],
event [+],
webapps [+],
php [+],
chat [+],
site [+],
cms [+],
calendar version [+],
calendar [+],
aidicms [+],
vulnerabilities [+],
upload [+],
txt [+],
phpbb [+],
log [+],
event calendar [+],
category [+],
calendar component [+],
authors [+],
zingiri [+],
wp ajax recent posts [+],
web [+],
usa [+],
shell [+],
shah tags [+],
security vulnerabilities [+],
script [+],
rich internet [+],
ria [+],
remote shell [+],
plugin version [+],
phpmyfaq [+],
phpfox [+],
manx [+],
manager v1 [+],
joomla [+],
image [+],
gallery 3 [+],
gallery [+],
freewebshop [+],
forgery [+],
file renaming [+],
dropdown [+],
command execution [+],
command [+],
browser [+],
zenphoto [+],
xss [+],
windows [+],
web application [+],
sql injection [+],
sql [+],
sleeping giant [+],
security [+],
rafal los [+],
rabbit hole [+],
rabbit [+],
manset [+],
lfi [+],
httpconsole [+],
http [+],
hosts [+],
file upload [+],
dom [+],
dokuwiki [+],
deadly cocktail [+],
command line interface [+],
black hat [+],
vulnerability [+],
code execution [+],
zane lackey [+],
vulns [+],
view [+],
video [+],
vanilla [+],
security authors [+],
security advisory [+],
secunia [+],
retired [+],
php sql [+],
penny auction [+],
malaysia [+],
lussumo [+],
login [+],
lackey [+],
internet applications [+],
hole [+],
hastymail [+],
hacking [+],
hack in the box [+],
event id [+],
dom exploiting [+],
calendar event [+],
bugtraq [+],
billy hoffman [+],
bannerize [+],
asia [+],
alex stamos [+],
advisory [+],
code [+],
file [+],
execution [+],
cross [+],
day [+],
image manager [+],
cross site scripting [+]
-
-
13:33
»
SecDocs
Authors:
Shreeraj Shah Tags:
AJAX XSS Rich Internet Applications Event:
Black Hat USA 2010 Abstract: Web 2.0 applications are using dynamic DOM manipulations extensively for presenting JSON or XML streams in the browser. These DOM calls mixed with XMLHttpRequest (XHR) object are part of client side logic written in JavaScript or part of any other client side technology be it Flash or Silverlight. DOM driven XSS is a sleeping giant in the application code and it can be exploited by an attacker to gain access to the end user’s browser/desktop. This can become a root cause of following set of interesting vulnerabilities – Cross Widget Sniffing, RSS feed reader exploitation, XHR response stealing, Mashup hacking, Malicious code injection, Spreading Worm etc. This set of vulnerability needs innovative way of scanning the application and corresponding methodology needs to be tweaked. We have seen DOM driven XSS exploited in various different popular portals to spread worm or virus. This is a significant threat on the rise and should be mitigated by validating un-trusted content poisoning Ajax or Flash routines. DOM driven XSS, Cross Domain Bypass and CSRF can cause a deadly cocktail to exploit Web 2.0 applications across Internet. This presentation will be covering following important issues and concepts.
-
13:33
»
SecDocs
Authors:
Shreeraj Shah Tags:
AJAX XSS Rich Internet Applications Event:
Black Hat USA 2010 Abstract: Web 2.0 applications are using dynamic DOM manipulations extensively for presenting JSON or XML streams in the browser. These DOM calls mixed with XMLHttpRequest (XHR) object are part of client side logic written in JavaScript or part of any other client side technology be it Flash or Silverlight. DOM driven XSS is a sleeping giant in the application code and it can be exploited by an attacker to gain access to the end user’s browser/desktop. This can become a root cause of following set of interesting vulnerabilities – Cross Widget Sniffing, RSS feed reader exploitation, XHR response stealing, Mashup hacking, Malicious code injection, Spreading Worm etc. This set of vulnerability needs innovative way of scanning the application and corresponding methodology needs to be tweaked. We have seen DOM driven XSS exploited in various different popular portals to spread worm or virus. This is a significant threat on the rise and should be mitigated by validating un-trusted content poisoning Ajax or Flash routines. DOM driven XSS, Cross Domain Bypass and CSRF can cause a deadly cocktail to exploit Web 2.0 applications across Internet. This presentation will be covering following important issues and concepts.
-
-
6:43
»
Packet Storm Security Recent Files
This is an HTTP console to remote administer Windows hosts with a browser-based, AJAX-enabled, command-line interface. Server requires .NET 3.5. Written in C# and JavaScript.
-
6:43
»
Packet Storm Security Misc. Files
This is an HTTP console to remote administer Windows hosts with a browser-based, AJAX-enabled, command-line interface. Server requires .NET 3.5. Written in C# and JavaScript.
-
-
21:03
»
Packet Storm Security Advisories
Secunia Security Advisory - High-Tech Bridge SA has discovered a vulnerability in the WP Ajax Recent Posts plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks.
-
-
17:01
»
Packet Storm Security Exploits
Ajax Category Dropdown WordPress plugin version 0.1.5 suffers from cross site scripting and remote SQL injection vulnerabilities.
-
-
18:23
»
Packet Storm Security Exploits
Log1 CMS suffers multiple security vulnerabilities including direct access to the AjaxFileManager without a session, arbitrary file renaming via ajax_save_name.php, and arbitrary file downloads.
-
18:23
»
Packet Storm Security Recent Files
Log1 CMS suffers multiple security vulnerabilities including direct access to the AjaxFileManager without a session, arbitrary file renaming via ajax_save_name.php, and arbitrary file downloads.
-
18:23
»
Packet Storm Security Misc. Files
Log1 CMS suffers multiple security vulnerabilities including direct access to the AjaxFileManager without a session, arbitrary file renaming via ajax_save_name.php, and arbitrary file downloads.