Bugtraq mailing list archives
RE: Internet Explorer and Opera local zone restriction bypass
From: "Thor Larholm" <thor () pivx com>
Date: Mon, 27 Oct 2003 23:44:01 -0800
From: Andreas Sandblad [mailto:sandblad () acc umu se] I can only reproduce it together with user-interaction, that is manually pressing refresh in Internet Explorer. I did some attempts to try to automaticly refresh the page using javascript but without any luck (denied access due to cross-site-policy).
There is absolutely no requirement for any user-interaction, as you can programmatically click the Refresh button - or rather, trigger the exact same non-window-object-dependant non-cross-site functionality in the current window object where you have all the access you need. document.execCommand("Refresh"); http://msdn.microsoft.com/workshop/author/dhtml/reference/methods/execcommand.asp Refresh is just one of the many command identifiers that document and range objects can utilize http://msdn.microsoft.com/workshop/author/dhtml/reference/commandids.asp Use a third window object to store the state on wether or not you have refreshed already, to avoid an infinite loop. Regards Thor Larholm PivX Solutions, LLC - Senior Security Researcher http://pivx.com/larholm/ - Get our research, join our mailinglist
Current thread:
- Re: Internet Explorer and Opera local zone restriction bypass, (continued)
- Re: Internet Explorer and Opera local zone restriction bypass Jort Slobbe (Oct 24)
- Re: Internet Explorer and Opera local zone restriction bypass jelmer (Oct 27)
- Re: Internet Explorer and Opera local zone restriction bypass Andreas Sandblad (Oct 27)
- Re: Internet Explorer and Opera local zone restriction bypass Andreas Sandblad (Oct 27)
- Re: Internet Explorer and Opera local zone restriction bypass jelmer (Oct 28)
- RE: Internet Explorer and Opera local zone restriction bypass Thor Larholm (Oct 27)
- RE: Internet Explorer and Opera local zone restriction bypass Mindwarper * (Oct 27)
- Re: Internet Explorer and Opera local zone restriction bypass Heikki Toivonen (Oct 27)
- Re: Internet Explorer and Opera local zone restriction bypass Mohsen Hariri (Oct 27)
- Re: Internet Explorer and Opera local zone restriction bypass Paul Szabo (Oct 27)
- RE: Internet Explorer and Opera local zone restriction bypass Thor Larholm (Oct 28)
- Re: Internet Explorer and Opera local zone restriction bypass Bipin Gautam hUNT3R (Oct 28)
- Re: Internet Explorer and Opera local zone restriction bypass william schulze (Oct 30)
- RE: Internet Explorer and Opera local zone restriction bypass Francis Favorini (Oct 30)
- Re: Internet Explorer and Opera local zone restriction bypass Paul Szabo (Oct 30)
- RE: Internet Explorer and Opera local zone restriction bypass Thor Larholm (Oct 30)
- RE: Internet Explorer and Opera local zone restriction bypass Paul Szabo (Oct 31)
- Re: Internet Explorer and Opera local zone restriction bypass Jort Slobbe (Oct 24)