Full Disclosure mailing list archives
Re: A technique to mitigate cookie-stealing XSS attacks
From: Ulf Harnhammar <ulfh () update uu se>
Date: Sun, 10 Nov 2002 04:21:41 +0100 (CET)
On Thu, 7 Nov 2002, Justin King wrote:
I would be very interested in major browsers supporting a <dead> tag with an optional parameter to be a hash of the data between the opening and closing dead tag. This tag would indicate that no "live" elements of HTML be supported (e.g., JavaScript, VBScript, embed, object).
I'm not sure if that's the best solution. Lots of code out there do much less filtering than it should, so there will probably be a way to include a </dead> tag and then use all the usual XSS tricks. // Ulf Harnhammar VSU Security ulfh () update uu se _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: A technique to mitigate cookie-stealing XSS attacks Georgi Guninski (Nov 05)
- <Possible follow-ups>
- Re: A technique to mitigate cookie-stealing XSS attacks Ulf Harnhammar (Nov 08)
- Re: A technique to mitigate cookie-stealing XSS attacks Ulf Harnhammar (Nov 09)