Have you heard of cross-site framing? The past few days I saw listed on our archive, several websites vulnerable to cross-site framing – listed as frame redirection. I will briefly describe a possible exploitation scenario, concluding with more emphasis on the negative impact that this type of vulnerability can have to the privacy of innocent individuals who are users of the affected websites.

Continue Reading »

Aviv Raff has published on his blog an interesting proof of concept of the vulnerability affecting Internet Explorer v7: a cross-site scripting in the navcancl.htm local resource.

Continue Reading »

The goals of XSSed.com are to provide informative resources on cross-site scripting(XSS) vulnerabilities and exploitation methodologies, and to archive XSS vulnerable websites for statistic purposes. Mirroring websites is a way to prove to vendors and webmasters that the vulnerability really existed – in case of denial. Users will become more aware on protecting themselves on some websites, as XSS vulnerabilities are mostly targeting the users and not the websites.

XSSed.com is also an attempt to spread education and awareness about XSS to IT professionals and amateurs involved or interested in secure web application development.

Continue Reading »

A new website dedicated specifically to cross-site scripting(XSS) vulnerabilities, will soon be launched in BETA mode.

With a no-hat approach, and only for educational purposes, we will receive notifications of websites, web-based services and software applications that have been “XSSed“. When a cross-site scripting vulnerability is submitted – URL poisoning, frame injection and other vulnerabilities that can be exploited against users are also allowed – it will be saved automatically in the on-hold archive until review by our staff.

Continue Reading »