[WEB SECURITY] The future of XSS attacks

[MustLive]

Hello participants of Mailing List.

Yesterday I wrote English version of my article The future of XSS attacks
(http://websecurity.com.ua/3878/), which you can read if you interested in
this topic.

In the article I talked about Cross-Site Scripting attacks where it’s not 
possible to use any tags and angle brackets. I listed attack vectors which 
can be used in this case (automated and non-automated). And wrote about 
current situation with modern browsers: in 2008 in Firefox 3 possibility of 
attack via -moz-binding was removed (partly) and in IE 8, which released at 
beginning of 2009, support of expression() was removed.

So I proposed my cross-browser solution for conducting of automated XSS
attacks in such conditions (when it’s not possible to use any tags and angle
brackets) - with using of MouseOverJacking technique, which I already wrote
about (http://websecurity.com.ua/3814/).

You can read the article The future of XSS attacks at my site:
http://websecurity.com.ua/3878/

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua


----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/

Subscribe via RSS: 
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

Join WASC on LinkedIn
http://www.linkedin.com/e/gis/83336/4B20E4374DBA