[WEB SECURITY] Blackbox xss reversing

gaz Heyes gazheyes at gmail.com
Thu Feb 3 04:50:08 EST 2011


Hi all

I'd like your thoughts on blackbox xss reversing. Do you think one
canary/identifier is enough? Is it needed? Using the input as a identifier
itself, would there be too many false positives? If a variable doesn't allow
alphanumeric characters, how would you create a canary/identifier? If a
variable is numeric only how would you know? Hmmm maybe doing a diff on the
page with different numbers might work, but what about randomized content
unrelated to inputs? Other then tags, attributes and characters what other
stuff would be useful to know?

Cheers

Gareth

PS I like asking questions, did you know that?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/attachments/20110203/b8a320fb/attachment-0003.html>


More information about the websecurity mailing list