[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Barney, Peeps, and Web Security



my ole buddy Steve writes for WebMonkey and has a nice article that
touches on security, stylesheets and more. Check it out.
---------- Forwarded message ----------
Date: Thu, 27 Apr 2000 17:09:42 -0400 (EDT)
From: Steven Champeon <schampeo@hesketh.com>

I just wrote an article for Webmonkey, entitled "XSS, Trust, and Barney"
that you might want to take a look at. It discusses the "Cross-Site
Scripting" problem, in some detail, and shows you how to abuse Web sites
that don't check form input for dangerous characters. Oh, and it also talks
about big purple dinosaurs.

 <http://hotwired.lycos.com/webmonkey/00/18/index3a.html>

It's an astonishingly widespread problem, as this URL will demonstrate:

 <http://hotwired.lycos.com/webmonkey/00/18/index3a_page6.html?tw=%3CIMG%20SRC%3Dhttp%3A%2F%2Fbarneyonline.com%2Fimages%2Fbab3.gif%3E>
 
No one is safe. Trust no one. Especially not Gina:

  <http://hotwired.lycos.com/webmonkey/00/18/index3a_page6.html?tw=%3CIMG%20SRC%3Dhttp%3a%2f%2fwww%2emarshmallowpeeps%2ecom%2fimages%2fpeeps_animation%2eGIF%3E>

It's a very serious problem, as well, so go check your code!

-- 
tired of being an underappreciated functionary in a soulless machine?
hesketh.com is hiring: <http://hesketh.com/careers/>



---
You are currently subscribed to internetworkers as: pjones@metalab.unc.edu
To unsubscribe send a blank email to leave-internetworkers-82026U@franklin.oit.unc.edu