<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
/* List Definitions */
@list l0
{mso-list-id:230701448;
mso-list-type:hybrid;
mso-list-template-ids:-624142760 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:.25in;
text-indent:-.25in;}
@list l1
{mso-list-id:656349668;
mso-list-type:hybrid;
mso-list-template-ids:958316662 67698711 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l1:level1
{mso-level-number-format:alpha-lower;
mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l2
{mso-list-id:1123884964;
mso-list-type:hybrid;
mso-list-template-ids:760120434 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l2:level1
{mso-level-start-at:5;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:.25in;
text-indent:-.25in;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoListParagraph style='margin-left:.25in;text-indent:-.25in;
mso-list:l0 level1 lfo1'><![if !supportLists]><span style='font-size:11.0pt;
font-family:"Calibri","sans-serif";color:#1F497D'><span style='mso-list:Ignore'>1.<span
style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>“XSS
isn’t technical”<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal style='margin-left:.25in'><span style='font-size:11.0pt;
font-family:"Calibri","sans-serif";color:#1F497D'>That, sir, is an argument
that XSS is *<b>more</b>* important to customers, not less. When you snatch
user credentials from a web portal login page, or own the entire population of client
desktops ‘cause they’re all configured to totally trust the vulnerable
site, the notion that “any fool could’ve found that” is just one
more reason to take the issue seriously.<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.25in'><span style='font-size:11.0pt;
font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal style='margin-left:.25in'><span style='font-size:11.0pt;
font-family:"Calibri","sans-serif";color:#1F497D'>Second, XSS exploits can get pretty
effing technical. Try using XSS to do something meaningful to a
cookieless app that uses client certificate authentication. It’ll give
you a real appreciation for why people write things like xssproxy.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoListParagraph style='margin-left:.25in;text-indent:-.25in;
mso-list:l2 level1 lfo2'><![if !supportLists]><span style='font-size:11.0pt;
font-family:"Calibri","sans-serif";color:#1F497D'><span style='mso-list:Ignore'>5.<span
style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>“Only
lamers publish XSS”<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal style='text-indent:.25in'><span style='font-size:11.0pt;
font-family:"Calibri","sans-serif";color:#1F497D'>Posting about XSS bugs on
wherever.com = lame.<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.25in'><span style='font-size:11.0pt;
font-family:"Calibri","sans-serif";color:#1F497D'>Posting about XSS bugs in
shipping software products = cool.<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.25in'><span style='font-size:11.0pt;
font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal style='margin-left:.25in'><span style='font-size:11.0pt;
font-family:"Calibri","sans-serif";color:#1F497D'>Re. what’s lame, it’s
because the case for full disclosure doesn’t work for web sites.
Seriously. There are a million regulatory schemes in place (PCI, SOX,
HIPAA, GLBA, SB1386, etc, etc) that exist to penalize organizations for failing
to protect customer data. Any hacker who wants to feel righteous can
anonymously tell a company that they’re vulnerable, and later, when the
company gets owned, that hacker can bust their balls by telling the world how they
made the company aware of the threat, yet nothing was done to mitigate it.<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.25in'><span style='font-size:11.0pt;
font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal style='margin-left:.25in'><span style='font-size:11.0pt;
font-family:"Calibri","sans-serif";color:#1F497D'>Re. what’s cool, it’s
because for a software product, there is no legislation to protect customers’
interests. (i.e., no product liability) Therefore, we have the full
disclosure debate, and anyone who believes in full disclosure for buffer
overflows has no reason to look down their nose at a meaningful XSS advisory.<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.25in'><span style='font-size:11.0pt;
font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal style='margin-left:.25in'><span style='font-size:11.0pt;
font-family:"Calibri","sans-serif";color:#1F497D'>Unless they just gotta feel
cool.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> full-disclosure-bounces@lists.grok.org.uk
[mailto:full-disclosure-bounces@lists.grok.org.uk] <b>On Behalf Of </b>reepex<br>
<b>Sent:</b> Sunday, November 04, 2007 2:26 PM<br>
<b>To:</b> full-disclosure@lists.grok.org.uk; pdp (architect)<br>
<b>Subject:</b> [Full-disclosure] on xss and its technical merit<o:p></o:p></span></p>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Pdp architect and I have been emailing back and forth about
whether xss has a place in fd, bugtraq, or the security research area at
all. He decided that we should start a discussion about in on here and
gets peoples unmoderated opinion. This discussion should not concern
whether its important due to stealing bank info, paypal, whatever it should
only stick to xss as a pure research area. Or as pdp described it: <br>
<br>
"we are talking about whether XSS is as technical as other security
disciplines. We are also talking about whether it should have a deserved an
recognized place among FD readers and contributers. however, the topic wont
cover only whether you can detect or inject XSS, this is lame. it will
cover the whole 9 yards... pretty much all the topics covered inside the XSS
book." <br>
<br>
My ideas on the topic are <br>
<br>
1) XSS isnt techincal no matter how its used <br>
2) people who use xss on pentests/real hacking/anything but phishing are lame
and only use it because they cannot write real exploits (non-web) or couldnt
find any other web bugs (sql injection, cmd exec,file include, whatever) <br>
3) XSS does not have a place on this list or any other security list and i
remember when the idea of making a seperate bugtraq for xss was proposed and i
still think it should be done.<br>
4) if you go into a pentest/audit and all you get out is xss then its a failed
pentest and the customer should get a refund. <br>
5) publishing xss shows your weakness and that you dont have the ability to
find actual bugs ( b/c xss isnt a vuln its crap )<br>
<br>
i think pdp is going to respond first. should be fun ;)<o:p></o:p></p>
</div>
</body>
</html>