On Saturday 12 August 2006 14:35, Valery Marchuk wrote:
> >I bet you haven't the balls all to search on nsa.gov and fbi.gov :>
>
> It looks like I have :) See my next message "XSS at nsa.gov" or just visit
> my blog
> http://www.securitylab.ru/blog/tecklord/179.php
http://lists.grok.org.uk/pipermail/full-disclosure/2005-May/thread.html#34263
I Reported this rather lame finding to them a while back as well as some other
possible issues. Got no reply, and as the discussion back then indicated
there could be a number of reasons for this, from them not really worrying
about it to it being a honeypot like attempt or other such theories.
Personally, I don't think they care all that much but I do think lame security
issues on the website of any organisation undermines their credentials for
handing out security advice to others.
I know that the seriousness of XSS is contentious in these parts but that's
not a debate I'd care to enter - I have my own ideas of the threat level of
XSS.
--
With Regards..
Barrie Dempster (zeedo) - Fortiter et Strenue
- http://reboot-robot.net -
"He who hingeth aboot, geteth hee-haw" Victor - Still Game
Attachment:
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/