Re: [Full-disclosure] on xss and its technical merit

[nate.mcfeters@xxxxxxxxx]

This is ridiculous.  Not to mention the implications for users of financial web 
apps, you still have to consider that xss is a great delivery mechanism for all 
sorts of attacks.  When you evaluate a flaw, you must evaluate the risk it 
presents to a victim.  Xss provides a rich attack surface.  Its not just 
stealing cookies anymore, which, btw is still a valid flaw and a great risk on 
some applications.

While on principal I agree that xss is no where near as technical to perform, 
does that even matter?  I would state that you actually strengthen the argument 
for xss being an issue by saying this.  If it is less technical, then it is 
easier for less tech people to exploit. 

Hopefully I didn't miss any major point made in all the inline comments, but 
xss is an issue tech or not.  

Now, should it be on full disc?  Depends In my view.  If it is momscookies.com, 
of course not.  But If it is a widely used framework, device, or web app, then 
I say why not?

I will leave my comments on the subject at that, as this is a debate I've heard 
far too many times now.

Believing xss is a non issue is like believing global warming doesn't exist.

Nate
Sent via BlackBerry from T-Mobile

-----Original Message-----
From: reepex <reepex@xxxxxxxxx>

Date: Sun, 4 Nov 2007 18:11:50 
To:"pdp (architect)" <pdp.gnucitizen@xxxxxxxxxxxxxx>, 
full-disclosure@xxxxxxxxxxxxxxxxx
Subject: Re: [Full-disclosure] on xss and its technical merit


you see i do not agree with this because you are relying on other bugs to make 
xss useful and again you are relying on interaction from the user.

any bug that requires another (form of) bug to be useful or that requires user 
interaction is inherently weaker then then other "any time" bugs like bof/sql 
injection/whatever 


On Nov 4, 2007 5:16 PM, pdp (architect) <pdp.gnucitizen@xxxxxxxxxxxxxx 
<mailto:pdp.gnucitizen@xxxxxxxxxxxxxx> > wrote:
 well valid point. XSS can alway be used as a career to whatever kind
of attack you have in there. Just imagine the MySpace XSS warm
combined with the IE VML or one of these ActiveX bugs that allow you
to write into arbitery files on the file system (so that it is not a 
software bug). Hmmm?




On Nov 4, 2007 11:51 PM,  <nate.mcfeters@xxxxxxxxx 
<mailto:nate.mcfeters@xxxxxxxxx> > wrote:
> What about when xss leads to stack overflows and command injections?  See 
> http://xs-sniper.com <http://xs-sniper.com> .  It would seem that if you 
> subscribe to the thought that only attacks that take over a victims computer 
> are valid, then you would have to now admit xss as valid as well. 
>
> Nate
> Sent via BlackBerry from T-Mobile
>
>
> -----Original Message-----
> From: reepex <reepex@xxxxxxxxx <mailto:reepex@xxxxxxxxx> >
>
> Date: Sun, 4 Nov 2007 13:26:17 
> To:full-disclosure@xxxxxxxxxxxxxxxxx 
> <mailto:To:full-disclosure@xxxxxxxxxxxxxxxxx> , "pdp (architect)" 
> <pdp.gnucitizen@xxxxxxxxxxxxxx <mailto:pdp.gnucitizen@xxxxxxxxxxxxxx> > 
> Subject: [Full-disclosure] on xss and its technical merit
>
>
> Pdp architect and I have been emailing back and forth about whether xss has a 
> place in fd, bugtraq, or the security research area at all. He decided that 
> we should start a discussion about in on here and gets peoples unmoderated 
> opinion. This discussion should not concern whether its important due to 
> stealing bank info, paypal, whatever it should only stick to xss as a pure 
> research area. Or as pdp described it: 
>
> "we are talking about whether XSS is as technical as other security 
> disciplines. We are also talking about whether it should have a deserved an 
> recognized place among FD readers and contributers. however, the topic wont 
> cover only whether you can detect or inject XSS, this is lame. it will cover 
> the whole 9 yards... pretty much all the topics covered inside the XSS book." 
>
> My ideas on the topic are
>
> 1) XSS isnt techincal no matter how its used
> 2) people who use xss on pentests/real hacking/anything but phishing are lame 
> and only use it because they cannot write real exploits (non-web) or couldnt 
> find any other web bugs (sql injection, cmd exec,file include, whatever) 
> 3) XSS does not have a place on this list or any other security list and i 
> remember when the idea of making a seperate bugtraq for xss was proposed and 
> i still think it should be done.
> 4) if you go into a pentest/audit and all you get out is xss then its a 
> failed pentest and the customer should get a refund. 
> 5) publishing xss shows your weakness and that you dont have the ability to 
> find actual bugs ( b/c xss isnt a vuln its crap )
>
> i think pdp is going to respond first. should be fun ;)
>
>  _______________________________________________ 
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html 
> <http://lists.grok.org.uk/full-disclosure-charter.html> 
> Hosted and sponsored by Secunia - http://secunia.com/ <http://secunia.com/> 
>






--
pdp (architect) | petko d. petkov

http://www.gnucitizen.org <http://www.gnucitizen.org> 

 _______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/