Re: [Full-disclosure] yahoomail dom based xss vulnerability

[pratul agrawal <pratulag@xxxxxxxxx>]

Its working Bro.  I think u had done some mistakes so u try it again with check 
that javascript execution feature is enable in your browser. and bro for 
execution of script it is must to use proper syntax that contain special 
characters. just put "><script>alert(123)<script>  in the New Folder field 
comes in the Move button and you will saw a pop up message with 123 reflected.

Have a nice time bro,
Pratul Agrawal

--- On Tue, 15/6/10, ㅤ ㅤRockey <skg102@xxxxxxxxx> wrote:

From: ㅤ ㅤRockey <skg102@xxxxxxxxx>
Subject: Re: [Full-disclosure] yahoomail dom based xss vulnerability
To: 
Cc: full-disclosure@xxxxxxxxxxxxxxxxx, security@xxxxxxxxx, info@xxxxxxxxxxxxxx
Date: Tuesday, 15 June, 2010, 5:10 AM


Tried reproducing on yahoo mail
both on the classic and new one . Error message i got in both cases were

"Sorry, but your folder name has prohibited characters (please use letters, 
numbers, dashes, and underscores). Please fix it and try again."


Cheers,
Rockey

--
It's all about Hacking and Security

http://h4ck3r.in/



-----Inline Attachment Follows-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/