Re: [Full-disclosure] XSS in Oracle default fcgi-bin/echo

["Thor (Hammer of God)" <thor@xxxxxxxxxxxxxxx>]

>You make wrong assumptions, and jump to conclusions:
> - Not anyone, but bona-fide ones only.
> - I do not "own" an Oracle site to test.
>Were not those obvious to right-thinking people?

You misunderstand.  Irrespective of the method you choose to validate 
"bona-fide" recipients of your PoC, you will have no control over what the 
recipient chooses to do with it once they have it.  As such, logic dictates 
that your PoC be considered "public" the moment you release it.   If there was 
any "obvious" point missed, it was that fact. 

My original position stands:  either disclose the code publically - in other 
words - don't fool yourself into thinking you are somehow being responsible by 
"validating" recipients prior, or simply send the code to Oracle and ask them 
if works or not.  It's unfortunate that you consider simple logic as assumptive 
or a presupposition but I respect your right to do so.

t

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/