Why is "Full HTML" Input Format Dangerous?

10.13.2008

This is a comment I submitted on my localhost site, with full HTML allowed for anonymous users. The fact that "XSS" came up in an alert means I'm vulnerable to attack.

If you want your skin to crawl more, visit the XSS Cheatsheet, which offers a number of techniques for XSS attacks. If you're ever in doubt, no better test than to attempt to hack yourself.

Attachment	Size
xss.gif	8.39 KB

Nick Lewis's blog

Comments

Fri, 2009-07-03 04:56 — wow gold (not verified)

buy wow gold cheap wow power

buy wow gold
cheap wow power leveling
my wow gold
cheapest wow power leveling
BUY wow gold
cheap wow power leveling
CHEAP rs gold
good wow power leveling
MY lotro gold
CHEAPEST aion gold
buy wow gold
cheap wow gold
CHEAPEST wow gold

Thu, 2008-10-23 11:31 — theamoeba

alert("you've been

alert("you've been hacked")

hmm - didnt work :(

Thu, 2008-10-23 22:36 — Nick Lewis

heh, won't comment on whether

heh, won't comment on whether it would have worked last time I audited this site's security.

Fri, 2008-10-24 11:04 — theamoeba

Hi, scary isnt it? This is a common problem and it usually happens to people who are uninformed. I think that MySpace got hacked like this. I sat through a seminar once and this was one of the topics on the agenda.

You can do SQL injection this too cant you?

anyway... cheerio - Im out to check how secure my sites are. ;)