Feed on Posts or Comments | Font Size: Decrease Font Size Increase Font Size 24 June 2024

Category ArchiveSecurity News

Filed under: Phishing, Privacy, Security News, XSS
posted by D1m on 28 Mar 2007

Cross-Site Framed?

Have you heard of cross-site framing? The past few days I saw listed on our archive, several websites vulnerable to cross-site framing – listed as frame redirection. I will briefly describe a possible exploitation scenario, concluding with more emphasis on the negative impact that this type of vulnerability can have to the privacy of innocent individuals who are users of the affected websites.

Continue Reading »

Filed under: Defacements, Security News, XSS
posted by D1m on 06 Mar 2007

XSSed.com: What, Who, Why?

The goals of XSSed.com are to provide informative resources on cross-site scripting(XSS) vulnerabilities and exploitation methodologies, and to archive XSS vulnerable websites for statistic purposes. Mirroring websites is a way to prove to vendors and webmasters that the vulnerability really existed – in case of denial. Users will become more aware on protecting themselves on some websites, as XSS vulnerabilities are mostly targeting the users and not the websites.

XSSed.com is also an attempt to spread education and awareness about XSS to IT professionals and amateurs involved or interested in secure web application development.

Continue Reading »

Filed under: Defacements, Hacktivism, Personal Opinions, Security News
posted by D1m on 22 Feb 2007

High-Profiled Websites Getting Hacked And Defaced

Everyday, the security of many high-profiled governmental, military, educational and corporate websites, is broken into by crackers who deface them. Although some defacers protest against wars and other just send greets to their cyberdudes, I believe that their true motive is to get to the top of the lead in “special” defacements. The defacers don’t want to admit this as the real reason for their attacks.

Continue Reading »

Filed under: Security News, XSS
posted by D1m on 08 Feb 2007

XSSed.com – Cross-Site Scripting Information And Attacks Archive To Be Launched Soon

A new website dedicated specifically to cross-site scripting(XSS) vulnerabilities, will soon be launched in BETA mode.

With a no-hat approach, and only for educational purposes, we will receive notifications of websites, web-based services and software applications that have been “XSSed“. When a cross-site scripting vulnerability is submitted – URL poisoning, frame injection and other vulnerabilities that can be exploited against users are also allowed – it will be saved automatically in the on-hold archive until review by our staff.

Continue Reading »

Filed under: Defacements, Exploits, Personal Opinions, Security News
posted by D1m on 01 Feb 2007

MSN.co.uk Money Related Websites Hacked And Defaced

Two websites belonging to MSN (Microsoft Network) in the United Kingdom, were defaced today by an attacker who goes by the nickname DARK LORD. It looks like someone who is unethically testing his SQL injection skills, and “feeding” himself with a false sense of pride, just by leaving the message “DARK LORD WAZ HERE”.

No. I am not a defacer psychologist. I am just expressing my personal opinion on the matter, which is this: If a website defacement doesn’t convey a meaningful message, then it is done for selfish reasons.

A bit of an embarassment for Microsoft’s sysadmins…

Continue Reading »

Next Page »