<<< Date Index >>>     <<< Thread Index >>>

Re: XSS phpBB 2.0.21 in administration



I know what XSS is. I'm pointing out the fact that to do any of the
XSS items in the report given, you have to be admin (since they are
all in the admin panel). If you are in the admin panel of any forum,
then there's other things you can do than try fiddle about with XSS.

Jessica


On 7/19/06, David Thomson <dave@xxxxxxxxxxxxxxxx> wrote:
Defenition from Google, on XSS.

Cross site scripting (XSS) is a type of computer security exploit where
information from one context, where it is not trusted, can be inserted into
another context, where it is. From the trusted context, an attack can be
launched. Note that although cross site scripting is also sometimes
abbreviated "CSS", it has nothing to do with the Cascading Style Sheets
technology that is more commonly called CSS.

Example:

A XSS attack is something that an attacker performs, not an admin. You can
use XSS to retrieve session information, cookies, md5 hashs, password hashes
all from within a web browser, no need to be an admin.

Hope this helps.