This site is soon to be deprecated by http://www.johnleitch.net

Thursday, September 10, 2009

Leveraging Existing CSS - Stickam.com

Stickam's filters are quite strict; attempting to inject a script tag results in an internal error page. The same thing happens with a variety of other tags, any event attribute, certain CSS property values (e.g. setting position to absolute) and even many of the site's CSS IDs and classes. But the filters miss some of the ID selectors that set the element position to absolute, and this can be utilized to cover the entire page with a link.

http://www.stickam.com/onlineMembers.do?personalTags="<a id="cboxTitle"style="height:9999px;width:9999px;"href="http://cross-site-scripting.blogspot.com"</a>

1 comment:

  1. This comment has been removed by a blog administrator.

    ReplyDelete