Fiddler XSRF Inspector 1.0 Released

Download



Overview
Fiddler XSRF Inspector is a plugin for Fiddler 2 that extracts cross-site request forgery attacks from HTTP requests.

Installation
Copy FiddlerXSRF.dll to the Fiddler 2 Inspectors folder, generally %ProgramFiles%\Fiddler2\Inspectors

Instructions
1) Capture the request that is going to be used to create a cross-site request forgery attack.
2) Navigate to the XSRF tab under inspectors to see the generated HTML. If the request uses the POST method, the option to convert it to GET will be available.
3) Click the Test button and observe the results.

Change Log
1.0
Initial Release

Tumblr.com Persistent XSS

onmouseover attributes added to user submitted markup via HTTP proxy are not stripped.

Exploit: Create a new link, add a description, and set the HTML to <h1>test</h1>. Submit the form and capture the request using an HTTP proxy (e.g. Fiddler). Change the post[three] value to <h1 onmouseover="alert(0)">test</h1> and resume the request.

PoC: http://asdfffffffff.tumblr.com/