Ethical Hacking/Penetration Testing and Information Security Blog
Saturday, June 16, 2012
Trition Digital Reflective XSS
Here is the long overdue short video of the reflective XSS in Triton Digital's cloud advertisement service and homepage. This found this vuln while inspecting firewall logs and noticing connections to a peculiar IP address sending a users date of birth, zip code and sex...So I investigated...
****This video is in response to the following blog post made on March 17, 2012****
another vulnerability. Reflective Cross Site Scripting (XSS)!!!!(Not as
cool as my CSRF but w/e lol)...While this company sells a service to
several large companies the product that was exploited is a cloud
service and nothing is installed on clients/customers servers so this
does not qualify for a CVE. I also exploited their homepage which is
outsourced to a web developing company.
Reported to the company last week. More details will come once they patch(Video)!
Reflected XSS Attacks
Reflected attacks are those where the injected code is reflected off
the web server, such as in an error message, search result, or any other
response that includes some or all of the input sent to the server as
part of the request. Reflected attacks are delivered to victims via
another route, such as in an e-mail message, or on some other web
server. When a user is tricked into clicking on a malicious link or
submitting a specially crafted form, the injected code travels to the
vulnerable web server, which reflects the attack back to the user’s
browser. The browser then executes the code because it came from a