Long time ago I found an interesting vulnerability in the Microsoft Internet Explorer 6 in which it was possible to execute javascript which was included in an image. The following is the the timeline of it: 07/15/05 Sven Vetsch detects the flaw 07/31/05 Sven Vetschs informs Microsoft 08/08/05 Semi-automated response by Microsoft 09/19/05 Proof-of-concept published [...]

After I read the blog post of RSnake in which he shows an XSS at netvibes.com I also thought that I should have a look at this webservice. First I have to say that the guys there have done a great job, this service really shows what the mysterious Web 2.0 is. On the other [...]

I’m using Mozilla Firefox now for a long time and so I’m happy to have version 2.0 since today. But of course in my profession and hobby as a security guy, the first thing I did was to test the new security features. One of these is the Phishing-Filter and here’s my workaround Option 1: [...]

As I wrote in one of my last postings, here’s the posting for my XSS vulnerability scanner I presented at 0sec. What is it and what can you do with it? As the name says, it’s a XSS vulnerability scanner. I wrote it during my research in the topic of XSS and as a part [...]

After my talk at 0sec I had an interesting short conversation with Roberto from Zone-H about attacking PDAs and especially smartphones trough XSS. Now here are some ideas I had about it. Because this are only ideas, I don’t know if it’s really possible to lunch such kind of attack at all An idea of [...]

Last weekend (13. – 15. October 2006) I had a talk at a small security conference in Switzerland called 0sec where the organizer was my employer the Dreamlab Technologies Ltd. My talk was named “The Future of XSS” and I think I’ve done my part there well, especially if I think about the fact that [...]

Long time ago I set up my old website and since a while I never put something new on it. The only thing I did from time to time was to write one or two sentences in form of a news post. Because of this I decided to set up a blog. Now it’s possible [...]