Live data from Hacker News

Cross Site Scripting is a Big Problem [bug fixed]

nycs.bigheadlabs.com

Post reply on HN

Print view View original

1–3 of 3 posts

Cross Site Scripting is a Big Problem [bug fixed]

Post by staunch » Fri, Apr 20, 2007, 2:46 AM UTC

Cross Site Scripting is a Big Problem [bug fixed]
nycs.bigheadlabs.com

Re: Cross Site Scripting is a Big Problem [bug fixed]

Post by jasonyan » Fri, Apr 20, 2007, 3:44 AM UTC

I guess it's a good thing there's no authentication on that site.

Re: Cross Site Scripting is a Big Problem [bug fixed]

Post by staunch » Fri, Apr 20, 2007, 4:08 AM UTC

jasonyan wrote: post #2

I guess it's a good thing there's no authentication on that site.

Any domain cookies for .bigheadlabs.com are vulnerable, which could be a real problem (Wordpress admin maybe?).

Domains are so cheap now that I almost always buy one for every project (even hacks) these days, partially just to isolate potential XSS issues.

I didn't mean to imply anything disparaging towards you, this kind of annoying stuff pops up even at Google. It's so easy to miss a spot, especially on quick hacks.

Thanks for creating that site, it's an awesome contribution.

Post reply on HN