Comments (7)
This issue seems similar to Issue 18. There is already an action item to
address this.
Original comment by [email protected]
on 23 Jul 2011 at 1:47
- Changed state: Accepted
- Added labels: ****
- Removed labels: ****
from domsnitch.
Hi! Great tool you've released and thank you for the response in #18, great
info for those learning.
Original comment by [email protected]
on 23 Jul 2011 at 2:08
- Added labels: ****
- Removed labels: ****
from domsnitch.
Marking this as duplicate of Issue 18. Please follow/comment the issue there.
Original comment by [email protected]
on 1 Sep 2011 at 8:23
- Changed state: Duplicate
- Added labels: ****
- Removed labels: ****
from domsnitch.
Re-opening as separate bug to track.
Original comment by [email protected]
on 1 Sep 2011 at 4:28
- Changed state: Accepted
- Added labels: ****
- Removed labels: ****
from domsnitch.
Hi!
Thanks for reopening ticket!
Global URL = http://cloudscan.org
Offending JS = https://a12.alphagodaddy.com/hosting_ads/gd01.js
Issues by UA | Chrome DOMSnitch Report
==========================================
Loading of CSS from an untrusted origin
Loading of scripts from an untrusted origin
Issues by UA | DOMinator Report
==========================================
Sources of Tainted Input: location.toString | referer
Acunetix Web Vulnerability Scanner, August 2011 Build
==========================================
JS executes from document.location path part via innerHTML in
https://a12.alphagodaddy.com/hosting_ads/gd01.js at line 26,28.
Suggestion: Consider sighting the sources and sinks.. line numbers of offensive
code, and a complete stack trace for repro.. a la Acunetix or DOMinator
Question: Different results all around.. I'm asking if you can run thru the
Global.URL yourself and compare and contrast the output of DOMinator vs.
DOMSnitch vs. Acunetix.
Post your own results, and I'll do the same.. I think it will be a great
learning example for all, immho...
-D
Original comment by [email protected]
on 1 Sep 2011 at 5:41
- Added labels: ****
- Removed labels: ****
from domsnitch.
Hi!
Adding.. no output from stack trace in exported TXT File.. no trace in output...
-D
Original comment by [email protected]
on 6 Sep 2011 at 1:04
- Added labels: ****
- Removed labels: ****
from domsnitch.
Hi!
w/r/t reporting, suggest that .. Mixed content through the HREF attribute of a
LINK element ... be part of a weak programming skills / DORK Report ..
w/r/t reporting, suggest that .. Loading of scripts from an untrusted origin.
.. be part of a weak programming skills / DORK Report..
w/r/t parsing, when Referrer Data found with innerHTML, when matching on www,
my and other vhost name.. injection of fqdn.vhost.tld results are FP ..
(provided for those following the thread).. example .. referrer data set to
www.xss.cx or my.xss.cx etc.... FP
w/r/t parsing and malformed JSON, suggest that be included in weak programming
skills / DORK Report..
w/r/t Report Format Suggestions.. consider developing a target analysis file,
including sources, sinks, methods abused etc.... suggest include other output
from the Scope on Wiki or a pointer URL etc.. often we compare the intended
scope of DOMinator and DOMSnitch and then compare the results with our own
analysis and often see a wide disparity in results... having the sources,
sinks, methods abused etc.. with the stack trace can often help reducing FP, FN
etc..
I'll post a few comps in another comment using the webkit XSSAdmin scripts as
example.
-D
Original comment by [email protected]
on 6 Sep 2011 at 1:30
- Added labels: ****
- Removed labels: ****
from domsnitch.
Related Issues (20)
- Hyperlinks / Anchors Broken HOT 2
- Removing Domsnitch from Chrome HOT 2
- DIV style popups containing form elements disappear when the mouse focuses on the popup and form HOT 1
- DOM Snitch Javascript events from blocking default action (link rewriting, etc) HOT 3
- DOM Snitch immediately crashes on start/reload HOT 4
- DOM Snitch redirects to empty url when referring to anchor HOT 2
- $('#logo').fadeOut(500).fadeIn(200).fadeOut(200).fadeIn(200).fadeOut(200).fadeIn(200); HOT 2
- Failing to flag a simple source HOT 3
- [deleted issue]
- [deleted issue]
- Export Record - No Output Seen for txt/doc HOT 10
- DOM Based xss via Cookie isn't exploitable HOT 1
- DOM Snitch seems to call itslef Untrusted code HOT 3
- ASP.NET Webforms Quirk
- Domsnitch fails to load properly on Chrome version 23.
- <td><img src="img/spacer.gif" width="1" height="25" alt="" /></td>
- DOM Snitch Content Scripts Appear to Leak Memory
- DOM Snitch not stable with a number of commercial websites -- especially with frames
- ""><img src=x onerror=prompt(/x/);>>
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from domsnitch.