SecurityRatty :: tag: html
Featured Articles :: The Extended HTML Form Attack Revisited :: Compromised Web Servers Serving Fake Flash Players :: Google Spamming Us :: The DDoS Attack Against CNN.com :: Automating web application security testing :: The top 10 spam characteristics (#1-5) :: RBN's Phishing Activities :: The top 10 spam characteristics (#6-10) :: A Localized Bankers Malware Campaign :: July 2007 - Operating System Vulnerability Scorecard
HTML forms are one of the features in HTTP that allows users to send data to HTTP servers. An often overlooked feature is that due to the nature of HTTP, the web browser has no way of identifying betw
...html file, where an IFRAME attempts to access the traffic management command and control, in a random URL it was 207.10.234.217/cgi-bin/index.cgi?user200 . A sample list of participating URLs, most of which are still active and running
joseantoniobaltanas .com automoviliaria .es/hotnews.html
risasnc .it/fresh.html
carpe-diem...
...html
Not too bad for a robot. How about some totally innane Apache directory structure stuff that couldnt possibly work
66.249.73.40 - - [26/Nov/2007:00:46:03 +0000] GET /bluehat-spring-2007/?C=S;O=A HTTP/1.1 200 3681 - Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html
Someone needs to figure out how UTF-7 works...
...HTML document, the appropriate sanitization depends on the specific context in which the data is inserted into the HTML document. The context could be in the regular HTML body, tag attributes, URL attributes, URL query string attributes, style attributes, inside JavaScript, HTTP response headers, etc
The following are some (by no means...
...HTML body : HTML messages usually include a plain text version of the email so that recipients with email clients that cannot read HTML can still view the message in plain text. However, many spammers tend to send HTML messages without this plain text body part. This is done to save on size and to force recipients to read the HTML version...
...HTML exists : Some spam messages include a code for identification in the text of the message. The text is entered outside the HTML tags so as to hide the code from the recipient. There is no legitimate reason to add text outside HTML tags, so the mere presence of illegal HTML can be treated as suspicious
9. Message body contains small font...