Apple.com XSS
Post moved here: http://intrepidusgroup.com/insight/2008/05/applecom-xss/
-
January 16"You'll see the typical security geek saying, 'People are dumb, people are stupid, they're never going to be trained,'." said Rohyt Belani, PhishMe co-founder and CEO. "We have statistics to prove otherwise."
4. Here is the kinda far fetched part: you need to hope/pray/socially engineer/somehow get the victim to go through the password change process, and authenticate.
I dont think that this is all that far fetched. I know I for one would be concerned to see a password reset email when I know I didn't request that, but I know lots of people that wouldn't. Also, as you need to go through this process to access the site, it's very likely that someone would go through the process anyway (maybe resetting back to their original password) while they remember to do it.
What would interest me is not browser ownership via XSS, but if the login/session was for developer.apple.com, or *.apple.com (as G does). That would be a nice vector for CSRF, which with XSS most current mitigation techniques are useless
TAMPERING WITH THE URL……
THIS IS COOL!