Re: Help with referer issues in XSS

If you are using firefox you have addons that let you specify whatever you
want in the referer field.

referer
https://addons.mozilla.org/en-US/firefox/addon/refcontrol/
or other header fields
https://addons.mozilla.org/en-US/firefox/addon/header-tool/


2012/3/2 Yuping Li <[email protected]>

> Hi, all
>
> Suppose there is a reflect XSS vulnerability in a pop SNS, but this
> site is "concerned" about security, so they check the referer field of
> certain POST request to make sure that they are normal and correct. Is
> it possible for me to bypass this check within javascript? It seems
> that I can't set this parameter like this:
>
> xmlHttp.setRequestHeader("Referer","http://expected.target");
>
> It would be appreciated if someone can give me a clue.
>
> Regards,
>
>
>
> This list is sponsored by Cenzic
> --------------------------------------
> Let Us Hack You. Before Hackers Do!
> It's Finally Here - The Cenzic Website HealthCheck. FREE.
> Request Yours Now!
> http://www.cenzic.com/2009HClaunch_Securityfocus
> --------------------------------------
>
>

_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

[email protected]
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org