Feed Injection in Web 2.0

Short Description
One new feature of “Web 2.0″, the movement to build a more responsive …. Feed Injection in Web 2.0. If you are familiar with Cross-Site Scripting attacks …

Website: www.spidynamics.com | Filesize: 277kb

Content
Start Secure. Stay Secure..
Feed Injection in Web 2.0
Hacking RSS and Atom Feed Implementations
By Robert Auger, SPI LabsStart Secure. Stay Secure..
. 2006 SPI Dynamics, Inc. All Rights Reserved.
No reproduction or redistribution without written permission.
ii
Feed Injection in Web 2.0
Table of Contents
INTRODUCTION……………………………………………………………………… 3
WEB FEEDS AS ATTACK VECTORS ……………………………………………… 4
Readers treating <> as literals ………………………………………………………… 4
Readers converting the HTML entities to their true values………………………… 5
Readers stripping out < > < and > during display …………………………… 6
RISKS BY ZONE ……………………………………………………………………… 7
Remote Zone Risks ………………………………………………………………………. 7
Local Zone Risks …………………………………………………………………………. 8
READER TYPE-SPECIFIC RISKS……………………………………………….. 11
Web Reader Risks………………………………………………………………………..11
Web Site Risks ……………………………………………………………………………11
USING A FEED AS A DEPLOYMENT VECTOR……………………………….. 12
How Does One Utilize a Web Feed Vulnerability? …………………………………..12
RISKS BY STANDARD…………………………………………………………….. 13
RSS…………………………………………………………………………………………13
Atom ……………………………………………………………………………………….13
CONCLUSION……………………………………………………………………….. 14
REFERENCES AND ADDITIONAL READING ………………………………… 16
ABOUT SPI LABS…………………………………………………………………… 18
ABOUT S.P.I. DYNAMICS INCORPORATED ………………………………… 19…