Hacker News Reader

Comment by apostacy | Hacker News Reader

Myspace was an XSS playground. You could embed javascript into anyone's profile, by leaving a flash applet (or for that matter a java applet) in a comment, and having it do an openurl to a javascript: url, which would execute in the context of the user viewing it.

I had fun replacing people's profile pictures after the page loaded, or stopping all of that annoying background music.

It was also possible to capture someone's document.cookie, as late as 2008.

Good times...

View on HN

A Norwegian social site back in the days called Nettby ("net-city") also allowed some html, but did it by just removing unallowed tags. I realised I could write <scr<script>ipt>, and after it did the removal of the first script tag I still had one.

This trick still works on surprisingly many sites. Allowing custom html is hard, so think long before rolling your own.

a good content security policy goes a very long way towards allowing workable custom html

Honestly if it's comments, just use Markdown or something. No reason for your users to have access to HTML.

You might not realise it, but the average markdown spec allows embedding html as well.

And then this happens: https://github.com/ChALkeR/notes/blob/master/Improper-markup...

I think it's funny that JIRA knows how to prioritize the best of all the list.

I'm hoping that was sarcasm...?

This was a fantastic read. For anyone else wondering: "TBA" is an abbreviation for "to be announced".

When you find a site that does this, throw up their login box and the user is looking at a seemingly legit login box genuine hosted by the target site, security certificate and all!

And if you are going to roll your own, whitelist, don't blacklist. And not just tags, but attributes, CSS rules etc., as well as text content (including escaping)

Of course, doing that will quickly tell you why you'd probably want to not roll your own...

I have rolled my own, twice, back in the day (once for the webmail service Nameplanet which started life in Oslo), and it was an ongoing pain of having to argue with people over why X or Y was filtered out because they didn't realise how it could be abused.

I really don't want to ever do that again.

Once in 2008-2009 I accidentally found CSRF on vkontakte.ru (now vk.com, now it's very popular social network). I created post on Livejournal with image that loaded from my server, responding with redirect to CSRF URL that posted random phrase from logged in user to single discussion thread. It looked like hundreds of people doing dadaist discussion.

"Samy" was the canonical example of that in action:

http://samy.pl/popular/tech.html

As I remember, it was being exploited for styling pages. When I registered there, I wondered how everyone change backgrounds and fonts on their pages (usually with quite insane look), and then found a post how to do it: add <style> tag to one of profile fields.

Myspace was a malware playground. Stuff like Apple QuickTime didn't have a decent updater back then, so it was script-kiddy galore. End of the line for the anything-goes web.

there was a fairly popular service called spyspace that let myspace users track their visitors using similar methods.

Reply on news.ycombinator.com