Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Re: Microsoft ISA Server HTTP error handler XSS (TL#007)
Date: Thu Jul 17 2003 - 18:05:38 CDT
This is very interesting. A side 'benefit' is that we can mask our
true url with the same scheme.
For an href in html in order to mask the true destination the <a
href="....>bloatedcorp.com</a>, can be manipulated by trivial
fool our recipient should they 'hover' the mouse over the link.
This can be defeated quite simply like so:
In an html mail message [default in Outlook Express] plus restricted
zone in Outlook Express 6 [again default] where no scripting is
allowed, the above link when presented to the recipient in an html
email message, and tested by 'hovering' the mouse over it, yields
nothing. Blank. Thereafter accepting the url, transports us to our
site as required.