passbe/beef-migration-test-3 — Issue #463: <xssrays> Add PoC for POST parameters injection 
Author: passbe
Created: 2011-12-09 01:07:38+00:00
State: open

Right now the PoC for POST parameter injection (when a form is created inside the injected iFrame) is "something".

The PoC constructed in this way:
poc = vector.input.replace(/XSS/g, "alert(1)");

Should be properly escaped when dealing with forms, otherwise
the PoC code will also be executed, or will throw errors
that will prevent the whole vector to work as excepted.
Google Code Issue: http://code.google.com/p/beef/issues/detail?id=427