Zoiz Blog

Jeremiah Grossman the Chief Technology Officer of WhiteHat Security officially announce the Top 10 Web Hacks 2007 polls result(s). Here is the list(s):

1. XSS Vulnerabilities in Common Shockwave Flash Files
2. Universal XSS in Adobe’s Acrobat Reader Plug-in
3. Firefox’s JAR: Protocol Issue(s)
4. Cross Site Printing (Printer Spamming)
5. Hiding JavaScript in Valid Images
6. Firefoxurl URI Handler Flaw
7. Anti-DNS Pinning (DNS Rebinding)
8. Google Gmail – Email Hijack Technique
9. PDF XSS can Compromise Your Machine
10. Port Scanning without JavaScript

“From quite a lot of techniques listed on his blog XSS and it’s various (Such as Cross Site Printing) are still occupying several positions in the Top 10 rank for the most popular techniques – Even the best 2 positions. This will be a quite significant evidence that Cross Site Scripting (XSS) and it’s various CSRF (Cross Site Request Forgery) and Cross Site Printing (Probably abbreviated as XSP) are dangerous and can be found anywhere.” Th0R said.

XSS and / or CSRF are one of the the biggest security issue. But somehow, I don’t know why it’s OVERLOOK by most of Indonesian techies and security experts. As we can see on most forums, mailing lists, and other communities in Indonesia, they RARELY talk about XSS and CSRF. Pitty~