bugtraq August 2007 archive
Main Archive Page > Month Archives  > bugtraq archives
bugtraq: Re: security contact for uat.edu needed

Re: security contact for uat.edu needed

From: Hans Wolters <hans.wolters_at_nospam>
Date: Thu Aug 02 2007 - 22:00:36 GMT
To: bugtraq@securityfocus.com

On 31-jul-2007, at 0:42, Hans Wolters wrote:

> Hi there,
>
> Anyone that knows how to contact responsible persons at uat.edu?
> root@ and security@ do not seem to work.
>

Thanks all for your suggestions. Current state:

abuse@ does not work and is listed in rfcignorant (since April this year).
noc@ seems to work but does not answer
whois contact person, seems to work but does not answer

Other addresses do seem to work but do not answer either.

Currently I can only announce the following. Uat runs a site called hackersdegree.com. This
is a site that allows persons to toy with a javascript shell. It's not a dangerous bug but it allows
people to insert XSS into it.

The bigger problem is that they are also providing a link to liverperson.net. The people coding
the site do not check any user input and therefor allow usernames with xss injected to. Let me
be clear, this is not to be blamed on liveperson.net, I have found other instances that will talk
to the liveperson.net robots that are not having these problems.

The XSS used is not a simple <script>alert(foo.bar) thingy, it's slightly more complicated.

If some of you are able to contact a whitehat over there then please let them contact me if
they need more information, I am not wasting money calling abroad for something that is not a problem for me. A university tricking students to graduate in security should be able to secure their own sites.

Best regards,

Hans