|Main Archive Page > Month Archives > bugtraq archives|
On 31-jul-2007, at 0:42, Hans Wolters wrote:
> Hi there,
> Anyone that knows how to contact responsible persons at uat.edu?
> root@ and security@ do not seem to work.
Thanks all for your suggestions. Current state:
abuse@ does not work and is listed in rfcignorant (since April this
noc@ seems to work but does not answer
whois contact person, seems to work but does not answer
Other addresses do seem to work but do not answer either.
Currently I can only announce the following. Uat runs a site called
people to insert XSS into it.
The bigger problem is that they are also providing a link to
liverperson.net. The people coding
the site do not check any user input and therefor allow usernames with xss injected to. Let me
be clear, this is not to be blamed on liveperson.net, I have found other instances that will talk
to the liveperson.net robots that are not having these problems.
The XSS used is not a simple <script>alert(foo.bar) thingy, it's slightly more complicated.
If some of you are able to contact a whitehat over there then please
let them contact me if
they need more information, I am not wasting money calling abroad for something that is not a problem for me. A university tricking students to graduate in security should be able to secure their own sites.