anyone with a fully patched IE6..
 

.. does either of theese 2 links popup a cmd.exe window for you? Absolutely harmless test.

http://www.signupsluts.com/ie.html

http://www.signupsluts.com/ie2.html

2nd one popped up a window "attempting injection"

first one loaded without problems, second one, same popup asPussyMan

Where are you testing it for?

The first one is trying to use an exploit.

ditto

:thumbsup Mozilla Firefox

nah doesn't run it

ok, that wasn't it though. It tries to execute "cmd.exe /c pause".

Testing for this but didn't get it to work:

http://seclists.org/lists/bugtraq/2004/Jul/0026.html

2nd window: INJECTED

wtf are you doing to my browser :feels-hot

That's just a normal java-scri-pt popup ... the exploit test is totally harmless + didn't even seem to work.

Apparently there's a way to bypass the latest IE securitypatch by using Shell.Application instead of ADODB.Stream (which the latest patch disabled).

No. it's not. The last patch I downloaded was 2 hours ago, my browser blocks both pages you submitted.

Read my posts better. You're talking about the ADODB.Stream patch correct? Im talking about a possibility to bypass it, was mentioned on bugtraq. But didn't work for me and nobody else so looks like false alarm atm. Or if I got the exploit test wrong somehow.

WTF ????
:feels-hot :mad: :feels-hot




























I got 20 Dollars bills coming out of my printer now !! :1orglaugh

wooohooo, I deserve 50%!

In the last couple of weeks I have seen a lot of submissions to my TGP with that injection code in it. I don't know what the hell whoever is submitting it is thinking like they'd get approved with that kind of bullshit.