Dear MustLivee, M> Which is also M> available on English (http://securityvulns.ru/Udocument911.html). Refering to the above, could you briefly explain : ============== This attack works in Internet Explorer when option “Initialize and script ActiveX control not marked as safe” (for Local intranet) is turned on (Enabled or Prompt). It's such bug in hole of Microsoft :-) and it's method of bypassing of the bug. This setting is needed only during attack via this XSS, when JS code placed on the same line, where there is a comment. Because if it's on other line (i.e. without preceding comment), then code will work and without this setting (Disable). That can be achieved in case, when attack made not via XSS, but the attack code is placed (in appropriate way) directly in body of page. ============== Your saying above that this attack works if "Initialise and script ActiveX control not marked as safe" is ENABLED. Then you say that: "if it's on other line (i.e. without preceding comment), then code will work and without this setting (Disable)" My question is, if this attack works with disabling access to unsafe controls without "preceding comment", why use the preceding comment at all ? If I understood you correctly this only works if the page is saved to the harddisk and then run?. -- http://secdev.zoller.lu Thierry Zoller
