Meta-Information XSS

In his article "Introducing Meta-Information XSS", Tyler Reguly describes a method of XSS attack by proxy.

The jist of it is, that most people trust the data returned from sources like ARIN.NET. The problem is that services like whois on ARIN may not filter the data that they retrieved on your behalf, thus possibly forwarding malicious content on to you.

To read about his investigation into the matter, read his blog post and follow the links to his white paper and presentation.


http://blog.ncircle.com/blogs/vert/archives/2010/04/introducing_metainformation_xs.html