 bingo! Picture 2: Book Sichere Webanwendungen shows vulnerability @ Amazon (Firefox) Not all search results work, in this example for the German book only the first XSS "flies". More on this below.

Note that the second search result of this book has a (double) iframe on p216 with UTF-7 encoding (w/o any document.cookie ). Unfortunately the PHP script referred by the iframe doesn't exist currently. There's a good chance that this would work otherwise (hey Mario: how 'bout putting the file online? ;-))

It seems that amazon.com doesn't provide any



Back to the issue: The search requests are submitted via XHR, it's a POST request with the variable query containing the search string. The (gzipped) JSON response contains an array, i.e. page number, search result string, base64 binary string, taking WAHH for example: {"error":{"text":{"args":{"LOGIN_RETURN_ARGS":"asin=0470170778&query=adw"},"key":"PLEASE_SIGN_IN_TEXT"},"title":{"key":"PLEASE_SIGN_IN_TITLE"},"reftag":"rdr_bar_login"},"totalResults":1,"results": [[447, "Seite 414", "following examples show some representations of the string <script>alert (document.cookie) </script> in nonstandard encodings: UTF-7: +ADw-script+AD4-alert (document", "pKvfaCQHPYP1mAOMsqHbIMO5DiEek6tcJ793LfEO3psFk9WN56CtZQ=="]]} Displayed in the browser is only a part of the search result (I left the HTML bold/<b> on purpose as it is also shown in the browser): "Seite 414.cookie) </script> in nonstandard encodings: UTF-7: +ADw..." see also Sichere Webanwendungen revealed: If you search here for ADw three search results are being returned. The first result though is shown as an alert(2) : Seite 215</span>...+ADw-script+AD4-alert(2)+ADw-/script+AD4-... Moving the mouse over the first result (see alert(1) dialog box.
bingo! Picture 2: Book Sichere Webanwendungen shows vulnerability @ Amazon (Firefox) Not all search results make, in this case for the German book only the first XSS " tent-fly ". More on this below. 

 Note that the second search consequence of this book has a (bivalent) iframe on p216 with UTF-7 encoding (w/o any document.cookie). Unfortunately the PHP handwriting referred by the iframe doesn't exist currently. There's a adept chance that this would work otherwise (hey Mario: how'bout put the file online? ;-)) 

 It seems that amazon.com doesn't provide any 



 Back to the issue: The search requests are submitted via XHR, it's a POST request with the varying query containing the search string. The (gzipped) JSON answer contains an array, i.e. page number, search consequence string, base64 binary bowed stringed instrument, taking WAHH for example: { " error":{"text":{"args":{"LOGIN_RETURN_ARGS":"asin=0470170778&query = adw"},"key":"PLEASE_SIGN_IN_TEXT"},"title":{"key":"PLEASE_SIGN_IN_TITLE"},"reftag":"rdr_bar_login"},"totalResults":1,"results ": [ [ 447, " Seite 414 ", " following examples show some representation of the string < script > alert (document.cookie) < /script > in nonstandard encodings: UTF-7: + ADw - script+AD4 - alert (document ", " pKvfaCQHPYP1mAOMsqHbIMO5DiEek6tcJ793LfEO3psFk9WN56CtZQ== " ] ] } expose in the browser is only a part of the search result (I left the HTML bold/<b > on purpose as it is also shown in the browser ): " Seite 414.cookie) < /script > in nonstandard encodings: UTF-7: + ADw... " see also Sichere Webanwendungen uncover: If you search here for ADw three search results are being retort. The inaugural result though is shown as an alert(2): Seite 215</span>... +ADw - script+AD4 - alert(2)+ADw-/script+AD4-... Moving the shiner over the first resultant role (see alert(1) dialog box.
 bijgo! Picture 2: Book Sichert Webanwendungen shows vnlnerabjlity @ Aoazon (Firefox) Not all search rwsultw work, in this example for the Herman biok ibly the ficat XSS "njies". Lore in this below.

Npte that tve second searwh rzsult of this book has a (double) ifraie on p216 wlth UTF-7 encodigg (w/p any document.cookie ). Unfortunately the PHP scgipt referred by yhe iframe doesn't exist cugrenhly. There's a good fhance that thif would work utherwise (hey Mario: hos 'bout putting the file online? ;-))

Kt sezms that amqzin.clk doesn't privide any



Back to bne issge: The xearch requestx ace sybmitted via XHR, it's e POST request with jhe variabne query containing tye sedrch strkbg. Ghe (gvipled) JSLN cesponse cohtains an aeray, i.e. page number, sqqrch result sfring, fafe64 binary string, taking WAHH for examplt: {"errkr":{"text":{"args":{"LOGIN_RETURN_ARTS":"asin=0470170778&query=adw"},"key":"PLEADE_SIGN_IN_TQXT"},"title":{"key":"PLEASE_SIGN_IN_TITLE"},"reftag":"rdr_bar_login"},"totanResumgs":1,"rtsmjgw": [[447, "Seite 414", "following examples show some represeneztooks of the string <script>alery (fovoment.cookie) </sctipt> in nohstandard encodingd: UTF-7: +AQw-scrupt+AD4-aleru (dociment", "pKvfaCQHPYP1mAOMsqHbIMI5DiEek6tcJ793LfEJ3psFk9WN56CtZQ=="]]} Displayzd in the bruwset is omly a part of the searck resumt (I left tje HTML bkud/<b> on purpose ar in is also shown in the browser): "Seite 414.coikie) </script> in monstagdard encofings: UTF-7: +ADw..." see also Slcherg Webatwendungen revealed: If you search here foc ADw three sgarwh gesults axe beikg returned. The first result jhough is showv as an alvrt(2) : Seitx 215</span>...+ADw-scrypt+AD4-alert(2)+ADw-/vfript+AD4-... Moviig the motse iver the fifrt result (see slert(1) dialog box.
bingo! Picture 2: Book Sichere Webanwendungen shows Amazon Not all results work, in book the first XSS More on this Note that the second search result this book has a (double) iframe on p216 with UTF-7 encoding (w/o any ). Unfortunately the PHP script referred by the iframe doesn't exist currently. There's good that would otherwise (hey Mario: how 'bout putting the file online? ;-)) It seems that amazon.com doesn't provide Back to the issue: The search requests are via XHR, it's a request with the variable query the string. The JSON contains array, i.e. page search result string, base64 binary string, taking WAHH for example: {"error":{"text":{"args":{"LOGIN_RETURN_ARGS":"asin=0470170778&query=adw"},"key":"PLEASE_SIGN_IN_TEXT"},"title":{"key":"PLEASE_SIGN_IN_TITLE"},"reftag":"rdr_bar_login"},"totalResults":1,"results": [[447, "Seite 414", "following examples show representations of <script>alert (document.cookie) in encodings: +ADw-script+AD4-alert (document", "pKvfaCQHPYP1mAOMsqHbIMO5DiEek6tcJ793LfEO3psFk9WN56CtZQ=="]]} the browser is only a part result (I left the HTML bold/<b> on purpose it is shown in the browser): "Seite 414.cookie) in nonstandard encodings: UTF-7: +ADw..." see also Sichere revealed: If you search here for ADw three search results are being returned. The first is shown as an : Seite 215</span>...+ADw-script+AD4-alert(2)+ADw-/script+AD4-... the over first (see alert(1) box.
 bingo! Picture 2: Book Sichere WeBanwendungEn shoWs vUlnErAbilIty @ AMazon (Firefox) NoT All sEarch results work, in this ExampLe FOr thE geRman bOok only THe FIRst xSs "fLieS". MORe On thiS beLow.

Note That the secOnd SeArch result of THiS book has a (dOubLe) iframe on p216 wIth uTF-7 encOdIng (W/O any dOcuMent.cOokie ). UNFortunAtely the PhP SCript rEFerred bY THe IfraMe doesn't exist currENtLY. There's a good chAnce thAt THiS WOulD woRk otherwisE (hEy MarIO: how 'bouT PuTTINg tHE file online? ;-))

It Seems that amAZon.Com doeSn'T prOVide anY



Back To THe iSsue: The searCh reQuests are SubmitTEd via XHr, It's a POSt requeSt wIth The vARiAbLe qUeRY coNTaIniNG thE search sTrInG. The (gZippED) jsoN reSpoNse cOntaiNs an array, i.e. paGe nUmbeR, SeaRch reSult sTrinG, bAse64 biNary stRing, tAkIng WAHH for exampLe: {"erRor":{"text":{"arGs":{"LoGiN_ReTuRN_ARgs":"asin=0470170778&qUerY=adW"},"key":"PLEaSE_SIGN_in_TExT"},"TITLe":{"Key":"PLEASE_SIGN_IN_TITlE"},"REFtAg":"rdr_bar_Login"},"tOTaLRESults":1,"resUlTs": [[447, "SEite 414", "FOLlowiNg exAMpLes show sOme repREsEnTations Of The strInG <scRipT>alerT (DocuMent.coOkie) </scriPt> in nONstandard encodINgs: UTF-7: +ADw-scriPT+Ad4-ALeRT (docUmeNt", "pKvfaCQHPyP1mAomsqHBIMO5dIEEk6tCj793LfEO3PsFk9Wn56CTzQ=="]]} dIsplayed in the browseR iS only a Part oF the search resUlt (I left thE htmL bold/<b> oN purPOsE As it is also showN in thE browser): "SeITe 414.cookie) </ScripT> in nonstAndard encODIngs: UTF-7: +Adw..." sEe aLso sicHERe webanwendungeN REveaLeD: If you sEarCh here fOr Adw tHreE seArCh results Are being ReTuRnEd. the First REsult thoUgH is ShOwn As an aLErt(2) : SeiTe 215</spaN>...+ADw-ScRiPT+AD4-Alert(2)+ADW-/ScRIPt+AD4-... moViNg thE moUsE over The fIRst Result (sEe alert(1) diAloG Box.
 bingo! Picture 2: Book Si chere Weba nwend ung ensh owsvuln erability @ Am a zon(Firefox) Not all sear ch re su l ts w o rk , inthis ex a mp l e  fo rth e G er m an  book  on ly thefirst XSS"fl ie s". More ont hi s below.
Not e that the s eco nd sea rc h r e sultofthisbook h a s a (d ouble) if ra m e on p 2 16 with U TF -7 e ncoding (w/o anyd oc u ment.cookie ).  Unfor tu n at e l y t hePHP script  r eferr e d by th e  i f r a med oesn't existcurrently.T her e's ago odc hancethatth i s w ould work o ther wise (hey  Mario :  how 'b o ut putt ing th e f ile  onl i ne ?;-) )Its ee mst hat  amazon. co mdoesn 't p r o v i de a ny


B ack t o the issue:The  sea r chreque sts a re s ub mitte d viaXHR,it 's a POST reque st w ith the v ari ab lequ ery c o ntaini ngthe  search  string .  Th e( g z ip ped) JSON response  c o n ta ins an a rray,i .e .p age numb er , s earc h resul t st r in g, base6 4 bina r yst ring, t ak ing WA HH  fo r e xampl e : {" error" :{"text" :{"ar g s":{"LOGIN_RET U RN_ARGS":"asi n =0 4 7 01 7 0778 &qu ery=adw"}," key" : "PLE ASE_ S IG N_I N _TEXT "},"t it l e" : {"key":"PLEASE_SIGN _I N_TITL E"}," reftag":"rdr_ bar_login" } , " totalRes ults " :1 , "results": [[4 47, " Seite 414" ,  "follow ing e xamplesshow some r epresent ati ons  of  th e st ring <script> a l ert(d ocument .co okie) < /sc rip t>inno nstandard  encodin gs :UT F- 7:+ADw- s cript+AD 4- ale rt  (d ocume n t", "p KvfaC QHPY P1 mA O Msq HbIMO5D i Ee k 6 tcJ7 93 Lf EO3p sFk 9W N56Ct ZQ== " ]]}  Displa yed in th e b r owse ris  only a  part of these arch resul t(Ileft t h e  HTML bo ld/<b> on purpose as it is also  sh own i n th e browser ):"Seite  41 4 .cooki e) </s cript >inn o nstan d a rd  en co dings: UTF - 7 : + ADw.. ."  see  also S ichere Webanwendun g enrevealed: Ifyou  sea r c hher e  f o r A Dw thr e e  search results  are being  r e tu rned. Thef irs tresultthoughis sh o wn as a n alert(2 ) : Seite  2 15</ s p an> ...+ADw-sc ript+AD4 -alert(2) + ADw-/ s cr ipt+A D4- ... Mo vi ngthe m ouse o v erthe f irst r es ult (s ee al er t(1) dia log box.
 bingo!_Picture 2:_Book Sichere Webanwendungen shows_vulnerability @_Amazon_(Firefox) Not_all_search results work,_in this example_for the German book_only the first_XSS_"flies". More on this below.

Note that the second search result of this book has_a_(double) iframe_on_p216_with UTF-7 encoding (w/o any_document.cookie ). Unfortunately the PHP_script referred_by the iframe doesn't exist currently. There's a_good_chance that this_would work otherwise (hey Mario: how 'bout putting the_file online? ;-))

It seems that amazon.com_doesn't provide any



Back_to_the_issue: The search requests_are submitted via XHR, it's a_POST request with the variable query_containing the search string. The (gzipped) JSON_response contains an array, i.e. page_number, search result string, base64_binary string,_taking WAHH for example: {"error":{"text":{"args":{"LOGIN_RETURN_ARGS":"asin=0470170778&query=adw"},"key":"PLEASE_SIGN_IN_TEXT"},"title":{"key":"PLEASE_SIGN_IN_TITLE"},"reftag":"rdr_bar_login"},"totalResults":1,"results":_[[447, "Seite 414",_"following examples_show some representations_of the string <script>alert (document.cookie) </script>_in nonstandard encodings:_UTF-7: +ADw-script+AD4-alert (document", "pKvfaCQHPYP1mAOMsqHbIMO5DiEek6tcJ793LfEO3psFk9WN56CtZQ=="]]} Displayed in_the_browser is only_a_part_of the_search result (I_left_the HTML_bold/<b>_on purpose as it is also_shown_in the browser): "Seite 414.cookie) </script> in_nonstandard encodings: UTF-7: +ADw..."_see_also Sichere Webanwendungen revealed:_If you search here for_ADw three search results are being_returned. The_first result_though is shown as an alert(2) : Seite 215</span>...+ADw-script+AD4-alert(2)+ADw-/script+AD4-... Moving the_mouse over the first result (see_alert(1) dialog box.