The CIA Freedom of Information website had the dumbest security hole in it. With all the recent hoo har about the “Family Jewels” documents, you’d expect they’d do a quick once over on this stuff. All the textual content on the document view pages is generated directly from variables passed in the url – with no input validation.
This opens them up to cross site scripting attacks (XSS) and really is just stupid. Lucky they aren’t the GUARDIANS OF THE LARGEST CACHE OF SENSITIVE INFORMATION IN THE WORLD or anything – *phew*.
Anyway, using this bug, I made a website where you can write your own documents and publish them on the CIA FOIA website:
I guess that from tomorrow, any mail for me should be addressed to Guantanamo Bay.
Actually, technically you’re the ones doing the exploiting by using the links my site provides – so, you know, at your own risk and all that.
Pingback: Spook Links - The Ultimate Black Hat Link Building Technique ::
It’s broken. (Thank goodness the ***GUARDIANS OF THE LARGEST CACHE OF EXTREMELY SENSITIVE INFORMATION IN THE FREE WORLD*** fixed that simple exploit.)