InformAction Forums

NoScripters and WebSec nerds of all lands, unite!
https://forums.informaction.com/

[RESOLVED] Turning off anti-XSS for specific WEB page

https://forums.informaction.com/viewtopic.php?t=3874

Page 1 of 1

[RESOLVED] Turning off anti-XSS for specific WEB page

Posted: Wed Feb 17, 2010 7:41 pm
by Patrusa
I am not a computer geek and I would like to turn anti-XSS protection off for the following WEB page:
https://wedc.lotus.com

Can anyone give me the syntax to enter this on the NoScript XSS Options tab?

Thanks

Re: Turning off anti-XSS for specific WEB page

Posted: Wed Feb 17, 2010 8:31 pm
by Giorgio Maone
Probably

Code: Select all

^https://wedc\.lotus\.com/
However a more precise answer can be given if you show me the [NoScript XSS] message that should appear in Tools|Error Console when the XSS warning is issued.

Re: Turning off anti-XSS for specific WEB page

Posted: Thu Feb 18, 2010 9:47 pm
by Patrusa
I cleared the error console and then tried the access. The results are below:

Code: Select all

[NoScript XSS] Sanitized suspicious request. Original URL [https://www.conferenceservers.com/register/api/main.asp?xml=%3CWDAPI++ver%3D%271.1%27+type%3D%27call%27+name%3D%27startSession%27+utc%3D%271266529497000%27%3E%3CPARAMETERS%3E%3CSUBSCRIBER+svc-prov%3D%27IBM%27+subscriber-id%3D%27462427%27+passcode%3D%272957527%27+autoprovision%3D%27false%27+billing-type%3D%27m%27+info1%3D%271%27+info2%3D%272%27+port-number%3D%27999%27+accelerated%3D%27false%27+%2F%3E%3CPARTICIPANT+name%3D%27Patrick+Rausch+%28IBM%29%27+e-mail+%3D%27patr%40us.ibm.com%27+company%3D%27IBM%27+same-win%3D%27false%27+%2F%3E%3CBRAND+name%3D%27MEETINGPROINTERNAL_EN-US%27+%3E%3Cadvertisementlurl+override%3D%22true%22%3Ehttps%3A%2F%2Fwedc.lotus.com%2Fmeeting%2FWelcome%3FOpenForm%3C%2Fadvertisementlurl%3E%3Cjoinpageurl+override%3D%22true%22%3Ehttps%3A%2F%2Fhttp%3A%2F%2Fwedc.lotus.com%2Fmeetings%2Fjoin%3C%2Fjoinpageurl%3E%3Cenableinvitelink+override%3D%22false%22%3Eundefined%3C%2Fenableinvitelink%3E%3C%2FBRAND%3E%3CSESSION+reportemail%3D%27patr%40us.ibm.com%27+sendreport%3D%27false%27+redirect%3D%27true%27+nonapi-join%3D%27false%27+api-sourceid%3D%271am%21BM%27+ppm%3D%27%27+pwdcheckbox%3D%27false%27+%2F%3E%3CVAPI+%2F%3E%3C%2FPARAMETERS%3E%3CCHECK+subscriber%3D%271a759fb52ec90fb04404f2cc2d467d2e%27+participant%3D%2711c4212207b736965aa3fca2da1aeafa%27+brand%3D%2753254f1d18700c7f3eb9cd0730780d7c%27+session%3D%276e10d2de7d2969e3de26d0fc15c9e5ca%27+vapi%3D%276fdc27c07bf7ab4c12cb70362101e802%27+%2F%3E%3C%2FWDAPI%3E] requested from [https://wedc.lotus.com/u_dir/unyte.nsf/DAC?OpenForm&Seq=1&schedid=2957527]. Sanitized URL: [https://www.conferenceservers.com/register/api/main.asp?xml=%20WDAPI+ver%20%201.1%20+type%20%20call%20+NAME%20%20startSession%20+utc%20%201266529497000%20%3E%20PARAMETERS%3E%20SUBSCRIBER+svc-prov%20%20IBM%20+subscriber-id%20%20462427%20+passcode%20%202957527%20+autoprovision%20%20false%20+billing-type%20%20m%20+info1%20%201%20+info2%20%202%20+port-number%20%20999%20+accelerated%20%20false%20+/%3E%20PARTICIPANT+NAME%20%20Patrick+Rausch+%20IBM%20%20+e-mail+%20%20patr@us.ibm.com%20+company%20%20IBM%20+same-win%20%20false%20+/%3E%20BRAND+NAME%20%20MEETINGPROINTERNAL_EN-US%20+%3E%20advertisementlurl+override%20%20true%20%3Ehttps%3A//wedc.lotus.com/meeting/Welcome%3FOpenForm%3C/advertisementlurl%3E%20joinpageurl+override%20%20true%20%3Ehttps%3A//http%3A//wedc.lotus.com/meetings/join%3C/joinpageurl%3E%20enableinvitelink+override%20%20false%20%3Eundefined%3C/enableinvitelink%3E%3C/BRAND%3E%20SESSION+reportemail%20%20patr@us.ibm.com%20+sendreport%20%20false%20+redirect%20%20true%20+nonapi-join%20%20false%20+api-sourceid%20%201am%21BM%20+ppm%20%20%20+pwdcheckbox%20%20false%20+/%3E%20VAPI+/%3E%3C/PARAMETERS%3E%20CHECK+subscriber%20%201a759fb52ec90fb04404f2cc2d467d2e%20+participant%20%2011c4212207b736965aa3fca2da1aeafa%20+brand%20%2053254f1d18700c7f3eb9cd0730780d7c%20+session%20%206e10d2de7d2969e3de26d0fc15c9e5ca%20+vapi%20%206fdc27c07bf7ab4c12cb70362101e802%20+/%3E%3C/WDAPI%3E#03530132750771953978].

Re: Turning off anti-XSS for specific WEB page

Posted: Thu Feb 18, 2010 9:51 pm
by Giorgio Maone

Code: Select all

^https://www\.conferenceservers\.com/register/api/main\.asp\?xml=

Re: Turning off anti-XSS for specific WEB page

Posted: Fri Feb 19, 2010 11:09 pm
by Patrusa
Looks like it works. Thanks Giorgio.
All times are UTC
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited