He now says he didn’t realise that Companies House was actually vulnerable to the extremely simple technique he used, known as “cross-site scripting”, which allows an attacker to run code from one website on another.
The original name of the company was ““><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD”. By beginning the name with a quotation mark and chevron, any site which failed to properly handle the HTML code would have mistakenly thought the company name was blank, and then loaded and executed a script from the site XSS Hunter, which helps developers find cross-site scripting errors.
That script would have simply put up a harmless alert – but it serves as proof that a malicious attacker could instead have used the same weakness as a gateway to more damaging ends.
we can call angle brackets chevrons? open chevron close chevron?
less than chevron, greater than chevron?
Previous company names: [NAME AVAILABLE ON REQUEST FROM COMPANIES HOUSE]
Dr Michael Tandy, you have my admiration and respect.
I like how the article attributes the xkcd comic with inspiring SQL injection, as if it wasn't already a known attack vector.
how many first names does this guy have
EDIT: also i really want to know what the isComputer function does
Without being able to see the rest of the line, my guess is that they forgot a semicolon or something. You can see that document also isn't highlighted properly.
My guess is that it's a stock photo that a non-coding designer created by cut-and-pasting some code.