Twitter XSS PoC

A new bug (or really, a variation of the old one) has been found (x3)

5:12 PM PDT: Once again, the issue appears to be fixed, this time by taking the whole server down. I don't think that was the wrong choice. Until next time...

• This is a proof of concept, exploiting The Bug published to XSSed.org this morning (09/06/2010).
• This is a proof of concept, exploiting a variation on the one that was sent to XSSed and patched yesterday
• This is a proof of concept, exploiting a variation on a variation on the one that was sent to XSSed and patched yesterday
• This is not my bug, and I have no idea whether it was "responsibly" disclosed or not. It IS public, though.
• I wrote this proof of concept in less than 10 minutes. These things are ridiculously easy to attack
• While this demo requires interaction, it doesn't have to. The entire attack could just as easily be completely silent.
• It won't work if you're using NoScript, RequestPolicy, or other client-side protections.
• If you're not using such protections, why the hell not?
• While I'm not collecting any data other than session cookies, and I'm discarding them once I post a tweet from your account, I could do much more. Use at your own risk

--mckt