where can i find some good examples of distructive HTML�

much less heard of it?

HTML isn't destructive. HTML is a static scripting language, it doesn't do ANYTHING other than look pretty..

You're talking about dhtml, or java, or activex or any one of a lot of other things..

I'd suggest you learn HTML, and dynamic html, and you'll start to get a better picture of what you can do with what technologies.

yes, but what does it take to create a folder in my menu containing shortcuts to a website I visited? My Firewall didn�t get this ...

zok is refering to exploiting a bug in an html parser. By send it a string (typically a url) and having this exploit a know bug of some sort. I would answer his question but i do not know of such bugs.

I'm wondering where exactly you got that idea from...

who?

One of my friends claimed that using HTML on AIM he was able to create distructive scripts or somthing nonsensical like that. But what I do know is that someone at our school had made fun of him so he went home he made a script that in turn killed his printer, through AIM. to me that does not seem posible unless he was able to screw with the kids drivers. but still, using AIM?

[This message has been edited by Zok (edited 10-16-2001).]

Jaded, thats the only thing i think you would be able to exploit.

doh.. yeah you would think that.

except that url hacks that most commonly come in the form of overflows have absolutely nothing to do with HTML or anything else on web pages...

[This message has been edited by Jadedfool (edited 10-16-2001).]

Well, there are a number of URL issues. There are cross-site scripting vulnerabilities, there are overflows in parsers, and there are buffer overflows in servers (especially IIS servers). There are probably numerous other sploits that seem to be HTML related but honestly have nothing to do with it.

Regardless, this issue is about AIM which is a whole separate ball of earwax. AIM has a number of interesting way of doing things, and a whole lot of messy buffers that they don't seem to handle properly. I haven't actually come across anything that is exploitable in the current version of AIM but, if you trick someone into "Direct Connect" with you, then the ability to access their disk and do some serious damage is greatly increased. Of course, that's all dependent upon the stupidity of others, but I guess that's something you can count on these days.

Anyway, Zok - I think your friend is full of it or created something that wasn't really HTML and just doesn't understand what he or she was doing.

As far as im aware it seems that AIM uses html to format messages sent across it.

As for the rest i was just speculating.

AIM actually has it's own set of functions built into the interpreter that gives you stuff. Documented tags do stuff like adding people to buddy lists, or opening up an IM window to a specific person. However, you can bet that there's a whole bunch of undocumented tags out there, because thats generally how these kind of things work.

Theres info on an obselete buffer overflow here that should be fairly helpful in explaining the basic concept...

Um can somebody check this site for me i think it is doing something when you try to get on it or download from it I am not sure but i think it might actually be doing it the site is http://26a.5u.com/ tell me what it is doing.