7 msยท
That company whose name used to contain HTML script tags Ltd
- MonadIsPronad 6y agoNow _that_ is pretty funny. I wonder what the company name is. Even the PDF of the incorporation certificate doesn't show the name.
- klodolph 6y ago; DROP TABLE "COMPANIES";-- LTD (Yes, the description is inaccurate.) Edit: This is a different company, actually.
- MonadIsPronad 6y agoOutstanding. What a clever, cheeky fellow. Obligatory XKCD: https://xkcd.com/327/ https://xkcd.com/327/
- fennecfoxen 6y ago; DROP TABLE "COMPANIES";-- LTD is still live at https://find-and-update.company-information.service.gov.uk/company/10542519 https://find-and-update.company-information.service.gov.uk/c... See also "BETTS & TWINE LTD" https://find-and-update.company-information.service.gov.uk/company/11678385 https://find-and-update.company-information.service.gov.uk/c... SAFDASD & SFSAF \' SFDAASF\" LTD https://find-and-update.company-information.service.gov.uk/company/08804157 https://find-and-update.company-information.service.gov.uk/c...
- cwmma 6y ago\"><SCRIPT SRC=MJT.XSS.HT></SCRIPT> LTD
- tomcat27 6y agohahahahaahaha! is this some prank?
- deleted 6y ago[deleted]
- tshanmu 6y agoWould be it interesting to know why the name had to be changed?
- klodolph 6y agoBecause there are a bunch of companies which do aggregation of information about companies, and not all of them used parameterized SQL queries :-/
- fennecfoxen 6y agoThis is HTML injection, not SQL.
- klodolph 6y agoThatโs kind of a minor detail.
- NullPrefix 6y agoAnd who's problem is that?
- ceejayoz 6y agoOn a "what's reasonable" level, or on a "gets you called in by a minister or MP to be yelled at" level?
- ygjb 6y agoSolidarity to all of the folks who have had to work with elected officials. I got ripped a new one because I recommended we disable a PHP project in the mid-2000s because a hay bale reporting app (report counts of bay hales on farms) due to an RCE bug. Within a few hours of the app being disabled there was drama from a politician who got a phone call from a prominent farmer...
- 6y ago
- bearbin 6y agoRelevant context: https://twitter.com/zofrex/status/1319286955314614275 https://twitter.com/zofrex/status/1319286955314614275 Apparently the name used to be \"><SCRIPT SRC=MJT.XSS.HT></SCRIPT> LTD
- outsidetheparty 6y agohitting mjt.xss.ht returns this: /* THIS SUBDOMAIN HAS BEEN BANNED FROM THE XSS HUNTER SERVICE. WE DO NOT ALLOW ABUSE OF OUR SERVICE, ALL SECURITY TESTING MUST BE AUTHORIZED. Please use our contact form if you believe this ban was a mistake: https://xsshunter.com/contact https://xsshunter.com/contact */
- pushrax 6y agoIt previously returned an XSS test payload https://pbs.twimg.com/media/ElAYZTcX0AEyFUY?format=jpg&name=large https://pbs.twimg.com/media/ElAYZTcX0AEyFUY?format=jpg&name=...
- Sephr 6y agoThe character set used looks to be specifically authorized by law[1] so this doesn't appear to be unauthorized testing. 1. https://news.ycombinator.com/item?id=24921261 https://news.ycombinator.com/item?id=24921261
- lopmotr 6y agoBut not authorized by all the company register clone sites that would have triggered this. The service appears to be for testing your own site.
- achairapart 6y agoNew name is disappointing. The company should at least be renamed to: \"><SCRIPT SRC=MJT.XSS.HT></SCRIPT> LTD
- 6y ago
- kalium-xyz 6y agoThis is not a prank, its the new Companies house search which still contains some kinks and I assume they had to work around a very specific one here.
- ceejayoz 6y agoMy understanding is that the Companies House search is fine, but various third-party consumers of the list might not be.
- tim333 6y agoHere's an internet archive of the old name on one of those https://web.archive.org/web/20201022184617/https://suite.endole.co.uk/insight/company/12956509-script-src-https-mjt-xss-ht-script-ltd https://web.archive.org/web/20201022184617/https://suite.end...
- razster 6y agoI registered <b>Be</b> for a small company a long time ago. I thought it was clever. They folded during the tech bubble.
- 7952 6y agoBold bee?
- znpy 6y agoBe bold ?
- Wistar 6y agoBe Best
- surround 6y ago๐๐ฒ
- azinman2 6y agoIโve never seen bold in an HN comment before? How do you do it?
- deleted 6y ago[deleted]
- wccrawford 6y agoLooks like Unicode characters to me.
- roddds 6y ago๐๐ง๐ข๐๐จ๐๐ ๐ก๐๐ฌ ๐๐ก๐๐ซ๐๐๐ญ๐๐ซ๐ฌ ๐ญ๐ก๐๐ญ ๐ฅ๐จ๐จ๐ค ๐ฌ๐ข๐ฆ๐ข๐ฅ๐๐ซ ๐ญ๐จ ๐๐จ๐ซ๐ฆ๐๐ญ๐ญ๐๐ ๐ญ๐๐ฑ๐ญ. ๐จ๐ป๐ถ๐ฐ๐ผ๐ฑ๐ฒ ๐ต๐ฎ๐ ๐ฐ๐ต๐ฎ๐ฟ๐ฎ๐ฐ๐๐ฒ๐ฟ๐ ๐๐ต๐ฎ๐ ๐น๐ผ๐ผ๐ธ ๐๐ถ๐บ๐ถ๐น๐ฎ๐ฟ ๐๐ผ ๐ณ๐ผ๐ฟ๐บ๐ฎ๐๐๐ฒ๐ฑ ๐๐ฒ๐ ๐. ๐๐๐๐๐๐๐ โ๐๐ ๐โ๐๐๐๐๐ก๐๐๐ ๐กโ๐๐ก ๐๐๐๐ ๐ ๐๐๐๐๐๐ ๐ก๐ ๐๐๐๐๐๐ก๐ก๐๐ ๐ก๐๐ฅ๐ก. ๐๐ฏ๐ช๐ค๐ฐ๐ฅ๐ฆ ๐ฉ๐ข๐ด ๐ค๐ฉ๐ข๐ณ๐ข๐ค๐ต๐ฆ๐ณ๐ด ๐ต๐ฉ๐ข๐ต ๐ญ๐ฐ๐ฐ๐ฌ ๐ด๐ช๐ฎ๐ช๐ญ๐ข๐ณ ๐ต๐ฐ ๐ง๐ฐ๐ณ๐ฎ๐ข๐ต๐ต๐ฆ๐ฅ ๐ต๐ฆ๐น๐ต. ๐ผ๐๐๐๐๐ ๐ ๐๐๐ ๐๐๐๐๐๐๐๐๐๐ ๐๐๐๐ ๐๐๐๐ ๐๐๐๐๐๐๐ ๐๐ ๐๐๐๐๐๐๐๐๐ ๐๐๐๐. ๐๐ฃ๐๐๐ค๐๐ ๐๐๐จ ๐๐๐๐ง๐๐๐ฉ๐๐ง๐จ ๐ฉ๐๐๐ฉ ๐ก๐ค๐ค๐ ๐จ๐๐ข๐๐ก๐๐ง ๐ฉ๐ค ๐๐ค๐ง๐ข๐๐ฉ๐ฉ๐๐ ๐ฉ๐๐ญ๐ฉ. (Don't do this: it's _terrible_ for accessibility, as screen readers can't parse these as regular text)
- jsty 6y agoNice to see Bobby Tables is all grown up. Relevant discussion on the Companies House Developer Forum: https://forum.aws.chdev.org/t/cross-site-scripting-xss-software-attack/3355 https://forum.aws.chdev.org/t/cross-site-scripting-xss-softw...
- ben_w 6y agoBobby Tables would be https://find-and-update.company-information.service.gov.uk/company/SC656788 https://find-and-update.company-information.service.gov.uk/c... Not to be confused with the equally inspired https://find-and-update.company-information.service.gov.uk/company/10542519 https://find-and-update.company-information.service.gov.uk/c...
- dilly_bar 6y agoHilarious!
- entrep 6y agoNot many DBMS which support stacked queries I'll guess.
- tcgv 6y agoI was wondering how much it costs to open a company in the UK to do something like that, and it seems to be really cheap (and quick): a) Incorporate directly via Companies House The standard registration fee to set up a company is just ยฃ12 for the โstandardโ Companies House web incorporation service, which takes up to 24 hours to turnaround. You can pay via credit card, debit card or PayPal. Source: https://www.itcontracting.com/how-much-limited-company-cost/ https://www.itcontracting.com/how-much-limited-company-cost/
- pjc50 6y agoYes, it is. Do they still require a minimum of two officers? (Spam warning: if you form a company at your home address, you will be inundated with paper spam for office equipment. Especially from Dell.)
- mathieuh 6y agoIs Companies House's website not done by GDS or something? I worked on a few GDS projects for DFT, we had to have independent pen testers test our services before they moved between phases.
- Someone1234 6y agoCompanies House wasn't compromised, they warned third parties about potential issues with the underlying data.
- mathieuh 6y agoNo I mean the fact that this was possible on their website, XSS is one of the simplest things to test, in fact it was one of the standard tests UI testers would do on new screens. Not saying they were compromised.
- ceejayoz 6y agoIt wasn't possible on their website. They provide data feeds to many third parties, who might themselves be vulnerable, hence the notification.
- mkishi 6y agoAccording to a thread [1] on Companies House's Developer Forum, they were. [1]: https://forum.aws.chdev.org/t/cross-site-scripting-xss-software-attack/3355 https://forum.aws.chdev.org/t/cross-site-scripting-xss-softw...
- hliyan 6y agoOn a related topic, the name of the company I work for starts with a colon. The rest of the name is a common adjective. As you can imagine, it is virtually ungooglable at the moment. Any thoughts on how to get around this?
- business007 6y agobetter find a nickname, like D's community did, using dlang lol otherwise no one could find anything on language googling
- schwartzworld 6y agohow hard would it be to learn BASIC using Google? "Basic Programming" is going to have a lot of irrelevant results.
- identity0 6y agoTry it! Nearly every result is related to BASIC. Search engines have gotten very good at guessing what is and isn't a proper noun over the years.
- iso1631 6y agoDDG'd BASIC programming all the results were about BASIC, the wiki page to start with, then * BASIC Programming : 7 Steps - Instructables * Learn More - Just BASIC * The History of the BASIC Programming Language * Programming in BASIC: the absolute beginner tutorial * FreeBASIC Language | Home * PureBasic - A powerful BASIC programming language * Quite BASIC โ fun, learning and nostalgia * World of Spectrum - Documentation - ZX Spectrum manual Only after all that is a non-basic link * Introduction | Programming for Beginners
- ithkuil 6y agoSearched BASIC programming on Google and if also returned results relevant to the actual programming language
- yobert 6y agoAnd the officer's last name is Tandy. Good computer name :D
- deleted 6y ago[deleted]
- proactivesvcs 6y agoI'm slightly surprised that AAISP's RevK isn't behind this one. I'd document his shenanigans but they'd eventually break out of the data set.
- jjar 6y agoFun fact: It's currently law that you can have the <> and "" characters in your name. https://www.legislation.gov.uk/uksi/2015/17/schedule/1/made https://www.legislation.gov.uk/uksi/2015/17/schedule/1/made
- pbhjpbhj 6y agoI think I'd excited that as Schedule 1 of this Act doesn't exclude those characters. For example you can use the characters w,i,n,d,s,o,r but catenated in an ordered string means you have to get special permission. Arguably the attempt to register this was an attempt to breech the Computer Misuse Act (which would make it illegal).
- gsnedders 6y agoWhat's really fun is many companies' forms don't allow for companies to have any punctuation in their name.
- surround 6y agoItโs been 13 years since the Bobby Tables comic was drawn, has nobody actually tried it yet?
- max1cc 6y ago"; DROP TABLE "COMPANIES";-- LTD" https://find-and-update.company-information.service.gov.uk/company/10542519 https://find-and-update.company-information.service.gov.uk/c...
- surround 6y agoWhat I mean is, has nobody named their child after an SQL injection payload?
- danielovichdk 6y agoLOL!
- 6y ago
- pbhjpbhj 6y agoFor a minute I thought their name was (without the quotes) "[NAME AVAILABLE ON REQUEST FROM COMPANIES HOUSE]". Seems like a regulation to add "computer code like expressions" to the list that requires prior approval of the Secretary of State might be useful.
- r-w 6y agoThat might require a bit more effort on the part of a company I know, who would have to register their logo "moz://a".
- pbhjpbhj 6y agoThat would be a trade mark rather than a company name in this instance I think. In UK registered trademarks are standard type-written letters for word marks. If they contain symbols then they're figurative marks and it's an image of the mark which is registered. On that point though, searching on the UK trademark registry it looks like it just strips non-alphanumeric symbols. A search for "Moz://aโ returns "moza".
- mocatta 6y agoRelatedly, several years ago I scraped all companies on the old companies house webcheck site. There were two that interrupted my scraper: both contained '<' in the company name, and both seemed to take the webcheck service offline for a few seconds whenever I requested their pages. I can't say for sure - it might have been a temporary IP block I suppose - but it amused me nonetheless.
- agys 6y agoThere was also this project of Mediengruppe Bitnik (check the video with some online bookstores): http://p-dpa.net/work/script-alert-mediengruppe-bitnik/ http://p-dpa.net/work/script-alert-mediengruppe-bitnik/
- habosa 6y agoThere's a great club in Berlin called "://about blank" So if you're gonna Google it, don't use the URL bar.
- DaiPlusPlus 6y agoMy favourite social establishment is The Progress Bar.
- paledot 6y agoNice spot, but the lines are always so long. Fortunately you always know how long you have to wait.
- ryukafalz 6y agoI giggled at the previous company name being redacted as โ[NAME AVAILABLE ON REQUEST FROM COMPANIES HOUSE]โ too. Not sure if thatโs a common thing to do or if they made an exception for these shenanigans so they didnโt have to display the XSS.
- addaon 6y agoNow someone just has to register "[NAME AVAILABLE ON REQUEST FROM COMPANIES HOUSE]" as a company name...
- deleted 6y ago[deleted]
- ineedasername 6y agoLike little Bobby Drop Tables: https://xkcd.com/327/ https://xkcd.com/327/
- gpvos 6y agoJust never change the name to "null".
- mci 6y agoHere is to the company Dariusz Jakubowski x'; DROP TABLE users; SELECT '1 that ran in Poland from 2014 to 2019 [0]. [0] https://prod.ceidg.gov.pl/CEIDG/ceidg.public.ui/SearchDetails.aspx?Id=e82735cd-bc2b-4ac0-8bac-a1dc54d8c013 https://prod.ceidg.gov.pl/CEIDG/ceidg.public.ui/SearchDetail... (check the reCAPTCHA and click "Dalej")
- wodenokoto 6y agoWhat was the name? Itโs former name is listed as โ[NAME AVAILABLE ON REQUEST FROM COMPANIES HOUSE]โ and itโs current name doesnโt contain any HTML tags (itโs literally the same as the headline) Those are both funny and confusing names, but they donโt warrant comparison to sql-injections, so I am guessing thereโs another name with actual HTML tags.
- daniaal 6y agoThis company is class. https://find-and-update.company-information.service.gov.uk/company/10542519 https://find-and-update.company-information.service.gov.uk/c...