[TheB0th]

One of the best tutorial, very simple to understand.
Only a thing: I think in HEX the symbol ">" is %3e and not %3c.
:wink:
PS: I can't find any site where the simple script works apart from "hackme" sites...I'm trying all of the tecniques you suggest to bypass the filters...

[Anima Templi]

One of the best tutorial, very simple to understand.
Only a thing: I think in HEX the symbol ">" is %3e and not %3c.
:wink:
PS: I can't find any site where the simple script works apart from "hackme" sites...I'm trying all of the tecniques you suggest to bypass the filters...

I'm glad that you liked the tutorial. And thank you for pointing out that mistake, I will edit it right away.

This is a tutorial on BASIC cross site scripting it means that this tutorial is meant to teach you the basics of XSS. Because of that you won't find many websites which is vulnerable to this, you will simply have to move on to more advanced XSS to be able to exploit websites these days. I have given you some methods to bypass the most common/easiest filters because this is basic. I have currently found XSS vulnerabilities on more than 50 big sites (utorrent.com, thedailyshow.com, cnn.com, aol.com, britannica.com etc.) and I can insure that none of those were basic XSS vulnerabilities. Cross site scripting is getting more popular than ever and that means that the programmers are paying it more attention. A combination of that results in better security on the sites and more work for the web application pentester/researcher.

Not any site is vulnerable, there are some sites which just aren't vulnerable to this kind of vulnerabilities. Just because the website has a search box doesn't mean it can be exploited. You will have to be able to write new scripts (it's here the Javascript comes in) to inject into the vulnerable form. You will have to be able to look at the source code and by trying out different scripts find out "why" and "how" this website is vulnerable. It takes a lot of time to reach that level but if you want to be succesful with this, you will have to get all the they to that point.


- Of course there's still websites vulnerable to basic XSS you just have to look for them.

[malkovicht]

Some times/ in most time you will have to escape the tag your in. One of the ways to do this is bu inserting "/> in front of your script. Like this

Code:

"/><script>alert("Anima Templi")</script>

this is a new part for me,. as far as i know, common html are using open tag <> and end tag </> but "/> i dont have any idea why you use this,. i would gladly if you could explain it to me sorry, noob question,. :p

---

Thanks for a great tutorial @Anima Templi Really well explained. I just wanted to mention a method to deface which doesn't require you to relocate the user.

Instead of this

Code:

<script>window.location="http://www.pastehtml.com/YOURDEFACEHERE/";</script>

... you can do this ...

Code:

<script>document.documentElement.innerHTML = unescape('%74%68%69%73%20%70%61%67%65%20%68%61%73%20%62%65%65%6e%20%64%65%66%61%63%65%64');</script>

You don't have to use unescape() but it's a good way to inject a styled deface page

) nice! but, i dont get it,. i think i need open w3c page and start to read it from the beginning,. XD

---

oh oh,. i'm too excite! i forgot to say,. @anima templi, nice tut! XD

[4lph4 c0d3r]

Nice tut man I must say that !

[chmod]

Nice tut man I must say that !

I have edited this post and removed all the capitals, this is considered shouting in a forum and thus is VERY rude if you continue to do this you will receive a warning.

[4lph4 c0d3r]

Nice tut man I must say that !

I have edited this post and removed all the capitals, this is considered shouting in a forum and thus is VERY rude if you continue to do this you will receive a warning.

ohk fine! will not do this from future

[EgyptGhost]

Nice tutorial Thanks & keep it up pro

[Anima Templi]

Hey guys, its a great tutorial you got here but on the first section it wasnt working for me. I scrolled through the thread and saw " "/><script>alert("Anima Templi")</script> " as being a solution for my problem but i had no luck with that either. I tried on multiple small websites with no luck. Any ideas on where to go from here?

Thanks!

You will have to realize that this doesn't work on every website. And what I showed was only one very basic way of bypassing the filters. Since XSS get more and more attention more and more sites decide to patch such vulnerabilities.

[Anima Templi]

Hey guys, its a great tutorial you got here but on the first section it wasnt working for me. I scrolled through the thread and saw " "/><script>alert("Anima Templi")</script> " as being a solution for my problem but i had no luck with that either. I tried on multiple small websites with no luck. Any ideas on where to go from here?

Thanks!

You will have to realize that this doesn't work on every website. And what I showed was only one very basic way of bypassing the filters. Since XSS get more and more attention more and more sites decide to patch such vulnerabilities.

[Anima Templi]

Hey guys, its a great tutorial you got here but on the first section it wasnt working for me. I scrolled through the thread and saw " "/><script>alert("Anima Templi")</script> " as being a solution for my problem but i had no luck with that either. I tried on multiple small websites with no luck. Any ideas on where to go from here?

Thanks!

You will have to realize that this doesn't work on every website. And what I showed was only one very basic way of bypassing the filters. Since XSS get more and more attention more and more sites decide to patch such vulnerabilities.