[Mr.No0b]

Hi Every One ~ This my first Tutorial in this HC Forum ! Now i explain Cross Site Scripting (XSS) . XSS is one of the easiest and most basic forms of website hacking. It is also an amazing method of social engineering .. Let see how we doing

Question : What is Cross site scripting (XSS) ?
XSS (or Cross site scripting) is exploiting a hidden input or form input in an website in order to inject your own scripts and HTML into a website. It occurs when websites don't filter characters in input fields such as ();>=<"' or only half way filters it. There are also many different types of XSS. . .

Question : What types of XSS are there?
May be 4 types !
1.) Persistent
2.) Non-Persistent
3.) DOM-based and
4.) RedXSS
Let's see what are they , , ,

Question : What is persistent XSS?
Persistent XSS (which is the least common) is when you inject a script into a web page and when you leave the page and return, the script sticks to the page .

What is non-persistent XSS?
Non-persistent XSS is when you inject a script on a web page and when you leave the page and return, the script is no longer there. This can still be very useful .

What is DOM-based XSS?
A DOM-based XSS is where you edit the DOM-Environment of a website (usually for malicious reasons) .

What is RedXSS?
RedXSS is an XSS attack on a forum that uses MyCode to hack users on the forum .

Ok . let's starting what you need !

You need :
An understand of HTML, especially forms.
An understanding of Javascript.
A brief understanding of PHP.
Mozilla Firefox . (NOT working on Chrome)

------------------------------------------------------------------------------------------------------------------------
How to Find XSS Vulnerabilities:-

To start finding these Vulnerabilities you can start checking out Blogs, Forums, Shoutboxes, Comment Boxes, Search Box's, there are too many to mention.

I receive questions on how i break into websites i mainly use SQLi but i have little but have some experience in XSS i will be combining my knowledge with that of some of my peers to give you a basic introduction into XSS. (credit -- AnonTitan)
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Ok .. let's start Basics of XSS !
Well now lets start learning some XSS Methods, the most common used XSS injection is :

<script>alert("Your Daddy N00b is Here")</script>

this will alert a popup message, saying "Your Daddy N00b is Here" without quotes . So,we can do another way .. It's That > "search.php?q=" . You can simple try the following on a website with the same thing .

http://website.com/search.php?q=<script>alert("Xss inject by n00b")</script>

There are good chances of it working, but dont worried if it don't, just try diffrent sites ... Another way , u can inject code with HTML Code .. Let's See :
http://website.com/search.php?q=<br><br><b><u>XSS Inject BY NOOB</u></b>

Done , i wish u can enjoy inject with Xss It's Wonderful

[Mr.No0b]

Hi Every One ~ This my first Tutorial in this HC Forum ! Now i explain Cross Site Scripting (XSS) . XSS is one of the easiest and most basic forms of website hacking. It is also an amazing method of social engineering .. Let see how we doing

Question : What is Cross site scripting (XSS) ?
XSS (or Cross site scripting) is exploiting a hidden input or form input in an website in order to inject your own scripts and HTML into a website. It occurs when websites don't filter characters in input fields such as ();>=<"' or only half way filters it. There are also many different types of XSS. . .

Question : What types of XSS are there?
May be 4 types !
1.) Persistent
2.) Non-Persistent
3.) DOM-based and
4.) RedXSS
Let's see what are they , , ,

Question : What is persistent XSS?
Persistent XSS (which is the least common) is when you inject a script into a web page and when you leave the page and return, the script sticks to the page .

What is non-persistent XSS?
Non-persistent XSS is when you inject a script on a web page and when you leave the page and return, the script is no longer there. This can still be very useful .

What is DOM-based XSS?
A DOM-based XSS is where you edit the DOM-Environment of a website (usually for malicious reasons) .

What is RedXSS?
RedXSS is an XSS attack on a forum that uses MyCode to hack users on the forum .

Ok . let's starting what you need !

You need :
An understand of HTML, especially forms.
An understanding of Javascript.
A brief understanding of PHP.
Mozilla Firefox . (NOT working on Chrome)

------------------------------------------------------------------------------------------------------------------------
How to Find XSS Vulnerabilities:-

To start finding these Vulnerabilities you can start checking out Blogs, Forums, Shoutboxes, Comment Boxes, Search Box's, there are too many to mention.

I receive questions on how i break into websites i mainly use SQLi but i have little but have some experience in XSS i will be combining my knowledge with that of some of my peers to give you a basic introduction into XSS. (credit -- AnonTitan)
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Ok .. let's start Basics of XSS !
Well now lets start learning some XSS Methods, the most common used XSS injection is :

<script>alert("Your Daddy N00b is Here")</script>

this will alert a popup message, saying "Your Daddy N00b is Here" without quotes . So,we can do another way .. It's That > "search.php?q=" . You can simple try the following on a website with the same thing .

http://website.com/search.php?q=<script>alert("Xss inject by n00b")</script>

There are good chances of it working, but dont worried if it don't, just try diffrent sites ... Another way , u can inject code with HTML Code .. Let's See :
http://website.com/search.php?q=<br><br><b><u>XSS Inject BY NOOB</u></b>

Done , i wish u can enjoy inject with Xss It's Wonderful

[soldi3r]

Dear fellow, you mentioned it tutorial.. But i couldn't see anything that you presented.. It's just a lil command you discussed.

[soldi3r]

Dear fellow, you mentioned it tutorial.. But i couldn't see anything that you presented.. It's just a lil command you discussed.

[Mr.No0b]

Dear fellow, you mentioned it tutorial.. But i couldn't see anything that you presented.. It's just a lil command you discussed.

Sorry for not understanding :ok: it my false miling: XSS is one of the easiest hacking

[Mr.No0b]

Dear fellow, you mentioned it tutorial.. But i couldn't see anything that you presented.. It's just a lil command you discussed.

Sorry for not understanding :ok: it my false miling: XSS is one of the easiest hacking

[Anima Templi]

You should work on how you present information for new people. Try to explain what you actually do and show them how to bypass filters. To make an example of what such could look like you can check out my tutorial on XSS: http://www.hackcommunity.com/Thread-Tuto...s-tutorial

I'm not saying that my tutorial is the ideal tutorial in the matter of fact not at all. I'm just saying that some little more information would be nice.

[Anima Templi]

You should work on how you present information for new people. Try to explain what you actually do and show them how to bypass filters. To make an example of what such could look like you can check out my tutorial on XSS: http://www.hackcommunity.com/Thread-Tuto...s-tutorial

I'm not saying that my tutorial is the ideal tutorial in the matter of fact not at all. I'm just saying that some little more information would be nice.

[RaccoonCity_mybb_import13707]

Good tutorial, just make it a little bit more detailed how you do the injecting and execution. It's hard to understand, good explaining of the different type of XSS vulnerabilities though, good work!

[Mojang]

cool tutorial time to do some xss